Should I be concerned with my wireless network?

[Scratch705]

icic, then woot, no unauthorized access on my wifi! wonder if it helps that i disabled SSID broadcast? so you can't even see the router when you do the windows wifi network search.

[JDay]

icic, then woot, no unauthorized access on my wifi! wonder if it helps that i disabled SSID broadcast? so you can't even see the router when you do the windows wifi network search.

Tools such as Kismet and Netstumbler will see your network when wireless clients are connected.

[OnlyKetchup]

As others have said you need to switch to WPA2. It's possible that your neighbor may have cracked your WEP key and is repeating your signal through their router, which is why you might be seeing the other network follow yours.

[NeoWeird]

Sorry guys and gals, busy 12+ hour days and church every night this week so I'm not around much.

As for encryption, I don't really care much at this point in time. The network really only supplies internet to three computers that have no personal information on them outside of emails, which let's face it, 90% of mine is MidwayUSA and Brownells spam. I plan on going to something more secure in the future when I setup a media RAID server but until that point I rather like the ability to share my connection with friends and family easily - the key is more of a deterant to some random high schooler down the street. Kind of like people that put the alarm stickers on their house windows. It does nothing but turns most non-serious threats away.

Back to the original topic though, should I be concerned about this piggybacking network? The fact that it is shadowing my channels is suspect, but if my router is not actually logging any traffic from it, should I even care? Some random kid honing his 'hacker' skills on local networks? Is there anyway to hide traffic from the host device? etc. etc. I personally can't think of a reason, but networks are not my strong point so I figured I'd ask.

[CalBear]

You can usually look at the clients connected to your router. If you never see any unidentified clients, or any unexpected spike in data usage, you're probably ok. Still, I would recommend the following steps:

1) At the very least, make sure you have root access password protected on your router.

2) Switch security to WPA-PSK2 w/ AES encryption. It is the most secure consumer level protection. Don't bother with MAC filtering. WPA keys don't have to be absurdly long to be safer than WEP. Just pick a decent key everyone in your family can remember.

Here are some reasons I can think of for making this switch:

1) Intranet protection. Most important transactions are done via HTTPS w/ encryption anyway, but you don't want to expose your computers or net transfers any more than necessary.

2) Speed. You don't want people mooching from your network. Also, many routers have hardware encryption for WPA w/ AES, which means encryption is very fast. I think WEP actually has a bigger performance hit on some routers.

3) Bandwidth caps. Again, you don't want someone leeching your connection and pushing your data usage toward the ISP's monthly bandwidth cap.

4) Illegal usage. Some people use the internet for illegal purposes. You don't want them using your internet connection to do this. After all, it's your IP address, your home address, your internet connection.

Sorry guys and gals, busy 12+ hour days and church every night this week so I'm not around much.

As for encryption, I don't really care much at this point in time. The network really only supplies internet to three computers that have no personal information on them outside of emails, which let's face it, 90% of mine is MidwayUSA and Brownells spam. I plan on going to something more secure in the future when I setup a media RAID server but until that point I rather like the ability to share my connection with friends and family easily - the key is more of a deterant to some random high schooler down the street. Kind of like people that put the alarm stickers on their house windows. It does nothing but turns most non-serious threats away.

Back to the original topic though, should I be concerned about this piggybacking network? The fact that it is shadowing my channels is suspect, but if my router is not actually logging any traffic from it, should I even care? Some random kid honing his 'hacker' skills on local networks? Is there anyway to hide traffic from the host device? etc. etc. I personally can't think of a reason, but networks are not my strong point so I figured I'd ask.

[MissionMTMan]

Sorry to say this but they are all hackable. All it takes is the right guy at the right place and you're screwed. Like everyone says, go with WPA 2. It will be your best bet and keep 99% of people out.

[Ricky-Ray]

Are you sure there's nothing else plugged into your network that your forgetting? I forgot about 2nd DVR that I installed and I was freaking out for about a week that there was a new MAC address on my network and they were able to get in after me changing the SSID, enabling MAC filtering, and changing the wpa2 passkey.

[NeoWeird]

Ok, maybe I'm not being clear - the message I try to convey frequently gets lost so I think it's me. I will try to outline what I'm asking in as short and precise of statements as I can.



I am using Inssider to scan other wireless networks being broadcasted in my area so I can determine the best channel to keep my network on with the least interference. All information about ANY other network is being obtained through this scanner.

There are ZERO unauthorized connections to my router or my modem. None. I know EVERY single one of them both current and in logs.

HOWEVER... a SEPARATE WIRELESS NETWORK being broadcasted somewhere near me is following me every time I change channels. As far as I can tell, this network or any device on it are NOT actually interacting with my network or any device on it. They are simply occupying the same channel I am, and follow to any channel I change to.

The other network has distinct information that is repeatedly being reported via Inssider. It has a name very different from any name given to my network or any of my devices, it is made by a manufacturer that I own NO components for, and has a unique MAC address that is not changing.

Should I be concerned with this behavior? It's obviously intentional, but I can not figure out why.

[CalBear]

Sorry, I've kind of taken the opportunity to lecture on wireless security, rather than answer your question. Some router's have a feature that automatically chooses the best available channel. Your neighbor may have a router that is acting up for some reason, and keeps changing its channel to match your router's channel. It may be a bad or strange algorithm. Either way, I'm pretty sure it's just his router auto selecting channels. I highly doubt it's anything malicious.

