How real of a threat is MAC adress spoofing on WiFi connections?

acemcmac

Lifer
Mar 31, 2003
13,712
1
0
I'm configuring a wireless router that uplinks into the corperate backbone at my company, but I am having an outright hellish time trying to get WEP configured. I'm wondering if I only have Wifi transmitting when necessary (when I need it for myself or when a visitor may need to use it), if I can simply do without and just have a restricted MAC adress list.

Any thoughts?
 

skyking

Lifer
Nov 21, 2001
22,709
5,837
146
It is your job, you need to decide. Seriously, why do you need a wireless connection to go to the corporate backbone?
WEP is hackable, MAC addy spoofing is dirt simple to do, wireless is hackable. If you think you are in a low risk environment (I am in the sticks, know my 3 neighbors that could possibly recieve), go for it. If you are in an urban setting with potentially 100's of strangers recieving your wireless, I would not.
I'd string a cable to that computer or move it.
 

acemcmac

Lifer
Mar 31, 2003
13,712
1
0
It's an urban setting all right, but in a small borough... there's a LAN gaming center just a few hundred feet away that connects to its T1 through a cross-town repeated 802.11b link with no wep that I can tell... I wish I could just figure out what the heck is wrong with my WEP here...

Either way, I'm not stringing up my PDA- Im using an e740 for my part in all of this. thanks for the input though...
 

acemcmac

Lifer
Mar 31, 2003
13,712
1
0
hehe, yeah :)

This is driving me nuts though, whenever I enable any kind of wep encryption and configure my PDA the same, my PDA can't ket a signal. It would seem that it just becomes too high latency with the range from the base station since IE will churn instead of 404 and AIM/IMAP/MSN will immediatley time out... I need to get a laptop in here to test it with a more powerful card I guess :confused:
 

mboy

Diamond Member
Jul 29, 2001
3,309
0
0
I am impementing wireless at work in the near future (on the cheap). AIN"T NO WAY I am even gonna deal with WEP.
I am gonna diable SSID broadcast, Use MAC filtering and only alow my router to pas IPsec traffic to a box running some type of 'NIX firewall (Ipcop,smoothwall or the like). Only 3DES or 256AES tunnels on my work wifi.
@ home (do not believe any of my neighbors are capable of cracking me, I live in the 'Burbs) I use Mac filter, no SSID broadcast AND 128bit WEP (until my buddy sends me my Cisco 1900 so I can create some Vlan's.

Bottom line is for Enterprise, you need real VPN (or switch level security)not that WEP crap.
 

acemcmac

Lifer
Mar 31, 2003
13,712
1
0
Exelent idea... I think I might go with that, disable broadcast and use a creative name with mac filtering... viola no more sercurity problem...

Anyone see a problem with this?

Edit: using a funky channel too
 

MoFunk

Diamond Member
Dec 6, 2000
4,058
0
0
Originally posted by: mboy

@ home (do not believe any of my neighbors are capable of cracking me, I live in the 'Burbs)

Do not worry about the neighbors, it's the war drivers and war walkers that I would be concerned with. :)

 

gunrunnerjohn

Golden Member
Nov 2, 2002
1,360
0
0
Originally posted by: acemcmac
Exelent idea... I think I might go with that, disable broadcast and use a creative name with mac filtering... viola no more sercurity problem... Anyone see a problem with this? Edit: using a funky channel too

Go with what? If you're thinking that disabling SSID broadcast, MAC filtering, and a different channel will protect you, you're incorrect. :) All one has to do is monitor some traffic when you're connected, and all of those things are revealed in clear text. :)
 

RhythmAddict

Member
Sep 15, 2003
114
0
0
Originally posted by: mboy
I am impementing wireless at work in the near future (on the cheap). AIN"T NO WAY I am even gonna deal with WEP.
I am gonna diable SSID broadcast, Use MAC filtering and only alow my router to pas IPsec traffic to a box running some type of 'NIX firewall (Ipcop,smoothwall or the like). Only 3DES or 256AES tunnels on my work wifi.
@ home (do not believe any of my neighbors are capable of cracking me, I live in the 'Burbs) I use Mac filter, no SSID broadcast AND 128bit WEP (until my buddy sends me my Cisco 1900 so I can create some Vlan's.

