Thursday Morning Only: Cheap Wireless Router

[BiPolar_Nut]

[ QUOTE ]
Yes, this router should be fine, and you can easily make it secure.

[/ QUOTE ]

I disagree unless that model is authenticating to a separate RADIUS server. Typical "securing" advice for wifi usually states disabling SSID broadcast (does NOTHING for security...SSID's are still in packets and easilly sniffed), MAC filtering (which is trivial to ARP-poison and spoof), WEP is a joke easilly crackable in 5 mins. WPA is better...but still only as good as the passphrase and easilly brute-able if you're using a pronouncable word w/ numbers. Better if mixed case, not pronouncable, and contains punctuation. Better yet if containing extended ASCII chars.

Even doing everything possible to most SOHO wifi routers, you can't protect against a DoS attack from any punk kid w/ a pringles can a mile away in line-of-sight.

I just can't justify adding the risk simply to have one less wire on the floor. Perhaps the risk can be small, but why risk 100% of your online funds (and possibly worse) even if you feel it is a 0.001% chance of being compromised? What's the upside? One less wire? Not worth it to me. YMMV and that's fine...I just think people should be aware of the risks and telling them "<blah> can be easilly secured" is grossly misleading.

No disrespect meant, Sam, but once you've had to clean up other people's messes from *not* securing networks adequately, you tend to place a higher value on not willfully opening holes...especially ones that can be exploited 24/7 from over a mile away.

[elffaw]

Use WPA, choose a good key. I don't see the problem.

[BiPolar_Nut]

[ QUOTE ]
Use WPA, choose a good key. I don't see the problem.

[/ QUOTE ]

DoS attacks are one problem...albeit more of an annoyance than a security risk per-se. I'll trust your "good key" includes extended ascii chars. Anything short of that can be bruted in ~10% of the time.

The main "problem" I see is wardrivers getting more educated and finding specific targets worthy of lengthy pen-testing. If I was randomly driving around snagging 802.11* packets and saw a lot of traffic to sites that scream "there's money here" (poker site addresses, seller helper sites for ebay, etc), I'd concentrate my next datamining project on those places salavating over the possibility of a big score...then find a way in, running a modded dictionary/sequential char generator for months if necessary if I have reason to believe I could make a 5 or 6 figure "payday".

Once you're specifically targeted...it's just a matter of time. Hopefully that never happens to you and I'm just a paranoid freak [img]/images/graemlins/smile.gif[/img]

[SamIAm]

-Sam

[hukilai]

Bipolar,

I am afraid it takes you much longer than a few months to crack a proper passphrase (WPA2 uses AES-based encrypting). I do not have precise numbers with me, but it is gigantic - and is far beyond capabilities even of a nastiest hacker.

'Weak' passphrases can be broken much faster, of course.

[ddubois]

Security Now is a great podcast, and Steve Gibson, the host, has a password generator on his site:
https://www.grc.com/passwords.htm

[BiPolar_Nut]

[ QUOTE ]
Bipolar,

I am afraid it takes you much longer than a few months to crack a proper passphrase (WPA2 uses AES-based encrypting). I do not have precise numbers with me, but it is gigantic - and is far beyond capabilities even of a nastiest hacker.

'Weak' passphrases can be broken much faster, of course.

[/ QUOTE ]

You may be right regarding WPA2 provided a solid passphrase is used. I haven't researched the specifics since historically through WEP and WPA1 cracking or bruting was fairly trivial. I still subscribe to the idea that WEP was supposed to be "the Sh*t" and it got cracked by some punk high school kid in cali....who's to say the same won't ahppen to WPA2...and in fact there are WPA1 vulnerabilities in certain circumstances). WPA2 may be the best thing since sliced bread...I just don't trust it *YET*, even if solid alphanumeric, random, nonsensical, and extended ascii chars are included.

It'd be wonderful if WPA2 is all it took to make it secure. Perhaps that's indeed all it takes. I just wouldn't bet my entire online bankroll on it...my overparanoid $0.02.