Thread: WIFI Security
View Single Post
Posts: 3,841 | Thanked: 1,079 times | Joined on Nov 2006
#6
Originally Posted by mydogsowner View Post
This article has me concerned:

http://www.jiwire.com/wi-fi-security...n-overview.htm
Such articles always make me shake my head. There's some truth to parts of it, but what they always seem to forget is this:
  1. Your home wi-fi network is exposed to maybe some dozen of people.
  2. Your ADSL/cable internet connection, on the other hand, is exposed to millions of people. If you ever get the chance, try running a sniffer at the connection point (outside any firewalls) on your ADSL modem. I've done that: Maybe 20 seconds after you fire it up the prodders start to hammer your network connection, scanning for open ports and the like. The network log at work is very interesting reading - this goes on 24/7.
The _real_ problem is connecting to a site requiring any of your private data: It doesn't _matter_ what kind of connection you use, whether that's wi-fi, ADSL, cable, at work: If it's not encrypted, someone can intercept that information. You _must_ use encryption. It doesn't help with the best WPA2 or any other wi-fi encryption, that part doesn't protect your actual network traffic, it only stops others from using your wi-fi network. It doesn't encrypt any of the actual internet traffic.

Let's say you have an adsl modem, a wi-fi router with its own firewall (most have one). There's a much much bigger chance someone will manage to break through to your home computer(s) through the ADSL modem than through the wi-fi router, simply because there are millions of potential attackers on the other side of the adsl modem but a very limited number in wi-fi range. (There is one potential big security problem with that wi-fi router though: If it allows access to its system setup page through wi-fi then the router can be hacked into and reconfigured to e.g. turn off its firewall. Ideally the router should only allow configuration to be done through one of its LAN ethernet ports.)

The big rule is simple: Whenever you transmit (including watching) private data over a network you should use encryption. For the web this means that the sites you watch should be accessible through https://, which is SSL encrypted, not http:// which isn't. As far as wi-fi is concerned you should think of it, and handle it, as the internet at large.

It mentions software and firewalls as a solution; but what's compatible/available with the n800?
Your wi-fi router should have a firewall. So should your home computer, as otherwise it's open to external attacks in case the wi-fi router's firewall falls down for some reason.

However, your N800 doesn't have any services that can actually be attacked, unless you install one. If there's no one listening then the attacker can shout all he wants, unlike how it's depicted in films and tv shows you can't just break in just because it's a computer in there.

However, there's one popular service you may come to install on your N800, and that's an ssh server. If you do, then suddenly you have something listening on port 22 which can give the attacker a login shell. And as the N800s all come with a well-known, fixed root password.. in other words, if you install either dropbear-server or openssh-server then you must take steps to prevent this (change root password, first of all).

So, you are saying that as long as I connect through http sites I'm safe from "sniffers"?
Yes. If you meant to say https sites, not http sites. The former are SSL encrypted, the latter are not. Normal web sites are just http sites, they're not encrypted and usually you won't care, if you're just reading Internet Tablet Talk, for example.

There's one popular wi-fi scam that's worth mentioning though: Be careful with wi-fi hotspots requring credit card info to get access to the network. These are HTTPS/SSL encrypted, but the scam is that someone sets up a fake pay-hotspot and you then go on to provide them with your credit card info.. this scam has been seen in airports, for example.

For the rest: As far as your N800 is concerned, you just have to
a) Set up your home wi-fi network with WPA encryption (if you want to keep others from accessing the internet through your wi-fi)
b) Firewalls in the wi-fi router and on your home computer(s)
c) Use SSL (HTTPS) when accessing sites with private data, whether that's from your N800 or from your desktop computer
d) Don't start worrying about your N800 security until you install a server like ssh.
e) That article mentioned VPNs.. yes, if you access your job network then VPN is an easy way to encrypt everything. But then again it's unlikely there's any other way of accessing that network.
__________________
N800/OS2007|N900/Maemo5
-- Metalayer-crawler delenda est.
-- Current state: Fed up with everything MeeGo.
 

The Following 7 Users Say Thank You to TA-t3 For This Useful Post: