Tag Info

Hot answers tagged

53

Unprotected Wifi networks, particularly in public places, are most certainly a threat. This is because you are connecting to a network without knowing who else could be on the network. 'Free Wifi' provided by cafes, restaurants, etc serve as excellent places for harvesting passwords. The attacker will perform a Man in the Middle attack, typically by ...


43

Something left unsaid, Why is the user wanting a WiFi? As long as the user feels they have a legitimate need they will continue to find workarounds to any of your attempts at blocking it. Discuss with the users what they are trying to accomplish. Perhaps create an official wifi network ( use all the security methods you wish - it will be 'yours' ). Or, ...


33

You can't allow customers to be on the same network as your own computers. A lot of new WiFi access-points take care of this for you, by creating two wifi networks, where the "guest" network does not have access to internal computers. The Cisco/Linksys 4200 is what I have at home for guests, and it's easy to setup, but there are many other systems that have ...


33

The schemes you mention are protocols for securing 802.11x traffic over wireless networks. They don't mandate how the AP password is encrypted or hashed during storage. However, the security of the protocol does rely on making the key secure. WEP relies on a broken RC4 implementation and has severe flaws in various aspects of its protocol which make ...


33

First of all that would entirely depend on the encryption used by the access point. There are several types of possible encryption. Mostly on consumer wireless access points these are: WEP WPA WPA2 WPS WEP Let's first dive into WEP. WEP was the first algorithm used to secure wireless access points. Unfortunately it was discovered that WEP had some ...


30

The risk here is in believing that a "hidden SSID" changes anything to the security. A non-hidden SSID means that the router will shout at regular intervals "hello everybody, I am Joe the Router, you may talk to me !". A hidden SSID means that the client machine (not the attacker's machine) will shout at regular intervals "Hey, Joe, where are you ? Please ...


29

Most probably the blocker is designed to let images through, maybe because they are hotlinking some images on the page where they ask for you to login. Appending ?.jpg to the URL makes the blocker think that the URL is an image. On the other hand, anything after the ? doesn't change the actual webpage requested, it only changes the GET headers. (so ...


27

HTTPS is secure over public hotspots. Only a public key and encrypted messages are transmitted (and these too are signed by root certificates) during the setup of TLS, the security layer used by HTTPS. The client uses the public key to encrypt a master secret, which the server then decrypts with its private key. All data is encrypted with a function that ...


23

After some discussion with @epeleg in chat, I think I may have a more thorough and (hopefully) clear answer. TL;DR: The protection afforded to a Wi-Fi network by encryption with a PSK is directly proportional to the complexity of the PSK, and the effort taken to safeguard that PSK. For any environment, this requires striking a careful balance between ...


20

They're stumbling blocks, but not insurmountable. SSID hiding can provide some protection from people looking for any SSID they can get their hands on, and MAC filtering can keep casual riffraff out. As the only methods of protecting a WLAN they're pretty weak. For someone who wants your network specifically encryption (most especially un-broken encryption) ...


19

An attacker can always determine the client's MAC address if they can sniff packets to or from the client. This is true regardless of whether encryption is used or not. The MAC address is in the outer encapsulation layer of the 802.11 packet, and there is no encryption applied to that level. Here's a good link at Microsoft that lays out the packet ...


17

Is it safe for a small business to let customers use their wifi while waiting? No. Even if no customer intentionally attacks his WiFi network they could be carrying some type of malware on their laptop/smart phone/portable device that might spread. Additionally the WiFi signal doesn't end at the front door. You have probably connected to a WiFi some ...


16

You can't. It doesn't matter whether the wifi is encrypted or not: you can't know whether the access point is trustworthy. A WPA2 access point with a strong password doesn't help when the access point itself is a rogue access point put up by someone who may or may not be the café or hotel owner. And yes, it happens — people put up open access points with ...


15

WPA2 is NOT protected against ARP poisoning. When you perform ARP poisoning, you announce that your MAC address is responsible for a given IP address. All of this happens at a layer higher than WPA2 is aware of. Let's say layer 3. Because the WPA2 encryption link is down on layer 2, and packets destined for the attacked IP are now addressed to the ...


