24

For some days, I was feeling that my Internet bill was booming. Then, I recently found out that a boy near my house was accessing my router to use the Internet. Then, I read some articles how to crack WEP security and found that it is way too easy to crack WEP.

So I was looking for some ways to increase the security of an AP using the WEP protocol. But I didn't find anything. My router does not support WPA/WPA2. So how can I make my router more secure, I mean uncrackable?

40

There is really only one solution to your problem. I do note however that you're not interested in upgrading your router, so I will talk a little about that.

Remember that by not upgrading your router, you are only delaying the inevitable.

What will work long enough for you to get a new router:

PULL THE PLUG

This is honestly the best solution until you get a new router.

Or TURN OFF THE WI-FI

You can probably do this from the administration panel of your router, if not, remove the antennas from the physical device and go Ethernet-only. If that is not possible, unplug.

Or CHANGE YOUR WEP PASSWORD and TURN ON MAC ADDRESS FILTERING

If your router supports it, you can define a MAC address filter to either whitelist or blacklist devices accessing the accesspoint. To do this, you will have to log into the administration panel of your router and enable MAC address filtering. (Check your manual on how to do this). What kind of filter you can enable depends on your router. If it's a whitelist, you will have to find the MAC addresses of all your devices, and add them to the list. This way only the devices added to the list will be able to connect to the Internet. If it's a blacklist, you will have to find the MAC address of your neighbour, and add that to the blacklist. This way, all other MAC addresses are allowed access, but not the addresses in the blacklist.

Why this won't work in the long run:

MAC address filtering is fairly simple for someone to who's a bit tech savvy to avoid. There are multiple tutorials on the subject, and it's really as simple as running a few terminal commands. Since your neigbour has already cracked your WEP key, chance is, he has enough skills to google how to spoof a MAC address.

This way, the neighbour can "pretend" to be you, by authenticating with the router using your computers MAC address.

Changing the password won't last for long, because of how WEP works. An attacker only need to listen to your network for a short period of time, to be able to extract your password. You can read more about it on Wikipedia.

And at last, since you've been breached, anything you have connected to your access point could in theory be infected now. Not only could the hacker have changed your DNS settings, started logging network activity, etc., he could also now be in the possession of all your files, pictures, passwords, credit-card information, etc. To be honest, all of your devices (if not already hacked) are in great danger of getting breached any second.

What you have to do:

Get a new router. Seriously. WEP was deprecated in 2004 and has been deemed insecure for a long long time. As you noted yourself, there are a lot of information on how to crack WEP keys online, and it's (almost) as simple as running a terminal command. Anyone can do it. Remember that in most countries, you are liable for what passes through your network. So if an adversary downloads torrents, children pornography or bomb schematics, you will be held liable. Is prison better than spending US$20 on a new router?

  • 29
    MAC address filters are snake oil and at the very best security by obscurity. You point this out, still I wouldn't suggest it. – user10008 Jul 5 '15 at 16:55
  • 12
    @Freedom It will not stop an attacker who knows how to crack WEP passwords, so is effectively useless. – Xander Jul 5 '15 at 23:10
  • 6
    You don't understand. The attacker can crack the passwords, but their connection will be refused because their MAC is not in the allowed list. And i doubt that finding a MAC that will be accepted to spoof is fast. – Freedo Jul 5 '15 at 23:19
  • 8
    @Freedom chances are the person doesn't need to find a MAC address: they already have them - they were connected to this person's network, and could find plenty of valid MAC addresses during this time - and changing the MAC address of all the devices may not even be possible depending on the device. – user2813274 Jul 5 '15 at 23:38
  • 12
    @Freedom Obtaining a whitelisted mac address is trivial, see: blog.techorganic.com/2010/12/21/… (Note the date of the article.) – Phizes Jul 6 '15 at 2:02
82

There is no method to make WEP uncrackable, or at least secure. So I suggest buying a new router that suports WPA2.

