Brain Assassin

Dur­ing my recent vaca­tion I was asked to con­fig­ure the wire­less LAN of a friend. I com­plied and did as I was asked. At the same time I thought I’d share a few of the most basic things with you. Since the most com­monly used routers on the mar­ket today are 802.11g/802.11 draft-​​n routers, I will focus on them. Most of the fol­low­ing infor­ma­tion should be applic­a­ble to older mod­els (802.11b or 802.11a routers) as well, pro­vided the man­u­fac­turer has made the appro­pri­ate firmware avail­able. That said, let’s get started.

First thing you should do is to look for a firmware update, espe­cially if you own an older model. After hav­ing installed the lat­est firmware, you should change your default router pass­word which is almost always some­thing along the lines of “admin”, “pass­word”, “changeme”, “pub­lic”, “pri­vate”, or “1234″. A more com­pre­hen­sive list of default router pass­words can be found at Default Router Pass­words. Addi­tion­ally, most routers come pre-​​configured with an IP address of 192.168.x.y, where x stands for “0″, “1″, “2″, “8″, “11″, or “15″, and y mostly stands for “1″ or “2″. Note that some routers have an IP address of 10.0.0.z where z often enough stands for “1″ or “2″. A strong pass­word doesn’t really pro­tect your net­work but it should ensure that nobody will mess with your settings.

Next, for­get about hid­ing the SSID (Ser­vice Set Iden­ti­fier). This is an iden­ti­fi­ca­tion code broad­cast by a wire­less router. That really doesn’t help you at all. You should change the SSID though, just to make it eas­ier for you to iden­tify your net­work and for that rea­son alone. There are many peo­ple out there who tell you to dis­able DHCP (Dynamic Host Con­fig­u­ra­tion Pro­to­col) because it pre­vents hack­ers from from enter­ing your net­work. That is not true. DHCP will make your life eas­ier, par­tic­u­larly if you do have guests a few with note­books or other MIDs (Mobile Inter­net Devices).

Fil­ter­ing MAC addresses is a good idea. In The­ory. Truth is, that these addresses are eas­ily detected and faked by any­one using the appro­pri­ate soft­ware. In addi­tion, it requires you to main­tain the list mean­ing that if you or any of your friends change the NIC (Net­work Inter­face Card) or the MID, you will also have to update the MAC address. Sure, you could make sure that the new MAC address is changed to the old and known one but that’s not very convenient.

That means, there’s only one ting left: Encryp­tion. There are quite a few Pro­to­cols avail­able for you, so here’s how to pick the one best suited for your pur­poses. The first wire­less secu­rity pro­to­col was WEP (Wire­less Equiv­a­lent Pri­vacy). Unfor­tu­nately, WEP is old and not safe. It can be cracked in a few min­utes so you shouldn’t even bother using it. Of course, WEP is bet­ter than no encryp­tion at all. WEP2 is more secure than WEP, but it doesn’t really improve on any of the inher­ent weak­nesses of the WEP model. If you’ve got no other choice, WEP2 is bet­ter than WEP.

WPA (Wi-​​Fi Pro­tected Access) is the way to go. It’s a much bet­ter secu­rity pro­to­col than WEP. There is WPA and then there is WPA2. As with the pre­de­ces­sor the suf­fix “2″ indi­cates a bet­ter secu­rity. Prob­lem is, that WPA2 wasn’t really designed with back­wards com­pat­i­bil­ity in mind, so it might not work on your router. If you have the choice though, you should go with WPA2. WPA2 is the imple­men­ta­tion of the approved IEEE 802.11i amend­ment. Both WPA and WPA2 fea­ture two secu­rity lev­els: WPA Per­sonal (aka WPA-​​PSK) and WPA Enter­prise. You don’t need to bother with the Enter­prise solu­tion. Choose WPA(2) Per­sonal and then select the encryp­tion stan­dard (TKIP or AES) sup­ported by your devices. AES is bet­ter than TKIP.

That’s it. Quite easy, I’d say. WPA2 (AES) is the best encryp­tion method avail­able right know and you should make use of it if you can. Hid­ing the SSID, main­tain­ing a fil­ter­ing list for MAC addresses, or dis­abling DHCP won’t help you in that regard. These meth­ods only serve to make your life more dif­fi­cult than it has to be.