Networks

Ask something
Question Locked

How to hack a wireless network

0 helpful
21 replies

by raharr

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Okay, maybe I should not ask this but I am going to anyway.

I install wireless networks and want to check to make sure that the security is good enough to slow do a hacker. I am not a hacker by any means, but I want to know how to do this to check security of the wireless networks I install. I know there are ways to do it and have downloaded alot of software that says it can be done, but I am not sure what steps to take. Can someone give me the step by step instructions so I can try it, at least on my home network.

Manys thanks.
Russ

21 replies

by thumbsup2

You may find some tools to help check the security, but you won't find help learning how to hack it. You'll have to learn that from the underground side of things. And, no, we won't tell you where to find that either.

Being conserned with security yourself, I'm sure you understand why we can't post anything like that in a public forum. You might consider hiring a security professional to check it for you. THEY have the right tools! ;)

by asredas

like it says you can find out how to do it i did, never done it though as it was just something i wanted to know how it was done not actually do it.

plus if you have'nt got 2 laptops you will never do it regardless of what software you have.

by raharr

Yah! I know it is a securty issue. But thought I would ask anyway.

Thanks

by michael kassner

It might be advantageous to explain how you secure your systems, that way a discussion about best practices could follow.

by tig2

I appreciate that you understood from your first post that you might be traveling on uncertain landscape.

I am very interested in learning from you what kinds of methods you employ to secure a wireless system. I live in a clustered environment and can see many open and unsecured networks. I am trying to put together a flyer for my neighbors that speaks to how they can secure themselves with a minimum of knowledge.

I understand the theory behind trying to hack it once it has been hardened. But I also see some major potential issues when working down that path.

So tell us what you think would work. Or what you are afraid you're missing- broad terms if you must. Let's consider this from a different angle.

Michael gives good advice. Teaming up on a challenge is generally the road to answers- and everyone learns new things for the effort.

I look forward to your reply.

by w2ktechman

I already have it written out and dont want to spend the time typing now.
I also have how to help protect from ID theft among other things that I revised for the dept. users a couple of months ago.

But mainly, I suggest people hide the SSID (not for security really) and setup WPA2 with a strong PW.
those are the 2 main keys.

WPA uses open authentication so only the data is encrypted, not the association with the AP. This means that the handshake does not (almost) give away the key like WEP in a shared key environment.

by w2ktechman

but I cannot know for certain your intentions. If you truly are a wireless installer, then you should already be well versed in wi-fi security and should have reference materials around to help you out.

Also, there are a lot of websites available to show how better to setup wifi security as well. But it will require some readin/learning.

Best bet, put in a firewall and block most things. Allow only what is needed for the tasks needed, and nothing more.
scrutinize the tasks needed if they pose any kind of security hazard/leak.

Thats about the best I can tell you. Hope it helps.

by raharr

You are correct. I have been installing wireless for several years. I take all the security measures possible. But, there is two parts to our agency. We have the agency technology department side, which doesn't know a whole lot about wireless and want to spend $30,000 plus for a consultant and the management software for the access points. And then we have the Education technology side which consists of me, myself and I. I have had several access points installed and even installed a wireless bridge that connects two buildings together that are about 1 mile apart. Everything has been working fine with no intruders.

The other day, I have the manager of the agency technology team tell me that they hacked into our wireless site. Now on my part, I could understand how they found it because I was working on the access point at this time and had not disabled the broadcast of the SSID. I have since changed it. When asked what they used to hack into it and what they access security code was, they would not tell me. So I was figuring that they just seen the access point because it was being broadcasted. Now I want to make sure. And I use to hack into the points in order to find out how long it took. Only thing is, I can not remember how it did it and what I used to do it with because I had no need to keep testing them.

Now I want to test them myself to make sure that I have taken all the steps possible to secure them.

I thought that someone here would be welling to help me out by either posting them or emailing me the type of software to use and how to use them correctly. But I understand the resk involved in sharing this information on a post. This could be usefull information for all net admins to have. I just did not want to spend days going back through all the manuals and information I have to test them.

Thanks for everyones input, but I am still working on it.

Russ

by tig2

Russ, I know a number of folks that may have some input on this.

I appreciate that you understand the risks involved with putting this kind of information out in the "wild". I would suggest this...

Build a straw man model of what you would like to "theoretically" like to accomplish and throw the model out for comment. My guess is that we will all have inputs at one level or another, none of them the whole of the answer but leading you to (hopefully) new things to think of in your current situation.

As Michael suggested earlier, given the subject matter this can be delicate.

However, I would suggest that to take your straw model to the Discussion board instead of the Question board, you might just find a degree of difference in the responses you receive.

I can see that you have been with us for 7 years. I would bet that is why you have such a good understanding of the challenge in your question. So let's turn it into a discussion of how to best go about, and what things others have encountered. It may help.

by w2ktechman

it seems that security is too light on the network. Hiding an SSID is not really security at all, it is more of a courtesy. There are many tools both HW and SW to sniff out hidden SSID's. Just broadcasting it should have done absolutely nothing to allow a cracker to break into the network.

A few suggestions to note. If you are using WEP get rid of it and put on WPA2. If you are using WPA2, then put a long encryption key in.
You can also increase security by adding a VPN and RADIUS server, but this will add cost and complexity to the wi-fi network.

by mayhem1969

Seems I recall reading a similar post a while back, where someone was saying they were a professional seeking hacks for their company's or client's use. The thread got heated, quickly and the poster quit. No one was willing to help then, and I doubt seriously you will find what your looking for here.

by Former member

Just make sure you use encryption and do not broadcast your SSID. That's the main security concern. Then, get yourself a wireless laptop or other device and try to connect to the wireless network. If it won't let you in, asks you for an SSID, then you're good to go.

