Tag Info

Hot answers tagged

84

Enforce Consequences for Students Found on the Network The first thing you need to do is ensure you have a written policy outlining what devices are allowed on the network. However, if you are not consistent in the enforcement of your policy, it is useless. This should also cover the usage policies for the Teachers, including locking their computers when ...


47

You are trying to solve the wrong problem. They are thousands and you are one. Since you are not a security expert (as far as I understand, sorry if I'm mistaken) and they aren't either but they are a horde, you are just bound to lose if you fight a conventional war. @AviD gave a great answer in a comment: Here is a non-technical idea: This is a ...


36

They're both evil. You shouldn't be connecting to any "Free Public Wifi" without assuming that all your unencrypted traffic will be monitored and modified. The best solution is to not connect to public networks at all, but if that's not an option for you then you can protect yourself a little more by specifying your own DNS (rather than letting the router ...


27

From a security perspective, I think you are asking the wrong question. WPA2 is the basic answer. But it's entirely incomplete! A more complete answer will view WPA2 as one component of your wireless network defence. Of course there's strong encryption methods using certificates/vpn etc but these are too difficult for most people to set up and are usually ...


25

In a nutshell, WPA2 is currently the most secure wireless security scheme. Personal and Enterprise It supports two main modes of authentication, known as WPA2-Personal and WPA2-Enterprise. The former utilises a pre-shared key (PSK) and is generally considered to be most suitable for home networks, whereas the latter is 802.1x which requires an ...


19

If passwords are leaking like that, you may have a bigger problem than restricting Wifi access. It sounds as if the kids could do almost anything a teacher can do (including manipulate exam results?) and are routinely doing so at your location. It sounds as if a little bit of teacher education would solve this, after some detective work to narrow down the ...


17

Instead of continuing in the comments, I think I will just answer your real question, which I understand to be - why is using WPA/WPA2 Personal with a public SSID and Passphrase not more secure than having an open network, and why doesn't WPA/WPA2 Enterprise work in the coffee shop scenario. If the passphrase was public (as it would be in this scenario) ...


17

Traditionally there hasnt been an easy user-oriented method to detect evil twin attacks. Most attempts to detect an evil twin attack (ETA) are geared towards the administrator of a network where they basically have the authorised network admins scanning and comparing wireless traffic. This isnt so much of what you are interested in. There is a paper here ...


17

Tell the barrista/clerk/etc the wifi has gone down, can they reboot the router. Most people will happily do so, bringing the AP down for a moment, and exposing the evil twin router in the process as any active network that survives a power cycle. If there is more than 1 evil twin router, this still works. If there are multiple good routers, this would ...


16

Ethernet Before I get flamed by everyone who says iPads don't have ethernet ports, this is simply a single layer of "security". In most cases teachers should be able to use their laptops with a physical ethernet BASE-100TX CAT5+ plain old physical cable. You will have reduced the attack surface area (as the keys won't be on the teacher's laptops anymore). ...


13

There is one thing an evil twin can't copy: location. Set up three computers, then triangulate it. Or have some sort of time detector. If one of them is responding fast enough that you know, according to the speed of light, they must be within the store, then you know that it will be in the store, which is helpful if delays make triangulation harder. Note: ...


12

Consider an equipment upgrade I know you're looking for a no-budget solution, but a matching set of enterprise-grade WAPs and central controller could make securing the network easier. Weigh it against the cost of defending against a lawsuit for cyber-bullying, or harassment of an employee, or facilitating the falsification of test scores... Use MAC ...


11

Hacking a television station is hard. Most of the broadcast infrastructure isn't connected to the Internet, making outside intrusion difficult or impossible. Let's say you want to hack your local news station. Problem #1 is that their equipment isn't connected to the Internet -- it's quite possible that they're still using a bank of Betamax machines for ...


11

Give each authorised user their own individual password. Then you'll be in a position to judge where the leaks are coming from (assuming they're being leaked as opposed to cracked). (eg You may find that need to educate one of your teaching staff not to leave the password written down on his desk). Set up harsh firewall rules that block access to most of ...


10

Short answer is: use WPA2. WPA would be somewhat tolerable, but WPA2 should really be preferred. Do not use WEP, which is not really better than nothing (arguably, WEP is worse than nothing, because it gives to users the impression that security is happening, whereas it is not). More importantly, be sure to use a strong password (meaning: very random) and ...


