12:01 p.m.
Hi,
I just installed F12 on my EEEPC 1000H. Everything is working fine
besides the WLAN connection to an access point with hidden SSID.
I installed the rt2860 drivers from rpmfusion, activated
wpa_supplicant and now I can see the WLAN acces point of my neighbors
in Network Manager, but after entering the details of my own hidden
WLAN Network Manager keeps asking for the WLAN passphrase again and
again.
I also have Ubuntu 9.10 on this EEEPC and there the connection to my
hidden WLAN worked out of the box. Also, on a DELL D620 laptop with
Intel WLAN card and F12 the connection to my hidden WLAN works just
fine.
Any ideas how to get this going on the EEEPC in F12?
Best regards,
Bernd.
9:34 p.m.
Wolfgang S. Rupprecht wrote:
Robert Moskowitz <rgm(a)htt-consult.com> writes:
> Actually WPA2 with 802.1X authentication is REALLY tight. No MITM
> will crack EAP TLS (EAP TLS is a little different than the TLS used in
> the most recent attack). Then use AES CCMP (not TKIP).
>
And there we have the real way in protecting a wifi access point: turn
off WEP, WPA (v1), and TKIP (under WPA2). Leave only WPA2 and CCMP.
Then let the computer choose a 64-bit hex number for the shared key.
Too bad the good advice is always drowned out by the hordes that claim
hiding SID's and changing port number on ssh are the way to get
security. (For ssh turn off everything but RSA and DSA -- this way the
computer chooses a strong "password" (really a secret key) for you.)
> Of course your management frames are not protected. That is 802.11w
> that will soon be in products....
>
> BTW, I worked on the 802.11 standards. I use past tense, as in June
> my management had me move over to work on 802.15 standards. (I was in
> Atlanta last week for the 802 meeting).
>
Thank you for speaking up! Will the new protocols require any HW
support or are they drop-in replacements on current wifi nodes?
802.11w will
'just' be a firmware upgrade. It was approved by RevComm
back in September, so it is up to the vendors to decide which shipping
products will support it.
Will all the packets now be cryptographically protected?
Well, you can't protect BEACONs, PROBEs, ASSOCIATIONs, AUTHENTICATIONs,
as there are no keys yet!
But DISASSOCIATE, the one I used in my attack against hidden SSIDs, can
be authenticated, thus stopping this particular attack. But there are
other ways, like flooding attacks to force a client to PROBE, thus
exposing the SSID; just a little harder.
802.11s has a way to establish keying in the AUTHENTICATE exchange.
There is talk about how to 'retrofit' that to non-mesh authentication.
It seems that no one wants to open Pandora's box and shortcut this
change, and it will have to go the PAR route and take a couple years. Sigh.
1:53 p.m.
Robert Moskowitz <rgm(a)htt-consult.com> writes:
Actually WPA2 with 802.1X authentication is REALLY tight. No MITM
will crack EAP TLS (EAP TLS is a little different than the TLS used in
the most recent attack). Then use AES CCMP (not TKIP).
And there we have the real way in protecting a wifi access point: turn
off WEP, WPA (v1), and TKIP (under WPA2). Leave only WPA2 and CCMP.
Then let the computer choose a 64-bit hex number for the shared key.
Too bad the good advice is always drowned out by the hordes that claim
hiding SID's and changing port number on ssh are the way to get
security. (For ssh turn off everything but RSA and DSA -- this way the
computer chooses a strong "password" (really a secret key) for you.)
Of course your management frames are not protected. That is 802.11w
that will soon be in products....
BTW, I worked on the 802.11 standards. I use past tense, as in June
my management had me move over to work on 802.15 standards. (I was in
Atlanta last week for the 802 meeting).
Thank you for speaking up! Will the new protocols require any HW
support or are they drop-in replacements on current wifi nodes? Will
all the packets now be cryptographically protected?
-wolfgang
--
Wolfgang S. Rupprecht
If the airwaves belong to the public why does the public only get 3
non-overlapping WIFI channels?
6:57 a.m.
Tim wrote:
Tim:
>> And the lack of a name doesn't prevent anyone from using it.
