| War drivers are in the business of finding wireless | | | | occupied until you can track them down. There |
| access points, documenting them and uploading | | | | are many honeypot programs free and |
| their locations to the web. Why would someone | | | | commercial that will simulate networks or servers |
| do this, well for several reasons:First they want | | | | but are really just recording all the hackers' |
| free internet access. Next they could just be war | | | | information and types of attacks.6. Use a RADIUS |
| driving as a hobby; finally they could be targeting | | | | Server - RADIUS servers require Wireless clients |
| your network for financial gain. | | | | to authenticate with a username and password |
| One of the most asked questions is how do you | | | | not just with a PSK (Pre- Shared Key). With out a |
| stop hackers from trying to hack your wireless | | | | RADIUS server you really don't know who is on |
| lan and how to catch them in the act.Stopping | | | | your WLAN. With a RADIUS server you know |
| Wardrivers:1. Use directional antennas: One of the | | | | who is accessing your WLAN and when they |
| most under stated uses of directional antennas | | | | accessed it. Also a RADIUS server gives you the |
| are how they keep your wireless signal within | | | | ability of creating policies for times your WLAN |
| your area of operation. If you are using a Omni | | | | can be accessed and other required security |
| directional antenna that is causing half the signal to | | | | features the wireless clients must have enabled |
| travel outside your building, you have a major | | | | their computers.Now let's put this all together to |
| security problem. Also while using your wireless | | | | catch our hacker. First you are going through your |
| directional antenna turndown transmit power to | | | | daily routine of checking logs on your Kismet IDS |
| reduce your signal strength if you can.2. Blend | | | | server and you notice the same MAC address |
| your wireless antennas into your buildings | | | | probing networks but not joining. Next you check |
| architecture or keep them low profile. This is not | | | | your help tickets and notice that in one area of |
| expensive, the whole point is not letting your | | | | the building clients were having trouble connecting |
| antennas stick out like a sore thumb so anyone | | | | to the wireless network or they had trouble |
| driving by doesn't say, wow they have a wireless | | | | staying connected. |
| network. Once again the best way to stop people | | | | Flags go up in your head, so you go over to |
| from trying to hack your wireless network is to | | | | your honeypot server and check that . You notice |
| keep it hidden.3. Use Kismet or Airsnort - Make a | | | | it was accessed around the same time of the |
| cheap wireless Intrusion detection system. Use an | | | | Kismet logs showed a client probing the network. |
| older desktop computer install Linux, install a USB | | | | The honey pot recorded the MAC address of the |
| wireless adapter or PCI wireless adapter and | | | | WAR driver and the operating system and the |
| boom you have your wireless war driver stopper. | | | | computer name.Next you check your security |
| Both Kismet and airsnort will alert you when | | | | cameras for that time but don't really notice |
| wireless clients are probing your network. If a | | | | anything. So for the next couple days you keep |
| wireless client is using netstumber and not joining | | | | monitoring your honey pot server and watch the |
| networks they will be found by Kismet. Their | | | | hacker try and crack the WLAN and the |
| wireless adapters MAC address will be logged and | | | | database server. The whole process of cracking |
| other details of the operating system. Most of the | | | | wireless encryption is actually two steps. The first |
| time these could be false hits but if you notice a | | | | step is gathering enough packets for your |
| pattern of the same MAC address probing | | | | cracking program to crack. This whole process of |
| networks you could have hacker issues.4. | | | | gathering enough packets can takes days or |
| Security Cameras - No matter how hard you try | | | | weeks not five minutes. Now once you do have |
| not to have your signal bleed outside your | | | | enough packets 64 bit WEP encryption can be |
| operations area it will...to a point. Probe your own | | | | cracked in less that five minutes. 128 bit |
| network as if you were a wardriver. Don't just | | | | encryption can take many times longer, WPA |
| use a standard wireless adapter to find out where | | | | with TKIP and AES encryption can takes months |
| you still can detect your network. You will want | | | | to crack.My whole point is that you have some |
| to use a highly directional antenna to see how far | | | | time to catch your hacker because he will be |
| away you can detect your own network. Once | | | | back many times, assuming that you already |
| you know your weak points setup some cheap | | | | have at least the basic security features in place. |
| security cameras to monitor those areas.5. Setup | | | | Now once you have all your logs compiled and |
| a Honey Pot - Give the Wardriver what they | | | | your honey pot data you should have a good idea |
| want, a network to hack. Take an access point | | | | how the hacker behaves. Check your security |
| connect it to a standalone switch with another | | | | cameras and you probably notice the same car or |
| junk computer connected to that switch. Name | | | | person in the area around that time. Take that |
| the SSID something sounding important like | | | | information to your in house security and tell |
| server WLAN and name the computer Database. | | | | them to watch for that vehicle or person and call |
| Finally use a weak password or just leave the | | | | the police.If you are lucky security or police will |
| access point without any security. Script kiddies | | | | spot him and apprehend him. Convicting him or |
| who say they "hack networks" really are only | | | | her will be tough but with your compiled logs and |
| connecting to open wireless lans with no security. | | | | video you should have a lot of evidence to help |
| If you give them a "Important sounding SSID | | | | your case.Simple and secure wireless solutions. |
| with a "database to hack" this will keep them | | | | |