Physical security for wireless networks

[japlytic]

http://youtu.be/kRhyvRAUG6k

This is one of the less-discussed wireless security issues, as far as I know.

[slackwarerobert]

Re: Physical security for wireless networks

Can the public get access to those cell jam paints? I seem to remember something almost like a paint for the walls, you turn it on and zap any signal from getting through. Never said if you can use it to paint outside of house, but that would do the trick. It is bad enough you have to mount small speakers to generate white noise on the windows to stop laser snooping.

[japlytic]

Re: Physical security for wireless networks

I believe if I approach the manufacturers about this problem, most (if not all) of them would put it in the "too hard" basket.

[japlytic]

Re: Physical security for wireless networks

Over two weeks ago I contacted Belkin with few hurdles; as I expected, it appears that Belkin has put this problem in the "too hard" basket.

[exevolution]

Re: Physical security for wireless networks

Physical security is the responsibility of the administrator/owner.

If you allow someone physical access to your home router, a simple reset button can be enough to get access as most home ISPs use DHCP and most routers ship with no wifi password by default.

That said this is a nice find, and I will continue to not use WPS

[japlytic]

Re: Physical security for wireless networks

If you allow someone physical access to your home router, a simple reset button can be enough to get access as most home ISPs use DHCP and most routers ship with no wifi password by default.

All you need to do is get the WPS PIN and/or push the pushbutton for this function - as per the video, I extracted the wireless passphrase with those two methods - no special tools required!

[Yatti420]

Re: Physical security for wireless networks

I disable UPNP.. WPS.. Anything that can be a vector for attack.. I've never used UPNP and it's now one of the biggest security concerns facing router/computer manufacturers..

Edit: Not only do I disable on router I usually take out windows support aswell.. Somehow upnp server streams can still receive and still work oddly...

This podcast sums it up nicely.. https://media.grc.com/sn/sn-389.mp3 ( Learned ALOT here https://www.grc.com)

[NUKLEAR-SLUG]

Re: Physical security for wireless networks

All you need to do is get the WPS PIN and/or push the pushbutton for this function - as per the video, I extracted the wireless passphrase with those two methods - no special tools required!

Both of which still require physical access to the device. If someone has gained physical access to your hardware then you've already been compromised so while interesting this isn't really that much of a big deal.

[LLLlllou]

Re: Physical security for wireless networks

Both of which still require physical access to the device. If someone has gained physical access to your hardware then you've already been compromised so while interesting this isn't really that much of a big deal.

Exactly, it's hardly a security flaw. It's like saying there's a security hole because anyone with the wireless password can get access, or anyone can get access by plugging an ethernet cable into the router..

My front door has a security flaw, anyone with the key can get in.

[Yatti420]

Re: Physical security for wireless networks

UPNP issues are far more scarier.. Zero authentication.. Lots routers (among other devices) are flawed.. D-Link fixed the DIR-655 .. I don't know about anything older however..

[japlytic]

Re: Physical security for wireless networks

Here's a story which could gain traction on this issue: http://crowdsupport.telstra.com.au/t...ght/true#M6375

[japlytic]

Re: Physical security for wireless networks

Gaining a bit more traction:
https://nakedsecurity.sophos.com/201...ur-own-crypto/

Recently, I made posts to Netgear, D-Link, Belkin and Linksys with the attached service bulletin; no response from Netgear with Belkin and Linksys looking into it, but D-Link said that they stand by their security features.

[diif]

Re: Physical security for wireless networks

This is all home kit, designed for the average consumer. It's not really an issue, if someone has physical access to your hardware it's game over anyway.
The kind of person that breaks into houses does not do it do get on my wifi but to steal my TV and shiny stuff. Any business being cheap and either using home kit or not employing a pro is asking for trouble.
The far smarter thing would be to access the router and change the DNS settings.

p.s. Linksys is owned by Belikin now.

[stj]

Re: Physical security for wireless networks

smart people dont use the router DNS.

some isp supplied Belkin-sys routers ignore the setting and use a hidden DNS server for tracking.

this was discovered a couple of months back when the server went down and people all over the u.s. and a couple of European country's couldnt get online and the ISP's couldnt work out why!!!

[Hondaman]

Re: Physical security for wireless networks

...some isp supplied Belkin-sys routers ignore the setting and use a hidden DNS server for tracking.

Can you point us to more information about this? Can this flaw be made less serious? Can it be eliminated?

[stj]

Re: Physical security for wireless networks

all anybody knows is some models - probably isp-supplied use a fixed DNS and ignore the settings in the menu's
the DNS seems to be connected to the router manufacturer and not the isp's
(BTW. Nokia fones do this too.)

as for doing anything about it,
all i can say is try to replace the firmware:

https://openwrt.org/
http://www.dd-wrt.com/
http://www.gargoyle-router.com/

and use a NON-ISP DNS server.
http://www.opennicproject.org/

[japlytic]

Re: Physical security for wireless networks

More traction on this issue: http://www.tomsguide.com/us/home-rou...ews-19245.html
A visiting tradesperson could get the PIN number or push the WPS button.

[stj]

Re: Physical security for wireless networks

a lot of router default keys are atleast partly based on the mac address.

[Uranium-235]

Re: Physical security for wireless networks

I was at a german restaurant and the company next door had an unpassworded AP. I connected, found a shared printer on a computer. got the driver, connected and printed out that they should secure their access point. I also pointed out that they had shared access to a bunch of access db's-customer list and their quickbooks file (albeit was passworded). Next week it had a password on it

[japlytic]

Re: Physical security for wireless networks

I found good search terms to find the physical security problem, being "Wi-Fi Protected Setup" and "physical security" - the issue is slowly but surely gaining traction.