Printable View
i run a belkin wireless router, my pc is hardwired and the one upstairs is connected with a wireless usb access thingy, ran netstumbler upstairs and had an intruder, i killed my home network and grabbing thier mac addy i blocked it in the router and enabled only my 2 mac addys thru the enable mac filtering function, yet the intruder was still present, i had to go to work but want it locked down when i get home, i need help
Intruder? Netstumbler won't detect intruders, as it's ONLY function is finding other wireless access points just like yours. This means that most likely your neighbor or nearbye setup their own home wireless network and netstumbler detected it's presence.
To quote the net stumbler website:
This means it looks for other wireless routers, wireless servers, and general access points that are offering wireless network access. So get what I mean? It doesn't detect people or clients connecting to wireless, it detects the wireless "servers" so to speak.Quote:
etStumbler is a tool for Windows that allows you to detect Wireless Local Area Networks (WLANs) using 802.11b, 802.11a and 802.11g.
http://www.netstumbler.com/faqs/general/
umm their mac addy was in my system, i think, the profiles name was mike and had the same ssid(?) i did, so can you tell me how to be sure?
I Agree with Guardian Alpha. If you are still paranoid, just setup an encryption key. That in conjunction with MAC Filtering will keep you safe from "the girl next door". Now, the question is what will keep the girl next door safe from you now that you're aware that you're in range of her 2.4Ghz vibes........
guardian is correct: you're probably seeing another AP with the same SSID (yours probably still has the default) - the MAC you're talking about is the MAC of that AP, not the MAC of "an intruder".
As I said, net stumbler only shows you other wireless "servers", not people who are connecting to them. If you have a default SSID (like 'linksys") then chances are there will be thousands of other people around the world with that same default SSID, because that's how it came out of the box.Quote:
i think, the profiles name was mike and had the same ssid(?) i did, so can you tell me how to be sure?
Is it an SSID you've made by hand? Even still, it isn't a client connecting to you, just a wireless point for others to connect to.
edit: fraggin has made an excellent point. Even though you don't have an intruder, it's always safer to turn on WAP or WEP encryption for your router, that way no one can log onto it without you specifically having them to put in the keyword.
This is the instructions for a Belkin 54g wireless router using WEP encryption, and it should be very close to how other versions of their routers preform:
http://www.belkin.com/support/kb/kb.asp?a=2806
If it's too different from your current wireless router model, look here for further information:
http://www.belkin.com/support/
makes sense, thanks for the clarity, i panicked for a sec and had to run to work
For wireless, I'd recommend the following:
- Change the default SSID to something only those in your household/apartment know.
Change the default channel to something else.
Password protect remote administration if enabled otherwise disable it.
Definitely turn off broadcasting.
Definitely change the default password on the router.
To expand on that a tad - Should you choose WPA-PSK as your encryption method, make sure you use a good passphrase (a nice mix of upper case/lower case, punctuation and symbols that's at least 20 characters long). That should do quite well). Also remember, if the "girl next door" just happens to be a tech savvy cracker, MAC filtering will only offer minimal help. For the common person, MAC filtering is a decent deterrent but don't rely on it.Quote:
If you are still paranoid, just setup an encryption key. That in conjunction with MAC Filtering will keep you safe from "the girl next door".
I checked this link, and I'm assuming you meant WPA encryption, not WEP?Quote:
This is the instructions for a Belkin 54g wireless router using WEP encryption, and it should be very close to how other versions of their routers preform:
If he/she did indeed create a unique SSID (not default), is it possible this is a case of the "evil twin"? Pardon my ignorance on the matter as I'm still learning the whole "evil twin" concept.Quote:
Is it an SSID you've made by hand? Even still, it isn't a client connecting to you, just a wireless point for others to connect to.
Evil twin is basically a bad guy’s honeypot AP with a stronger signal within your wireless area that mimic your legitimate AP. This may attract you or your users to log into the evil AP. With a convincing login prompt, you or your user could give away sensitive data like usernames and passwords.
That's why personally I don't recommend disabling SSID broadcast. Legitimate wireless clients will find a SSID-broadcasting APs easier and unknowingly get trapped in a honeypot. Also, disabling SSID broadcast won't prevent a sniffer getting the SSID, since the SSID is sent in the clear in the probe message when a client associates to an AP.
MAC filtering? Some pros and cons. MAC addresses are also transmitted in the clear text. In a dynamic environment, I won't try to configure APs for each and every trusted client.
