Network security question..Itunes related

[Mangudai]

So while I was on my Dad's network today I noticed it would get really slow sometimes so I assumed it wasn't protected and I was right. My brother originally put a WEP on the network but my Dad's computer was having issues getting on the network so he took it off. I didn't want to deal with all that again so what I do was block the MAC addresses of the computers that were accessing the network from outside. But before I did that I tried blocking the IP addresses but one of the computers but it reconnected with another IP address and that's when I blocked it via the MAC address. My brother noticed on his Itunes today that it showed that it was shared with one of the computers that I blocked today..I have no experience with Itunes so I wanted to know if it was normal for Itunes to associate someones playlist with more than one ipod/iphone if they were both accessing computers on the same network? Or was this done maliciously? The thing is, my brother uses his Itunes almost everyday and only noticed this today so im wondering if this was done on purpose and if so how would I be able to prevent this or something similar from happening again...

Im assuming this was done after I initially blocked their IP address because I don't think its possible to gain access to a network if your MAC address is blocked?

 

[IStorm]

Im assuming this was done after I initially blocked their IP address because I don't think its possible to gain access to a network if your MAC address is blocked?

Its very easy to with MAC spoofing

 

[CraftyChicken]

You could setup a MAC white-list to only allow your dad's and your brother's computer to connect. But that still isn't security...

 

[horndog]

The one thing about security, if someone wants to get in, they will try, it is a matter how difficult you make for them determines how far they are willing to try.

 

[number69]

Enable encryption buddy. You blocked the person's IP address that he/she had at the time, problem is your router most likely has DHCP enabled, so they just get a new IP given to them. Also what the guy mentioned above about MAC spoofing is true. MAC filtering is only one aspect.

Anyway, don't you have at least WPA available on that router? Obviously if your router has WPA2 use that. Either way get away from WEP. Even with just WPA if you use a long random character passphrase(not dictionary words, names, etc..) you'll increase your protection greatly. Of course when you set this up log into the router from a wired connection, not wireless, and turn off broadcasting and change your admin password and save it. Then set up your encryption type and long random character passphrase. Keep the mac filtering in place. I also disable the SSID broadcasting on my own router. Then turn broadcasting back on. You can also get into disabling DHCP and using static IPs for each system in your house but for general purposes and ease of use in your case you can leave it on. I keep DHCP enabled but I have my router assign the same IPs to each of my systems. I also use a lightweight software firewall on each system in my house as well. I can fine tune things some more from there if need be...like allowing only the IPs my router assigns to my own systems to talk to each other and what protocols.

Just doing one of the above steps won't do much(like disabling SSID broadcasting) but if you do multiple layers you'll be better protected. Basically you want to waste the person's time who is trying to get into your network so they give up and move on. Good encryption with a long character random phrase password is very important.

 

[Mangudai]

Enable encryption buddy. You blocked the person's IP address that he/she had at the time, problem is your router most likely has DHCP enabled

You're right. It initially was set to give out up to 50 ip addresses but I reduced this to three for our three computers, I don't know this to be an effective means of helping to secure the network since the ip addresses were already given out(along with the other ways of course) but it made sense at the time. I assumed that if I block the other ip addresses and just keep ours then it wouldnt assign anymore. Yes, my router does have WPA2 I'll be enabling that today as well. The admin password has been changed and I will be turning off SSID broadcasting as well. I noticed you mentioned broadcast twice though. Once as broadcast and again as SSID broadcast is there a difference? Ive been checking the log and so far no one besides us are showing up but if someone is mac spoofing then I suppose I wouldn't know.

So basically I should

Enable WPA2 with a long randomized sequence of characters, turn off SSID broadcasting, consider disabling DHCP and using static IPs, make a white list for our mac addresses(as oppose to a black list). That makes sense, thanks.

 

[imajeanius]

seems like a lot of work. won't turning back on wep do the trick?

 

[ambientZ]

just use wpa2. if they dont have the key then they cant get on to do anything - dhcp can stay on if your network is protected.

 

[Shalafi]

mac-address filtering and disabling your SSID from being visible are two "basic security" steps, but the truth on that is they are only able to keep out the casuals, anyone with half a brain will know how to change their MAC address, it's NOT complicated at all, it can be done in a few seconds.

Wireless works because your wireless sends out a probe to discover any networks it can associate with. Now, with some software, they can make those "invisible" networks visible. So really, those 2 things aren't gonna secure your network, limiting your DHCP pool helps, but so does enabling WPA2 encryption, AES is better than TKIP, so use AES if the devices you're associating with your router support it.

Don't forget, for each layer of security you build your network on, the harder it becomes to crack, no network is impossible to crack for a seriously determined network, so with that in mind, your overall goal is to keep out as many people as possible.

Taking basic steps weeds out like 80-90 percent of the people out there, disabling SSID broadcast, MAC address filtering, but what really keys in on that large of a percentage is having WPA 2 encryption going.

So . . . . .

 

[number69]

I noticed you mentioned broadcast twice though. Once as broadcast and again as SSID broadcast is there a difference? Ive been checking the log and so far no one besides us are showing up but if someone is mac spoofing then I suppose I wouldn't know.

So basically I should

Enable WPA2 with a long randomized sequence of characters, turn off SSID broadcasting, consider disabling DHCP and using static IPs, make a white list for our mac addresses(as oppose to a black list). That makes sense, thanks.

Broadcasting and SSID are different. Well people use the term "broadcast the SSID" which may lead to confusion. Simply put, enabling broadcasting is turning on Wi-Fi.

The SSID(Service set identifier) is your Wi-Fi network name. So you could enable broadcasting(Wi-Fi) and disable your router from broadcasting the SSID, the name of your network. Again, this by itself won't do a helluva lot but I do it on my network at home. A layered approach works best as I described in my last post. Most important thing again, is good encryption and a long random character passphrase.

 

[jrdonnaruma]

just use wpa2. if they dont have the key then they cant get on to do anything - dhcp can stay on if your network is protected.

That isn't entirely true. if you force a deauth/reauth from one of the wireless clients, and capture the 4 way handshake you can get access to the network, even with WPA/WPA2.

The current release of Backtrack is all setup for this sort of attack, and cracking WPA/WPA2 is really not that difficult if you understand how to use kismet/wireshark/airmon/aircrack and/or COWpatty. recon -> forcedeauth ->capture handshake -> crack handshake -> auth yourself.

But I second what others have said, disable SSID broadcast, limit number of IPs, use a deny-all mac address security policy (deny-all except the ones you want), use static IPs, and WPA2. The combination will make it difficult for most to gain access.