Ok, maybe I'm not being clear - the message I try to convey frequently gets lost so I think it's me. I will try to outline what I'm asking in as short and precise of statements as I can.

I am using Inssider to scan other wireless networks being broadcasted in my area so I can determine the best channel to keep my network on with the least interference. All information about ANY other network is being obtained through this scanner.

There are ZERO unauthorized connections to my router or my modem. None. I know EVERY single one of them both current and in logs.

HOWEVER... a SEPARATE WIRELESS NETWORK being broadcasted somewhere near me is following me every time I change channels. As far as I can tell, this network or any device on it are NOT actually interacting with my network or any device on it. They are simply occupying the same channel I am, and follow to any channel I change to.

The other network has distinct information that is repeatedly being reported via Inssider. It has a name very different from any name given to my network or any of my devices, it is made by a manufacturer that I own NO components for, and has a unique MAC address that is not changing.

Should I be concerned with this behavior? It's obviously intentional, but I can not figure out why.

Here is another thread where someone asked a similar question:

http://www.eggheadcafe.com/software/aspnet/34079995/is-my-neighbor-hacking-my-network.aspx

[Ricky-Ray]

Is SSID broadcast enabled? If so have you tried turning it off and see what happens?

[NeoWeird]

SSID is not turned off, and I was tempted to try it after you suggested it, but after reading that last link I think I'll stay away from it for now.

If I read that link correctly, it sounds like it's one of those things that happens but 99% of the population has no idea why it happens. Good to know; at least I don't need to worry about anything malicious going on in the background.

Thanks guys.

[JDay]

Sorry guys and gals, busy 12+ hour days and church every night this week so I'm not around much.

As for encryption, I don't really care much at this point in time. The network really only supplies internet to three computers that have no personal information on them outside of emails, which let's face it, 90% of mine is MidwayUSA and Brownells spam. I plan on going to something more secure in the future when I setup a media RAID server but until that point I rather like the ability to share my connection with friends and family easily - the key is more of a deterant to some random high schooler down the street. Kind of like people that put the alarm stickers on their house windows. It does nothing but turns most non-serious threats away.

WPA and WPA2 are easier to share since you use a password instead of hexadecimal. People can also crack your WEP key and sniff your internet traffic, they could hijack your online banking session or email account if they wanted to. It only takes a minute to switch to WPA2 on the router (just change the setting in the drop down box in wireless security and type in a strong password). You should also look into 128-bit AES encryption (which WPA2 uses), it's used by the DoD to secure classified (Secret) documents. This means that it does not just turn the most non-serious threats away.

[JDay]

Here are some reasons I can think of for making this switch:

1) Intranet protection. Most important transactions are done via HTTPS w/ encryption anyway, but you don't want to expose your computers or net transfers any more than necessary.

If someone cracks his WEP key they can easily hijack any HTTPS session he is on. This is just one example of why he needs to take this seriously.

http://hackaday.com/2009/02/23/sslstrip-hijacking-ssl-in-network/

sslstrip, hijacking SSL in network
posted Feb 23rd 2009 7:25pm by Eliot Phillips
filed under: cons, downloads hacks, security hacks

Last week at Black Hat DC, [Moxie Marlinspike] presented a novel way to hijack SSL. You can read about it in this Forbes article, but we highly recommend you watch the video. sslstrip can rewrite all https links as http, but it goes far beyond that. Using unicode characters that look similar to / and ? it can construct URLs with a valid certificate and then redirect the user to the original site after stealing their credentials. The attack can be very difficult for even above average users to notice. This attack requires access to the client’s network, but [Moxie] successfully ran it on a Tor exit node.

The fact he managed to run this on a Tor exit node also shows why you shouldn't trust that "secure anonymous" network.

[JDay]

Are you sure there's nothing else plugged into your network that your forgetting? I forgot about 2nd DVR that I installed and I was freaking out for about a week that there was a new MAC address on my network and they were able to get in after me changing the SSID, enabling MAC filtering, and changing the wpa2 passkey.

How did it get back on if you didn't reconnect it?

[JDay]

Ok, maybe I'm not being clear - the message I try to convey frequently gets lost so I think it's me. I will try to outline what I'm asking in as short and precise of statements as I can.



I am using Inssider to scan other wireless networks being broadcasted in my area so I can determine the best channel to keep my network on with the least interference. All information about ANY other network is being obtained through this scanner.

Just set the channel to auto, it will switch to the channel with the most interference automatically and you will never notice it.

There are ZERO unauthorized connections to my router or my modem. None. I know EVERY single one of them both current and in logs.

HOWEVER... a SEPARATE WIRELESS NETWORK being broadcasted somewhere near me is following me every time I change channels. As far as I can tell, this network or any device on it are NOT actually interacting with my network or any device on it. They are simply occupying the same channel I am, and follow to any channel I change to.

The other network has distinct information that is repeatedly being reported via Inssider. It has a name very different from any name given to my network or any of my devices, it is made by a manufacturer that I own NO components for, and has a unique MAC address that is not changing.

Should I be concerned with this behavior? It's obviously intentional, but I can not figure out why.

Maybe a neighbor is messing with your for some reason? In any case set the channel to auto and if they try to use the same channel it'll just change again.