On 05/03/2010 06:46 AM, Scott Ehrlich wrote:
A question for the comm techies out there -
You have a wired network via a major provider - comcast, verizon, rcn,
etc, at your home.
I have Charter Cable.
Your neighbor (someone on your street) also subscribes to the same
provider. Can they see your traffic? Can you see theirs?
I just captured 5 minutes of packets and after filtering out traffic to
my network the only thing I saw was DHCP broadcasts and arp.
So, the short answer is "No, I can't." Traffic seems to be isolated.
For my provider. In my neighborhood. Right now. As long as no one is
poisoning the arp cache. YMMV :-)
This is an improvement because some years ago I recall seeing peoples
NETBIOS traffic -- to the point where I put an explicit ignore line in
my firewall rules to avoid filling up my disk with dropped packet logs.
None the less, paranoia....er....good security practices require me to
assume that someone at Charter will fat finger a configuration and
traffic will be visible or someone will intentionally crack in upstream
some where.
Thanks for any good educational insight on this. Depending on the
answer, it _might_ help sway me to consider wifi at home.
I'm going to spend a bit more time talking about the question you didn't
really ask -- WiFi security.
Overview:
* You can't make WiFi bullet-proof
* You can make the vulnerability irrelevant
* It's likely not necessary unless you live in Cambridge or Berkeley
or similar environment.
I haven't updated myself on state-of-the-art WiFi cracking in about a
year but I have done enough WiFi pen testing against my own networks to
realize that many of the common "just do this and you'll be secure" bits
of advice are effectively useless.
Take, for example, lack of SSID broadcast -- that only helps you when
you have no other traffic. My net always has some traffic, so a WiFi
sniffer (e.g. Netstumbler) will pick up network existence regardless of
SSID broadcast.
WEP is like securing your house by locking a screen door. WPA2 is more
like a solid front door, which means you'll keep out casual attackers
but anyone sitting nearby (such as a neighbor) has plenty of time to
crack in using a variety of detectable and undetectable methods.
There are some things you can monitor -- such as MACs appearing on your
net that you don't own -- that are a give-away for an attack. You can
also whitelist your own MACs and use a default exclude policy and feel
all warm and cozy until someone clones an existing MAC and gets on your
net anyway. There are some things which you theoretically could monitor
(such as WiFi retransmission rates) that could detect an attack but I
haven't found available to monitor in a home level WiFi device (though I
did not search exhaustively, because...)
I think the biggest problem in WiFi security is that home-class devices
have very slow patch cycles so any newly discovered vulnerability will
take a huge amount of wall time to patch and vendors aimed at the home
market have very little incentive to release security patches. A
secondary consideration is that they have a relatively low
power/transistor budget for complex security protocols.
My conclusion is that WiFi is inherently insecure and I should treat it
as such.
Therefore I put it on the *outside* of my firewall and use OpenVPN for
all clients I want to allow in to my network. I started down this path
when I got a TiVo Series 2 and discovered it didn't support WPA.
Doing this requires a bit more routing/firewalling than a typical home
WiFi router from Staples can handle out of the box. I use a book size
C7 based dual-NIC PC from NewEgg running Ubuntu Server to which I added
an extra USB NIC. This also gives me a good point to run various
monitoring apps, intelligently filter out IRC and outbound SMTP (except
from my mail server) and shape/control traffic.
However, I think you should be able to achieve this with alternate
firmware such as DD-WRT as well if you're willing to spend the time
figuring it out -- the hardware underlying e.g. a Linksys WRT series
router is pretty capable.
This setup means I can just "lock the screen door" and do nothing fancy
with MAC excludes (which are a pain), post my network key on the frig
for any of my geek friends who just have to have WiFi for their iPhone
when they come over, and incidentally because I don't take a lot of
steps to keep out the neighbors I can easily monitor for people who try
to break in to my system using the easy methods.
There are only a few problems with this setup:
1) I have to generate an OpenVPN key for all of my devices and install
OpenVPN. I had it deployed anyway for remote access, so it is
relatively small incremental cost.
2) My Mom was confused at why she could get to Google but her mail
server kept timing out and spent a few hours before she asked me
3) This is really all for my own amusement and that of 2 network savvy
neighbors -- other than my own pen testing, this neighborhood is either
so tame that no one has even tried to launch a break-in against my
network, or I've been totally pwned by the prep-school kiddies down the
street who's idea of amusement is swapping neighborhood lawn ornaments
after midnight.
4) I believe the threat environment for home WiFi (as opposed to
corporate WiFi) is much less harsh. There's little reason for a
knowledgeable attacker to try an individual home network and script
kiddies are should be fairly easy to detect.
Hope this helps,
--
Dewey
_______________________________________________
bblisa mailing list
[email protected]
http://www.bblisa.org/mailman/listinfo/bblisa
