Search the Community

Wi-Fi has evolved over the years, and so have the techniques for securing your wireless network. An Internet search could unearth information that’s outdated and no longer secure or relevant, or that’s simply a myth. We’ll separate the signal from the noise and show you the most current and effective means of securing your Wi-Fi network. Myth No. 1: Don’t broadcast your SSID Every wireless router (or wireless access point) has a network name assigned to it. The technical term is a Service Set Identifier (SSID). By default, a router will broadcast its SSID in beacons, so all users within its range can see the network on their PC or other device. An SSID that isn't broadcast will still show up as an 'Other Network' in Windows 7. Preventing your router from broadcasting this information, and thereby rendering it somewhat invisible to people you don’t want on your network, might sound like a good idea. But some devices—including PCs running Windows 7 or later—will still see every network that exists, even if it can’t identify each one by name, and unmasking a hidden SSID is a relatively trivial task. In fact, attempting to hide an SSID in this way might pique the interest of nearby Wi-Fi hackers, by suggesting to them that your network may contain sensitive data. You can prevent your router from including its SSID in its beacon, but you can’t stop it from including that information in its data packets, its association/reassociation requests, and its probe requests/responses. A wireless network analyzer like Kismet or CommView for WiFi, can snatch an SSID out of the airwaves in no time. This wireless network analyzer showed the hidden SSID of 'cottage111' after I connected a device to the network. https://kismetwireless.net/ http://www.tamos.com/products/commview/ The analyzer captured the SSID from the association packets that the device exchanged with the router. Disabling SSID broadcasting will hide your network name from the average Joe, but it’s no roadblock for anyone intent on hacking into your network, be they an experienced blackhat or a neighborhood kid just goofing around. Myth No. 2: Enable MAC address filtering A unique Media Access Control (MAC) address identifies every device on your network. A MAC address is an alphanumeric string separated by colons, like this: 00:02:D1:1A:2D:12. Networked devices use this address as identification when they send and receive data over the network. A tech myth asserts that you can safeguard your network and prevent unwanted devices from joining it by configuring your router to allow only devices that have specific MAC addresses. Setting up such configuration instructions is an easy, though tedious, process: You determine the MAC address of every device you want to allow on your network, and then you fill out a table in the router’s user interface. No device with a MAC address not on that table will be able to join your network, even if it knows your wireless network password. But you needn’t bother with that operation. A hacker using a wireless network analyzer will be able to see the MAC addresses of every computer you’ve allowed on your network, and can change his or her computer’s MAC address to match one that’s in that table you painstakingly created. The only thing you’ll have accomplished by following this procedure is to waste some time—unless you think that having a complete list of the MAC addresses of your network clients would be useful for some other purpose. A wireless network analyzer scans the airwaves and shows the MAC addresses of the wireless routers and access points on your network, as well as all the computers and other devices connected to them. MAC-address filtering might help you block the average Joe from connecting to your router from an unauthorized computer or other device, but it won’t stop a determined hacker. It will render your network more difficult for legitimate users to work with, however, because you’ll have to configure your router every time you add a new device to it or provide a guest with temporary access. Myth No. 3: Limit your router’s IP address pool Every device on your network must also be identified by a unique Internet Protocol (IP) address. A router-assigned IP address will contain a string of digits like this: 192.168.1.10. Unlike a MAC address, which the device sends to the router, your router will use its Dynamic Host Control Protocol (DHCP) server to assign and send a unique IP address to each device joining the network. According to one persistent tech myth, you can control the number of devices that can join your network by limiting the pool of IP addresses your