Wireless Router Pharming

[Lead Head]

Originally Posted by Panda Man

You'd think the manufacturer would but a huge yellow slip of paper on the router that says - "CHANGE THE DAMN PASSWORD - Here's how:" in the package to help protect those that aren't as in tune with the tech world.

They always do in the manual, but no one reads the manual!

[Quakindude]

This is a good place to relay this experience!

My next door neighbor has a son that's a big-shot IT manager for AT&T in Atlanta. When my neighbors got their laptops and new wireless router, I volunteered to set it up, show them how to do it and most importantly, give them step-by-step directions on how to change their router info and a good schedule for doing so. I also gave them notes on how to tell if someone has cracked their key and is leeching off them. While I was at it, I also put their one desktop on the network using a wireless PCI card I didn't need anymore.

I'm over talking to Buster a couple months down the road and his son just so happens to show up for the Christmas Holidays. Buster introduces me to his son saying, "Tom here is the guy I told you about. He helped us set up our router." This dude looks at me and says, "Name's Jeff. When I get done setting up my parents router, I'll come get you so you can see how to do it."

:evil:<--- is what rose inside of me, is what I wanted to do but I love Buster and Beth, they're great, down to earth people and I have too much respect for them.

About a week later, I see Jeff and his family packing up their truck and head out. Buster comes over to thank me for not being the same kind of jerk his son was to me, apologizes for his son's attitude and to tell me his son had told him this:

"That dude knows what he's doing. He's got my approval to work on your computers and network. Hell, he wrote a couple things down here that I knew about but never put into action on my own router."

My biggest points are:

1. Turn off SSID broadcasting
2. Change the default router password to an 6-8 character length alphanumeric password with at least two special characters...ie...!@#$%^&*()
3. Use the highest form of encryption all your hardware supports. I'll give up some speed for security every time.
4. Turn on Mac address filtering.
5. Don't use a shared key. Type in a phrase which contains numbers and letters and hit generate. Don't store it as a pass-phrase though.
6. Change your key weekly. 1, 2, 3, 4. There's four weeks in a month. Coincidence?
7. Once a quarter, change your phrase and hit generate again. It's a PITA to go around and update all your computers, but security is the key here. If you live in densely populated areas, apartments, heavily urbanized areas and so on, generate a new key weekly.
8. Do a quick security check once a week. Log into your router, check all your settings, especially MAC address filtering and make sure your computers are the only ones allowed still. If you know you've entered the right password and you can't log in, do the following immediately:
A. Hit the reset button on your router to return it to factory settings.
B. When setting up your router this time around, keep the previous advice in mind.
C. Change ALL your passwords to ALL of your financial institutions, emails, etc.

I personally make a habit of making a password list. It is hand written on paper that's kept in my safe here in the house. It is a list of passwords that I will use every 3 months for my important banking accounts, emails and forums. My consolation to security is that I will use the same password for all Financial stuff, the same for all emails, the same for all forums, each category has it's own set of passwords. My passwords look like this:

Say my son's name is Tony, my daughters name is Morgan and my wife's name is Heidi. I will make up a combo of any names and numbers that do not include their names, birth dates or SSN's. I take things that are important to me and make passwords. An example follows:

Financial:
Hard!Ware$Logic*2006

Email:
Hardware!Logic$06

Forums
H!L$06

See the way each password can help you remember the others? Once you get used to it, it's nothing to type it in. Your fingers just float through the keys and it's done.

If you look at this and say, "Screw that! What a PITA!" then don't tell me about your losses when they happen. The higher your population density for your area, the more likely for theft of your transmitted property. Demographics will prove that high population centers are usually filled with kids ages 8-28 that love to do nothing more than sit in their bedrooms late at night, using network stumbler to find your traffic and a couple of other programs to bust your box.


*whew*

That's my $500 worth!

[Bigedmond]

I run internet over power line here. Work pretty good. Not as good as direct connect to the router, but it was the best i could do without running some cat5.

[carpenator]

Quaken, that is cool. Speaking from someone who does IT, you do see a lot of people that say they know what they are doing and that can make a person jaded. I am sure you know how it is dealing with tech support. Now imagine if the people doing tech support came to your network to fix it. With my State agency our support contract is set up where I once had a tech come out to replace a case fan, I just took it and gave him the old one and said I thought I could handle it. There has been a few times where a tech was sent of to do something and I ended up doing the work and the tech asked me why they even sent them out since I could do it better.

I am not saying it was right, in his mind he might have just been treating you like a new person on the staff showing you the right thing. Just though I would give a different perspective. In all honesty it sounds like you know more about wireless setup then I do, or at least as much if I am selling myself short. Out of all the people who say they know what they are doing, how many really have those kinds of skills?

Plus thinking about it, when I get out of the car from a road trip with my kids I am usually not in a good mood to begin with, if I had in my mind that I was going to have to fix what some hack did to my folks network I bet I would have handled it much worse.

Good story, just my feedback. Keep him in the back of your mind if you need a reference. I bet he was glad to see his folks were in good hands.

[Reloadron]

Good story Quakindude. I look at the percentages every time I set up a wireless network. Seems like if I am in an apartment I will likely see 5 or 6 wireless networks. Interesting is out of every 5 or 6 I will see 1 or 2 wide open and unprotected. Right out of the box and on the air. They always seem to hit right around the 20 to 25% number. Also interesting is there seems to be no change between the affluent and non affluent areas. Meaning the wealthy are as clueless as to what is going on.

Now if we take a million networks that tells me the odds are between 200,000 and 250,000 networks are wide open. That is a hell of alot of data for the taking. Yeah, as was mentioned, the router should be in a bright orange bag with bold black print stating: "WARNING".

I am in a residential suburb of Cleveland and in my immediate area I seem to be the only wireless network. Neighbors are mostly seniors on dial up.

Ron

[Carl Martin]

Reloadron:

I'd say that's about on par with my neighborhood. I actually read (on another forum, of course!) a post by a moderator who claimed he had no need for wireless security since he had a good firewall program and good antivirus. Good luck to him! (Reminds me of another who said you only need AV if you surf porn sites or open email from strangers. My, my, my.)

[screwballl]

I would say the number of people that do not secure their wireless is closer to 50-60%
There is only one other wireless network within range of my house and they do have it secured, it is a motorola but thats all I can see of it, just the SSID. I am sure if I used the necessary tools I could easily crack it but I would rather keep mine secure using much of the same information mentioned above and let the hackers get into his not mine.

[Reloadron]

Looking at this:

Reloadron:

I'd say that's about on par with my neighborhood. I actually read (on another forum, of course!) a post by a moderator who claimed he had no need for wireless security since he had a good firewall program and good antivirus. Good luck to him! (Reminds me of another who said you only need AV if you surf porn sites or open email from strangers. My, my, my.)

And this:

I would say the number of people that do not secure their wireless is closer to 50-60%
There is only one other wireless network within range of my house and they do have it secured, it is a motorola but thats all I can see of it, just the SSID. I am sure if I used the necessary tools I could easily crack it but I would rather keep mine secure using much of the same information mentioned above and let the hackers get into his not mine.

It becomes apparent there are a good number of unprotected wireless networks out there. Also interesting is how I noticed income had little to do with my observations. Just as often as not I see doctors and lawyers as clueless as everyone else.

The antivirus thing is another story. I come upon literally countless infected machines as a result of expired or simply non functioning AV. People tend to go out and plop down bucks for a Dell, Gateway, Emachine, or the like. These generally come with a few free trials of AV software. The trial lapses and the prompts bug them so they (or a friend) simply uninstall the AV. Hell, AVG is free. These people need to learn the importance of good AV software. That or keep me in beer money. The absolute best AV is found at common_sense.com.

Ron

[screwballl]

I deal with this every day... smart, dumb, rich, poor, PC techs, PC n00bs, christian, non-christian, French, American, Australian.... the only people that really have a clue are the true Network technicians and those of us that really see the true need for securing the connection. I try to spread some of this information to people that understand, and for others I mention to "have their wireless secured by a network tech".

[Carl Martin]

Don't want to get too far off-topic here, but I think we have to realize that a PC is a very high maintenance machine and most people lack the skills to properly care for their computers or just don't take the time to do so.

I often think today's computers are at the same level of technology as a 1960's muscle car: big, powerful, fly like a bat out of hell; but every time you turned around those things needed something fixed, rebuilt, or replaced, and required constant tinkering to keep them in top shape. To top it off, it's like we're living in a bad neighborhood with ruffians trying to steal and vandalize our vehicles.