15

The question (to most people) is an oxymoron. By definition, people will think that "open WiFi" means "un-encrypted WiFi. To me you seem to be asking "Why did the people that wrote the 802.11 standard way back in 1997 make the decisions that they did?" The short answer - we can only find out by asking them (or seeing if there are any discussion documents ...


14

The other answers are correct, however there is one big fish being mostly ignored: DNS cache poisoning As @Larry said, since you own the router you own the DNS. Meaning you can cause any other user of that network, use any server you want for any address they request. But more than that: You can make leave your DNS ownership in place, even ...


14

Was prompted by conversation with @Iszi on chat to make things much clearer - to just highlight the main increased risks. An attacker could reroute every request sent by users of the network leading to: Phishing attack - for example the normal guidance for users is to never click on untrusted links for things like online banking, but to always type in the ...


14

Regardless of what you do at the AP, I believe I can say with a fair amount of certainty that you will at some point find that your wireless data is being broadcast "outside the walls". First, you must understand that your AP is not the only wireless transmitter on your home network. All of your wireless clients that connect to the AP are also ...


14

I do not know if your question is about dictionary attacks in general, or dictionary attacks in the case of a WiFi network with password protection. For the general question of dictionary attacks: there are two kinds of dictionary attacks, the online attacks and the offline attacks. An offline attack is one such that the attacker got enough data to "test" ...


14

Letting guest coming on your network is not a good idea. But this has already been said. A major point that must must remarked is that even for guest you need identification and authentication. In fact (I am not aware of you laws) you want to make sure to be able to track back any user of your WiFi in case of a problem with justice. If someone comes to tell ...


14

Yes and no. They may not have your password in plaintext, but they have enough to potentially guess it and verify that guess (i.e. offline brute forcing). WPA2 authentication is performed through a four-way handshake. Instead of just sending your password in plaintext to any access point you connect to, this handshake ensures that unless both parties ...


14

Firewalls can't tell where your traffic is coming from in terms of the physical network - they only see the data that the protocol provides, such as MAC / IP, which aren't much use in this case. I think you're falling into the trap of looking for a technical solution to a managerial problem. Remember Immutable Law of Security #10: Technology is not a ...


14

Using valid SSL/TLS connection by making sure you're always connecting to the https:// version of the website and that the browser isn't giving you any warnings or errors, is your first line of defence. An addon called HTTPS Everywhere can be very helpful here. The approach you're proposing (SSH to your trusted network) is a very standard approach. I use it ...


13

Yes, a VPN connection encrypts the connection between your computer and the remote VPN host. The connection would just look like gibberish to anyone sniffing the traffic, either in the coffee shop or on the Internet. It is worth noting that the same applies to any content sent over HTTPS even if you aren't using a VPN. It is also worth noting that if you ...


13

If someone knows my wifi password (be it WEP or WPA) what can they see on my screen? Do they just see URLs I visit, or can they see everything in my browser,....or can they see everything I do on my computer? Does using HTTPS make any difference? They can't see anything on your screen (unless you've enabled some sort of unencrypted remote desktop screen ...


12

There is no firewall rule which can help you there: by construction, the rogue AP provides a network path which bypasses your firewalls. As long as the users have physical access to the machines they use and their USB ports (that's hard to avoid, unless you pour glue in all the USB ports...) and that the installed operating systems allow it (then again, hard ...


12

The article is a huge amount of FUD and scaremongering, but even if you take the basic info outlined in it then there is only a small worry and it is very easy to protect yourself. if you have your android device set to backup online then yes, it will back up known wifi passwords. This is the same as iPads and other devices that give this cloud backup ...


11

No, neither of these are worthwhile measures against an attacker. Unless you have an easy to guess password you need to assume anyone who might realistically try to gain access to your network has software to help or a little knowledge of how to get around such techniques. SSID hiding doesn't improve security since it is trivial to identify the SSID of a ...


11

Short answer: it depends. SSL/TLS itself is no more vulnerable over a public wifi connection, than over "regular" internet. It was designed to be used in open channels. However, there a few other aspects to consider: Often users don't browse directly to the HTTPS site, they start off at the HTTP site and redirect from there. E.g you browse to ...



Only top voted, non community-wiki answers of a minimum length are eligible