  • 27
    @Shivam sorry to tell you, but it is the correct answer... It is not possible to make WEP secure. I recommend you upgrade to a device that can support a secure protocol. – AviD Jul 5 '15 at 13:03
  • 3
    Indeed. Anyone that can see a WEP signal can crack it a few minutes (I know this for a fact, as I'm a White Hat Hacker). – user79559 Jul 5 '15 at 16:54
  • 7
    @danielAzuelos No serious AP manufacturer would even think about using the term "802.11i" in response to a question from a consumer. WPA2 is a standard term, and encompasses more than 802.11i (specifically, it means that a device was tested and certified to implement 802.11i's requirements in a way which is compatible with other devices). Furthermore, when discussing the various generations of security protocols, talking about WEP, 802.11i draft, and 802.11i final is not really something people do; in contrast, WEP, WPA, and WPA2 are a nicely parallel set of terms. – cpast Jul 6 '15 at 1:04
  • 3
    @danielAzuelos Wi-Fi is a commercial term, I should expect wireless access point builders to speak of 802.11a/b/g/n, which are the IEEE standard for networking over radio. – Aron Jul 6 '15 at 2:28
  • 3
    @danielAzuelos Do you really expect the asker, who just discovered that WEP is insecure and who doesn't have a router that supports WPA2, to understand what you said? This answer is worded appropriately for the asker's knowledge level. Calling it "WPA2" is sufficient for helping the asker understand what they need to do. An answer that can be understood (even if a little incompletely) is by far superior to one full of so much jargon it answers nothing. – jpmc26 Jul 7 '15 at 1:00
14

No. You cannot make WEP uncrackable, but there are some things you may be able to do to help the problem until you get a new router.

Modify the signal strength. Take off one (or more) antennas from your router (if you have a small apartment). Move your router to the center of your home. These steps may make it more difficult for a neighbor to get a decent signal strength from their location, and give up.

Use a captive portal. Adding another step of authentication to the process with a more secure password may help. However, if the attacker is savvy enough they can likely bypass this. There are some resources for this.

Get a new router. The only real solution here is to buy a new router. Not only is your internet bill high as a result of this, but the attacker can view everything you do when you are on the internet, and plant malware on your network. They have the ability to do some really nasty things. WEP only takes seconds to minutes to crack. You should just eat the cost and upgrade to a new router.

  • There is an extra option: force the use of a VPN. Only practical if you already run one and all your devices have a client for it of course. For a time I had my AP entirely open but on a separate leg and set my router to allow nothing but OpenVPN to/from a specific local address via that interface, and my laptop & androids connected to my LAN via OpenVPN just like they did when off-site. No I have a Widnows Phone device this no longer works (no OpenVPN client) so I've changed things. – David Spillett Jul 7 '15 at 15:32
  • 1
    Captive portal saying what? Dear Mr. Hacker, go away? – Konrad Gajewski Jul 8 '15 at 0:25
9

WEP has fundamental design flaws preventing it from ever being secure. This means that in order to get a secure network you either have to replace WEP with something secure (WPA2) or enforce security at a higher level in the protocol stack.

Security at a higher level in the protocol stack means you don't allow your AP to get access to the internet. Instead you allow your AP to connect to a server on your LAN and use a secure protocol between WiFi clients and that server. That secure protocol could be a VPN protocol or SSH with port forwarding (the builtin socks proxy work quite nicely).

Of those two approaches upgrading to WPA2 is clearly the simplest to implement. WPA2 is not flawless either, but you can get decent security if you use a unique SSID and a strong password.

  • Setting up security on OSI level 7 arguably will cost more than buying a WPA2 capable router. – Aron Jul 6 '15 at 2:49
  • 1
    @Aron: On the flip side, connecting to the Internet through even a 100% unbreakable wireless link would only guard information until the point where it gets handed off to the ISP. Using socket-level security could protect information all the way to the destination. – supercat Jul 6 '15 at 15:28
  • @Aron I don't even know if OSI protocols can run over WiFi. I only use IP. – kasperd Jul 6 '15 at 16:46
  • OSI Level 7 includes Http. TCP/IP is OSI Level 4. Wifi is OSI Level 1. – Aron Jul 6 '15 at 17:09
  • @Aron No, those are not OSI protocols. Besides your numbering doesn't make sense because HTTP operates directly on top of TCP, there is no layer between them. Moreover there is no layer called TCP/IP because TCP and IP are two separate layers. – kasperd Jul 6 '15 at 17:17
1

First of all, nothing is uncrackable. You can certainly make your passwords more difficult to crack, use better algorithms, but nothing would be uncrackable.
You can upgrade your router which supports WPA/WPA2.
If your router firmware supports, you can also track the MAC-ID being used by the boy, and add it to black list. But again, it is easy to change the MAC-ID of a device, so you might want to keep an eye on the MAC-IDs being used.
Even better, you can make a note of MAC-IDs of your devices and add it to your white list, so that only those MAC-IDs are allowed on your router.
Also, try checking for router's firmware updates.

