Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

On a recent certification exam, I was presented with a question about ways to secure an 802.11 wireless network. It was a multiple-answer question, but the only two available answers that related at all to security were addressing SSID Hiding and MAC Address Filtering.

Fortunately, this particular certification was neither wireless- nor security-focused.

I'm aware that these two should definitely not be your only means of securing your wireless network, but are they still really considered worth implementing on top of more sturdy authentication and encryption mechanisms?

share|improve this question

4 Answers 4

up vote 21 down vote accepted

They're stumbling blocks, but not insurmountable. SSID hiding can provide some protection from people looking for any SSID they can get their hands on, and MAC filtering can keep casual riffraff out. As the only methods of protecting a WLAN they're pretty weak.

For someone who wants your network specifically encryption (most especially un-broken encryption) will provide vastly better security. MAC spoofing is trivial in most adapters these days, and after you've cracked the network to the point you can monitor in-flight packets you can get a list of valid MAC addresses. SSID is trivial at that point as well. Due to the automated nature of the toolsets available, MAC filtering and SSID hiding aren't really worth the effort any more. In my opinion.

share|improve this answer
2  
SSID hiding isn't even a stumbling block since it is so trivial to identify. Unless you have an easy-to-guess password any 'casual riffraff' can't connect and anyone else will have software to automatically identify SSID and probably spoof MAC addresses. The only thing SSID hiding does is make it more difficult for valid users to connect, as well as arguably compromise the security of those devices that are configured to connect. howtogeek.com/howto/28653/… technet.microsoft.com/en-us/library/bb726942.aspx#EDAA –  Rory May 20 '12 at 17:58

Kismet and other completely passive rfmon scanners have been around for a long, long time. Unless it's on a home wifi network that you never share with guests and seldom add devices to, the marginal increase in security you get from those two actions isn't worth the marginal increase in inconvenience.

share|improve this answer
    
@user502 - I'm not sure how RFID scanners have anything to do this, or when Kismet became one? –  Iszi Jan 13 '11 at 19:33
    
@user502 - if you replace rfid with 802.11 I think you'll be right :-) –  Rory Alsop Jan 13 '11 at 20:50
    
s/rfid/rfmon, indeed; thank you. –  user502 Jan 13 '11 at 21:04

No, neither of these are worthwhile measures against an attacker. Unless you have an easy to guess password you need to assume anyone who might realistically try to gain access to your network has software to help or a little knowledge of how to get around such techniques.

SSID hiding doesn't improve security since it is trivial to identify the SSID of a network that's in use (download and run inSSIDer for instance), and in fact it can compromise the security of wireless clients that are configured to connect to hidden SSID networks. From Microsoft:

it is highly recommended that you do not use non-broadcast wireless networks.

MAC address filtering doesn't improve security since network traffic includes the unencrypted MAC address of active network devices. This means anyone can find out a MAC address that's on the allowed list and then use easily available software to spoof their MAC address.

Authentication and encryption are the only reasonable ways to secure your wireless network. For a home network that means using WPA2-PSK security with a strong password and an SSID that's not on the list of the 1000 most common SSIDs.

MAC address filtering perhaps provides one benefit: controlling access for non-malicious users. Once you've given someone your wifi password you have no control over who they give the password to: they can easily tell their friends, perhaps after forgetting that they shouldn't. MAC address filtering means you have central control over which devices belonging to non-hackers can connect.

So if you're worried about someone hacking into your network, forget SSID hiding and MAC address filtering. If you don't want your friends' friends to connect, MAC address filtering might help ... although it'd be less hassle to ask your friends not to pass on the password or just enter the wifi password for them on any devices.

share|improve this answer
1  
"an SSID that's not on the list of the 1000 most common SSIDs". Why do say this? Obviously it would be confusing and inconvenient to use one of those common SSIDs - but why does this decrease security? Does it make the encryption layer easier to attack somehow? –  Andrew Ferrier Oct 12 '12 at 12:20
    
I can't remember exactly, but I think it's because you can generate something like a rainbow table of possible passwords for the most common SSIDs and then brute force it. If you have an uncommon SSID then it's more work to generate such a list of possible passwords. That assumes the hashed password is related to the SSID, which seems about right but I don't have any reference for that. –  Rory Feb 13 at 18:03
    
@Rory, you're probably thinking of the Renderlab Church of Wifi WPA-PSK Lookup Tables, useful in both Pyrit and coWPAtty, both of which were rendered obscolescent for attackers with a few thosuands dollars or more (or much less money, cloud GPU access, and a small target list) by modern GPU's and oclHashcat, but still VERY useful for attackers with limited resources. –  Anti-weakpasswords Apr 6 at 17:34

As a security device, SSID hiding doesn't do much because in order to connect to the hidden network the client will broadcast the SSID instead of the access point broadcasting it, so by passively monitoring for a little while you can pick up what the SSID is anyway. MAC locking is also not much good for security. If you are passively monitoring you will see what MACs successfully connect and can spoof one of them and connect yourself. These are features that can be of moderate help when combined with other methods, but the management effort is not worth the benefit, and it would be much better to spend the effort on enterprise WPA2. Hidden SSIDs can be useful for the non-security use of reducing confusion when you have business networks and public access networks in the same building/area. If you hide the non-public networks customers/guests looking to connect to your public access network will not be as easily confused.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.