Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Computing > Wireless Networking > Wireless Network Security for Dummies, Please

Reply
Thread Tools

Wireless Network Security for Dummies, Please

 
 
=?Utf-8?B?Sm9obiBUQ0k=?=
Guest
Posts: n/a
 
      10-27-2004
I am completely new to this issue and basically “computer illiterate”, so
please forgive my naivety. However, I am able to follow step-by-step
instructions in user guides etc., as long as they do not use too much jargon.

Have followed multifarious threads in these User Groups, over the past few
days, trying to understand security and encryption etc of wireless networks
(before I went ahead and tried anything myself). Unfortunately, I became
totally confused and disillusioned.

All my home PCs, laptops and peripherals (network router & wireless
adaptors) are Dell and have XP with SP2. Initial setup was relatively simple
and the network has been working great for over 18 months. However, I had not
had the time (nor the courage, nor the inclination) to tackle
encryption/security. Especially as we have no near neighbours. Therefore, I
have simply relied on Norton Internet Security Pro 2002, Windows Firewall &
Spybot.

From the threads, and bearing in mind the numerous problems of hardware &
software configuration & incompatibility and the SP2 issue etc., which so
many people are experiencing, I had decided, over the weekend, that security
was not a priority (at least for me). It was more important to keep a network
that just worked.

However, it occurred to me that inputting the MAC addresses of the network
adaptors into the router (and nothing else) could possibly be much easier(?)
than & just as secure(?) as encryption (and without signal strength loss(?)
nor transmission speed loss(?)).

This I have now done. In total it took less than 10 minutes, including the
time to read the 5 MAC addresses on the adaptors/ cards, input them onto the
router and reboot (took longer to find the router’s original installation CD,
which contained the User Guide).

Now only the designated PC’s can connect to my network. However, the Windows
XP “Wireless Network Connection” box tells me that the network is “Unsecured”
and “configured for open access”. This I guess is because it is not
encrypted.

I am obviously deluding myself as I have not found absolutely any reference
to it at all in any of the threads anywhere. So what basic facts am I
missing? What are the dangers/weaknesses of this solution?

 
Reply With Quote
 
 
 
 
Jack
Guest
Posts: n/a
 
      10-27-2004
Hi

Bear in mind that though the same word Security is used to describe secure
Internet Connection and Secure Wireless, there is No real relation between
the two

Norton Internet Security is a Firewall; Wireless Security has Nothing to do
with Firewalls.

Wireless is just a replacement for a Wire and thus can be intercepted by
people in the neighborhood attaching then self to your LAN. That why there
is Wireless Security measures to avoid Local Tapping. These measure are
unique only the Wireless itself, and has to be used even if there is No
Internet Connection.

Link to: http://www.ezlan.net/Wireless_Security.html

The Firewall "Job" is to protect the Internet connection from being
invaded, and to prevent your LAN computers from transmitting out to the
Internet privileged information.

Each computer on your Network that has access to the Internet should have
its own Firewall regardless of whether you use Wire or Wireless.

Internet -Basic protection: http://www.ezlan.net/firewall.html

In addition you should have tools available if your computers get Infested.

Internet Infestation: http://www.ezlan.net/infestation.html

Jack (MVP-Networking).



"John TCI" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> I am completely new to this issue and basically "computer illiterate", so
> please forgive my naivety. However, I am able to follow step-by-step
> instructions in user guides etc., as long as they do not use too much

jargon.
>
> Have followed multifarious threads in these User Groups, over the past few
> days, trying to understand security and encryption etc of wireless

networks
> (before I went ahead and tried anything myself). Unfortunately, I became
> totally confused and disillusioned.
>
> All my home PCs, laptops and peripherals (network router & wireless
> adaptors) are Dell and have XP with SP2. Initial setup was relatively

simple
> and the network has been working great for over 18 months. However, I had

not
> had the time (nor the courage, nor the inclination) to tackle
> encryption/security. Especially as we have no near neighbours. Therefore,

I
> have simply relied on Norton Internet Security Pro 2002, Windows Firewall

&
> Spybot.
>
> From the threads, and bearing in mind the numerous problems of hardware &
> software configuration & incompatibility and the SP2 issue etc., which so
> many people are experiencing, I had decided, over the weekend, that

security
> was not a priority (at least for me). It was more important to keep a

network
> that just worked.
>
> However, it occurred to me that inputting the MAC addresses of the network
> adaptors into the router (and nothing else) could possibly be much

easier(?)
> than & just as secure(?) as encryption (and without signal strength

loss(?)
> nor transmission speed loss(?)).
>
> This I have now done. In total it took less than 10 minutes, including the
> time to read the 5 MAC addresses on the adaptors/ cards, input them onto

the
> router and reboot (took longer to find the router's original installation

CD,
> which contained the User Guide).
>
> Now only the designated PC's can connect to my network. However, the

Windows
> XP "Wireless Network Connection" box tells me that the network is

"Unsecured"
> and "configured for open access". This I guess is because it is not
> encrypted.
>
> I am obviously deluding myself as I have not found absolutely any

reference
> to it at all in any of the threads anywhere. So what basic facts am I
> missing? What are the dangers/weaknesses of this solution?
>



 
Reply With Quote
 
 
 
 
Chris Gual [MSFT]
Guest
Posts: n/a
 
      10-28-2004
Hi John,

Jack answered a bunch of your questions in his followup post, but I
wanted to make a couple of points in addition.

Entering the MAC addresses of your wireless cards into the router makes
use of a feature called 'MAC address filtering'. Ideally this should only
let the computers you own become active participants in your wireless
network. However, MAC address filtering is not a secure solution for a
wireless network. It can be defeated very easily, because:
1) the data you are sending between your computers and router is still
unencrypted and anyone close enough can listen to it (it's just radio waves)
2) it's fairly easy to spoof MAC addresses (here's a link to a product
that does this: http://www.klcconsulting.net/smac/ )

If you want to improve the security of your wireless network, you have
to configure your computers and router for encryption.

http://www.microsoft.com/hardware/br..._security.mspx

Thanks,
Chris Gual [MSFT]
--
This posting is provided "AS IS" with no warranties, and confers no rights.

"John TCI" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
>I am completely new to this issue and basically "computer illiterate", so
> please forgive my naivety. However, I am able to follow step-by-step
> instructions in user guides etc., as long as they do not use too much
> jargon.
>
> Have followed multifarious threads in these User Groups, over the past few
> days, trying to understand security and encryption etc of wireless
> networks
> (before I went ahead and tried anything myself). Unfortunately, I became
> totally confused and disillusioned.
>
> All my home PCs, laptops and peripherals (network router & wireless
> adaptors) are Dell and have XP with SP2. Initial setup was relatively
> simple
> and the network has been working great for over 18 months. However, I had
> not
> had the time (nor the courage, nor the inclination) to tackle
> encryption/security. Especially as we have no near neighbours. Therefore,
> I
> have simply relied on Norton Internet Security Pro 2002, Windows Firewall
> &
> Spybot.
>
> From the threads, and bearing in mind the numerous problems of hardware &
> software configuration & incompatibility and the SP2 issue etc., which so
> many people are experiencing, I had decided, over the weekend, that
> security
> was not a priority (at least for me). It was more important to keep a
> network
> that just worked.
>
> However, it occurred to me that inputting the MAC addresses of the network
> adaptors into the router (and nothing else) could possibly be much
> easier(?)
> than & just as secure(?) as encryption (and without signal strength
> loss(?)
> nor transmission speed loss(?)).
>
> This I have now done. In total it took less than 10 minutes, including the
> time to read the 5 MAC addresses on the adaptors/ cards, input them onto
> the
> router and reboot (took longer to find the router's original installation
> CD,
> which contained the User Guide).
>
> Now only the designated PC's can connect to my network. However, the
> Windows
> XP "Wireless Network Connection" box tells me that the network is
> "Unsecured"
> and "configured for open access". This I guess is because it is not
> encrypted.
>
> I am obviously deluding myself as I have not found absolutely any
> reference
> to it at all in any of the threads anywhere. So what basic facts am I
> missing? What are the dangers/weaknesses of this solution?
>



 
Reply With Quote
 
=?Utf-8?B?UGF2ZWwgQS4=?=
Guest
Posts: n/a
 
      10-28-2004
"Chris Gual [MSFT]" wrote:
> 2) it's fairly easy to spoof MAC addresses (here's a link to a product
> that does this: http://www.klcconsulting.net/smac/ )


I doubt that SMAC really does what it claims.
From the description on their site, it seems to detect that adapter
supports overriding MAC address, but does not expose this to user -
then it simply employs this feature.

However, this trick will fail if the netcard driver or firmware don't allow
overriding MAC address. The wireless router will see the original MAC address,
no matter what address Windows sees.
In this case only modification of the driver and/or firmware can help,
and it is possible.

Regards,
--PA

 
Reply With Quote
 
=?Utf-8?B?Sm9obiBUQ0k=?=
Guest
Posts: n/a
 
      10-28-2004
Jack & Chris,

Many thanks to you both. Think I understand.
Great articles and relatively easy to understand, even for me. Thanks again.
I was preparing a follow up to Jack when the response from Chris came in. He
must be psychic as he has already answered the first question in section 2.

May I crave your indulgences a little further? Grateful if you could
clarify/amplify a few points taken in order from your most excellent
replies:-

(1) Firewalls etc: As mentioned previously, each of my 5 computers has
Norton Internet Security. Windows Firewall is also enabled. Just read the
manual on the DSL Modem (Actiontec GT704-WG……. our ISP uses PPPoA not PPPoE).
Understood very little, because of the jargon/abbreviations, but have now
realized that it is also a gateway with the following default settings: DMZ
Hosting, UPnP & Remote Management are “off”. NAT is on. Firewall Security was
set to basic. There are 3 other security levels and I have now set it to
“Medium” (which allows all services “out” and leaves open ports 25,110, 7070,
1503, 163, 443, 983 & 885 in the “in” column.). I have deliberately not
touched the Port Forwarding section…..yet (Presume I may have to if I get
“access out” problems - have already lost “Remote Desktop” ability).

Took the recommendation from one of the articles to install NetBEUI and
unchecked TCP/IP in file & printer sharing. Also had IPX/SPX, which had to be
unchecked before the computers lost their ability to connect to one
another…now they all have NetBEUI and everything fine- except “Remote
Desktop”. I assume that they are only now connecting with NetBEUI).

Questions: (a) Do you now consider this arrangement sufficient for “normal
home” use? If not, can you specifically (or generally) recommend any other
programs/add-ons etc.?
(b) Have just had a quick look in the Remote Desktop discussions…….phew!!!!!
What is the best way to restore “Remote Desktop”? (enable Remote Management
in the modem/gateway, open specific port(s) which? or do I have to do both?)

(2) Local Tapping: Each computer on the network is connected via the router
(not directly to the DSL modem) and identified by its unique MAC address. The
router is set to “deny access to all others”. How can my neighbours or
passers by connect locally to the router and hence to my network?
This was my original concern. QUOTE: Wireless Network Connection box tells
me that the network is "Unsecured" and "configured for open access". This, I
guess, is because it is not encrypted. UNQUOTE.

Questions: (a) Would you recommend encryption on top? Can you recommend a
similar article to the others for “trouble free encryption for dummies” (The
modem/gateway has options for WEP (up to 256bits), WEP+802.1x and WPA but the
wireless adaptors/cards only for WEP 64/128? So am limited to WEP 12.
Presume it would be best to use the wizard in XP SP2 and transfer the
settings to the other computers with a flash drive and to the modem/gateway
manually (as its USB connector is the “wrong end” to accept the flash drive).


(3) Internet Infestation: I have Spybot and Norton Antivirus (within Norton
Internet Security Pro) on each computer.

Question: Considering that I would also like to avoid overkill, which of the
other programs would you recommend, out of those in the article (StartUp,
Process Explorer, Ad-Aware, a2-free) to best complement/supplement what I
already have?

Many thanks in advance, your advice is much appreciated.



"Chris Gual [MSFT]" wrote:

> Hi John,
>
> Jack answered a bunch of your questions in his followup post, but I
> wanted to make a couple of points in addition.
>
> Entering the MAC addresses of your wireless cards into the router makes
> use of a feature called 'MAC address filtering'. Ideally this should only
> let the computers you own become active participants in your wireless
> network. However, MAC address filtering is not a secure solution for a
> wireless network. It can be defeated very easily, because:
> 1) the data you are sending between your computers and router is still
> unencrypted and anyone close enough can listen to it (it's just radio waves)
> 2) it's fairly easy to spoof MAC addresses (here's a link to a product
> that does this: http://www.klcconsulting.net/smac/ )
>
> If you want to improve the security of your wireless network, you have
> to configure your computers and router for encryption.
>
> http://www.microsoft.com/hardware/br..._security.mspx
>
> Thanks,
> Chris Gual [MSFT]
> --
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
> "John TCI" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
> >I am completely new to this issue and basically "computer illiterate", so
> > please forgive my naivety. However, I am able to follow step-by-step
> > instructions in user guides etc., as long as they do not use too much
> > jargon.
> >
> > Have followed multifarious threads in these User Groups, over the past few
> > days, trying to understand security and encryption etc of wireless
> > networks
> > (before I went ahead and tried anything myself). Unfortunately, I became
> > totally confused and disillusioned.
> >
> > All my home PCs, laptops and peripherals (network router & wireless
> > adaptors) are Dell and have XP with SP2. Initial setup was relatively
> > simple
> > and the network has been working great for over 18 months. However, I had
> > not
> > had the time (nor the courage, nor the inclination) to tackle
> > encryption/security. Especially as we have no near neighbours. Therefore,
> > I
> > have simply relied on Norton Internet Security Pro 2002, Windows Firewall
> > &
> > Spybot.
> >
> > From the threads, and bearing in mind the numerous problems of hardware &
> > software configuration & incompatibility and the SP2 issue etc., which so
> > many people are experiencing, I had decided, over the weekend, that
> > security
> > was not a priority (at least for me). It was more important to keep a
> > network
> > that just worked.
> >
> > However, it occurred to me that inputting the MAC addresses of the network
> > adaptors into the router (and nothing else) could possibly be much
> > easier(?)
> > than & just as secure(?) as encryption (and without signal strength
> > loss(?)
> > nor transmission speed loss(?)).
> >
> > This I have now done. In total it took less than 10 minutes, including the
> > time to read the 5 MAC addresses on the adaptors/ cards, input them onto
> > the
> > router and reboot (took longer to find the router's original installation
> > CD,
> > which contained the User Guide).
> >
> > Now only the designated PC's can connect to my network. However, the
> > Windows
> > XP "Wireless Network Connection" box tells me that the network is
> > "Unsecured"
> > and "configured for open access". This I guess is because it is not
> > encrypted.
> >
> > I am obviously deluding myself as I have not found absolutely any
> > reference
> > to it at all in any of the threads anywhere. So what basic facts am I
> > missing? What are the dangers/weaknesses of this solution?
> >

>
>
>

 
Reply With Quote
 
mikeBNF
Guest
Posts: n/a
 
      10-28-2004
only one thing i would change.disable all windows firewalls, as they only
protects against incoming stuff & install ZA free on ALL machines.
this protects bothways so will stop said 'phone-home' virus stuff or mailer
worms.

mike

"John TCI" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Jack & Chris,
>
> Many thanks to you both. Think I understand.
> Great articles and relatively easy to understand, even for me. Thanks

again.
> I was preparing a follow up to Jack when the response from Chris came in.

He
> must be psychic as he has already answered the first question in section

2.
>
> May I crave your indulgences a little further? Grateful if you could
> clarify/amplify a few points taken in order from your most excellent
> replies:-
>
> (1) Firewalls etc: As mentioned previously, each of my 5 computers has
> Norton Internet Security. Windows Firewall is also enabled. Just read the
> manual on the DSL Modem (Actiontec GT704-WG... our ISP uses PPPoA not

PPPoE).
> Understood very little, because of the jargon/abbreviations, but have now
> realized that it is also a gateway with the following default settings:

DMZ
> Hosting, UPnP & Remote Management are "off". NAT is on. Firewall Security

was
> set to basic. There are 3 other security levels and I have now set it to
> "Medium" (which allows all services "out" and leaves open ports 25,110,

7070,
> 1503, 163, 443, 983 & 885 in the "in" column.). I have deliberately not
> touched the Port Forwarding section...yet (Presume I may have to if I get
> "access out" problems - have already lost "Remote Desktop" ability).
>
> Took the recommendation from one of the articles to install NetBEUI and
> unchecked TCP/IP in file & printer sharing. Also had IPX/SPX, which had to

be
> unchecked before the computers lost their ability to connect to one
> another.now they all have NetBEUI and everything fine- except "Remote
> Desktop". I assume that they are only now connecting with NetBEUI).
>
> Questions: (a) Do you now consider this arrangement sufficient for "normal
> home" use? If not, can you specifically (or generally) recommend any other
> programs/add-ons etc.?
> (b) Have just had a quick look in the Remote Desktop

discussions...phew!!!!!
> What is the best way to restore "Remote Desktop"? (enable Remote

Management
> in the modem/gateway, open specific port(s) which? or do I have to do

both?)
>
> (2) Local Tapping: Each computer on the network is connected via the

router
> (not directly to the DSL modem) and identified by its unique MAC address.

The
> router is set to "deny access to all others". How can my neighbours or
> passers by connect locally to the router and hence to my network?
> This was my original concern. QUOTE: Wireless Network Connection box tells
> me that the network is "Unsecured" and "configured for open access".

This, I
> guess, is because it is not encrypted. UNQUOTE.
>
> Questions: (a) Would you recommend encryption on top? Can you recommend a
> similar article to the others for "trouble free encryption for dummies"

(The
> modem/gateway has options for WEP (up to 256bits), WEP+802.1x and WPA but

the
> wireless adaptors/cards only for WEP 64/128? So am limited to WEP 12.
> Presume it would be best to use the wizard in XP SP2 and transfer the
> settings to the other computers with a flash drive and to the

modem/gateway
> manually (as its USB connector is the "wrong end" to accept the flash

drive).
>
>
> (3) Internet Infestation: I have Spybot and Norton Antivirus (within

Norton
> Internet Security Pro) on each computer.
>
> Question: Considering that I would also like to avoid overkill, which of

the
> other programs would you recommend, out of those in the article (StartUp,
> Process Explorer, Ad-Aware, a2-free) to best complement/supplement what I
> already have?
>
> Many thanks in advance, your advice is much appreciated.
>
>
>
> "Chris Gual [MSFT]" wrote:
>
> > Hi John,
> >
> > Jack answered a bunch of your questions in his followup post, but I
> > wanted to make a couple of points in addition.
> >
> > Entering the MAC addresses of your wireless cards into the router

makes
> > use of a feature called 'MAC address filtering'. Ideally this should

only
> > let the computers you own become active participants in your wireless
> > network. However, MAC address filtering is not a secure solution for a
> > wireless network. It can be defeated very easily, because:
> > 1) the data you are sending between your computers and router is

still
> > unencrypted and anyone close enough can listen to it (it's just radio

waves)
> > 2) it's fairly easy to spoof MAC addresses (here's a link to a

product
> > that does this: http://www.klcconsulting.net/smac/ )
> >
> > If you want to improve the security of your wireless network, you

have
> > to configure your computers and router for encryption.
> >
> >

http://www.microsoft.com/hardware/br..._security.mspx
> >
> > Thanks,
> > Chris Gual [MSFT]
> > --
> > This posting is provided "AS IS" with no warranties, and confers no

rights.
> >
> > "John TCI" <(E-Mail Removed)> wrote in message
> > news:(E-Mail Removed)...
> > >I am completely new to this issue and basically "computer illiterate",

so
> > > please forgive my naivety. However, I am able to follow step-by-step
> > > instructions in user guides etc., as long as they do not use too much
> > > jargon.
> > >
> > > Have followed multifarious threads in these User Groups, over the past

few
> > > days, trying to understand security and encryption etc of wireless
> > > networks
> > > (before I went ahead and tried anything myself). Unfortunately, I

became
> > > totally confused and disillusioned.
> > >
> > > All my home PCs, laptops and peripherals (network router & wireless
> > > adaptors) are Dell and have XP with SP2. Initial setup was relatively
> > > simple
> > > and the network has been working great for over 18 months. However, I

had
> > > not
> > > had the time (nor the courage, nor the inclination) to tackle
> > > encryption/security. Especially as we have no near neighbours.

Therefore,
> > > I
> > > have simply relied on Norton Internet Security Pro 2002, Windows

Firewall
> > > &
> > > Spybot.
> > >
> > > From the threads, and bearing in mind the numerous problems of

hardware &
> > > software configuration & incompatibility and the SP2 issue etc., which

so
> > > many people are experiencing, I had decided, over the weekend, that
> > > security
> > > was not a priority (at least for me). It was more important to keep a
> > > network
> > > that just worked.
> > >
> > > However, it occurred to me that inputting the MAC addresses of the

network
> > > adaptors into the router (and nothing else) could possibly be much
> > > easier(?)
> > > than & just as secure(?) as encryption (and without signal strength
> > > loss(?)
> > > nor transmission speed loss(?)).
> > >
> > > This I have now done. In total it took less than 10 minutes, including

the
> > > time to read the 5 MAC addresses on the adaptors/ cards, input them

onto
> > > the
> > > router and reboot (took longer to find the router's original

installation
> > > CD,
> > > which contained the User Guide).
> > >
> > > Now only the designated PC's can connect to my network. However, the
> > > Windows
> > > XP "Wireless Network Connection" box tells me that the network is
> > > "Unsecured"
> > > and "configured for open access". This I guess is because it is not
> > > encrypted.
> > >
> > > I am obviously deluding myself as I have not found absolutely any
> > > reference
> > > to it at all in any of the threads anywhere. So what basic facts am I
> > > missing? What are the dangers/weaknesses of this solution?
> > >

> >
> >
> >



---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.784 / Virus Database: 530 - Release Date: 27/10/2004


 
Reply With Quote
 
=?Utf-8?B?Sm9obiBUQ0k=?=
Guest
Posts: n/a
 
      10-29-2004
Gentlemen,
Quick update on Encryption (section 2 below): Your replies had confirmed the
necessity to encrypt. So I ignored all the possible things that have gone
wrong within the other threads and took the plunge with WEP128. Couldn't have
been easier. All 5 computers working fine. Many thanks.

Now only have to sort out "Remote Desktop" - section (1b) and whether to add
anything else to address the "Infestation" issue - section (3).

"John TCI" wrote:

> Jack & Chris,
>
> Many thanks to you both. Think I understand.
> Great articles and relatively easy to understand, even for me. Thanks again.
> I was preparing a follow up to Jack when the response from Chris came in. He
> must be psychic as he has already answered the first question in section 2.
>
> May I crave your indulgences a little further? Grateful if you could
> clarify/amplify a few points taken in order from your most excellent
> replies:-
>
> (1) Firewalls etc: As mentioned previously, each of my 5 computers has
> Norton Internet Security. Windows Firewall is also enabled. Just read the
> manual on the DSL Modem (Actiontec GT704-WG……. our ISP uses PPPoA not PPPoE).
> Understood very little, because of the jargon/abbreviations, but have now
> realized that it is also a gateway with the following default settings: DMZ
> Hosting, UPnP & Remote Management are “off”. NAT is on. Firewall Security was
> set to basic. There are 3 other security levels and I have now set it to
> “Medium” (which allows all services “out” and leaves open ports 25,110, 7070,
> 1503, 163, 443, 983 & 885 in the “in” column.). I have deliberately not
> touched the Port Forwarding section…..yet (Presume I may have to if I get
> “access out” problems - have already lost “Remote Desktop” ability).
>
> Took the recommendation from one of the articles to install NetBEUI and
> unchecked TCP/IP in file & printer sharing. Also had IPX/SPX, which had to be
> unchecked before the computers lost their ability to connect to one
> another…now they all have NetBEUI and everything fine- except “Remote
> Desktop”. I assume that they are only now connecting with NetBEUI).
>
> Questions: (a) Do you now consider this arrangement sufficient for “normal
> home” use? If not, can you specifically (or generally) recommend any other
> programs/add-ons etc.?
> (b) Have just had a quick look in the Remote Desktop discussions…….phew!!!!!
> What is the best way to restore “Remote Desktop”? (enable Remote Management
> in the modem/gateway, open specific port(s) which? or do I have to do both?)
>
> (2) Local Tapping: Each computer on the network is connected via the router
> (not directly to the DSL modem) and identified by its unique MAC address. The
> router is set to “deny access to all others”. How can my neighbours or
> passers by connect locally to the router and hence to my network?
> This was my original concern. QUOTE: Wireless Network Connection box tells
> me that the network is "Unsecured" and "configured for open access". This, I
> guess, is because it is not encrypted. UNQUOTE.
>
> Questions: (a) Would you recommend encryption on top? Can you recommend a
> similar article to the others for “trouble free encryption for dummies” (The
> modem/gateway has options for WEP (up to 256bits), WEP+802.1x and WPA but the
> wireless adaptors/cards only for WEP 64/128? So am limited to WEP 12.
> Presume it would be best to use the wizard in XP SP2 and transfer the
> settings to the other computers with a flash drive and to the modem/gateway
> manually (as its USB connector is the “wrong end” to accept the flash drive).
>
>
> (3) Internet Infestation: I have Spybot and Norton Antivirus (within Norton
> Internet Security Pro) on each computer.
>
> Question: Considering that I would also like to avoid overkill, which of the
> other programs would you recommend, out of those in the article (StartUp,
> Process Explorer, Ad-Aware, a2-free) to best complement/supplement what I
> already have?
>
> Many thanks in advance, your advice is much appreciated.
>
>
>
> "Chris Gual [MSFT]" wrote:
>
> > Hi John,
> >
> > Jack answered a bunch of your questions in his followup post, but I
> > wanted to make a couple of points in addition.
> >
> > Entering the MAC addresses of your wireless cards into the router makes
> > use of a feature called 'MAC address filtering'. Ideally this should only
> > let the computers you own become active participants in your wireless
> > network. However, MAC address filtering is not a secure solution for a
> > wireless network. It can be defeated very easily, because:
> > 1) the data you are sending between your computers and router is still
> > unencrypted and anyone close enough can listen to it (it's just radio waves)
> > 2) it's fairly easy to spoof MAC addresses (here's a link to a product
> > that does this: http://www.klcconsulting.net/smac/ )
> >
> > If you want to improve the security of your wireless network, you have
> > to configure your computers and router for encryption.
> >
> > http://www.microsoft.com/hardware/br..._security.mspx
> >
> > Thanks,
> > Chris Gual [MSFT]
> > --
> > This posting is provided "AS IS" with no warranties, and confers no rights.
> >
> > "John TCI" <(E-Mail Removed)> wrote in message
> > news:(E-Mail Removed)...
> > >I am completely new to this issue and basically "computer illiterate", so
> > > please forgive my naivety. However, I am able to follow step-by-step
> > > instructions in user guides etc., as long as they do not use too much
> > > jargon.
> > >
> > > Have followed multifarious threads in these User Groups, over the past few
> > > days, trying to understand security and encryption etc of wireless
> > > networks
> > > (before I went ahead and tried anything myself). Unfortunately, I became
> > > totally confused and disillusioned.
> > >
> > > All my home PCs, laptops and peripherals (network router & wireless
> > > adaptors) are Dell and have XP with SP2. Initial setup was relatively
> > > simple
> > > and the network has been working great for over 18 months. However, I had
> > > not
> > > had the time (nor the courage, nor the inclination) to tackle
> > > encryption/security. Especially as we have no near neighbours. Therefore,
> > > I
> > > have simply relied on Norton Internet Security Pro 2002, Windows Firewall
> > > &
> > > Spybot.
> > >
> > > From the threads, and bearing in mind the numerous problems of hardware &
> > > software configuration & incompatibility and the SP2 issue etc., which so
> > > many people are experiencing, I had decided, over the weekend, that
> > > security
> > > was not a priority (at least for me). It was more important to keep a
> > > network
> > > that just worked.
> > >
> > > However, it occurred to me that inputting the MAC addresses of the network
> > > adaptors into the router (and nothing else) could possibly be much
> > > easier(?)
> > > than & just as secure(?) as encryption (and without signal strength
> > > loss(?)
> > > nor transmission speed loss(?)).
> > >
> > > This I have now done. In total it took less than 10 minutes, including the
> > > time to read the 5 MAC addresses on the adaptors/ cards, input them onto
> > > the
> > > router and reboot (took longer to find the router's original installation
> > > CD,
> > > which contained the User Guide).
> > >
> > > Now only the designated PC's can connect to my network. However, the
> > > Windows
> > > XP "Wireless Network Connection" box tells me that the network is
> > > "Unsecured"
> > > and "configured for open access". This I guess is because it is not
> > > encrypted.
> > >
> > > I am obviously deluding myself as I have not found absolutely any
> > > reference
> > > to it at all in any of the threads anywhere. So what basic facts am I
> > > missing? What are the dangers/weaknesses of this solution?
> > >

> >
> >
> >

 
Reply With Quote
 
=?Utf-8?B?TWFya0cgMzA=?=
Guest
Posts: n/a
 
      10-29-2004
Hi John,

I'm really struggling to get 128 bit WEP to work, using a Netgear DG834G
with latest firmware. After setting up my wireless laptop, I get a
'connection' ie max signal strength etc, but no data transfer. There seems
to be an attempt to send, but nothing coming back. When trying to access any
internet sites etc, absolutely nothing... Any ideas folks ?