It's that easy.

The next step a hacker would have to take is to actually target your network and then to sit there and try to hack the encryption key, which is near impossible.

by raharr

I have taken all your answers in. I did change the admin password. Security keys are strong and the disabled the SSID. There are many programs out there that will give me the SSID. But, getting the security is almost impossible. I have already asked them to give me the white sheets and prove that they got in. I still haven't heard anything back from them. They insist that I purchase $30,000 in equipment that will protect our network.

There is enough freeware programs and given enough time, you can just about break any wireless security. But it is the time it takes to break it. That is the mean reason for me asking the question. I wanted to check and see how long it would take for someone to get enough IV's to crack the code. I have also updated the software on the access point and decreased the transmitting range. It is most like as secure as you can get it. The time it takes also depends on the amount of activity and since they are not used much at night, it would be impossible to get enough broadcast information from the access point.

Thanks for all of your inputs into my problem. And you can see what kind of headaches I have working with a two part agency and people that really don't know much about wireless.

Russ

I like testing my own stuff first just to make sure.

by tig2

But will also share a little (Windows) pgm with you- 3x encryption using some pretty obscure dodges. What I do is define my pass phrase, encrypt it, plug in the result. Nice thing is that I can maintain the original on a piece of paper. Unless you can find the right stick with the encryption protocol, you aren't getting it. Brute force would have a pain in the tail- I use every kind of lettering on the keyboard, bit swapping, and a trick or two that I will not discuss. In short, I could tell you my pass phrase- but if you don't wash it through my protocol, you have nothing.

SSID=hidden in my world. Firewall=always on and passwords to turn on the Windows machines. My Mac does not run on root privs and I have some toys defending her- you don't drop $3000 on your baby and then let her get infected.

Use WPA2 as a default.

I definitely want to hear what you have in place and your white paper on ID theft sounds really good as well.

I think that we both think on the same paranoid lines. I guess I am in good company.

by michael kassner

You still did not tell the members what your setup is like. What encryption, firewall, etc? It would be very easy to help you if you tell us that information. You do not have to be specific, just the process.

As for SSID broadcasting you actually may run into trouble by disabling it, Windows OS's sometimes start dropping links. As mentioned there is no security from not broadcasting it either.

As for the others gaining access, that is up for discussion, when we know your setup. I run wireless security pens tests just about every week and in reality it is more difficult than most think to gain access if a few simple precautions are taken.

by raharr

I think I found what I was looking for.

FYI....

Here is more information on how we are set up. First, to let everyone know, we are juvenile correction facility and a special school district. I am using linksys access points to connect several labs to our network that contain 10 to 15 computers each. The access points are in the classrooms with the computers. They have a short range, so I really am not worried to much about hackers, but I have to prove a point that it is not as easy as the agency says it is. I have disabled the broadcast for the ssid, using WPA2 with special characters and a combination of both upper and lower case letters. Filtered MAC address to allow only the ones in the room to connect. I have made it as touch as possible, even using linksys access points.

During a meeting, I was told that the agency was able to get into the network after only a few minutes. So, now I am stuck trying to prove my case. I order for me to do that, I need to test it for myself to see if I can break into it and how long it takes.

I know that given enough time, anything can be gotten into. I just want to track how long it takes to get into it.

Thanks
Russ

by tig2

If I beat something to death, I can get in.

Have you gotten the "white hat" logs from the other agency? Have you been able to query the people that had access to your network?

I think that they need to "prove their case" against you. I would want to see what and who got where. And then I would want to review the appropriate logs.

This is nuts. Make them prove their position. THEN let's work together to strengthen your (theoretical) faults.

by the scummy one

I think TIG is right. Make them tell you or show you what they accessed.
It is likely that they used a utility to see the SSID and connect to the AP, but this is hardly getting onto the network.

WPA uses OSA (Open System Authentication). You can connect to the AP (access point)without issue. The data however is encrypted.
Using the MAC filters can be overcome by free SW, but with a small amount of users as you have, there should be little overhead, and another layer of security added. This also makes the 'cracker' waste more time trying to break in.
From what you stated, if the PW is long (over 32 characters) then they did not get in without help most likely.
Keep on the lookout for a rogue AP. Maybe someone connected a wifi router directly to the network. Or maybe someone is sharing their connection via ad-hoc mode.
Both of these would be easier than breaking in via brute force.

by michael kassner

Just my two cents. I would like to know just exactly what they accessed. I would change all of the encryption keys and then have them show you one more time. Force them to copy a file that can only be accessed via a wireless connection. That is typically how I have to prove that I gained access.

by the scummy one

We know the basics, and it sounds secure enough from the wireless side. But what about physical access to the AP(s)???

an AP has a port(s) for configuring the AP itself. This may have been breached if access to the AP was easily gotten.
So, here is my suggestion, if access to the AP is avail, lock it down. Change the username/PW for the admin account. give a long alphanumeric PW for it.
Then, lock access to the device without interfering with the antenna's. A plastic mount aroung the AP with the antenna's sticking out in a locking box should do just that. It should keep anyone from physically tampering with the AP to gain access.

just a thought...

This discussion is closed to new replies.