| War drivers are in the business of finding wireless | | | | you can track them down. There are many honeypot |
| access points, documenting them and uploading their | | | | programs free and commercial that will simulate |
| locations to the web. Why would someone do this, well | | | | networks or servers but are really just recording all the |
| for several reasons:First they want free internet | | | | hackers' information and types of attacks.6. Use a |
| access. Next they could just be war driving as a | | | | RADIUS Server - RADIUS servers require Wireless |
| hobby; finally they could be targeting your network for | | | | clients to authenticate with a username and password |
| financial gain. | | | | not just with a PSK (Pre- Shared Key). With out a |
| One of the most asked questions is how do you stop | | | | RADIUS server you really don't know who is on your |
| hackers from trying to hack your wireless lan and how | | | | WLAN. With a RADIUS server you know who is |
| to catch them in the act.Stopping Wardrivers:1. Use | | | | accessing your WLAN and when they accessed it. |
| directional antennas: One of the most under stated | | | | Also a RADIUS server gives you the ability of creating |
| uses of directional antennas are how they keep your | | | | policies for times your WLAN can be accessed and |
| wireless signal within your area of operation. If you are | | | | other required security features the wireless clients |
| using a Omni directional antenna that is causing half the | | | | must have enabled their computers.Now let's put this all |
| signal to travel outside your building, you have a major | | | | together to catch our hacker. First you are going |
| security problem. Also while using your wireless | | | | through your daily routine of checking logs on your |
| directional antenna turndown transmit power to reduce | | | | Kismet IDS server and you notice the same MAC |
| your signal strength if you can.2. Blend your wireless | | | | address probing networks but not joining. Next you |
| antennas into your buildings architecture or keep them | | | | check your help tickets and notice that in one area of |
| low profile. This is not expensive, the whole point is not | | | | the building clients were having trouble connecting to |
| letting your antennas stick out like a sore thumb so | | | | the wireless network or they had trouble staying |
| anyone driving by doesn't say, wow they have a | | | | connected. |
| wireless network. Once again the best way to stop | | | | Flags go up in your head, so you go over to your |
| people from trying to hack your wireless network is to | | | | honeypot server and check that . You notice it was |
| keep it hidden.3. Use Kismet or Airsnort - Make a | | | | accessed around the same time of the Kismet logs |
| cheap wireless Intrusion detection system. Use an | | | | showed a client probing the network. The honey pot |
| older desktop computer install Linux, install a USB | | | | recorded the MAC address of the WAR driver and |
| wireless adapter or PCI wireless adapter and boom | | | | the operating system and the computer name.Next |
| you have your wireless war driver stopper. Both | | | | you check your security cameras for that time but |
| Kismet and airsnort will alert you when wireless clients | | | | don't really notice anything. So for the next couple |
| are probing your network. If a wireless client is using | | | | days you keep monitoring your honey pot server and |
| netstumber and not joining networks they will be found | | | | watch the hacker try and crack the WLAN and the |
| by Kismet. Their wireless adapters MAC address will | | | | database server. The whole process of cracking |
| be logged and other details of the operating system. | | | | wireless encryption is actually two steps. The first step |
| Most of the time these could be false hits but if you | | | | is gathering enough packets for your cracking program |
| notice a pattern of the same MAC address probing | | | | to crack. This whole process of gathering enough |
| networks you could have hacker issues.4. Security | | | | packets can takes days or weeks not five minutes. |
| Cameras - No matter how hard you try not to have | | | | Now once you do have enough packets 64 bit WEP |
| your signal bleed outside your operations area it will...to | | | | encryption can be cracked in less that five minutes. |
| a point. Probe your own network as if you were a | | | | 128 bit encryption can take many times longer, WPA |
| wardriver. Don't just use a standard wireless adapter | | | | with TKIP and AES encryption can takes months to |
| to find out where you still can detect your network. | | | | crack.My whole point is that you have some time to |
| You will want to use a highly directional antenna to see | | | | catch your hacker because he will be back many |
| how far away you can detect your own network. | | | | times, assuming that you already have at least the |
| Once you know your weak points setup some cheap | | | | basic security features in place. |
| security cameras to monitor those areas.5. Setup a | | | | Now once you have all your logs compiled and your |
| Honey Pot - Give the Wardriver what they want, a | | | | honey pot data you should have a good idea how the |
| network to hack. Take an access point connect it to a | | | | hacker behaves. Check your security cameras and |
| standalone switch with another junk computer | | | | you probably notice the same car or person in the |
| connected to that switch. Name the SSID something | | | | area around that time. Take that information to your in |
| sounding important like server WLAN and name the | | | | house security and tell them to watch for that vehicle |
| computer Database. Finally use a weak password or | | | | or person and call the police.If you are lucky security or |
| just leave the access point without any security. Script | | | | police will spot him and apprehend him. Convicting him |
| kiddies who say they "hack networks" really are only | | | | or her will be tough but with your compiled logs and |
| connecting to open wireless lans with no security. If | | | | video you should have a lot of evidence to help your |
| you give them a "Important sounding SSID with a | | | | case.Simple and secure wireless solutions. |
| "database to hack" this will keep them occupied until | | | | |