How to block or detect user setting up their own personal wifi AP in our LAN?

Question

Recently, I found a user plug a USB Wifi stick on his desktop, and set up an AP without password. How can we detect or block this via firewall rules or other approach?

Answer 1

Something left unsaid, Why is the user wanting a WiFi? As long as the user feels they have a legitimate need they will continue to find workarounds to any of your attempts at blocking it.

Discuss with the users what they are trying to accomplish. Perhaps create an official wifi network ( use all the security methods you wish - it will be 'yours' ). Or, better, two - Guest and Corporate WAPs.

WiFi is not something which needs be banned "just because," however it does need specific attention, just like all other aspects of security.

Answer 2

Firewalls can't tell where your traffic is coming from in terms of the physical network - they only see the data that the protocol provides, such as MAC / IP, which aren't much use in this case.

I think you're falling into the trap of looking for a technical solution to a managerial problem. Remember Immutable Law of Security #10: Technology is not a panacea. Whilst technology can do some amazing things, it can't enforce user behaviour.

You have a user that is bringing undue risk to the organisation, and that risk needs to be dealt with. The solution to your problem is policy, not technology. Set up a security policy that details explicitly disallowed behaviours, and have your users sign it. If they violate that policy, you can go to your superiors with evidence of the violation and a penalty can be enforced.

Answer 3

There is no firewall rule which can help you there: by construction, the rogue AP provides a network path which bypasses your firewalls. As long as the users have physical access to the machines they use and their USB ports (that's hard to avoid, unless you pour glue in all the USB ports...) and that the installed operating systems allow it (then again, hard to avoid if users are "administrators" on their systems, in particular in BYOD contexts), then the users can setup custom access points which gives access to, at least, their machine.

What you can do is use a laptop, smartphone or tablet to list existing AP, and track them down, using the signal strength as a clue to the AP physical location. However, ultimately, this is a policy issue: educate your users to the dangers of setting custom access points; warn them that this is forbidden by the local security policies, and that they will be held responsible (legally and financially) for what may result from such misbehaviour.

Answer 4

In addition to the answers around the policy side of things there's a couple of technical approaches that can help you here, depending on how tightly controlled your IT environment is.

1. USB port lockdown - in your particular case the user has made use of a USB Wi-Fi stick to create the AP. If you have software which can lock-down what classes of USB device are allowed (and your users don't have local admin rights to disable them) then this would be one option to restrict this kind of activity.
2. Network Access Control - another way to see rogue Access Points on the network would be for the user to plug a standard wireless AP into an ethernet port in the network. To help block this NAC could be used to restrict access to the network to approved devices.
3. As @thomas-pornin mentions above detection of the AP can be done with a handheld scanner, also if you have an existing corporate wireless network then a lot of vendors (e.g. Cisco) will provide a rogue access point detection mechanism which makes use of the legitimate Access points to detect the rogues.

I will mention that all these measures can be bypassed by a determined/savvy attacker, however they would likely be effective with ordinary users.

Answer 5

I'm actually quite shocked and somewhat appalled by the number of people dismissing this as a policy or managerial problem.

Yes, a policy needs to be created/enforced so that appropriate disciplinary action can be taken if or when a user is caught violating policy.

However, policy alone is not going to prevent your network/data from being compromised if a user isn't following policy!

If it's within your ability to do so, by all means a technical control should be implemented.

With that being said, if your users are on windows you may take a look at: http://www.wirelessautoswitch.com/about.aspx

Group Policy can be implemented to stop other users on your network from connecting to rogue AP's: http://social.technet.microsoft.com/Forums/en/w7itpronetworking/thread/7130f1a5-70fd-429f-8d41-575085489bd1 however, this won't stop the bad guys from connecting to your users rogue AP.

As Rory mentioned, you could go the route of disabling USB ports but this is not always practical depending upon your situation.

Answer 6

Full disclosure I work for a large Cisco solution partner.

As others have mentioned, a firewall will not help much.

There is a whole class of products called wireless intrusion detection / prevention system (WIDS / WIPS). Cisco, Aruba, Motorola Air Defense, and Airtight Networks Spectraguard are some vendors/products in this category. Not an exhaustive list. For a small customer I had good luck deploying Airtight Networks because they have a hybrid on-premise/cloud model that is inexpensive and easy to get running quickly. It's also very effective. One feature it had was that it could learn the MAC addresses of your organization's endpoints(laptops) and detect when it observed one joining a wireless network not operated by your organization. It could then alert you and/or "jam" the endpoint or AP (be very careful not to break applicable laws in your area!)

Kismet is an open source wireless tool that can be used (among many other things) as a wireless intrusion detection system. See http://www.kismetwireless.net/documentation.shtml

Walking around with a laptop or other handheld scanner certainly works--but only when you are walking around :-) Great for incident response or troubleshooting but not a feasible long-term wireless monitoring solution.

Another technical approach is to prevent this on the offending endpoint computer itself. Others have offered good advice on this so I will not repeat.

Of course creating policy and providing users with legitimate and secure way to meet their justified business needs is very important too. As with so many topics in security it takes a blend of technical and administrative(policy) controls to be successful.

Best of luck!

Answer 7

If the rogue access point is operating in bridged mode (which most will be) you'll see the mac addresses of the wireless client(s) on the switch port of the desktop.

You can block these unknown mac addresses on most switches by setting the switches port address filtering to "learn then block" mode - it will learn the 1st mac address seen and then block any new ones. The switch could also log when they block an unknown mac address.

You could also do this by deploying 802.1x and authenticating each device on your network tho that would be more complicated to setup.

Answer 8

Develop a script which, running on a machine with wireless hardware, periodically scans the wireless environment for the presence of access points, and caches them in a persistent list. The program can raise an alarm (e.g. e-mail to the admins) whenever a hitherto unseen access point emerges and is added to the list. At that point it is the admin's discretion whether that access point goes into the persistent list, or must be hunted down and disabled.

An appropriate response to the alarm might be to send out an e-mail to all staff in the building:

Whoever started an access point with SSID "FooBar" has 10 minutes to take it down, and we will forget the whole thing. Or else you can let us find it. You don't want that.

Answer 9

I'd say it's best if you can work this out between admins and users, since admin is not there to block 'just because' but rather to support the infrastructure of the organization and help users perform their work easier (not harder). Going down the road of measure vs counter-measure for each policy just makes it more likely that users will be less inclined to see network admin as helpful and their respect for admin may nose-dive. That said, if wifi is a very big problem that is absolutely necessary to curtail (not just because that's policy mind you), then you can set up 802.1x and have all nodes that connect by wifi authenticate in before getting access (also this will account for sessions so that anything happening should be monitored). Also, port security can be implemented if the number of nodes in a lan or vlan is known then the rogue router can be detected and neutralized. Port security really isn't a great solution here as a simple wifi usb can get around it (in this situation) but it can at least stifle the activity of rogue routers. So-called 'war-driving' works well and, if necessary and known basically where the AP's might be hiding, admins have been known to send techs to walk around with a laptop or phone searching at random times to hunt down the AP's locations. If you don't mind invading privacy, you can adjust the privileges on any laptops controlled by the organization to monitor activity and get alerts on any attempts to connect to wifi points (and hence rogue AP's).

Answer 10

Several previous answers (such as Thomas Pornin's) have emphasized the need for user education and policy enforcement, and noted that, if users have administrator access on their computers (or can plug their own devices to the wired network), a determined user can always set up an unauthorized access point in a way that makes it invisible to the network.

However, I'd argue that such education would nonetheless be most effective if complemented with a technical solution that would stop users from being able to set up unauthorized access points simply by plugging in a USB stick. Sure, a user with admin access can always circumvent it if they really want and know how to, but at least they'll have to work at it, and hopefully won't be able to do it without being aware that they're circumventing a security measure.

It's a bit like protecting your network from viruses: to do it effectively, you really want to both educate your users and run a virus scanner. Either measure alone is sub-optimal.

---

As for how to implement such a solution, an obvious approach would be to set up a firewall rule on all workstations to reject any IP packets that don't originate on the local host or be destined to it. On Linux systems, for example, I believe the following iptables policy ought to be sufficient:

iptables -F FORWARD
iptables -P FORWARD DROP

This ensures that any packets entering the FORWARD chain (i.e. those that are neither locally generated nor destined to local sockets) will be unconditionally dropped. If you want to be nice, you can also have them generate an ICMP rejection message:

iptables -I FORWARD -j REJECT --reject-with icmp-host-unreachable

Of course, you need to make sure these rules are reapplied on every reboot. Alternatively, you could just disable IPv4 forwarding in the kernel by adding the following line to /etc/sysctl.conf:

net.ipv4.ip_forward = 0

and running sysctl -p to reload the file (which will happen automatically on reboot).

