Category Show-n-Tell Thursday
Bookmark :              



I recently was informed (in an internal forum called Iris Office Notes) about a Symantec security article highlighting the latest way that insecure home routers are being exploited. The article is called Drive-By Pharming: How Clicking on a Link Can Cost You Dearly. From the article:

The attackers create a Web page that includes malicious JavaScript code. When the Web page is viewed, this code, running in the context of your Web browser, uses a technique known as ‘Cross Site Request Forgery’ and logs into your local home broadband router. Now, most such routers require a password for logging in. However, most people never change this password from the original factory default. Upon successful login, the JavaScript code changes the router’s settings. One simple, but devastating, change is to the user’s DNS server settings.

This article brought some basic tips to mind - tips that I routinely suggest to friends and family (non-geeks, of course) for setting up their wireless home networks. Since this topic brought these suggestions to mind again, and since I needed a SnTT topic for today, I thought I would write them down - and this way I can point my family to this post in the future when asked about wireless home networks

There are a variety of ways your (wireless) router can be exploited - this is just the latest. Of course, wireless routers are much less secure by their very nature. It is fertile ground for hackers, phishers, etc. - and this is not because wireless routers are particularly insecure, it is mainly because neophyte users have no idea how to take advantage of the security measures built into the router. To avoid these potential vulnerabilities there are a couple of steps you should take, at a minimum, when setting up a wireless network.

Step 1: Change the friggin' password!
Every geek - and I mean EVERY geek - who has an interest in wireless networks knows the default password to every router on the market, or can simply Google it to find it (don't believe me? Take a look here.) This means that a router that is set up out of the box without any changes is wide open - for access AND configuration - to anyone who wants to access it. Change your password - and just like any other password, make sure it is one that is not easily guessed.

Step 2: Use wireless encryption
When wireless networking was first beginning to make inroads into the consumer market there was really only one type of wireless encryption available - WEP, or Wirless Equivalent Privacy (BTW, no one knows what WEP stands for - it's just called WEP, so don't bother memorizing it) In the early days WEP was difficult to understand and a pain to set up, especially for the folks who wanted to use your network. You usually needed to know some really long hex string as the key, and it was just difficult for the average user - so most consumers avoided it. Also, to make matters worse, the WEP protocol was easily cracked by "Wardrivers".

Then things got much better - WPA (Wi-fi Protected Access) came along, which greatly improved upon WEP in a couple of areas. First, it was much more secure (read: harder to crack) than WEP; and second it only required a "passphrase" to access a WPA-secured network instead of some incomprehensible (by humans) hex key. This means that if you wanted to, you could make your passphrase something like "Wee willie winkie", which is much easier to remember than 37925A56C3411655B090AA5D. This means that WPA is easy to set up and is easy to use. The ONLY drawback to WPA is that older (read: more than a few of years old) wireless equipment may not support WPA, only WEP; the nice thing is that virtually all of this equipment can be updated with firmware patches to support WPA.

Now, these steps barely scratch the surface of the variety of methods you can use to make your network even more secure - things like MAC filtering, additional DMZ firewalls, and so on. However, if you take these basic steps to secure your environment you will have a wireless router and network that is more secure than most home networks in use today.

Hopefully this will help those of you who are considering a wireless home network but know nothing about it; and for those of you who are wiley veterans of wireless networking, please share other simple tips with the class!

Enjoy!

Rock
**It's not the voices in my head that bother me, it's the voices in your head that do.