Bottom line is for Enterprise, you need real VPN (or switch level security)not that WEP crap.

Agreed. For now, anyway, VPN over wireless is the way to go. WEP is doable, but not difficult enough to get around. At least utilizing VPN, you're using a method of security that (in comparison to WEP/WPA) is tried and true.

I used to work at a...lets just say somewhere HIPPA would be very interested in. They had the audacity to put up a fully un protected (no mac filtering, no wep, no radius - NOTHING) network. Thi soon came down when a local paper postedan article about a patient inadvertantly hopping on there wireless network with their personal laptop. Somehow, the security team decided to then install a .b network (first one was .a) with 64 bit encryption. Oh yeah, sounds

Also, this is a great question/topic. I oftened wondered about the degree of diifficulty pertaining to spoofing MACs on a Wifi Network - Cheers :beer:much more secure... :confused:
 

mboy

Diamond Member
Jul 29, 2001
3,309
0
0
Originally posted by: MoFunk
Originally posted by: mboy

@ home (do not believe any of my neighbors are capable of cracking me, I live in the 'Burbs)

Do not worry about the neighbors, it's the war drivers and war walkers that I would be concerned with. :)
Agreed. I am the last house in a Cul-de-sac, so not many ward drivers I don't think.

 

acemcmac

Lifer
Mar 31, 2003
13,712
1
0
Originally posted by: gunrunnerjohn
Originally posted by: acemcmac
Exelent idea... I think I might go with that, disable broadcast and use a creative name with mac filtering... viola no more sercurity problem... Anyone see a problem with this? Edit: using a funky channel too

Go with what? If you're thinking that disabling SSID broadcast, MAC filtering, and a different channel will protect you, you're incorrect. :) All one has to do is monitor some traffic when you're connected, and all of those things are revealed in clear text. :)

Monitor it with what? netstumbler and other such apps will be mute to a network that doesent broadcast... The wireless network is its own network anyway that wouldn't echo any of the backbone's traffic. The security of the actual data on the wireless is irrelevant... I just don't want someone stumbling into the point and trying to get at the backbone... What would you suggest?
 

gunrunnerjohn

Golden Member
Nov 2, 2002
1,360
0
0
Originally posted by: acemcmac
Originally posted by: gunrunnerjohn
Originally posted by: acemcmac Exelent idea... I think I might go with that, disable broadcast and use a creative name with mac filtering... viola no more sercurity problem... Anyone see a problem with this? Edit: using a funky channel too
Go with what? If you're thinking that disabling SSID broadcast, MAC filtering, and a different channel will protect you, you're incorrect. :) All one has to do is monitor some traffic when you're connected, and all of those things are revealed in clear text. :)
Monitor it with what? netstumbler and other such apps will be mute to a network that doesent broadcast... The wireless network is its own network anyway that wouldn't echo any of the backbone's traffic. The security of the actual data on the wireless is irrelevant... I just don't want someone stumbling into the point and trying to get at the backbone... What would you suggest?
When you're connected, you ARE broadcasting for all to hear. How do you think the data on the network connection gets to your wireless machines? Once they know the AP exists, they can connect to it. Surely you don't think it's that simple to secure a wireless network!
rolleye.gif
 

mboy

Diamond Member
Jul 29, 2001
3,309
0
0
Originally posted by: acemcmac
Originally posted by: gunrunnerjohn
Originally posted by: acemcmac
Exelent idea... I think I might go with that, disable broadcast and use a creative name with mac filtering... viola no more sercurity problem... Anyone see a problem with this? Edit: using a funky channel too

Go with what? If you're thinking that disabling SSID broadcast, MAC filtering, and a different channel will protect you, you're incorrect. :) All one has to do is monitor some traffic when you're connected, and all of those things are revealed in clear text. :)

Monitor it with what? netstumbler and other such apps will be mute to a network that doesent broadcast... The wireless network is its own network anyway that wouldn't echo any of the backbone's traffic. The security of the actual data on the wireless is irrelevant... I just don't want someone stumbling into the point and trying to get at the backbone... What would you suggest?


