There seems to be a mix of good/bad/miss information
changing your default router IP does nothing to secure your router since anyone on your network can either listen to network traffic and get the info or just brute-force IP scan.
Locking your router down to a list of MAC addresses can help, but anyone hacking your wireless network will just listen to the traffic and grab one of the mac addresses that are currently broadcasting data. Your router just ignores any mac address that doesn't match your list. but when your wireless device send data to your router, it broadcasts it's own mac address and someone can just read that and change their mac address to match yours.
Disabling SSID broadcast is a VERY good step in the right direction. It makes it quite a bit harder to figure out if there is a network to break into.
Anyone, who is set out to get free internet from someone, will just have some easily downloadable software that will listen to all wireless traffic and can pick up a network name by watching traffic patterns. If you use a wireless device, it has to communicate with your router and that traffic can be listened to.
Now that you're not broadcasting your SSID, you need to password protect your connection. WPA2 uses AES encryption. The non-AES encryption can be broken given enough time. The weaker encryption used by the older wireless protocols can be broken by listening to large amounts of data. Once someone has your SSID, then can have a device just sit and record all of your data. There is A LOT of data that is always the same in network packets. Being that people know what data to expect, they just listen to your wireless network for a few days, collect the data, and break your password based on knowing what the data should look like. AES is crazy hard to do this, but the older encryptions are relatively easy.
nutshell: disable SSID broadcasting, use WPA2 with AES (decent password)
While that may be true, to hack the network they need the key. They can listen to the traffic all they want It does them no good If they cant break the encryption-or If it re-keys before enough packets are obtained, The network is still secure. In my case the algorithm for the Temporal key renews
every 600 seconds.(by the time they crack the key it would already be changed). Researchers have found a way to break the Temporal Key Integrity Protocol (TKIP) key used by WPA in a matter of twelve to fifteen minutes. They have
not yet managed to crack the encryption keys used to secure data that goes from the PC to the router. Security experts had known that TKIP could be cracked using what's known as a dictionary attack. Using massive computational resources, the attacker essentially cracks the encryption by making an extremely large number of educated guesses as to what key is being used to secure the wireless data.
Dictionary/brute force attacks will not crack an encryption key that is random like this, and will have difficulty with a temporal key that renews and changes every 10 minutes:
0z417swWM1'@((H#3$J]{,GOBW248+_@#fsdVXPq34012
Beck-Tews attacks (as well as others) operate on the premise that a long re-keying interval is used for TKIP (i.e., default 3600 seconds), this re-keying Interval must be changed.
The Aircr***-ng cracks utilize
WEP (
Brute-force search) and
WPA (Dictionary File) keys breakers.
Effectively the only way to break WPA is to brute force it, so if you have a long key with letter, numbers and symbols in you are in effect making it logistically impossible to crack. It is important to also set the TKIP renewal to 600 Seconds.
How to secure WPA PSK
1. Block anonymous internet requests
2.You can disable SSID Broadcast (I leave mine enabled though-as it makes it easier to reconnect to network in the event I repair/disconnect from network)
3. Do not use default SSID- change it
4.I use WPA TKP with a randomly manual generated 40+ digit string consisting of Numbers/symbols/letters/caps/lower case-Not an auto generated string (back it up, and
store it somewhere safe- like a encrypted/protected drive)
5.Enable MAC Filtering to allow only those IP's you add to the access list (i.e., networked computers)
6. Disable remote Admin/Disable Remote upgrade/Disable UPnP
7. Set alpha/numeric random password to router that is no less than 8 digits.
8.
THIS IS VERY IMPORTANT!-TKIP re-keying Interval must be reset to 600 seconds (or less)
"...the frst practical attack on WPA secured wireless networks, besides
launching a dictionary attack when a weak pre shared key (PSK) is used-
The attack works if the network is using TKIP to encrypt the traffic. An
attacker, who has
about 12-15 minutes access to the network is then able
to decrypt an ARP request or response and send 7 packets with custom
content to network."
Eircom default wireless configuration is still insecure - boards.ie
http://www.infoworld.com/d/security-central/once-thought-safe-wpa-wi-fi-encryption-cracked-635
http://dl.aircrack-ng.org/breakingwepandwpa.pdf