>>
Robert Moskowitz:
> No. You MUST have the name to associate with the AP. But all you
> have to do is force a current user of the AP to reassociate to get the
> name. There are now attack tools that will do this for you....
>
Only in the sense that *YOU* (the client) need know which name to use,
but stopping the SSID from broadcasting the name doesn't keep that name
a secret.
Tim, my friend, I wrote the definitative paper on this subject that
everyone references. I just about blew my gasket when one "security
researcher" published that the SSID was an exposed password and the
vendors jumped on a historical artifact of the standard and 'hid' the SSID.
Historical because when the standard was developing, there were a few
vendors that did not have the concept of an SSID in their product.
Afterall, theirs was the ONLY wireless network that would EVER be in the
warehouse or the retail store (that might hint to you who was the
leading vendor at the time without an SSID concept). So to move forward
the standard allows for no SSID. Of course all those systems are gone
and dead but the function lives on in the standard...
IF you only have one AP in your network and your signal is ALWAYS good,
you don't suffer too much from hiding your SSID, but as we said it makes
no sense.
My recommendation has always been to clearly announce who you are in
your SSID. That way if someone near you is having signal problems, they
can physically locate you and maybe work out an arrangement to share the
airways. So my SSID is my business name. My brother-in-law's is his
street address.
Oh, I am officially a security researcher and architect. I study
security systems to understand how they work and I design others (I
authored HIP, for example). Some colleagues and I are working up some
definitions. We take the four nouns:
Researcher
Architect
Pimp
Practioner
With the three modifiers:
Security
Risks
Vulnerablities
And define them. Now pretty much all three modifers for the noun, Pimp,
have the same definition. Someone that works in the area for fun and
profit. Sound like many of the 'outspoken security advocates'? And
every time I read the words, 'Risks Practioner', I think Bungie Jumper. :)
11:30 p.m.
On Thu, 2009-11-26 at 20:39 -0500, Bill Davidsen wrote:
The only way to absolutely prevent unauthorized use is to turn off
the
machine. That's why there are security updates regularly, *all*
measures are about making it harder, forcing the evildoer to find and
use the more difficult exploit.
Irrelevant to the second topic at hand. That the SSID has nothing to do
with security, and no amount of ducking and weaving makes it so. It's
not a security device, it's not a measure taken to secure a device, it's
not an exploit issue.
The *name* of a wireless network (the SSID) is not a security issue.
The *name* of a computer is not a security issue.
The *name* of anything else on our LAN is not a security issue.
Passwords, pass phrases, and keys *are*.
To the first topic at hand: First advice to anybody having issues
getting their network to work is to stop hiding the SSID, now, and for
the future. When you set up your network to work properly, then you're
much likely to find that it works.
Anybody who offers bad advice about hiding it, and false justifications
for doing so, needs correcting. They are in error, and causing problems
for everyone trying to set up networking.
--
[tim@localhost ~]$ uname -r
2.6.27.25-78.2.56.fc9.i686
Don't send private replies to my address, the mailbox is ignored. I
read messages from the public lists.
11:21 p.m.
Tim:
> And the lack of a name doesn't prevent anyone from using it.
Robert Moskowitz:
No. You MUST have the name to associate with the AP. But all you
have to do is force a current user of the AP to reassociate to get the
name. There are now attack tools that will do this for you....
Only in the sense that *YOU* (the client) need know which name to use,
but stopping the SSID from broadcasting the name doesn't keep that name
a secret.
--
[tim@localhost ~]$ uname -r
2.6.27.25-78.2.56.fc9.i686
Don't send private replies to my address, the mailbox is ignored. I
read messages from the public lists.
9:36 p.m.
Bill Davidsen wrote:
Tim wrote:
> Tim (re hidden SSIDs):
>>> It doesn't add *ANY* security.
>>> It *does* add problems.
>>>
>>> It doesn't hide your access point, at all. It still appears as an
>>> access point that can be used. Anybody, and everybody, can see that
>>> there's one there. It just doesn't have a name associated with it.
>>>
>>> And the lack of a name doesn't prevent anyone from using it.
>
> Bill Davidsen:
>> FUD. How can you hold two diametrically opposed ideas in your brain
>> without your head exploding?
