Hot answers tagged

88

Enforce Consequences for Students Found on the Network The first thing you need to do is ensure you have a written policy outlining what devices are allowed on the network. However, if you are not consistent in the enforcement of your policy, it is useless. This should also cover the usage policies for the Teachers, including locking their computers when ...


50

You are trying to solve the wrong problem. They are thousands and you are one. Since you are not a security expert (as far as I understand, sorry if I'm mistaken) and they aren't either but they are a horde, you are just bound to lose if you fight a conventional war. @AviD gave a great answer in a comment: Here is a non-technical idea: This is a ...


37

They're both evil. You shouldn't be connecting to any "Free Public Wifi" without assuming that all your unencrypted traffic will be monitored and modified. The best solution is to not connect to public networks at all, but if that's not an option for you then you can protect yourself a little more by specifying your own DNS (rather than letting the router ...


20

Traditionally there hasnt been an easy user-oriented method to detect evil twin attacks. Most attempts to detect an evil twin attack (ETA) are geared towards the administrator of a network where they basically have the authorised network admins scanning and comparing wireless traffic. This isnt so much of what you are interested in. There is a paper here ...


20

If passwords are leaking like that, you may have a bigger problem than restricting Wifi access. It sounds as if the kids could do almost anything a teacher can do (including manipulate exam results?) and are routinely doing so at your location. It sounds as if a little bit of teacher education would solve this, after some detective work to narrow down the ...


19

Tell the barrista/clerk/etc the wifi has gone down, can they reboot the router. Most people will happily do so, bringing the AP down for a moment, and exposing the evil twin router in the process as any active network that survives a power cycle. If there is more than 1 evil twin router, this still works. If there are multiple good routers, this would ...


19

Ethernet Before I get flamed by everyone who says iPads don't have ethernet ports, this is simply a single layer of "security". In most cases teachers should be able to use their laptops with a physical ethernet BASE-100TX CAT5+ plain old physical cable. You will have reduced the attack surface area (as the keys won't be on the teacher's laptops anymore). ...


16

Yes, this is possible. It is not an easy task, though, and you are not likely to be a target. There are series of equipment which are shielded so that such attempts are more difficult. They follow sets of standards called TEMPEST.


14

There is one thing an evil twin can't copy: location. Set up three computers, then triangulate it. Or have some sort of time detector. If one of them is responding fast enough that you know, according to the speed of light, they must be within the store, then you know that it will be in the store, which is helpful if delays make triangulation harder. Note: ...


13

When you use Tor, all data is encrypted between your computer and the exit node. As long as the exit node isn't on the same network that you are on (very, very unlikely to occur), the data will be protected from the local network. Note that meta data such as the fact that you're using Tor and rough estimates of how much data you are communicating may be ...


13

Give each authorised user their own individual password. Then you'll be in a position to judge where the leaks are coming from (assuming they're being leaked as opposed to cracked). (eg You may find that need to educate one of your teaching staff not to leave the password written down on his desk). Set up harsh firewall rules that block access to most of ...


13

Consider an equipment upgrade I know you're looking for a no-budget solution, but a matching set of enterprise-grade WAPs and central controller could make securing the network easier. Weigh it against the cost of defending against a lawsuit for cyber-bullying, or harassment of an employee, or facilitating the falsification of test scores... Use MAC ...


10

You need to tighten human security, not technical security. WiFi password is good enough, the real questions are "Who is leaking passwords to students?" and "How to stop them?". You can't have any security if privileged persons (staff) share their credentials with the ones you're trying to block. Setting up different passwords for every single person would ...


10

I would use WPA2-Enterprise, so everyone would use own name and password, not just a password, which is same for everyone. To setup WPA2-Enterprise, you just need to have RADIUS server. The cheapest opinion, I think is to buy a NAS server. It supports multiple things and RADIUS sometimes too (I recommend Synology for this). Alternative is to use some ...


10

First of all, a cracker is considered somebody that reverse engineers software in a way where copy protections or nags screens are removed. From Wikipedia: Software cracking (known as "breaking" in the 1980s1) is the modification of software to remove or disable features which are considered undesirable by the person cracking the software, especially ...


