Tag Info

New answers tagged

0

I read that this MIC is derived from the PSK (e.g. WPA2 key). Does this mean that these frames are still spoofable from inside the network (i.e. if you own the PSK)? Or does it defend against insider de-auth attacks as well? If you have the AP's MAC address, SSID and WiFi password then you have everything you need to impersonate an AP running ...


1

You should say to the teachers about this, so they would not give passwords to students and then apply WPA2-Enterprise scheme.


0

Lots of answers here already, but here's my take. The Human Problem (Social Engineering) You have teachers casually handing passwords out to students. The first group you need to educate about the use of the network is your teachers. Otherwise, further security measures are pointless. Presuming you are using a strong password for the WiFi key and using ...


0

You are approaching the problem the wrong way, and in the process making yourself (and the institution in general) the enemy. The student body is, collectively, smarter and has more resources. Also don't forget who you work for (them). If I was in your place I would take the simple route - a completely open student wifi network. Yes, you read that right - ...


2

Here's a different strategy. Let's start by assuming the following: Any password you give teachers will leak so long as the teachers have no motivation not to share their passwords Once a password leaks it travels widely via word of mouth Enforcement / action against students for using borrowed passwords is hard We are trying to stop the average student ...


9

I would use WPA2-Enterprise, so everyone would use own name and password, not just a password, which is same for everyone. To setup WPA2-Enterprise, you just need to have RADIUS server. The cheapest opinion, I think is to buy a NAS server. It supports multiple things and RADIUS sometimes too (I recommend Synology for this). Alternative is to use some ...


10

You need to tighten human security, not technical security. WiFi password is good enough, the real questions are "Who is leaking passwords to students?" and "How to stop them?". You can't have any security if privileged persons (staff) share their credentials with the ones you're trying to block. Setting up different passwords for every single person would ...


19

If passwords are leaking like that, you may have a bigger problem than restricting Wifi access. It sounds as if the kids could do almost anything a teacher can do (including manipulate exam results?) and are routinely doing so at your location. It sounds as if a little bit of teacher education would solve this, after some detective work to narrow down the ...


12

Consider an equipment upgrade I know you're looking for a no-budget solution, but a matching set of enterprise-grade WAPs and central controller could make securing the network easier. Weigh it against the cost of defending against a lawsuit for cyber-bullying, or harassment of an employee, or facilitating the falsification of test scores... Use MAC ...


2

802.1X IEEE 802.1X is a Standard for Port-based Network Access Control (PNAC) - it provides an authentication mechanism to devices wishing to attach to a LAN or WLAN. There are different ways it can be setup so you'll have to look into what your equipment and needs are, but a typical use-case is if you have an MS ActiveDirectory with all your users ...


11

Give each authorised user their own individual password. Then you'll be in a position to judge where the leaks are coming from (assuming they're being leaked as opposed to cracked). (eg You may find that need to educate one of your teaching staff not to leave the password written down on his desk). Set up harsh firewall rules that block access to most of ...


47

You are trying to solve the wrong problem. They are thousands and you are one. Since you are not a security expert (as far as I understand, sorry if I'm mistaken) and they aren't either but they are a horde, you are just bound to lose if you fight a conventional war. @AviD gave a great answer in a comment: Here is a non-technical idea: This is a ...


16

Ethernet Before I get flamed by everyone who says iPads don't have ethernet ports, this is simply a single layer of "security". In most cases teachers should be able to use their laptops with a physical ethernet BASE-100TX CAT5+ plain old physical cable. You will have reduced the attack surface area (as the keys won't be on the teacher's laptops anymore). ...


2

Find a way to not give out the password. I don't have experience with this tool, but SpiceWorks has a free Mobile Device Management program at http://www.spiceworks.com/free-mobile-device-management-mdm-software/. Use that to distribute the WPA2 password to all of the computers that are authorized to connect. If a student gets their hands on the installer, ...


2

I'm going to recommend doing what most public Wi-Fi sources do, and require authentication through a website with individual usernames and passwords. Use a WPA password as well if you want will provide some protection from casual sniffing. This is available through the free DD-WRT router, specifically through software called ChiliSpot. You can then use a ...


6

Set up a captive portal that uses RFC 6238 like Google Authenticator (GA) (https://github.com/google/google-authenticator). GA has a PAM module. Have each employee, install the app, then come to your IT office, in person, to set up (sync) their account with the app. Use the auth token as either the only, or second factor. If the QR codes or secrets get ...


84

Enforce Consequences for Students Found on the Network The first thing you need to do is ensure you have a written policy outlining what devices are allowed on the network. However, if you are not consistent in the enforcement of your policy, it is useless. This should also cover the usage policies for the Teachers, including locking their computers when ...


0

To certain extent, LTE provides "somewhat" end to end security. Contrary to what @D.W said, (I am assuming what he meant by wired network is probably core network - i.e. after base stations), 4G/LTE would use Diameter protocol and hence IPSec. So the legacy Signalling System no. 7 (SS7) like core network protocols will be replaced in LTE and hence ...


-1

This is a great question, because it highlights the importance of one of the three fundamental requirements of any secure protocol, i.e. integrity. (For the record, the other two fundamental requirements are secrecy and authenticity). The goal of integrity is to prevent a man in the middle from altering the content of a message en route from the sender ...


1

"Would it be possible for the attacker to change this packet before reaching its destination and modify it telling instead that I´ve got 0 health and then send to the server with modified values" They could intercept and alter the packet easily, but forwarding the altered packet to the server without the server knowing it's come from another user is the ...


1

Yes, it's perfectly possible. The answer is to use encrypted connections, since encryption protocols such as TLS/SSL and SSH will stop the attacker from seeing what's in the packets, and also allow the server to detect and reject any changes from what was sent by the client.



Top 50 recent answers are included