router can draw—a range from 192.168.1.1 to 192.168.1.10, for instance. That’s baloney, for the same reason that the next claim is. Myth No. 4: Disable your router’s DHCP server The flawed logic behind this myth claims that you can secure your network by disabling your router’s DHCP server and manually assigning IP address to each device. Supposedly, any device that doesn’t have one of the IP addresses you assigned won’t be able to join your network. In this scenario, you would create a table consisting of IP addresses and the devices they’re assigned to, as you would with a MAC addresses. You’d also need to configure each device manually to use its specified IP address. Disabling your router's DHCP server and manually limiting the number of IP addresses it can assign are not effective security procedures. The weakness that negates these procedures is that if a hacker has already penetrated your network, a quick IP scan can determine the IP addresses your network is using. The hacker can then manually assign a compatible address to a device in order to gain full access to your network. As with MAC address filtering, the main effect of limiting IP addresses (or assigning them manually) is to complicate the process of connecting new devices that you approve of to your network. This scanning app reveals all of the IP addresses in use on a wireless network. Myth No. 5: Small networks are hard to penetrate This myth suggests that reducing your wireless router’s transmission power will make it harder for someone outside your home or place of business to sneak onto your network because they won’t be able to detect it. This is the dumbest security idea of them all. Anyone intent on cracking your wireless network will use a large antenna to pick up your router’s signals. Reducing the router’s transmission power will only reduce its range and effectiveness for legitimate users. No myth: Encryption is the best network security Now that we’ve dispensed with five Wi-Fi security myths, let’s discuss the best way to secure your wireless network: encryption. Encrypting—essentially scrambling—the data traveling over your network is powerful way to prevent eavesdroppers from accessing data in a meaningful form. Though they might succeed in intercepting and capturing a copy of the data transmission, they won’t be able to read the information, capture your login passwords, or hijack your accounts unless they have the encryption key. Several types of encryption have emerged over the years. Wired Equivalent Privacy (WEP) provided the best security in the early days of Wi-Fi. But today WEP encryption can be cracked in a matter of minutes. If that’s the only security your router provides, or if some of your networked devices are so old that they can work only with WEP, it’s long past time for you to recycle them and upgrade to a newer standard. Wi-Fi Protected Access (WPA) came next, but that security protocol had security problems, too, and has been superseded by WPA2. WPA2 has been around for nearly 10 years. If your equipment is old enough to be limited to WPA security, you should consider an upgrade. WPA2, with an AES-encrypted preshared key, is an effective security protocol for home networks. Both WPA and WPA2 have two different modes: Personal (aka PSK, an acronym for Pre-Shared Key) and Enterprise (aka RADIUS, an acronym for Remote Authentication Dial In User Server). WPA Personal is designed for home use and is easy to set up. You simply establish a password on your router and then enter that password on each computer and other device that you want to connect to your Wi-Fi network. As long as you use a strong password—I recommend using 13 or more mixed-case characters and symbols—you should be fine. Don’t use words found in the dictionary, proper nouns, personal names, the names of your pets, or anything like that. A strong password might look like this: h&5U2v$(q7F4*. Your router might include a push-button security feature called Wi-Fi Protected Setup (WPS). WPS enables you to join a device to your WPA2-secured wireless network by pushing a button on the router and a button on the client (if the client also supports WPS). A flaw in WPS leaves it vulnerable to brute-force attacks, however. If you’re particularly security-conscious, you might consider turning off WPS in your router. Enterprise-mode WPA2 is designed for networks run by businesses and organizations. It provides a higher level of security than WPA, but it requires a RADIUS server or a hosted RADIUS service. Now that you understand the best way to secure your network, spend a few minutes making sure that your router is configured properly.