DEF. NOT TRUE!
So how is it on it's own network? Do you have it on a VLAN, firewalled off in some way?
Oh, netstumbler can pick up AP's that don't broadcast their SSID btw.
 

skyking

Lifer
Nov 21, 2001
22,709
5,837
146
netstumbler and other such apps will be mute to a network that doesent broadcast
SSID is a convenience. Not broadcasting SSID is a no-security measure, unless you plan on running a wide open wireless lan with no wep.
Then it helps to keep your neighbors out of it.
 

JackBurton

Lifer
Jul 18, 2000
15,993
14
81
Originally posted by: RhythmAddict
Originally posted by: mboy
I am impementing wireless at work in the near future (on the cheap). AIN"T NO WAY I am even gonna deal with WEP.
I am gonna diable SSID broadcast, Use MAC filtering and only alow my router to pas IPsec traffic to a box running some type of 'NIX firewall (Ipcop,smoothwall or the like). Only 3DES or 256AES tunnels on my work wifi.
@ home (do not believe any of my neighbors are capable of cracking me, I live in the 'Burbs) I use Mac filter, no SSID broadcast AND 128bit WEP (until my buddy sends me my Cisco 1900 so I can create some Vlan's.

Bottom line is for Enterprise, you need real VPN (or switch level security)not that WEP crap.

Agreed. For now, anyway, VPN over wireless is the way to go. WEP is doable, but not difficult enough to get around. At least utilizing VPN, you're using a method of security that (in comparison to WEP/WPA) is tried and true.

I used to work at a...lets just say somewhere HIPPA would be very interested in. They had the audacity to put up a fully un protected (no mac filtering, no wep, no radius - NOTHING) network. Thi soon came down when a local paper postedan article about a patient inadvertantly hopping on there wireless network with their personal laptop. Somehow, the security team decided to then install a .b network (first one was .a) with 64 bit encryption. Oh yeah, sounds

Also, this is a great question/topic. I oftened wondered about the degree of diifficulty pertaining to spoofing MACs on a Wifi Network - Cheers :beer:much more secure... :confused:
More than likely you'll have problems with VPN and wireless when jumping from one subnet to another. VPN doesn't like that. I'd do PEAP and RSA with a new security key being generated every 10mins. ;)
 

acemcmac

Lifer
Mar 31, 2003
13,712
1
0
Originally posted by: mboy
Originally posted by: acemcmac
Originally posted by: gunrunnerjohn
Originally posted by: acemcmac
Exelent idea... I think I might go with that, disable broadcast and use a creative name with mac filtering... viola no more sercurity problem... Anyone see a problem with this? Edit: using a funky channel too

Go with what? If you're thinking that disabling SSID broadcast, MAC filtering, and a different channel will protect you, you're incorrect. :) All one has to do is monitor some traffic when you're connected, and all of those things are revealed in clear text. :)

Monitor it with what? netstumbler and other such apps will be mute to a network that doesent broadcast... The wireless network is its own network anyway that wouldn't echo any of the backbone's traffic. The security of the actual data on the wireless is irrelevant... I just don't want someone stumbling into the point and trying to get at the backbone... What would you suggest?


DEF. NOT TRUE!
So how is it on it's own network? Do you have it on a VLAN, firewalled off in some way?
Oh, netstumbler can pick up AP's that don't broadcast their SSID btw.

Copy That. The wireless network routes UP into the backbone. No traffic upstream of the connection can get into the wireless system, all ports in the firewall are closed. When no device is connected, there are no packets, and it would be my understanding that the network would be invisible to anyone who isn't "TEH LEET HAXXOR" about getting . Maybe I bought the wrong tools for the job, but this has to be simple. All of the wireless devices we will be using with this network will be transient except for my pda... VPN is not feasable, anything that a novice can't setup inside of 5 mintues after an admin registers their mac adress is unacceptable, and for the life of me I can't seem to get a connection to sustain itself over a distance when I use WEP encryption.

Right now it's running with MAC adress registration and ssid broadcast off until I can think of something better that doesen't alienate my highly-impressionable user base.

Oh- and one other thing... when I tested netstumbler... I came back negative.
 

mboy

Diamond Member
Jul 29, 2001
3,309
0
0
Originally posted by: gunrunnerjohn
If you're happy with your security with the measures you've taken, who are we to rain on your parade. :D:D:D


Yes, as long as you think you are secure by having your backbone (I would imagine your LAN) not able to access your wireless, then you are secure
rolleye.gif


If you didn't like anyone's answers, then why did u ask?