If you really want to that route (MAC filtering), and you mean serious business, do also the following:
- Disable DHCP for wireless clients. If you have time to register all the valid MACs, you or your users should have time to set static IPs.
- Don't use the default subnet. Use funky subnet like 10.123.234.0 with mask 255.255.255.192 (it gives you the 10.123.234.1-62 range).
- Connect your AP to the rest of your network via a switch, not a hub. Disable port mirroring, unless you know what you're doing.
- Segregate your wireless segment and wired segment with a firewall. By nature, wlan is an untrusted or not-so-trusted network.
- Setup a proxy with user authentication to get to the Net.
Of course, always use the highest level of encryption available and use strong passphrases.
And even with all those I'm still paranoid. :D
Peace always,
<jdenny>
jdenny, very nicely put.
Quote:
Also, disabling SSID broadcast won't prevent a sniffer getting the SSID, since the SSID is sent in the clear in the probe message when a client associates to an AP.
Bingo.Quote:
MAC addresses are also transmitted in the clear text. In a dynamic environment, I won't try to configure APs for each and every trusted client
I was recently surprised to find out just how much information is "in plain site" even with a wpa-psk encrypted wireless network. The Client/AP association exposes a great deal of information. So much in fact, that the only true saving grace against a determined cracker is a good passphrase (as you mentioned).
I have a question about the evil twin subject.
Let's say someone creates an evil twin of my wireless network using the same SSID. In my wireless networking configurations (on wireless clients), I automatically connect to preferred networks. Since this evil twin has the same SSID, will the wireless clients scanning for active wireless networks automatically assume this is my preferred network since it has the same SSID? In addition to that, using my network as an example, which uses WPA-PSK encryption. Won't the passphrase be incorrect when one of my wireless clients tries to connect to this evil twin?(assuming whomever setup the evil twin doesn't know my passphrase). We don't have login prompts as it's an automatic connection so any login prompts will be a good indication of a bogus AP.Quote:
Legitimate wireless clients will find a SSID-broadcasting APs easier
try running AirSnare
sorry if someone mentioned this already.
Use WEP or WAP, use stored keys and use mac filtering.... When you feel paranoid, scramble/create another unique key pair.
It depends, really. You should NEVER EVER EVER connect by SSID. In fact, IIRC, Windows does the method I'm about to talk about, automagically. Always connect by MAC address of the WAP. Sure, they can twin a SSId, but they can't twin a MAC. So, always have your connect check the MAC address it is connecting to before allowing a full handshake. Windows will keep settings of which AP's you connected to before and thus automagically reconnect them to you again. I'm pretty sure that method too checks the MAC address rather than just the SID.Quote:
I automatically connect to preferred networks. Since this evil twin has the same SSID, will the wireless clients scanning for active wireless networks automatically assume this is my preferred network since it has the same SSID?
This usually nullifies evil-twin attacks, which leaves me wondering why they even work in the first place.
I worked at a distribution center that had 15 acres of covered warehouse that was within RF range of Interstate 20. It was not uncommon to see people parked on the side of the interstate with RF antenna's on their vehicle. We were also war chalked on a few sites. It was one of my jobs to secure the 30 cisco aironet AP's they had. I got a list of MAC addresses that used the devices and did MAC filtering and ACL configuration to keep things secure. It worked out ok and it was secure. Unless you had a MAC address that was in the ACL, you were pretty much only limited to seeing a signal.
Why can't they? I can set my MAC to whatever I want...Quote:
It depends, really. You should NEVER EVER EVER connect by SSID. In fact, IIRC, Windows does the method I'm about to talk about, automagically. Always connect by MAC address of the WAP. Sure, they can twin a SSId, but they can't twin a MAC.
macchanger
I can also broadcast plenty of counterfeit APs with the same SSID and MAC...
fakeap
Has anyone checked out the products from http://www.airdefense.net/ ?
Looks like they have some worthy products... they even have a "personal" version....
I keep requesting trial versions of their various product but they have not emailed me links.
I'm not putting in real contact info except for my "spam" email address...
Maybe since I'm not putting in real contact info, they won't let me try it out?
I would put in real info... but I don't want to be hounded by the sales people after the "trial" period. Its happened time and time again. I can't find anywhere to download it either... :(
A much simpler and surer method of solving the evil twin problem is to: 1. Go into your closet, 2. Grab that baseball bat, 3. Start hunting the offender.
Heh! :D
ZT3000
Beta tester of "0"s and "1's"
Why don't you try to remove the intruder's SSID on the profile?