>
> You idiot. You don't understand what you're reading, and the one
> spouting the FUD is you - that hiding an SSID has anything, at all, even
> to the slightest degree, to do with security. Get a fucking clue.
>
>> Look at your first two lines and reconcile "adds no security" with
>> "harder to use."
>
> The two have absolutely nothing to do with each other.
>
> Security is about *preventing* unauthorised use, the SSID has absolutely
> nothing to do with security. And *no* amount of futzing around with it
> will ever "secure" a network.
>
The only way to absolutely prevent unauthorized use is to turn off the
machine. That's why there are security updates regularly, *all*
measures are about making it harder, forcing the evildoer to find and
use the more difficult exploit.
I have a colleague that recommends putting your AP on a timer, so you
don't forget to turn it off when you won't be in the house.
Actually WPA2 with 802.1X authentication is REALLY tight. No MITM will
crack EAP TLS (EAP TLS is a little different than the TLS used in the
most recent attack). Then use AES CCMP (not TKIP).
Of course your management frames are not protected. That is 802.11w
that will soon be in products....
BTW, I worked on the 802.11 standards. I use past tense, as in June my
management had me move over to work on 802.15 standards. (I was in
Atlanta last week for the 802 meeting).
8:08 p.m.
Tim wrote:
On Tue, 2009-11-24 at 15:14 -0500, Bill Davidsen wrote:
> I don't use hidden SSID much, as it only lends a tiny bit of security
>
It doesn't add *ANY* security.
It *does* add problems.
It doesn't hide your access point, at all. It still appears as an
access point that can be used. Anybody, and everybody, can see that
there's one there. It just doesn't have a name associated with it.
And the lack of a name doesn't prevent anyone from using it.
No. You MUST have the name to associate with the AP. But all you have
to do is force a current user of the AP to reassociate to get the name.
There are now attack tools that will do this for you....
8:06 p.m.
Bernd Bartmann wrote:
Hi,
I just installed F12 on my EEEPC 1000H. Everything is working fine
besides the WLAN connection to an access point with hidden SSID.
I installed the rt2860 drivers from rpmfusion, activated
wpa_supplicant and now I can see the WLAN acces point of my neighbors
in Network Manager, but after entering the details of my own hidden
WLAN Network Manager keeps asking for the WLAN passphrase again and
again.
I also have Ubuntu 9.10 on this EEEPC and there the connection to my
hidden WLAN worked out of the box. Also, on a DELL D620 laptop with
Intel WLAN card and F12 the connection to my hidden WLAN works just
fine.
Any ideas how to get this going on the EEEPC in F12?
Unhide your SSID. It does not increase your security.
I published the original paper on this, but it is hard to find in the
PDF format. I have it in txt format at:
http://www.htt-consult.com/Docs/The_myth_of_hiding%20SSIDs.htm
7:39 p.m.
Tim wrote:
Tim (re hidden SSIDs):
>> It doesn't add *ANY* security.
>> It *does* add problems.
>>
>> It doesn't hide your access point, at all. It still appears as an
>> access point that can be used. Anybody, and everybody, can see that
>> there's one there. It just doesn't have a name associated with it.
>>
>> And the lack of a name doesn't prevent anyone from using it.
Bill Davidsen:
> FUD. How can you hold two diametrically opposed ideas in your brain without your
> head exploding?
You idiot. You don't understand what you're reading, and the one
spouting the FUD is you - that hiding an SSID has anything, at all, even
to the slightest degree, to do with security. Get a fucking clue.
> Look at your first two lines and reconcile "adds no security"
> with "harder to use."
The two have absolutely nothing to do with each other.
Security is about *preventing* unauthorised use, the SSID has absolutely
nothing to do with security. And *no* amount of futzing around with it
will ever "secure" a network.
The only way to absolutely prevent unauthorized use is to turn off the machine.
That's why there are security updates regularly, *all* measures are about making
it harder, forcing the evildoer to find and use the more difficult exploit.
Being "harder to use" without it is about breaking normal
network
functionality. Those people that are authorised to use the system, now,
have a more difficult time connecting to the right access point, or
avoiding connecting to the wrong one.
