[51984] in North American Network Operators' Group
Re: Drive-by spam hits wireless LANs
daemon@ATHENA.MIT.EDU (Jared Mauch)
Wed Sep 11 13:16:19 2002
Date: Wed, 11 Sep 2002 13:13:52 -0400
From: Jared Mauch <jared@puck.nether.net>
To: John Angelmo <john@veidit.net>
Cc: Jared Mauch <jared@puck.nether.net>,
"Neil J. McRae" <neil@DOMINO.ORG>, blitz <blitz@macronet.net>,
nanog@merit.edu
In-Reply-To: <3D7F78A5.2030409@veidit.net>
Errors-To: owner-nanog-outgoing@merit.edu
On Wed, Sep 11, 2002 at 07:08:53PM +0200, John Angelmo wrote:
> Jared Mauch wrote:
> In some way you are right, but still I think it's even worse to use WEP
> cause then the admins might think it's safe, it takes about 15 minutes
> to crack a wepkey, so instead of drive-by spamming you could call it
> drive-by, have a bagle, start spamming.
I'm not trying to fix the underlying wireless encryption
option just provide a simple way that the manufacturers can ship
a 'more secure' out-of-the-box-product.
> The most hardware/software indipendent solution I have seen so far is
> the use of VPN, simply place the WLAN outside your own LAN.
Absolutely.
There are a lot of things one can do:
1) enable wep
2) rotate wep keys
3) authenticate by mac-address
4) restrict dhcp to known mac-addresses
5) force utilization of vpn/ipsec client
Obviously not all of these solutions are available
in all cases, but in a home or small lan-environment a subset of
these will increase security (even if it's reinforcing the screen door
with 1/16" of balsa wood)
- jared
--
Jared Mauch | pgp key available via finger from jared@puck.nether.net
clue++; | http://puck.nether.net/~jared/ My statements are only mine.