A small Swiss app developer has invented what it claims is a way to securely and anonymously transfer files between a browser and a mobile device without having to leave any traces of the user's identity, device ID or location. Marketed by creators Bitdrop as a way of defeating surveillance by the NSA and others - "zero knowledge privacy" - users simply initiate transfers from the firm's upload portal after scanning a QR Code using a dedicated app running on their mobile device. This code creates a unique and time-limited window for files to be transferred to the user's mobile (or shared with a third party that has a download code), secured using what the company calls 256-bit "variable encryption," essentially a way to randomise conventional symmetric keys for each transfer. BitdropBitdrop: Big on security, not so much on design. The keys themselves are sucked onto the sender's own mobile device during a temporary connection. Files can't be accessed by Bitdrop itself or any other authority because the encryption key is stored only on the sender's mobile device. In the event the files are not moved from the firm's servers to the mobile by a third party receiver within 24 hours they are destroyed. The location of the encryption key is critical. They keys are never retained on the sending computer, never sit on Bitdrop's servers and are never moved to third-parties receiving the files. Only the sender has these keys. The firm heralds the concept as a way of moving encrypted data around without it being tied to any identity; Bitdrop does not require users to register or reveal their email address. Neither the sender nor receiver can be identified. What about the security of the mobile app itself? According to Bitdrop, the identity of all contacts using the service is accessible only after entering an access code. It sounds like complex 'down the rabbit hole' security but it should be simple to use with an interesting extra advantage that although the sender needs to install the app to scan the QR code, the receiver does not, making it free of the friction of many secure file transfer systems that require both ends to use identical software. This is the kind of app that not long ago would have sounded like overkill but that was before the NSA and Edward Snowden alerted the security-conscious to the reality of state surveillance. This might or not bother US or UK users who trust their Governments but what about business users using their mobiles in other parts of the world; do they trust the Russian or Chinese Governments too? Undoubtedly these already have or will soon have systems similar to Prism. Explaining its architecture, founder 'Markus Kristian Kangas had this to say when contacted by Techworld: One slight issue is that the launch app is iPhone-only although an Android app is promised, as is a version for web-to-web transfers. The company is also a total unknown so issues such as longevity, support and security must be taken on trust. The app costs $4.99 (£3.20).

Sending a Snapchat, at this point, is like sending a photo over regular text message. People you don’t want viewing your private pics are still going to see them — even the cops. For those unfamiliar, Snapchat lets users send photos called Snaps that expire after 30 seconds (once you’ve opened them), so you can share your private or embarrassing photos without leaving them out in the ether indefinitely. The company “revealed” — I put this in quotations because, to me, this is obvious — that unopened Snaps can and have been handed over to law enforcement as part of criminal investigations (as long as the cops have a warrant). This includes your photos, videos, and the company’s new feature – “Stories.” Stories can be pulled from a server even after they have been opened given that they expire after 24-hours. How can this be when Snaps are designed to disappear forever? Snapchat runs all your photos and videos through its servers before delivering them to the recipient. While waiting to be opened and viewed, Snaps sit on that server, accessible by a special tool only chief technology officer Bobby Murphy and Micah Schaffer, who runs Snapchat’s trust and safety department, have access to. There are over 350 million Snaps that run through the system daily, according to Snapchat, and a dozen requests for Snaps have been fulfilled since May 2013. That you can read below https://www.documentcloud.org/documents/717257-snapchat-law-enforcement-guide-12112-1.html It’s apparent that you can’t truly believe your Snaps will remain under lock and key. First off, the people you send your Snaps to can take screenshots of the photos, so they may not disappear at all. Beyond that there are even products made to save this content. Snaphack is one of these, as noted by NBC. That said, I doubt this kind of news will make even the smallest dent in the app’s usage. People sending pics of criminal activities may think twice, but otherwise Snapchat seems to have one thing really going for it: a strong community. A good number of my peers — mid-twenties young professionals — who use Snapchat say it legitimately keeps them in touch with friends and family. It’s a form of novel entertainment. None of them trust the service for its “privacy” merits; it’s just another social network that connects people through a funny premise: Send me a picture with your eyelids inverted and I’ll send you one of my double-chin. And hey, as long as they don’t mind those photos ending up just about anywhere — including the courtroom — then more power to them.

Millions of Americans, non-Americans have been swept up in this digital dragnet. According to a new report from the Washington Post, the National Security Agency is This new revelation, not surprisingly, comes from the top secret documents entrusted to the Post and other media outlets by former National Security Agency contractor Edward Snowden. This new unnamed program, which the Post says “has not been disclosed before, The paper added: Based on the Post’s reporting, which includes a byline from independent security researcher Ashkan Soltani, the program appears to be related to X-Keyscore, which snags nearly all short-term unencrypted traffic from various points around the globe. As Ars previously described, it would be nearly impossible for the NSA to store all that data for an extended period of time. One slide published in June 2013 says that for a single 30-day period in 2012, this amounted to “at least 41 billion total records.” According to an unnamed intelligence official, the Post noted that “because of the method employed, the agency is not legally required or technically able to restrict its intake to contact lists belonging to specified foreign intelligence targets,” adding that “when information passes through 'the overseas collection apparatus... the assumption is you’re not a US person.'" A spokesperson for the Office of the Director of National Intelligence also told the Post that the agency is focused on "terrorists, human traffickers, and drug smugglers," not the contacts of ordinary Americans.