When will idiots get it through their dense heads that making something
more difficult to use, normally/properly, has absolutely nothing to do
with making something more secure. And that publicly repeating
that /hide the SSID/ crap actually causes harm. Because of it, we have
people foolishly breaking their networking, and thinking that they're
securing it.
Do not hide the SSID, it is a COMPLETE WASTE OF TIME.
Actually, I gave him a way to do what he asked, it's his machine, not mine. I
only advise (in lower case, even) because it's not my week to be God. Checking
the roster, it's not yours, either.
Have a nice holiday.
--
Bill Davidsen <davidsen(a)tmr.com>
"We have more to fear from the bungling of the incompetent than from
the machinations of the wicked." - from Slashdot
8:13 p.m.
Tim (re hidden SSIDs):
> It doesn't add *ANY* security.
> It *does* add problems.
>
> It doesn't hide your access point, at all. It still appears as an
> access point that can be used. Anybody, and everybody, can see that
> there's one there. It just doesn't have a name associated with it.
>
> And the lack of a name doesn't prevent anyone from using it.
Bill Davidsen:
FUD. How can you hold two diametrically opposed ideas in your brain
without your
head exploding?
You idiot. You don't understand what you're reading, and the one
spouting the FUD is you - that hiding an SSID has anything, at all, even
to the slightest degree, to do with security. Get a fucking clue.
Look at your first two lines and reconcile "adds no
security"
with "harder to use."
The two have absolutely nothing to do with each other.
Security is about *preventing* unauthorised use, the SSID has absolutely
nothing to do with security. And *no* amount of futzing around with it
will ever "secure" a network.
Being "harder to use" without it is about breaking normal network
functionality. Those people that are authorised to use the system, now,
have a more difficult time connecting to the right access point, or
avoiding connecting to the wrong one.
When will idiots get it through their dense heads that making something
more difficult to use, normally/properly, has absolutely nothing to do
with making something more secure. And that publicly repeating
that /hide the SSID/ crap actually causes harm. Because of it, we have
people foolishly breaking their networking, and thinking that they're
securing it.
Do not hide the SSID, it is a COMPLETE WASTE OF TIME.
--
[tim@localhost ~]$ uname -r
2.6.27.25-78.2.56.fc9.i686
Don't send private replies to my address, the mailbox is ignored. I
read messages from the public lists.
2:42 p.m.
Bill Davidsen wrote:
Tim wrote:
> On Tue, 2009-11-24 at 15:14 -0500, Bill Davidsen wrote:
>> I don't use hidden SSID much, as it only lends a tiny bit of security
>
> It doesn't add *ANY* security.
> It *does* add problems.
>
> It doesn't hide your access point, at all. It still appears as an
> access point that can be used. Anybody, and everybody, can see that
> there's one there. It just doesn't have a name associated with it.
>
> And the lack of a name doesn't prevent anyone from using it.
>
FUD. How can you hold two diametrically opposed ideas in your brain
without your head exploding? Look at your first two lines and reconcile
"adds no security" with "harder to use." The fact that problems come
up
regularly from legitimate users indicates that it is harder to get
working, how that can fail to "lend a tiny bit of security" eludes me. I
certainly didn't suggest that it was a desirable practice, but I gave it
an honest appraisal. The fact that it wouldn't slow you down doesn't
make it worthless.
However, those are your opinions, you're welcome to them. The second one
certainly is correct.
You have to remember that you have two types of users here. You have
the normal users - they want to connect to the access point without
problems. Hiding the SSID hurts them. Then you have the cracker.
Hiding the SSID does not hamper him, as he is capturing packets
anyway to help break the encryption. This gives him the SSID as part
of the process even if it not being broadcast. So as a security
measure, it does not add security, while at the same time, it is
making it harder for normal users.
The one exception I can see to that is if the only security is
hiding the SSID. The the person cracking the system has to find the
SSID before connecting. The normal users already have it. But they
have to tell the computer what SSID you are trying to connect to,
instead of the system seeing the SSID and connecting to it, or
giving you a choice of SSIDs to connect to.
Mikkel
--
Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!
1:13 p.m.
Tim wrote:
On Tue, 2009-11-24 at 15:14 -0500, Bill Davidsen wrote:
> I don't use hidden SSID much, as it only lends a tiny bit of security
It doesn't add *ANY* security.
