Tag Info

Hot answers tagged

84

Enforce Consequences for Students Found on the Network The first thing you need to do is ensure you have a written policy outlining what devices are allowed on the network. However, if you are not consistent in the enforcement of your policy, it is useless. This should also cover the usage policies for the Teachers, including locking their computers when ...


46

You are trying to solve the wrong problem. They are thousands and you are one. Since you are not a security expert (as far as I understand, sorry if I'm mistaken) and they aren't either but they are a horde, you are just bound to lose if you fight a conventional war. @AviD gave a great answer in a comment: Here is a non-technical idea: This is a ...


19

If passwords are leaking like that, you may have a bigger problem than restricting Wifi access. It sounds as if the kids could do almost anything a teacher can do (including manipulate exam results?) and are routinely doing so at your location. It sounds as if a little bit of teacher education would solve this, after some detective work to narrow down the ...


16

Ethernet Before I get flamed by everyone who says iPads don't have ethernet ports, this is simply a single layer of "security". In most cases teachers should be able to use their laptops with a physical ethernet BASE-100TX CAT5+ plain old physical cable. You will have reduced the attack surface area (as the keys won't be on the teacher's laptops anymore). ...


12

Consider an equipment upgrade I know you're looking for a no-budget solution, but a matching set of enterprise-grade WAPs and central controller could make securing the network easier. Weigh it against the cost of defending against a lawsuit for cyber-bullying, or harassment of an employee, or facilitating the falsification of test scores... Use MAC ...


11

Give each authorised user their own individual password. Then you'll be in a position to judge where the leaks are coming from (assuming they're being leaked as opposed to cracked). (eg You may find that need to educate one of your teaching staff not to leave the password written down on his desk). Set up harsh firewall rules that block access to most of ...


9

You need to tighten human security, not technical security. WiFi password is good enough, the real questions are "Who is leaking passwords to students?" and "How to stop them?". You can't have any security if privileged persons (staff) share their credentials with the ones you're trying to block. Setting up different passwords for every single person would ...


8

I would use WPA2-Enterprise, so everyone would use own name and password, not just a password, which is same for everyone. To setup WPA2-Enterprise, you just need to have RADIUS server. The cheapest opinion, I think is to buy a NAS server. It supports multiple things and RADIUS sometimes too (I recommend Synology for this). Alternative is to use some ...


6

Set up a captive portal that uses RFC 6238 like Google Authenticator (GA) (https://github.com/google/google-authenticator). GA has a PAM module. Have each employee, install the app, then come to your IT office, in person, to set up (sync) their account with the app. Use the auth token as either the only, or second factor. If the QR codes or secrets get ...


3

Knowing your identity, John Doe, and your device information are two separate things. They will likely know your IP address (that was assigned you), and your device/MAC address but that doesn't necessarily translate to John Doe unless there is some other information to connect the dots. If you are connecting to a wifi that you had to sign up for (and say, ...


2

802.1X IEEE 802.1X is a Standard for Port-based Network Access Control (PNAC) - it provides an authentication mechanism to devices wishing to attach to a LAN or WLAN. There are different ways it can be setup so you'll have to look into what your equipment and needs are, but a typical use-case is if you have an MS ActiveDirectory with all your users ...


2

Find a way to not give out the password. I don't have experience with this tool, but SpiceWorks has a free Mobile Device Management program at http://www.spiceworks.com/free-mobile-device-management-mdm-software/. Use that to distribute the WPA2 password to all of the computers that are authorized to connect. If a student gets their hands on the installer, ...


2

I'm going to recommend doing what most public Wi-Fi sources do, and require authentication through a website with individual usernames and passwords. Use a WPA password as well if you want will provide some protection from casual sniffing. This is available through the free DD-WRT router, specifically through software called ChiliSpot. You can then use a ...


2

Yes, it can. Home-router firmware is notoriously fragile, so any sort of sustained attack (or sometimes, even ordinary activity) can cause it to crash, requiring a reset.


2

In PSK mode, the Pairwise Master Key (PMK) is derived from the passphrase. Both the supplicant and the authenticator prove that they have knowledge of the pre-shared key to one another: [Supplication to authenticator Message B] contains a MIC value and thus proves that the supplicant knows the PMK [Authenticator to supplicant Message C] verifies to ...


2

Reaver could crash a home router, depending on a few factors. However, if we assume the implementation of WPS was well written (that is, didn't leak memory or suffer race conditions), it is unlikely that reaver would cause a crash. The attack leveraged by reaver involves brute forcing the WPS Pin. Depending on how well the router firmware was written, the ...


1

No you can't unless you have installed a monitor system that logs the network actions (remember anyway that the MAC address can be changed).


1

Short answer to your question is yes, Hydra and Crunch can be used in combination. Your statement that "bruteforcing is generating every possible combination in order to guess..." is correct but the term "bruteforcing" is often used in relation to guessing based on a wordlist, so we just have to deal with the impercise term. On to your goal of recovering ...


1

I agree that for the reasons you explained, MAC address authentication is not very difficult to bypass -- although as schroeder points out, this is difficult on non-rooted phones/tablets. Instead, 802.1x authentication or something like Cisco's MacSec offers far superior security. MAC address lists are often maintained for other reasons. For example, one ...


1

One non-security use case is in Japan where the JR train line has an access point in each carriage and through your installed app, can use your MAC address to pin point which exact carriage you are riding in. In addition, depending on how many passengers are riding, the number number of MAC addresses can determine how crowded the train is. Potential privacy ...


1

Unmodified MAC address lists are useful when discovering the type of hardware used on the network. MACs contain the vendor info and can be used to narrow down into the types of hardware used (iPhone, Laptop, etc.). For me, this is useful to know if an employee has hooked up their personal mobile device on the company network instead of the guest network (as ...


1

One of the reasons is that some DHCP use MAC adresses when you need to assign static IPs. It is also sometimes used by firewalls and security software (especially in routers).


1

You should say to the teachers about this, so they would not give passwords to students and then apply WPA2-Enterprise scheme.


1

Here's a different strategy. Let's start by assuming the following: Any password you give teachers will leak so long as the teachers have no motivation not to share their passwords Once a password leaks it travels widely via word of mouth Enforcement / action against students for using borrowed passwords is hard We are trying to stop the average student ...


1

To be able to reconnect to a WiFi router, with out prompting the user every time for the shared secret, the client operating system needs to remember the shared secret. Some operating systems make this "hard" for a user to see, but this will not prevent a determined user from recovering the shared secret. Yes this is a weakness, but then so is any scheme ...


1

Typically, no, the attack only tests for the AP's response to stimuli. But, the developers have noted that some home-grade firmware dies when the Reaver attack was used. A successful brute-forcing does not change the settings, so the existing users of the network are not aware.


1

Considering that the code they inject can be anything, one would have to assume that there are risks. Perhaps their code has a vulnerability in it that allows injection. Perhaps it obscures important items on the page. Perhaps it references an external resource (eg: JavaScript) of less security. Who knows? It certainly seems a risk to me. There are other ...



Only top voted, non community-wiki answers of a minimum length are eligible