Is there a way to verify the identity of a router over WiFi?

Question

I to find out a way to “verify a router's identity” for security purposes.

I was thinking in some process that involves hiding the router's SSID plus verifying the router's MAC address when performing the connection. The problem here is, the SSID, even when hidden, can be easily detected, as well as the MAC address, a password even with WPA2 security isn't completely helpful when non-techies are connected to that network because social engineering.

So this information would allow an attacker to spoof the router's identity, and maybe with a stronger WiFi signal this attacker would cause pre-configured computers to switch from the real network to the fake one, allowing the attacker to see all packages being transmitted inside and outside the network.

I want to know if there's an SSL-like scheme for verifying the identity of the router someone is connecting to, in order to avoid these kind of attacks.

Answer 1

There is an SSL like scheme: EAP-TLS and EAP-TTLS. It is similar to SSL in that it does not check the identity the hardware (router, server hardware...) but that it does authentication at the software level - using TLS with certificates in both cases.

Of course, like the TLS use in HTTPS it needs some initial trust on which the authentication can be build on. With HTTPS this is in most cases done by having the certificates signed by a public CA which ships as trust anchor with the browser or OS. With EAP-TLS this can be done too although it is actually common to use non-public CA, i.e. have a private PKI.

But, EAP-TLS is not much used for public hotspots or small networks at home and most SoHo routers don't even support it. It is mostly used in enterprise environments instead. For smaller networks usually WPA-PSK is used where authentication is done by having a shared secret between client and access point. This is enough to securely identify your own router at home provided that you use a strong password which is not known to a potential attacker.

As for public hotspots which don't use any password or which use widely known passwords: you cannot trust these for many reasons. One is that an attacker might open a rouge hotspot with the same name and password and you cannot tell the difference. Additionally these networks are used by untrusted users and are usually not protected against ARP spoofing or similar which makes man in the middle attacks possible. If you really need to use such networks you better use a VPN or similar to tunnel your traffic to a trusted network.

Answer 2

Two options:

Use a VPN on the client so any man in the middle is avoided and you connect to your network that way. Even if it does go through a bad actors.

Use RADIUS in a EAP-TLS configuration to offer authentication to radius clients and servers. The client in this configuration would be the AP and not the end users device (a common mis conception in RADIUS for new admins)

Answer 3

An OpenBSD/FreeBSD WiFi router with authpf will do exactly this. The server's ssh key will not change often, if ever, and you can control the behaviour of users with a high degree of granularity. I recommend athn PCI cards -> https://man.openbsd.org/athn.4 Since pfSense is based on FreeBSD, you would get the fastest (in terms of configuration) ride using that on an PCENGINES Alix/APU or Soekris.

Answer 4

To restate what the OP is asking in a different way, if I am not mistaken, it is: "How can I keep my wifi access point secure after the encryption key or password is leaked to everyone". Answer: use WPA enterprise (radius) which uses a different password for everyone so this can't happen, or use any of the number of methods for using open wifi securely.