It *does* add problems.
It doesn't hide your access point, at all. It still appears as an
access point that can be used. Anybody, and everybody, can see that
there's one there. It just doesn't have a name associated with it.
And the lack of a name doesn't prevent anyone from using it.
FUD. How can you hold two diametrically opposed ideas in your brain without your
head exploding? Look at your first two lines and reconcile "adds no security"
with "harder to use." The fact that problems come up regularly from legitimate
users indicates that it is harder to get working, how that can fail to "lend a
tiny bit of security" eludes me. I certainly didn't suggest that it was a
desirable practice, but I gave it an honest appraisal. The fact that it wouldn't
slow you down doesn't make it worthless.
However, those are your opinions, you're welcome to them. The second one
certainly is correct.
--
Bill Davidsen <davidsen(a)tmr.com>
"We have more to fear from the bungling of the incompetent than from
the machinations of the wicked." - from Slashdot
7:13 p.m.
On Tue, 2009-11-24 at 15:14 -0500, Bill Davidsen wrote:
I don't use hidden SSID much, as it only lends a tiny bit of
security
It doesn't add *ANY* security.
It *does* add problems.
It doesn't hide your access point, at all. It still appears as an
access point that can be used. Anybody, and everybody, can see that
there's one there. It just doesn't have a name associated with it.
And the lack of a name doesn't prevent anyone from using it.
--
[tim@localhost ~]$ uname -r
2.6.27.25-78.2.56.fc9.i686
Don't send private replies to my address, the mailbox is ignored. I
read messages from the public lists.
2:14 p.m.
Bernd Bartmann wrote:
Hi,
I just installed F12 on my EEEPC 1000H. Everything is working fine
besides the WLAN connection to an access point with hidden SSID.
I installed the rt2860 drivers from rpmfusion, activated
wpa_supplicant and now I can see the WLAN acces point of my neighbors
in Network Manager, but after entering the details of my own hidden
WLAN Network Manager keeps asking for the WLAN passphrase again and
again.
I also have Ubuntu 9.10 on this EEEPC and there the connection to my
hidden WLAN worked out of the box. Also, on a DELL D620 laptop with
Intel WLAN card and F12 the connection to my hidden WLAN works just
fine.
Any ideas how to get this going on the EEEPC in F12?
I don't have an FC12 machine available to me without walking to another part
of
the building, so this is from memory. Right click the network icon and go to
Network Connections->Wireless->New. You have a box which wants your SSID, leave
it blank and fill in the box for MAC instead.
I also saw something when I set the machines up referring to hidden addresses,
sorry to say I didn't need it and don't remember.
I don't use hidden SSID much, as it only lends a tiny bit of security, under the
"Hiking in Bear Country" theory. You don't have to outrun the bear, you have
to
outrun the slowest member of the party. If your site is harder to hack it
discourages the incompetent who run a script but understand nothing. It makes
you slightly more attractive to someone who is competent, so take your choice.
Good luck.
--
Bill Davidsen <davidsen(a)tmr.com>
"We have more to fear from the bungling of the incompetent than from
the machinations of the wicked." - from Slashdot
6:53 p.m.
On Mon, 2009-11-23 at 19:01 +0100, Bernd Bartmann wrote:
Any ideas how to get this going on the EEEPC in F12?
First hint: Stop hiding your SSID, and see if it works.
Info: Hiding your SSID doesn't make you more secure, it doesn't even
hide your access point from other people, it just shows up as an
un-named access point. Your access point is still, merrily,
transmitting beacon pulses (probably several times a second, by
default), announcing that there's an access point, here.
The SSID is an important part of normal networking. When you
deliberately break things, you can expect problems to crop up.
And if you have neighbours who have followed the same silly advice about
hiding their SSID, it gets even more tricky for you all to connect to
the right access points.
--
[tim@localhost ~]$ uname -r
2.6.27.25-78.2.56.fc9.i686
Don't send private replies to my address, the mailbox is ignored. I
read messages from the public lists.
5279
days inactive
5285
days old
15 comments
6 participants
participants (6)
-
Bernd Bartmann -
Bill Davidsen -
Mikkel -
Robert Moskowitz -
Tim -
Wolfgang S. Rupprecht