Re: WLAN security

[flash flash@xxxxxxxx]

≪Does anyone know if turning off the broadcasting of SSID provides good
protection?≫

It offers some. It makes the AP invisible--up to a point. It does
not, of course, mask RF (radio frequencies)--these are still visible.
So, anyone who is driving by with a WLAN sniffer will see the RF and the
MAC addresses of the pcs associated with any local APs. Pretty soon, the
hacker/cracker will figure out where the APs must be, based on
transmissions from pcs associated with them.

Other security measures include MAC address filtering and rotating keys.

MAC address filtering is configured on the AP; it allows only known MAC
addresses to associate with the AP. This too provides only partial
security. It is effective against inadvertent associations from
neighbors who happen to have overlapping WLAN cells (e.g., one floor
down or in the apartment next door). A dedicated hacker/cracker,
however, will have the tools to see which pcs are associating to the
local APs and then use the allowed MAC addresses as their own. Two pcs
having the same MAC address will not be easy to detect, even with
professional sniffing tools. It would show up, if at all, in the form of
various network anomalies (packets being distributed between them
randomly, causing higher layer apps to complain of incomplete
transmission, for example). See screenshot for an example of MAC address
filtering.

Rotating keys offer significantly better protection than a single key,
and changing your keys every few months increases your protection as
well. WPA2 (WiFi Protected Access v2) is the current standard.
You can define several keys and rotate them in time cycles or after a
certain number of packets. Rotating keys must be configured on the AP
and on all pcs allowed to associate with the AP.

I use a combination of the above measures: SSID nonbroadcast, MAC
address filtering, plus rotating keys (and not all pcs use the same
key). Bear in mind that no WLAN security measures are as secure as
a cabled LAN. You cannot make it impossible for dedicated professionals
to hack into your WLAN, but you can make it not worth the casual war
driver's trouble to do so. They are clever, but lazy, and prefer to
drive two streets farther along where they find easier pickings.
Also bear in mind that wireless speed is inversely proportional to
distance from the AP. The current max is 54Mbps close to the AP, which
drops off to 1Mbps at distance.
Most antennas (certainly for home use) transmit more in the horizontal
plane than in the vertical, so you will likely experience more cell
overlap with apartments on the same floor than with those two floors up.
No antenna is perfect; the RF cell will not be a geometrically perfect
circle out to 100m but will have irregularities (bulges and dents, as it
were). This affects not only your transmission speed, but also how far
away your cell is hackable.
A further measure to protect against war driving is to get yourself a
WLAN site survey tool. This is a software tool to be installed on a
laptop; turn it on, walk around outside your house/building where the AP
is, and find out how far your signals are travelling beyond your walls.
Less is more; turn the power output down to shrink your cell coverage.

Hope this helps.

Cheers,