Step-by-Step Guide

Step 2: Search for weaknesses

When I assess wireless network security in Windows environments, I frequently come across the following security vulnerabilities. They're actually not hard to find -- especially with a little time and the knowledge of what to look for.

Access point weaknesses

  • Physically insecure installation location

  • Stock omni-directional antenna that sends signals in every direction -- often where they don't need to go

  • Signal power level too high allowing radio signals to leak outside of your building

  • MAC address controls that are easily circumvented

  • WEP, WPA, or WPA2 not being used or not being used properly

  • Management interfaces that are publicly-accessible -- often with weak or no administrator password protection

Wireless client weaknesses

  • Windows systems not protected by a personal firewall that are sharing drives, providing various types of remote connectivity and missing critical software patches

  • Dual-homed systems that are connected to both the wired and wireless networks at the same time

  • Wireless clients with ad-hoc mode enabled

  • Printers installed on the wired network with wireless connectivity left enabled

Also, check out this free downloadable chapter of the book I co-authored,

    Requires Free Membership to View

Hacking Wireless Networks For Dummies, for information on network discovery via war driving.

Wireless network security testing

 Home: Introduction
 Step 1: Build your arsenal of tools
 Step 2: Search for weaknesses
 Step 3: Dig in deep to demonstrate the threat

ABOUT THE AUTHOR:
Kevin Beaver is an independent information security consultant and expert witness with Atlanta-based Principle Logic, LLC. He has more than 18 years of experience in IT and specializes in performing information security assessments revolving around compliance and IT governance. Kevin has authored/co-authored six books including Hacking For Dummies, Hacking Wireless Networks For Dummies, Securing the Mobile Enterprise For Dummies (all by Wiley), as well as The Practical Guide to HIPAA Privacy and Security Compliance (Auerbach). He can be reached at kbeaver@principlelogic.com..
Copyright 2006 TechTarget

This was first published in September 2006

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: