If you've been watching all by other episodes and wireless threats you should be significantly concerned
that there could be problems with a typical 8 to 11 wireless network.
And that's what this episode is all about hardening.
To 11.
Now there's a lot to cover here so what I'm going to do is I'm going to break it down into These are
four groups that I use personally when I'm thinking about hardening my 10:52 networks.
Number one is going to be survey installation issues.
Number two is going to be maintaining an existing wireless network.
Number three which is actually a corollary to monitoring a wireless network.
And number four the one that everybody forgets.
How do you defend your wireless client.
So let's go and get started with survey and installation
if you're going to be installing or upgrading a wireless network.
The first question you have to answer is What do I have here right now.
And that's the job of what I call survey tools now survey tools can physically manifest as multi thousand
dollar specialized pieces of hardware that look like tablets to something as simple as absolutely free
open source software that you can install on any laptop and do it yourself.
There's a reason some stuff's free and some stuff's expensive though.
Be that as it may a good site survey program is going to be looking for things like for example SS IDs
the MAC addresses all the different bands it's going to be running on all the different channels.
Hopefully only two things like signal strength and it's going to be taking all this information and
it's going to be documenting it for you in a way with good charts with good graphing with good logs
that help you document everything that is 10:52 around you.
And that's really where good survey tools come into play.
In fact a really good survey tool will often have an added feature called a heat map so here's an example
of one what you're looking at here is the relative signal strength of all the different wireless access
points within this little office environment.
So the more red it is the stronger the signal.
And then it goes out to green where it becomes an extremely light signal.
The end result of all this is that if you're going to be setting up a wireless network you've got to
do some kind of site survey and you need a survey tool.
I'm not going to try to sell you on any particular one Kismet but there's a lot of great tools out there
and these are the core tools that allow you to set up a network so that you can get to the next point.
Maintaining one.
So you've got a new happy 10:42 network up and running well.
Good for you but we need to talk about what we do to maintain that wireless network and in particular
to maintain its security.
The number one rule.
The biggest one in the one nobody seems to do is good wireless documentation take advantage of those
site surveys to have all of your SS IDs Mac addresses associated to whaps physical location heat maps.
All of this organized and easy to get to so that we know exactly how our networks are laid out.
Here's a floorplan example of my total seminars office.
Now you can see here are a couple of wireless access points.
But in this case I only have one SS ID we're just not that big but we know exactly where everything
is.
We know the SS IDs and we know the access point mac addresses now.
Good documentation is great.
So before we get into a little more depth here I want to start off by killing what I call a couple of
old tech tales specially for those of you who have taken other Campania exams.
These may be a bit of a shock to you old tech tail number one turning off broadcast.
SS ID is a good thing.
It really isn't any wireless access point will say turn off broadcast as an ID.
The problem with this is that pretty much any wireless device out there even the clients that come with
Windows systems can see there's an SS ID out there they just don't see the name so it doesn't hide you
very well.
The second thing is MAC filtering to actually set up a wireless access point so that every client is
Mac filtered.
Can happen but it's usually fairly rare.
You would see a situation like in an industrial control system where you only had very specific workstations
that access that particular wireless access point.
In that situation it would work pretty well.
Other than that for example in a coffee shop you have so many different people coming in and out.
The concept of MAC filtering simply doesn't work.
However one that does work well is the idea of a.p isolation.
Every access point out there has a little checkbox that calls a p isolate.
What that means is that all of the wireless devices on that SS ID can all see the access point can all
get to the network.
But unlike a typical Eastment that work they can't see each other.
It's a powerful tool and it's done on just about every access point especially those that are out in
the public now the next thing I want to talk about is a 2.1 X a lot of people will have a WPA to P.S.
K encryption out there and that's great if you're going to do that.
Use long passwords and I mean like 20 characters and avoid using words and phrases like that make it
complicated.
It will make it pretty much impossible for guys like me to be able to crack your WPA or WPA to passwords
if you make them long.
However 8:0 2.1 X is not that hard to implement.
I'm not saying it's the easiest thing in the world you're going to have to bring in an extra server
you are going to do some kind of authentication but it makes for a robust and pretty much uncrackable
wireless network.
OK so your networks up and cooking.
The big danger you have to wireless networks isn't what you know it's things that appear that you don't
know for example a rogue access point.
So what we do on any good wireless network is we do occasional scanning monthly every two weeks it really
depends on how paranoid your security levels are and the scanning really is nothing more than just research
the network going out there listening for SS IDs you don't recognize.
Looking for whaps that are coming out on your SS ID but with a MAC address that you don't recognize
any good wireless network is going to be doing this type of periodic scanning.
In fact it becomes so important that in some situations you pretty much want to be scanned continuously
and that's the job of a wireless intrusion detection system
a wireless intrusion detection system is as the name implies an intrusion detection system that's looking
for things on the ESM bands 2.4 gigahertz and five gigahertz where 18 to 11 lives.
Now a W ID can manifest in a lot of different ways you can get a piece of freeware that you can install
on a laptop or you can spend a lot of money with big third party turnkey systems.
So the important part about new ideas is that it monitors your wireless radios it watches for rogue
access points it knows all the wireless access point MAC addresses.
So if a evil twin were to appear they would recognize it.
A good idea.
If you want it can do stuff like Well we know what protocols are on here so it can actually watch for
the protocols that are supposed to work and not supposed to work.
It can do a lot of very very powerful stuff but it can come at a price.
There's a reason why some ideas are free and some are very very expensive.
Whatever the case may be.
Let me give you one quick example.
Here's the floorplan of my total seminars network.
Now a good w ideas is usually going to start with sensors.
These are physical devices that are placed around your network and they're really nothing more than
wireless access points.
Now they're not actually transmitting.
They're simply listening for things that shouldn't be there if they hear something they'll send that
data to a W idea server.
This is a dedicated box whose only job is to take all this information and get it to a nice log file
so that people can access it.
Now a W idea is is only going to be as good as the way it lets us know.
Intrusions are taking place.
So we're getting these logs that are being built up on the W idea server but that's only so much goodness.
I mean a good idea is you can set it up to send you it and send this text message.
You can set it up to give you an e-mail.
You can even make a phone call and give you a voice text telling you exactly what's happening.
So the really really powerful tools to know how much money you want to spend.
But the important thing for the exam is that you're going to be expected to be able to look at what
we call log files and to be able to have some idea of what type of naughtiness is taking place.
So let's take a look at a couple of examples.
For the first example here's a log output from a hypothetical idea.
Now as you look at this what I want you to notice is that it's noticing that there are a number of log
in failures attempting to access a particular SS server.
Now if we were to look at that we would say that there's probably somebody is trying to hack into the
server.
An example of a very bad thing as a second example on this particular one we see a list of a number
of access points that are working away but if you take a look on one in particular you'll notice that
it says unknown B as as ID.
However it shares the same SS ID as all of the other listings on this particular log which is office.
This would be a great example of an evil twin a good wireless intrusion detection system is absolutely
amazing.
But there's another line of defense I want to talk about and that's the individual clients So let's
talk about hardening your client's
wireless clients aren't something that we actually harden per se in fact they're the things we tend
to defend against in case somebody who's another wireless client is trying to get into a network they
shouldn't.
However there are some situations where the not really the device but that crazy thing that's using
the device the human working that system needs some training to be able to watch out for some particularly
scary situations.
Now you would say to yourself I'm just a wireless user.
I count on the I.T. guys to do all this stuff.
Well that's actually not true.
There's actually some very cool things you can do if you only have the right tool and you've got the
right tool.
If you look at any wireless client all of them have a list of SS IDs that pop up.
Here's an example in Windows Ted.
Here's an example in OS 10.
I love Macs because they give you more detail than Windows does by default in fact even my mobile device
gives me a nice list of essays IDs that I can see the cool part is is that's in essence a survey tool.
It gives you a poor man's survey tool.
It's a casual tool doesn't give you as much information but it gives you enough information to be able
to watch out for scary situations.
That's one example.
No problem.
Let's say that you've been working in your office here for the last two years and you always log in
to this one as I.D. called office one day you just happened to notice when you look at your list of
business IDs that there's a new idea out there and it's called Bob or lynxes or dealing Corps something
like that.
Now you know good and well that there's never been an SS ID like that before.
At least within your office area this could be a great example of a rogue access point somebody has
bought themselves a little Linksys router and plugged it in.
Might be time to call the I.T. Department huh.
Need another example.
No problem.
So let's say you're out on the road.
Now normally you work here in the shop so you always link into an SS I.D. called Shop now.
That's great.
But suddenly you're out on the road and you're giving a sales presentation to some mechanics and suddenly
you realize that you on an SS I.D. called Shop.
Now wait a minute.
First of all what's happening here.
Well number one shop I mean if you're in the auto industry I could imagine a lot of people would coincidentally
all name their SS IDs shop but the other thing that could be happening here is it might be an evil twin
scenario.
Somebody is intentionally set up an SS I.D. called shop to get to you.
So that's something to watch out for.
One more example.
You got it.
Let's say that you've been working for years at a particular location and you've set up your wireless
network and every day you come in with your laptop and everything's great and you're on there and you're
on Google and whatever.
But then suddenly one day you suddenly see that it's asking you for your username and password again
or just for your private shared key whatever it might be in a situation like this unless somebody in
the I.T. Department told you they change the key or something.
You might be a victim of a classic man in the middle attack.
So that's something to watch out for too.
So remember just because you are on a client you're a critical and important part of I.T. wireless security.