  • 1
    I have read somewhere that the MAC address can be changed easily, then what good would blacklisting do? – Snake Eyes Jul 5 '15 at 12:50
  • 3
    I expected that answer "to make a white-list" but as mentioned earlier it is very easy to spoof MAC address! – Snake Eyes Jul 5 '15 at 12:53
  • 5
    If you're that much concerned, you'll have to get a new router which supports WPA/WPA2, and remember to set a long password, preferably not including dictionary words. All the 'password-rules' apply here as well. :) – pri Jul 5 '15 at 12:55
  • 2
    I expected a cheaper method. Buying a router is the last resort. – Snake Eyes Jul 5 '15 at 13:00
  • 6
    Check for router's firmware updates. – pri Jul 5 '15 at 13:01
1

If you can automate the changing of the WEP password across your network and do so with a new password every 5 minutes, your network will be fairly well protected against casual attackers. It will not be uncrackable though.

If you change your network password every 3 seconds, though, it will be uncrackable, as the fastest crackers still require several thousand packets of data collection, and then several seconds on a modern processor to extract the key from the data.

You can make your WEP network uncrackable.

Is this easier than switching to WPA? Probably not. In fact, most of the reasons to stay with WEP (such as supporting older devices) also preclude frequent password changes. If that's the reason to stay with WEP, then you should reconsider your network configuration - but that's a different question.

  • Here's some of the latest data on WEP cracking speed: techworld.com/news/security/… it also goes into a few solutions which make WEP more difficult to crack, but ultimately one should migrate from WEP rather than adding bandaids. – Adam Davis Jul 7 '15 at 19:28
  • The PTW attack only requires thousands to tens of thousands of packets, except for the occasional "hard key" that requires hundreds of thousands. – Mark Jul 7 '15 at 22:31
-1

Provided, you want to stick with the router you have, you can:

  1. Since it takes time to actually crack WEP since one has to collect enough IV packets, it makes sense to change the password on a regular basis. You can also automate the process.
  2. Go for MAC filtering. This will make things a little bit more complicated for the attacker.
  3. Go for the longest WEP key possible (64 bit is way too little).
  4. Set up PPPoE, and enable connection to the Internet through this method only. This would solve the problem, but I doubt if you have the necessary means to implement it. Then again, I might be wrong.
  5. This is a bit crazy, but one might start sending false IVs to confuse the cracking software used by the attacker. I have no idea how to do it, so this is just a thought.

Also: WPA is really only implemented over old hardware - maybe firmware update is available enabling WPA-TKIP?

  • Would it be possible to change the password every couple of seconds? Distributing the new password via TLS over the WEP wifi AP to the machines that are allowed to have it. Perhaps rotate MAC addresses and MAC whitelist as well. Administration becomes a burden, your legitimate machine require special software to connect via the AP, and the AP's throughput and latency might also be negatively affected. – Kasper van den Berg Jul 5 '15 at 19:06
  • 2
    @Kasper, isn't such automatic password change already called "WPA-TKIP"? – grawity Jul 5 '15 at 22:09
  • @grawity Yup. But its also considered insecure. WEP is so insecure its laughable, you might as well use an Enigma machine. – Aron Jul 6 '15 at 2:34
  • 1
    The question is about improving WEP. EVERYBODY knows WPA is better. @KaspervandenBerg each change would require an association, so it is not practical. – Konrad Gajewski Jul 6 '15 at 15:55
-5

Just restrict the MAC address access to the router and then hide the network SSID so that a casual attacker doesn't know it is there in the first place.

And, obviously, as soon as you can, replace your router.

  • 6
    Against an attacker with the ability to break WEP, neither MAC filtering nor SSID hiding provides any protection. – Mark Jul 6 '15 at 21:34

protected by schroeder Jul 6 '15 at 18:14

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.