For some days, I was feeling that my Internet bill was booming. Then, I recently found out that a boy near my house was accessing my router to use the Internet. Then, I read some articles how to crack WEP security and found that it is way too easy to crack WEP.
So I was looking for some ways to increase the security of an AP using the WEP protocol. But I didn't find anything. My router does not support WPA/WPA2. So how can I make my router more secure, I mean uncrackable?
There is really only one solution to your problem. I do note however that you're not interested in upgrading your router, so I will talk a little about that.
Remember that by not upgrading your router, you are only delaying the inevitable.
This is honestly the best solution until you get a new router.
You can probably do this from the administration panel of your router, if not, remove the antennas from the physical device and go Ethernet-only. If that is not possible, unplug.
If your router supports it, you can define a MAC address filter to either whitelist or blacklist devices accessing the accesspoint. To do this, you will have to log into the administration panel of your router and enable MAC address filtering. (Check your manual on how to do this). What kind of filter you can enable depends on your router. If it's a whitelist, you will have to find the MAC addresses of all your devices, and add them to the list. This way only the devices added to the list will be able to connect to the Internet. If it's a blacklist, you will have to find the MAC address of your neighbour, and add that to the blacklist. This way, all other MAC addresses are allowed access, but not the addresses in the blacklist.
MAC address filtering is fairly simple for someone to who's a bit tech savvy to avoid. There are multiple tutorials on the subject, and it's really as simple as running a few terminal commands. Since your neigbour has already cracked your WEP key, chance is, he has enough skills to google how to spoof a MAC address.
This way, the neighbour can "pretend" to be you, by authenticating with the router using your computers MAC address.
Changing the password won't last for long, because of how WEP works. An attacker only need to listen to your network for a short period of time, to be able to extract your password. You can read more about it on Wikipedia.
And at last, since you've been breached, anything you have connected to your access point could in theory be infected now. Not only could the hacker have changed your DNS settings, started logging network activity, etc., he could also now be in the possession of all your files, pictures, passwords, credit-card information, etc. To be honest, all of your devices (if not already hacked) are in great danger of getting breached any second.
Get a new router. Seriously. WEP was deprecated in 2004 and has been deemed insecure for a long long time. As you noted yourself, there are a lot of information on how to crack WEP keys online, and it's (almost) as simple as running a terminal command. Anyone can do it. Remember that in most countries, you are liable for what passes through your network. So if an adversary downloads torrents, children pornography or bomb schematics, you will be held liable. Is prison better than spending US$20 on a new router?
There is no method to make WEP uncrackable, or at least secure. So I suggest buying a new router that suports WPA2.
No. You cannot make WEP uncrackable, but there are some things you may be able to do to help the problem until you get a new router.
Modify the signal strength. Take off one (or more) antennas from your router (if you have a small apartment). Move your router to the center of your home. These steps may make it more difficult for a neighbor to get a decent signal strength from their location, and give up.
Use a captive portal. Adding another step of authentication to the process with a more secure password may help. However, if the attacker is savvy enough they can likely bypass this. There are some resources for this.
Get a new router. The only real solution here is to buy a new router. Not only is your internet bill high as a result of this, but the attacker can view everything you do when you are on the internet, and plant malware on your network. They have the ability to do some really nasty things. WEP only takes seconds to minutes to crack. You should just eat the cost and upgrade to a new router.
WEP has fundamental design flaws preventing it from ever being secure. This means that in order to get a secure network you either have to replace WEP with something secure (WPA2) or enforce security at a higher level in the protocol stack.
Security at a higher level in the protocol stack means you don't allow your AP to get access to the internet. Instead you allow your AP to connect to a server on your LAN and use a secure protocol between WiFi clients and that server. That secure protocol could be a VPN protocol or SSH with port forwarding (the builtin socks proxy work quite nicely).
Of those two approaches upgrading to WPA2 is clearly the simplest to implement. WPA2 is not flawless either, but you can get decent security if you use a unique SSID and a strong password.
If you can automate the changing of the WEP password across your network and do so with a new password every 5 minutes, your network will be fairly well protected against casual attackers. It will not be uncrackable though.
If you change your network password every 3 seconds, though, it will be uncrackable, as the fastest crackers still require several thousand packets of data collection, and then several seconds on a modern processor to extract the key from the data.
You can make your WEP network uncrackable.
Is this easier than switching to WPA? Probably not. In fact, most of the reasons to stay with WEP (such as supporting older devices) also preclude frequent password changes. If that's the reason to stay with WEP, then you should reconsider your network configuration - but that's a different question.
First of all, nothing is uncrackable. You can certainly make your passwords more difficult to crack, use better algorithms, but nothing would be uncrackable.
You can upgrade your router which supports WPA/WPA2.
If your router firmware supports, you can also track the MAC-ID being used by the boy, and add it to black list. But again, it is easy to change the MAC-ID of a device, so you might want to keep an eye on the MAC-IDs being used.
Even better, you can make a note of MAC-IDs of your devices and add it to your white list, so that only those MAC-IDs are allowed on your router.
Also, try checking for router's firmware updates.
Provided, you want to stick with the router you have, you can:
Also: WPA is really only implemented over old hardware - maybe firmware update is available enabling WPA-TKIP?
Just restrict the MAC address access to the router and then hide the network SSID so that a casual attacker doesn't know it is there in the first place.
And, obviously, as soon as you can, replace your router.
