On Tue, 23 Sep 2008, sth wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
...because I knew this group would appreciate it.
I tripped over a sober "mea culpa"[1] from Microsoft just now . (Note
their use of "non-broadcast networks", here, does not refer to the
Ethernet broadcast domain, but WLANs whose SSIDs are not broadcast by
the AP for clients to "hear" prior to association.)
- From a TechNet article[2]:
"When non-broadcast networks are used to hide a vulnerable wireless
network—such as one that uses open authentication and Wired Equivalent
Privacy—a Windows XP or Windows Server 2003-based wireless client can
inadvertently aid malicious users, who can detect the wireless network
SSID from the wireless client that is attempting to connect. Software
that can be downloaded for free from the Internet leverages these
information disclosures and targets non-broadcast networks."
Suddenly makes me feel all warm and fuzzy toward...oh, wait. No it
doesn't. ;-)
I wonder what Unices exhibit this behavior, too...
All of them.. I think its the nature of the information exchange in WEP..
When a
client tries to connect to a non-broadcasting SSID, it has to transmit the
SSID -- anyone listening can then hear the SSID.
I think they are saying that 'non-broadcast SSID' != 'secure SSID'.
B
Cheers,
- -sth
[1] http://en.wikipedia.org/wiki/Mea_culpa#Popular_meaning
[2] http://technet.microsoft.com/en-us/library/bb726942.aspx
sam hooker|http://www.noiseplant.com|i am between the internet
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkjY+wgACgkQX8KByLv3aQ1pfwCg36wtXVQMszdamD6zemkN6b53
Y8MAoPZWj5CDIURyu3IjawMXCO9pBqqE
=tc7Y
-----END PGP SIGNATURE-----
