hacker alert

[Rhys]

Today my wife was trying to get online and found her connection wasn't working well. I checked and somebody had set up an ad-hoc network of the same name as our house network. The first thing I did was to conceal the SSID and then change the SSID and password. This is the first time in about 3 years that I have found somebody trying to hack our home network. I therefore recommend that if you have a home network that you immediately hide the SSID and then change your SSID and passwords. I don't know whether this is a criminal offence but I suspect it is and it was a shame I couldn't get the guy's MAC address.

[Visual Reality]

Hiding the SSID does nothing btw.

Also, I strongly suggest WPA or WPA2 + AES with a 20 character password generated here:

http://www.kurtm.net/wpa-pskgen/

[Rhys]

Oh it's a WPA/WPA2 password with a PSK passphrase.

[Visual Reality]

WEP is useless...it can and will be hacked by anyone who knows how to search Google for the tools to do so.

The method I described above (and linked to) is virtually bulletproof. At least anyone who can get through, likely won't invest the time to brute force their way in.

[Rhys]

I'm not using wep though...

I hid my SSID on the basis that it's harder for them to discover. What they were trying to do was to broadcast a copy SSID and then to listen into the broadcast passwords and possibly then allowing pier to pier connection then to the internet and using a packet sniffer to get bank passwords etc.

With a hidden ssid it's much harder for them to discover.

[Visual Reality]

I know, I'm just saying in case anyone reads this and is still using WEP. If your router can do WPA, get it set up.

Many tools that search for local wireless networks don't even need the SSID to find them. The built in windows tool only shows the SSID broadcasts, but not all of them follow that rule.

[seanhoxx]

If it is your home network, and you are in a residential neighborhood it is likely some just trying to hotspot you or jump onboard for free high speed, still doesn't make it right though. Any indication that they tried to enter any of your programs, or download data?
if you are in a more urban or built up area take a walk around outside and look for "war chalking" paint or chalk markings that indicate reception, connection, access etc. mostly in a circle divided into thirds or fourths, do a web search for more info. If you run a bussiness out of your home may want to beef up security, I'm not real up on the techie side of this but have done some investigations with sex offenders, child pornographers hacking networks to dead end investigations.

[Rhys]

It's a home network. It looks to me as though somebody by setting up an ad-hoc network of the same name as my house network was trying to phish for passwords. I changed and hid the SSID of our house network. The next security update will be later today and I'll install MAC filtering. I just have to ID the Mac addresses of all the computers likely to use our network.

I'm glad in a way that this happened. It's shown me a loophole in my system and that loophole is in most of the systems I administer. I know the dental office I administer has had a hidden SSID from day 1. I will drive by there later and install MAC filters as well.

[Beowulff]

Dunno a lot about this myself, but this was a wake up call to me:

Kismet (http://www.kismetwireless.net/)

Cheers :)

[Rhys]

Dunno a lot about this myself, but this was a wake up call to me:

Kismet (http://www.kismetwireless.net/)

Cheers :)

There is no security that cannot be breached or broken. What we can do is to make it so hard that people just run out of time.

[seanhoxx]

keep in mind if it is someone trying to get inside that is more serious, you say systems you adminester for, that tells me you may be a target, could be as simple as a phishing scam to start spam emailing users and clients, or it could be a theft / fraud attempt. keep your eyes open, if you can tell that you are getting continuely probed you may want to make local law enforcement at least aware of it, if your local agency has a cyber crimes or computer crime unit that is who to talk to. You harden the target they most likely will just go away, it's not worth the time and effort to hack in when there are so many other softer targets.
Sean

[Rhys]

I was amazed to find somebody trying it on with a domestic network in a residential area. I'd have expected it in an industrial context. On the other hand we do have teenagers locally. I can point a finger at two possible sources - one the house opposite and one of the next door neighbors. Nobody else has teenagers. I don't know how far the range of my Belkin Wireless G router is but I should not imagine more than 100 yards.

[ColColt]

Sometimes I feel overgunned with the securit programs I have besides the usual firewall and antiviurs set up. I don't use wireless because of problems I've heard others have. I have a straight wired Linksys router and knock on wood, have yet to have any problems. I only need one computer so, there's no network setup and no ne gets on the computer but me. I hope they catch these varmints.

[Rhys]

When I installed the network in the dental office, as it was a non-connected network (no internet connection) I figured fairly reasonable security would be OK.

Now that I've had somebody trying it on with my domestic network, I am maxing out on security and will raise security levels on all the networks I administer. I still find it hard to believe that so many offices near the dental office have such lax security that their networks are 100% open for anybody to piggy-back onto.

[Mark_48]

....... I checked and somebody had set up an ad-hoc network of the same name as our house network.....

How and where did you check this? Occasionally my router looks like it has activity when neither my wife or I are online, so I'm slightly suspicious somethings going on, but I'm not sure how to go about troubleshooting it.

[Rhys]

How and where did you check this? Occasionally my router looks like it has activity when neither my wife or I are online, so I'm slightly suspicious somethings going on, but I'm not sure how to go about troubleshooting it.

I could see it on my wife's laptop. There were two networks listed with the same name. One was my wifi router and the other was an ad-hoc pc-pc network. As soon as I saw that I hid our network's SSID and changed the network name and password. Later I restricted it to only the Mac addresses of our machines.

[seanhoxx]

Rhys as you said earlier about 100 yards from the router for distrance, maybe a bit more if on a second floor, also depends on how flat and open the area is, so could be a bit farther. Take your laptop for a drive or a walk around the neighbor hood and see how far you can connect from. Also you can buy key ring devices that seek out signals for less than $20.00. Drive around, you will be surprised at how many open unprotected "free" signals are out there! IF it's teens they are most likely looking for fast connection to download musid or videos from, still not right, but better then being under cyber attack. You don't have to go to extremes with security, unless you want to just making your "target" harder to get at will often be enough. It just isn't worth the effort with so many other "soft" targets out there.

[Rhys]

If security is a real problem then I don't install wireless networks. Everything from a security view should be cabled.