Unfortunately, I'm not familiar enough with Windows network administration to be able to say what might do the same trick there. (Also, I should warn that I haven't actually tested that these solutions work in the OP's scenario. Please do your own testing before relying on them.)

Answer 11

The most drastic solution to mitigate this type of risk is to move the network away from the user by implementing VDI/Thin Client (Welcome back to the mainframe era :-) ). Combined with other security functions it should relegate the issue to remote access.

If this is not practical, it is preferable to have a system which detect USB device type insertion and silently raise alert to security team rather than block USB device as the user will find other mean to get what he needs that you may not be protected against (i.e. bring his home wireless router and plug it into your network if you do not have authentication).

Answer 12

As I write this, you have been given a couple of answers. I simply offer a couple more:

1.) Policy - ugh! Many have mentioned the dirty word, but it is true. You need to start with a policy, which exists as a business statement for users to follow. This policy should be clear in its intent and supported by standards and baselines.

2.) I am not a fan of re-inventing the wheel, or building a rocket ship when a simple solution will work just fine. SANS had a webcast series going strong for a while where David Hoelzer taught various quick tricks on auditing. One such episode discussed AP detection and is related to your question. You can view this episode here: http://auditcasts.com/screencasts/4-can-you-hear-me-now

While not completely related, I found that viewing episode #3 was also helpful in understanding Wireless technology. http://auditcasts.com/screencasts/3-auditing-hacking-wpa-wpa2 (I can not be clear enough here, DO NOT do this without explicit permission).

I modified David's solution a bit, but have applied it to my office and it's passed for PCI Compliance.

3.) Nessus offers a plug in, where it scans the wired end of a Rogue AP and reports on it when detected. You'll need to subscribe to Nessus professional feed if you are going to use it in the office. It's affordable at $1,200.00 a year and it'll enable you to scan and support other policies such as patch compliance, build standards, vulnerabilities.

I hope that gives you some direction, let us know what you end up using and how it's implemented.

kind regards,

Answer 13

As has been mentioned user engagement is the best solution here. Yet it should be mentioned that in some situations you might absolutly not want a wifi enabled on your network.

One possible solution not mentioned here. If your are working at some supper high security office. Where wifi has been deemed a high risk.

You could set up a restricted access list based on the mac addresses of the network cards of the devices / work stations that are specifically allows access on that network. This can be quite a lot of work, having to get the mac address of every device that needs access on you system.

There are still ways to work around this by spoofing the mac address of some other work station to allow an unknown device on the network. It still requires some measure of skill and know how. Most Wifi device don't have the option to spoof a mac address unless you know how to change the devices firmware and are comfortable with working the devices configuration at a command line level.

Allot of universities set a network access per a mac address. Before you can access the internet you need to enter your computers mac address on some registration site. This links your system user account with your computers mac address. You need both to be able to access the network and internet. This link explains how that works. http://netreg.sourceforge.net/SysAdmin/

You can do this at the DHCP level, where ip address are assigned on the network. No ip address no access on the network

http://www.yolinux.com/TUTORIALS/DHCP-Server.html

You can also do this at the firewall level, which is much more secure.

http://www.cyberciti.biz/tips/iptables-mac-address-filtering.html

As I have stated this is not full proof as any body with enough time and effort can by pass any type of security. Specifically via mac spoofing.

Answer 14

Here's a possibility just waiting for others to find holes in it:

1. Have all internal network connections use encryption between endpoints and a central (set of) routers/switches. This could be VPN or other solutions.

2. Have customization of the encryption technology on each endpoint that validates that endpoint does not allow routing/bridging through it.

Now all that is needed is a way to validate that the endpoint's encryption technology is only what you have provided and not hacked.

An example - NOT AN ENDORSEMENT - of available solutions includes http://juniper.net/us/en/solutions/enterprise/security-compliance/…

Answer 15

I guess i have a completely different solution.
One Single Sentence:
Internet access through a VPN that allows only one session per user.