"John TCI" wrote:

> Gentlemen,
> Quick update on Encryption (section 2 below): Your replies had confirmed the
> necessity to encrypt. So I ignored all the possible things that have gone
> wrong within the other threads and took the plunge with WEP128. Couldn't have
> been easier. All 5 computers working fine. Many thanks.
>
> Now only have to sort out "Remote Desktop" - section (1b) and whether to add
> anything else to address the "Infestation" issue - section (3).
>
> "John TCI" wrote:
>
> > Jack & Chris,
> >
> > Many thanks to you both. Think I understand.
> > Great articles and relatively easy to understand, even for me. Thanks again.
> > I was preparing a follow up to Jack when the response from Chris came in. He
> > must be psychic as he has already answered the first question in section 2.
> >
> > May I crave your indulgences a little further? Grateful if you could
> > clarify/amplify a few points taken in order from your most excellent
> > replies:-
> >
> > (1) Firewalls etc: As mentioned previously, each of my 5 computers has
> > Norton Internet Security. Windows Firewall is also enabled. Just read the
> > manual on the DSL Modem (Actiontec GT704-WG……. our ISP uses PPPoA not PPPoE).
> > Understood very little, because of the jargon/abbreviations, but have now
> > realized that it is also a gateway with the following default settings: DMZ
> > Hosting, UPnP & Remote Management are “off”. NAT is on. Firewall Security was
> > set to basic. There are 3 other security levels and I have now set it to
> > “Medium” (which allows all services “out” and leaves open ports 25,110, 7070,
> > 1503, 163, 443, 983 & 885 in the “in” column.). I have deliberately not
> > touched the Port Forwarding section…..yet (Presume I may have to if I get
> > “access out” problems - have already lost “Remote Desktop” ability).
> >
> > Took the recommendation from one of the articles to install NetBEUI and
> > unchecked TCP/IP in file & printer sharing. Also had IPX/SPX, which had to be
> > unchecked before the computers lost their ability to connect to one
> > another…now they all have NetBEUI and everything fine- except “Remote
> > Desktop”. I assume that they are only now connecting with NetBEUI).
> >
> > Questions: (a) Do you now consider this arrangement sufficient for “normal
> > home” use? If not, can you specifically (or generally) recommend any other
> > programs/add-ons etc.?
> > (b) Have just had a quick look in the Remote Desktop discussions…….phew!!!!!
> > What is the best way to restore “Remote Desktop”? (enable Remote Management
> > in the modem/gateway, open specific port(s) which? or do I have to do both?)
> >
> > (2) Local Tapping: Each computer on the network is connected via the router
> > (not directly to the DSL modem) and identified by its unique MAC address. The
> > router is set to “deny access to all others”. How can my neighbours or
> > passers by connect locally to the router and hence to my network?
> > This was my original concern. QUOTE: Wireless Network Connection box tells
> > me that the network is "Unsecured" and "configured for open access". This, I
> > guess, is because it is not encrypted. UNQUOTE.
> >
> > Questions: (a) Would you recommend encryption on top? Can you recommend a
> > similar article to the others for “trouble free encryption for dummies” (The
> > modem/gateway has options for WEP (up to 256bits), WEP+802.1x and WPA but the
> > wireless adaptors/cards only for WEP 64/128? So am limited to WEP 12.
> > Presume it would be best to use the wizard in XP SP2 and transfer the
> > settings to the other computers with a flash drive and to the modem/gateway
> > manually (as its USB connector is the “wrong end” to accept the flash drive).
> >
> >
> > (3) Internet Infestation: I have Spybot and Norton Antivirus (within Norton
> > Internet Security Pro) on each computer.
> >
> > Question: Considering that I would also like to avoid overkill, which of the
> > other programs would you recommend, out of those in the article (StartUp,
> > Process Explorer, Ad-Aware, a2-free) to best complement/supplement what I
> > already have?
> >
> > Many thanks in advance, your advice is much appreciated.
> >
> >
> >
> > "Chris Gual [MSFT]" wrote:
> >
> > > Hi John,
> > >
> > > Jack answered a bunch of your questions in his followup post, but I
> > > wanted to make a couple of points in addition.
> > >
> > > Entering the MAC addresses of your wireless cards into the router makes
> > > use of a feature called 'MAC address filtering'. Ideally this should only
> > > let the computers you own become active participants in your wireless
> > > network. However, MAC address filtering is not a secure solution for a
> > > wireless network. It can be defeated very easily, because:
> > > 1) the data you are sending between your computers and router is still
> > > unencrypted and anyone close enough can listen to it (it's just radio waves)
> > > 2) it's fairly easy to spoof MAC addresses (here's a link to a product
> > > that does this: http://www.klcconsulting.net/smac/ )
> > >
> > > If you want to improve the security of your wireless network, you have
> > > to configure your computers and router for encryption.
> > >
> > > http://www.microsoft.com/hardware/br..._security.mspx
> > >
> > > Thanks,
> > > Chris Gual [MSFT]
> > > --
> > > This posting is provided "AS IS" with no warranties, and confers no rights.
> > >
> > > "John TCI" <(E-Mail Removed)> wrote in message
> > > news:(E-Mail Removed)...
> > > >I am completely new to this issue and basically "computer illiterate", so
> > > > please forgive my naivety. However, I am able to follow step-by-step
> > > > instructions in user guides etc., as long as they do not use too much
> > > > jargon.
> > > >
> > > > Have followed multifarious threads in these User Groups, over the past few
> > > > days, trying to understand security and encryption etc of wireless
> > > > networks
> > > > (before I went ahead and tried anything myself). Unfortunately, I became
> > > > totally confused and disillusioned.
> > > >
> > > > All my home PCs, laptops and peripherals (network router & wireless
> > > > adaptors) are Dell and have XP with SP2. Initial setup was relatively
> > > > simple
> > > > and the network has been working great for over 18 months. However, I had
> > > > not
> > > > had the time (nor the courage, nor the inclination) to tackle
> > > > encryption/security. Especially as we have no near neighbours. Therefore,
> > > > I
> > > > have simply relied on Norton Internet Security Pro 2002, Windows Firewall
> > > > &
> > > > Spybot.
> > > >
> > > > From the threads, and bearing in mind the numerous problems of hardware &
> > > > software configuration & incompatibility and the SP2 issue etc., which so
> > > > many people are experiencing, I had decided, over the weekend, that
> > > > security
> > > > was not a priority (at least for me). It was more important to keep a
> > > > network
> > > > that just worked.
> > > >
> > > > However, it occurred to me that inputting the MAC addresses of the network
> > > > adaptors into the router (and nothing else) could possibly be much
> > > > easier(?)
> > > > than & just as secure(?) as encryption (and without signal strength
> > > > loss(?)
> > > > nor transmission speed loss(?)).
> > > >
> > > > This I have now done. In total it took less than 10 minutes, including the
> > > > time to read the 5 MAC addresses on the adaptors/ cards, input them onto
> > > > the
> > > > router and reboot (took longer to find the router's original installation
> > > > CD,
> > > > which contained the User Guide).
> > > >
> > > > Now only the designated PC's can connect to my network. However, the
> > > > Windows
> > > > XP "Wireless Network Connection" box tells me that the network is
> > > > "Unsecured"
> > > > and "configured for open access". This I guess is because it is not
> > > > encrypted.
> > > >
> > > > I am obviously deluding myself as I have not found absolutely any
> > > > reference
> > > > to it at all in any of the threads anywhere. So what basic facts am I
> > > > missing? What are the dangers/weaknesses of this solution?
> > > >
> > >
> > >
> > >

