What protection can I take against a not very experienced attacker (15 kid) who wants your Wi-Fi password, wannabe hacker and using ARP spoofing and programs such as: wifikill, selfishnet, netcut, wireshark, dumper, jumpstarter, crunch, wpswin, veracrypt, ettercap, hydra.

He owns a laptop with Windows 8 and Kali Linux on VirtualBox, which I have my hand on now to format and install an OS (is there any restriction I can make or any recommendations you suggest).

My router is a NETGEAR dg84 v3. I know it's very old. can I do something like a guest network with it?

What steps I need to perform to achieve that?

I don't want him sniffing everyone's traffic and hijacking passwords, what can I do in my situation other than getting another Wi-Fi connection?

How much damage he can do with such programs? And does programs such as Ettercap, hydra and Wireshark works if I enabled the wireless isolation? And disable remote access and WPS?

When he is sniffing traffic and passwords does it happen in real time? Or is it stored somehow in the router and he can view it when want?

And which program is the most dangerous one?

  • 9
    Have you considered changing the password? – Philipp Dec 22 '16 at 22:51
  • Does this person need Internet access at all, or is it okay to kick him off the network entirely? The latter should be simple - just use WPA2 encryption, disable WPS, set a long, 20+ character random password, and physically protect against access to the router's reset button and LAN ports if needed. WPA2 is strong as long as it is set up properly. But providing restricted access without a router that has built-in guest networking will require significantly more expertise. – tlng05 Dec 22 '16 at 23:01
  • if i disable WPS would and enable isolation would that stop programs like ettercap?? – mark000 Dec 22 '16 at 23:06
  • 2
    If they don't know the password (WPA2 key) to connect to your network, none of the tools will be able to capture any meaningful data as the communication will be encrypted. Isolation doesn't prevent sniffing; wireless communication must travel through the air and you can't beat physics. What WPA2 does is scramble the traffic so that it looks like gibberish to anyone who doesn't have the key. As for WPS, it should always be disabled simply because it has a flaw that substantially weakens WPA2. – tlng05 Dec 23 '16 at 3:17
  • 2
    Do they know your wifi password? Have you changed it after that? – defalt Dec 23 '16 at 4:53

If you give him the wifi password there's not much you can do to prevent him from monitoring wireless traffic. With typical consumer-grade hardware your only options to partially protect yourself are to set up a guest network (not sure if that's available on your router) or buy a second router and connect both to the network. But neither of those are perfect solutions and the only real solution is to not allow him on your network at all.

If you must give him network access, I would recommend using a VPN on all of your computers to prevent most packet-sniffing, and lock down the firewall and prevent any sharing features on the OS.

The simplest fix would be to configure a second access point (separate SSID on the same device) for his use which is separate to everyone else's, but this is unlikely to be feasible on an older router such as yours. A router which supports multiple access points would also potentially offer the option to configure other weaker SSIDs for him to test against.

If you want to stick with what you have then as mentioned by others you should enforce network isolation, I think it is off by default on older NETGEAR routers. Also configure a client to gateway VPN for other users, the NETGEAR router that you have should have support for this out of the box. You will probably need to download the client software from their website and there is likely to be a limit on the number of people that can connect at the same time.

When information is sniffed from a network (whether wired or wireless) it is normally saved onto the device being used to do the sniffing, so in this scenario the boy's laptop.

Instead of trying to prevent him doing this sort of thing (it is unlikely that controls you apply will be successful), depending on his personality it might be worth supporting the interest and trying to channel it into a (legal) career path?

I think the best thing you can do at this point is manage a White list MAC addresses for your known devices and block all other MACs. But as soon as the kid got to know one of your MACs then this option fails. He can easily do a MAC spoof.

  • 1
    So is not the best thing... the macs can be easily spoofed as you said... – OscarAkaElvis Dec 22 '16 at 23:49
  • and he already using a mac changer so he is well aware of this – mark000 Dec 23 '16 at 0:17

What steps I need to perform to achieve that?

First step would be to change your password to your network. The 15 year old will be able to sniff your data whenever he cares to if he is within range of the network, however if he does not have the network key then he will not be able to 'read' the data because it is encrypted; meaning your data is safe.

Also keep in mind when choosing a new password, make sure it is not easily subject to a brute force attack. If he does have a program like "Hydra" then he will be able to crack passwords based off of a password list.

And which program is the most dangerous one?

I do not know if I can answer that question, as I am unfamiliar with some of those programs. Each of those programs are unique in their own way. They each serve similar purposes or entirely different purposes. As long as you protect your network key and make sure that network key is not easily vulnerable to a brute force attack then that should render those programs to be not very effective.

Remove the wifi hardware from the device. Get a big bulky USB one to give when wifi access is allowed. If you give him 802.11b hardware he won't be able to monitor most wifi traffic from newer g/n/ac stuff. Giving him an 802.11a device will make him not be able to monitor most everything since it can't monitor 2.4GHz nor the new 5ghz N/ac stuff. I said these things because I thought you may be worried about him messing with the neighbors' wifi.

I would say just change your wifi password, but it looks like you don't want him getting on to your wifi network as he might spy on your or disrupt you.

If you don't want him on your own network, then:

1) Get a second access point with a different password for him to use. I see why the answer to this situation isn't a simple one step answer. One problem with this is that he still has access to your wired network now, since his access point will be plugged in to your LAN, and he can play ARP games. You could set up VLANs to isolate them. That requires more professional hardware. You could plug his access point (not configured as a NAT router!) in to yours have have it operate as a regular router (not NAT router) giving him a different private IP address range. I believe Linksys access points support this. This has its draw backs as uPNP may stop working. If you plug his access point in to yours directly with the WAN port while leaving it configured as a NAT router then he'll be behind double NAT which works but it can be quite messy.

2) Get an access point with a guest network feature.

He'll just reinstall the programs back on his computer unless you completely lock it down, and even that may not work. I don't see how you can remove bad programs.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.