Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Situation

I swapped out a dead router at home today. I setup the new router with the same SSID and encryption settings. The devices on my network acted like nothing had happened and are happily connected to the new router.

Question

If I swap out a physical host or VM using the same IP and using SSH for example, connect to that host, the thumbprints are different and problems ensue. Why does this not happen when switching out a router? I could think of a few cases where this could be done maliciously, so I'm surprised it works like this.

share|improve this question

migrated from serverfault.com Jan 30 at 19:04

This question came from our site for professional system and network administrators.

2  
Because there is no mechanism for fingerprinting APs in WiFi.. at least without extending it. Plus, things like roaming between APs and mobility would be negatively impacted. –  NickW Jan 30 at 16:49
    
@NickW Some clients use the MAC of the AP as a fingerprint. I know something I own does this and it's more annoying than anything; roaming from one AP to another produces error messages. –  Chris S Jan 30 at 16:51
    
@ChrisS I'd imagine it could be done, but anyone competent could spoof the same MAC, it's about as useful as MAC filtering on an AP. –  NickW Jan 30 at 16:58
2  
Because the SSID and wifi encryption settings occur at layer 2 of the OSI model. Think of it like a physical switch. If my computer is hooked into an Ethernet switch, and I replace the switch, my computer will normally function the same afterwards. There is no fingerprint comparison, etc. MitM attacks are possible at this layer, and many security tools actually listen to the packets at this layer. –  Stefan Lasiewski Jan 30 at 17:39
    
Great responses, why are these not answers? –  bn. Jan 30 at 17:48

3 Answers 3

up vote 4 down vote accepted

WiFi access points have no secret. They use a SSID, but they otherwise offer or know nothing that the client can validate. Every time a device (say, a laptop) connects to a WiFi router, it uses it as if it was a new router and expects nothing in particular from that router. Secrets are more on the client side: the router will require the device to demonstrate knowledge of the WiFi password.

With a SSH server, the server has a private/public key pair, and shows the public key, and the client records that public key. If the client reconnects, then it will require that the server uses the same public key as previously; otherwise, it will complain loudly (as you observe).

There is no such public key in a WiFi router. Clients are not actually interesting in knowing whether the router has changed or not, because the router is only meant to route data to the Internet, not to provide access to some sensitive data or receive sensitive data.


When you talk to your banker, you want to be sure that you have a genuine banker with you, because you will give him your money. When you talk to the cashier at a supermarket you don't care whether he is a real cashier or not, as long as you get to exit the supermarket with the food and security guards don't begin to shout at you.

share|improve this answer

Essentially the security on a wireless network is provided in the encryption key (for WPA2-PSK and WEP protected networks) or the authentication process for WPA2 enterprise networks).

An attacker who can get physical access to the access point and then replace it with their own hardware can compromise the security of the network (assuming they can extract the key from the device), so that's what needs to be protected to protect the system.

In the example you give about SSH it's that key exchange which provides the security so changing it causes alerts. The analagous situation in a wireless network would be an attacker setting up an Access Point with the same SSID but a different key.

share|improve this answer

As @Stefan Lasiewski, mentioned in a comment in a typical network there is little to no security down at the layer data link layer of the network (see OSI model).

But there are features present in some switches, and wifi devices to implement 802.1x which is a technology that provides for authentication and encryption at the link layer. These features are not present on low-end wifi equipment like you might find in your home since administering is very complex and the effort required to configure it properly is far beyond the risk most people face.

share|improve this answer
    
PPP is one way of improving security at (a virtual) layer 2. EAP-TLS allows secure mutual authentication between a client and authentication server, it's a bit enterprise-y though. –  mr.spuratic Jan 31 at 13:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.