 
Reply With Quote
 
Chris Gual [MSFT]
Guest
Posts: n/a
 
      10-29-2004
Hi John,

Glad to see that you got encryption working, but I thought I would add a
couple of words to help clarify how encryption and MAC address filtering
relate to wireless security.

In answer to question #2 below concerning 'Local Tapping', it might be
useful to try to think of it as if your computer and router are
communicating through walkie-talkies (which use radio waves like wireless).
If you aren't using encryption, someone else who has a walkie talkie can
listen in on the conversation. Setting up the MAC address filtering might
keep them from joining you network, but they would still be able to
evesdrop. Furthermore, it is also theoretically possible for someone to
listen in on your computers, figure out what MAC addresses your computers
use, and pretend to use one of those MAC addresses (MAC address spoofing).

Using 128 bit WEP does a lot to help improve your networks security. I
should also point out that there *are* known security vulnerabilities with
WEP. It is also possible for someone to figure out the WEP key you are
using by listening to enough encrypted traffic to crack the key. I believe
they need to collect about 5-10 million packets. Gathering all these
packets will probably take quite a bit of time, but it is *theoretically*
possible. Chances are, WEP will probably be secure enough for your needs.
WEP encryption will make it a lot more difficult for someone malicious to
break into your network.

For anyone interested in more info about theoretical vulnerabilities in
802.11 security, Bernard Aboba has a good collection of links on this web
page: http://www.drizzle.com/~aboba/IEEE/

Thanks
Chris Gual [MSFT]
--
This posting is provided "AS IS" with no warranties, and confers no rights.