7

Set up a captive portal that uses RFC 6238 like Google Authenticator (GA) (https://github.com/google/google-authenticator). GA has a PAM module. Have each employee, install the app, then come to your IT office, in person, to set up (sync) their account with the app. Use the auth token as either the only, or second factor. If the QR codes or secrets get ...


5

The focus of Tor is not privacy, but anonymity. When you use Tor, your traffic is protected under multiple layers of encryption as it bounces between relay nodes, before it finally reaches and is decrypted by the exit node. The exit node finally sends your traffic to the intended destination and the reply back to you through the Tor network. This setup has ...


5

For detecting an Evil Twin attack with a standard setup, the only information you really have and the SSID, The MAC address of the wireless access point, and the DHCP IP address, gateway, and DNS server that it hands out. Apart from that, you might find the evil twin using a different frequency than the original, like the true AP being on 2.4GHz and the evil ...


5

You could sniff the network for traffic and change your network configuration to an active machine(i.e. MAC address): # ifconfig wlan0 down # ifconfig wlan0 hw ether DE:AD:66:55:12:34 <== sniffed MAC # ifconfig wlan0 up assuming wlan0 is your wireless network interface. On Windows you can do something like this. Now there should be two work stations ...


5

NFC is just another medium like wires, wifi, microwave, light-comms, etc. It will be incumbent on the security professionals to create and guide their safe use whether it is for payments, data sharing or any other purpose. Being an invisible medium probably brings its own risks in terms of awareness, but there is nothing intrinsic beyond its invisibility ...


5

If the encryption to the banks web site is encrypted end-to-end with TLS they cannot sniff the secret. But The attacker could use tools like sslstrip to downgrade you to plain text. If you are not aware about you might not notice. There are ways for the bank to enforce HTTPS like with using HSTS, but it is not supported by all browsers and not all banks ...


5

If the connection is unencrypted then you can sniff the video and watch it, real time if you have the tools and have visibility of the connection (typically by being on the target's network, but not necessarily) You won't necessarily know when they stop and start the video, as most video services buffer the stream (ie they download ahead of where you are ...


5

What you are trying to do is called "carving" a file in the forensic world. I know there are plenty of off the shelf tools that can pull out images and display them in a browser in real time, so it should be possible to do this with video. It may be more complicated to do a video in real time though do to file access restrictions (one process reading while ...


4

You're missing the bigger question: why? Encryption adds greatly to the coffee shop's cost. There are small one-time costs incurred when someone has to configure the access points, assign passwords, manage them, change them, post signs saying "this week's password is C0ffeebuck$" etc. There is an ongoing high payroll cost, too. Baristas are paid to ...


4

The Amazon Fire TV is pre-configured with your account: Pre-registered to your Amazon account so you can enjoy favourite titles and personalised recommendations They configure this with your details taken from the account you used to order the device.


4

WPS does not seem to be a well implemented technology. If you reverse engineer the firmware, you may find that the algorithm is MAC based, etc (such as in the case of some D-Link Routers or Belkin). It also looks like in many cases that implementation weaknesses also permit brute forcing (also see CERT VU#723755) to be done easily. This is supposedly open ...


4

I'm going to recommend doing what most public Wi-Fi sources do, and require authentication through a website with individual usernames and passwords. Use a WPA password as well if you want will provide some protection from casual sniffing. This is available through the free DD-WRT router, specifically through software called ChiliSpot. You can then use a ...


4

The network you've set up uses pre-shared secret authentication. If you're already on the network, then you know the password so seeing it in plain-text isn't that much of a big deal. In most enterprise environments, they use 802.1x authentication so there's not much to be worried about. Could I access the password of wireless networks as they are ...


4

A closed binary is harder to audit than something you have source for, so technically you add some risk by doing this. However, you may already be taking equal or greater risks: Are you compiling Debian from source yourself or downloading a binary ISO? Are you auditing the source code yourself or just assuming someone else has done it, like everyone ...


4

I agree with your analysis of the reasons why police departments and other agencies would use "weak" encryption products with their radios: simply because as of the current day encryption crackers are rarely used by common criminals that listen to radio transmissions of such agencies (they perhaps use analog/digital radio scanners, but such scanners can ...



Only top voted, non community-wiki answers of a minimum length are eligible