D-secret is D-logon string allowing access to everything A group of embedded device hackers has turned up a vulnerability in D-Link consumer-level devices that provides unauthenticated access to the units' admin interfaces. The flaw means an attacker could take over all of the user-controllable functions of the popular home routers, which includes the DIR-100, DI-524, DI-524UP, DI-604S, DI-604UP, DI-604+ and TM-G5240 units. According to the post on /DEV/TTYS0, a couple of Planex routers are also affected, since they use the same firmware. A Binwalk extract of the DLink DIR-100 firmware revealed that an unauthenticated user needs only change their user agent string to xmlset_roodkcableoj28840ybtide to access the router's Web interface with no authentication. The /DEV/TTYS0 researcher found the user agent string inside a bunch of code designed to run simple string comparisons. For one of those comparisons, “if the strings match, the check_login function call is skipped and alpha_auth_check returns 1 (authentication OK)”, the author notes. Some commentards to that post claimed to have successfully tested the backdoor against devices visible to the Shodan device search engine. The /DEV/TTYS0 author, Craig, says the backdoor exists in v1.13 of the DIR-100revA products. At this point, there's no defence against the backdoor, so users are advised to disable WAN-port access to the administrative interfaces of affected products.

Crackers tap new sources to uncover "givemelibertyorgivemedeath" and other phrases. Early last year, password security researcher Kevin Young was hitting a brick wall. Over the previous few weeks, he made steady progress decoding cryptographically protected password data leaked from the then-recent hack of intelligence firm Stratfor. But with about 60 percent of the more than 860,000 password hashes cracked, his attempts to decipher the remaining 40 percent were failing. The so-called dictionary attacks he mounted using lists of more than 20 million passwords culled from previous website hacks had worked well. Augmented with programming rules that substituted letters for numbers or combined two or more words in his lists, his attacks revealed Stratfor passwords such as "pinkyandthebrain", "pithecanthropus", and "moonlightshadow". Brute-force techniques trying every possible combination of letters, numbers, and special characters had also succeeded at cracking all passwords of eight or fewer characters. So the remaining 344,000 passwords, Young concluded, must be longer words or phrases few crackers had seen before. He cracked the first 60 percent of the list using the freely available Hashcat and John the Ripper password-cracking programs, which ran the guesses through the same MD5 algorithm Stratfor and many other sites used to generate the one-way hashes. When the output of a guessed word matched one of the leaked Stratfor hashes, Young would have successfully cracked another password. (Security professionals call the technique an "offline" attack because guesses are never entered directly into a webpage.) Now, with his arsenal of dictionaries exhausted and the exponential increase in the time it would take to brute force passwords greater than eight characters, Young was at a dead end. In the passwords arms race, he was losing. Young knew he needed to compile new lists of words he never tried before. The question was where to find the words. After cracking 60 percent of passwords leaked in the hack of Stratfor, Kevin Young mined the Internet for longer passphrases. A free cracking dictionary anyone can compile Young joined forces with fellow security researcher Josh Dustin, and the cracking duo quickly settled on trying longer strings of words found online. They started small. They took a single article from USA Today, isolated select phrases, and inputted them into their password crackers. Within a few weeks, they expanded their sources to include the entire contents of Wikipedia and the first 15,000 works of Project Gutenberg, which bills itself as the largest single collection of free electronic books. Almost immediately, hashes from Stratfor and other leaks that remained uncracked for months fell. One such password was "crotalus atrox". That's the scientific name for the western diamondback rattlesnake, and it ended up in their word list courtesy of this Wikipedia article. The success was something of an epiphany for Young and Dustin. A crotalus atrox, aka western diamondback rattlesnake. Almost immediately, a flood of once-stubborn passwords revealed themselves. They included: "Am i ever gonna see your face again?" (36 characters), "in the beginning was the word" (29 characters), "from genesis to revelations" (26), "I cant remember anything" (24), "thereisnofatebutwhatwemake" (26), "givemelibertyorgivemedeath" (26), and "eastofthesunwestofthemoon" (25).