Small Business Attack – Rogue Wireless Detection

The best way to prevent rogue wireless access points from appearing on your network is to set up the network to make it more difficult.  Though it is more work to lock down a network to only allow connections to specific MAC addresses and on specific ports, it does go a long way to prevent unauthorized devices from magically appearing on the network.

Of course, this sort of approach is not always feasible. In those situations, you have to go one step further and run periodic scans for unauthorized devices. Commonly used in wardriving, tools like NetStumbler and Kismet can also be used to find WAPs in your own building.

Using such a tool, it is important to first identify what “normal” is.  Begin with a visual scan of every network port in your location. Make sure that you’re not starting with a rogue WAP on your network. Once you have done a visual sweep, run one of the tools and get a feel for what is normally present in your environment. Then, after a day or so (sometimes more), you should have a list of the wireless networks around. Each of these should be tracked down and identified as legitimate.

Then, on a periodic basis, you can check for new wireless access points and make sure that the list isn’t changing on you. If it is, you might have a problem.

It is important, however, to stress that this is not a perfect solution. You will likely need to occasionally visually inspect your network and verify that there are no new devices floating around. You should make sure that no laptops are set up to bridge a connection to the outside world. You should do your best to lock down the network. Then, when you’ve done all you can do, scan to fill in the holes.

Good luck.

Small Business Attack – Rogue Wireless

The best attacks are often also the simplest. It’s easier to just steal someone’s wallet or purse than it is to hack into a vendor and download their credit card number. It’s easier to offer someone a chocolate bar for their password than it is to send them a phishing email and hope that it works. Similarly, it is easier to break into a network from the inside than it is from the outside.

For example, an attacker could stroll in to your office, wait for a distraction, and plug in a wireless access point and then run any desired attacks from the outside. For example, the WL-330 is the size of a pack of cards. (As is the DWL-G730AP.) It’s easy to smuggle in and easy to set up. Then, all the attacker needs to do is to have an excuse to get into your building.

Of course, those can’t be hard to come by. After all, it’s not like your organization ever orders pizza, calls in for service to a printer or has a cleaning staff, right? I’m also sure that there is no secluded place that an attacker could sit with a laptop and run exploration tests. Most buildings don’t have parking lots, nearby coffee houses or bathrooms, right?

Oh, wait.

Maybe there is a problem.