10

You need to tighten human security, not technical security. WiFi password is good enough, the real questions are "Who is leaking passwords to students?" and "How to stop them?". You can't have any security if privileged persons (staff) share their credentials with the ones you're trying to block. Setting up different passwords for every single person would ...


9

I would use WPA2-Enterprise, so everyone would use own name and password, not just a password, which is same for everyone. To setup WPA2-Enterprise, you just need to have RADIUS server. The cheapest opinion, I think is to buy a NAS server. It supports multiple things and RADIUS sometimes too (I recommend Synology for this). Alternative is to use some ...


8

From what I've read, using https:// is safe. Is this true for networks set up for malicious purposes? If done right https is still safe. But, if you (actively) accept any kind of untrusted certificate (self-signed or signed by unknown CA) an active man-in-the-middle attack is possible. If the attacker owns a public root-CA or some intermediate CA or ...


6

For NFC technology, the main solution that has been offered to date is distance bounding, in which a tightly timed exchange of challenges and responses persuades the verfier that the prover cannot be further away than a certain distance. This solution, however, has some drawbacks: It still won't say whether the specific endpoint the verifier is talking to ...


6

Set up a captive portal that uses RFC 6238 like Google Authenticator (GA) (https://github.com/google/google-authenticator). GA has a PAM module. Have each employee, install the app, then come to your IT office, in person, to set up (sync) their account with the app. Use the auth token as either the only, or second factor. If the QR codes or secrets get ...


5

A wireless network that is unprotected means that anyone can simply connect to your wireless access point, and collect all of your traffic. If users of the network aren't using HTTPS (SSL/TLS enabled) webpages then their passwords, usernames, and any other sensitive information would be unprotected. Using WPA2-PSK, the wireless access point uses the ...


4

It does indeed slightly facilitate a remote attack on your machine, since an attacker would be able to send you packets from your local network, rather than having to rely on NAT traversal from the router you use to connect to the Internet. You would still need to have network-facing services running on your machine, such as SMB/CIFS, Telnet, other protocols ...


4

For WPA, The authentication process is known as a four-way handshake. It's a bit complex to describe but in short, the access point will know that there was an unsuccessful attempt to connect, but it will not know what key was actually supplied. Fortunately, this would mean that the bogus wifi ap will not be able to figure out the key to the "real" ap. ...


4

My understanding of NFC is that, as a standard, it doesn't offer any provision for encryption of data security. This means you'll have to implement security on top of it. So first: the important part: do not try to implement it yourself: You do not have the understanding necessary to design it properly (as demonstrated by your question) Even with proper ...


4

Your understanding is already pretty good. As you say, there are a variety of EAP protocols: LEAP, PEAP, EAP-FAST, EAP-TLS, etc. Each one works differently, but they all do the same thing: authenticate a user before allowing them access to a wireless network. You could call EAP a protocol, or you could call it a framework of protocols, where each variant ...


4

Use a faraday cage. I have tried it before and managed to completing shield it such that it is unable to get any GSM or wifi signal. http://en.wikipedia.org/wiki/Faraday_cage A link on building simple homemade faraday cages : http://www.thesurvivalistblog.net/build-your-own-faraday-cage-heres-how/


4

If you don't have permission, breaking into someone else's network is illegal regardless of why you're doing so. If you really want to learn about the security vulnerabilities of WPA-PSK and WEP, I recommend setting up your own AP and practice breaking into it.


4

In my context, the asia-pacific region, it's about 50-50 between secured WPA/WPA2 and unsecured. If you have a look at wigle.net you could find out exactly, however it's a lot of work, because you'll have to do quite a bit of filtering etc for actual coffee shops and not just commercial or personal networks, but you'll get a good broad picture anyway. For a ...


4

First of all, you need to disable SSLv3 on your browser, to prevent POODLE attack (SSL3 "POODLE" Vulnerability) Then, there's no issue using HTTPS even in "not safe" areas, because TLS protect you from Man In The Middle attack, with handshake, end-to-end encryption and Certificate Chain verfication. One common problem you could encounter, is SSL ...


4

For detecting an Evil Twin attack with a standard setup, the only information you really have and the SSID, The MAC address of the wireless access point, and the DHCP IP address, gateway, and DNS server that it hands out. Apart from that, you might find the evil twin using a different frequency than the original, like the true AP being on 2.4GHz and the evil ...



Only top voted, non community-wiki answers of a minimum length are eligible