"John TCI" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Jack & Chris,
>
> Many thanks to you both. Think I understand.
> Great articles and relatively easy to understand, even for me. Thanks
> again.
> I was preparing a follow up to Jack when the response from Chris came in.
> He
> must be psychic as he has already answered the first question in section
> 2.
>
> May I crave your indulgences a little further? Grateful if you could
> clarify/amplify a few points taken in order from your most excellent
> replies:-
>
> (1) Firewalls etc: As mentioned previously, each of my 5 computers has
> Norton Internet Security. Windows Firewall is also enabled. Just read the
> manual on the DSL Modem (Actiontec GT704-WG... our ISP uses PPPoA not
> PPPoE).
> Understood very little, because of the jargon/abbreviations, but have now
> realized that it is also a gateway with the following default settings:
> DMZ
> Hosting, UPnP & Remote Management are "off". NAT is on. Firewall Security
> was
> set to basic. There are 3 other security levels and I have now set it to
> "Medium" (which allows all services "out" and leaves open ports 25,110,
> 7070,
> 1503, 163, 443, 983 & 885 in the "in" column.). I have deliberately not
> touched the Port Forwarding section...yet (Presume I may have to if I get
> "access out" problems - have already lost "Remote Desktop" ability).
>
> Took the recommendation from one of the articles to install NetBEUI and
> unchecked TCP/IP in file & printer sharing. Also had IPX/SPX, which had to
> be
> unchecked before the computers lost their ability to connect to one
> another.now they all have NetBEUI and everything fine- except "Remote
> Desktop". I assume that they are only now connecting with NetBEUI).
>
> Questions: (a) Do you now consider this arrangement sufficient for "normal
> home" use? If not, can you specifically (or generally) recommend any other
> programs/add-ons etc.?
> (b) Have just had a quick look in the Remote Desktop
> discussions...phew!!!!!
> What is the best way to restore "Remote Desktop"? (enable Remote
> Management
> in the modem/gateway, open specific port(s) which? or do I have to do
> both?)
>
> (2) Local Tapping: Each computer on the network is connected via the
> router
> (not directly to the DSL modem) and identified by its unique MAC address.
> The
> router is set to "deny access to all others". How can my neighbours or
> passers by connect locally to the router and hence to my network?
> This was my original concern. QUOTE: Wireless Network Connection box tells
> me that the network is "Unsecured" and "configured for open access".
> This, I
> guess, is because it is not encrypted. UNQUOTE.
>
> Questions: (a) Would you recommend encryption on top? Can you recommend a
> similar article to the others for "trouble free encryption for dummies"
> (The
> modem/gateway has options for WEP (up to 256bits), WEP+802.1x and WPA but
> the
> wireless adaptors/cards only for WEP 64/128? So am limited to WEP 12.
> Presume it would be best to use the wizard in XP SP2 and transfer the
> settings to the other computers with a flash drive and to the
> modem/gateway
> manually (as its USB connector is the "wrong end" to accept the flash
> drive).
>
>
> (3) Internet Infestation: I have Spybot and Norton Antivirus (within
> Norton
> Internet Security Pro) on each computer.
>
> Question: Considering that I would also like to avoid overkill, which of
> the
> other programs would you recommend, out of those in the article (StartUp,
> Process Explorer, Ad-Aware, a2-free) to best complement/supplement what I
> already have?
>
> Many thanks in advance, your advice is much appreciated.
>
>
>
> "Chris Gual [MSFT]" wrote:
>
>> Hi John,
>>
>> Jack answered a bunch of your questions in his followup post, but I
>> wanted to make a couple of points in addition.
>>
>> Entering the MAC addresses of your wireless cards into the router
>> makes
>> use of a feature called 'MAC address filtering'. Ideally this should
>> only
>> let the computers you own become active participants in your wireless
>> network. However, MAC address filtering is not a secure solution for a
>> wireless network. It can be defeated very easily, because:
>> 1) the data you are sending between your computers and router is
>> still
>> unencrypted and anyone close enough can listen to it (it's just radio
>> waves)
>> 2) it's fairly easy to spoof MAC addresses (here's a link to a
>> product
>> that does this: http://www.klcconsulting.net/smac/ )
>>
>> If you want to improve the security of your wireless network, you
>> have
>> to configure your computers and router for encryption.
>>
>>
>> http://www.microsoft.com/hardware/br..._security.mspx
>>
>> Thanks,
>> Chris Gual [MSFT]
>> --
>> This posting is provided "AS IS" with no warranties, and confers no
>> rights.
>>
>> "John TCI" <(E-Mail Removed)> wrote in message
>> news:(E-Mail Removed)...
>> >I am completely new to this issue and basically "computer illiterate",
>> >so
>> > please forgive my naivety. However, I am able to follow step-by-step
>> > instructions in user guides etc., as long as they do not use too much
>> > jargon.
>> >
>> > Have followed multifarious threads in these User Groups, over the past
>> > few
>> > days, trying to understand security and encryption etc of wireless
>> > networks
>> > (before I went ahead and tried anything myself). Unfortunately, I
>> > became
>> > totally confused and disillusioned.
>> >
>> > All my home PCs, laptops and peripherals (network router & wireless
>> > adaptors) are Dell and have XP with SP2. Initial setup was relatively
>> > simple
>> > and the network has been working great for over 18 months. However, I
>> > had
>> > not
>> > had the time (nor the courage, nor the inclination) to tackle
>> > encryption/security. Especially as we have no near neighbours.
>> > Therefore,
>> > I
>> > have simply relied on Norton Internet Security Pro 2002, Windows
>> > Firewall
>> > &
>> > Spybot.
>> >
>> > From the threads, and bearing in mind the numerous problems of hardware
>> > &
>> > software configuration & incompatibility and the SP2 issue etc., which
>> > so
>> > many people are experiencing, I had decided, over the weekend, that
>> > security
>> > was not a priority (at least for me). It was more important to keep a
>> > network
>> > that just worked.
>> >
>> > However, it occurred to me that inputting the MAC addresses of the
>> > network
>> > adaptors into the router (and nothing else) could possibly be much
>> > easier(?)
>> > than & just as secure(?) as encryption (and without signal strength
>> > loss(?)
>> > nor transmission speed loss(?)).
>> >
>> > This I have now done. In total it took less than 10 minutes, including
>> > the
>> > time to read the 5 MAC addresses on the adaptors/ cards, input them
>> > onto
>> > the
>> > router and reboot (took longer to find the router's original
>> > installation
>> > CD,
>> > which contained the User Guide).
>> >
>> > Now only the designated PC's can connect to my network. However, the
>> > Windows
>> > XP "Wireless Network Connection" box tells me that the network is
>> > "Unsecured"
>> > and "configured for open access". This I guess is because it is not
>> > encrypted.
>> >
>> > I am obviously deluding myself as I have not found absolutely any
>> > reference
>> > to it at all in any of the threads anywhere. So what basic facts am I
>> > missing? What are the dangers/weaknesses of this solution?
>> >

>>
>>
>>



 
Reply With Quote
 
Chris Gual [MSFT]
Guest
Posts: n/a
 
      10-29-2004
Hi Pavel,

I don't know if SMAC actually works. I included the link as an
illustration that MAC address spoofing is an acutal vulnerability that does
exist.

If the person doing the MAC spoofing is using an open source OS they
will probably be able to modify the netcard driver.

Thanks,
Chris Gual [MSFT]
--
This posting is provided "AS IS" with no warranties, and confers no rights.
it should also be possible to modify their driver as well.



"Pavel A." <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> "Chris Gual [MSFT]" wrote:
>> 2) it's fairly easy to spoof MAC addresses (here's a link to a
>> product
>> that does this: http://www.klcconsulting.net/smac/ )

>
> I doubt that SMAC really does what it claims.
> From the description on their site, it seems to detect that adapter
> supports overriding MAC address, but does not expose this to user -
> then it simply employs this feature.
>
> However, this trick will fail if the netcard driver or firmware don't
> allow
> overriding MAC address. The wireless router will see the original MAC
> address,
> no matter what address Windows sees.
> In this case only modification of the driver and/or firmware can help,
> and it is possible.
>
> Regards,
> --PA
>



 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Public Wireless Network together with Private Wireless Network PL Computer Security 1 11-15-2007 03:54 PM
Wireless Network Wizard and scripting updates to wireless network. Jordan Wireless Networking 1 11-03-2007 02:16 PM
Deleting a "Wireless network" created with the wireless network wi =?Utf-8?B?SmFtZXM=?= Wireless Networking 2 02-03-2006 11:18 AM
Wireless Bridge VS Wireless Access Point for DVR connection to wireless network Mark Wireless Networking 0 12-28-2005 09:21 PM
Wireless Network Help with a mixed wired and wireless network Rupert NZ Computing 1 05-09-2004 08:52 PM



Advertisments