3

There is a computer that is not mine that is accessible on my network. I can even access its filesystem via AFP. What I want to know is how the computer could get on my network. My network is secured like this:

screenshot

Does that mean that they've used password cracking tools? The pass is not easy to guess but not hard to figure out via brute-force hacking, I guess.

If I am being hacked, should I switch to WPA?

4
  • 6
    (Someone voted to move this to Server Fault, but I disagree. From its FAQ: Server Fault is for system administrators and IT professionals, people who manage or maintain computers in a professional capacity. If you are in charge of servers/networks/many desktop PCs (other than your own) then you're in the right place to ask your question! Well, as long as the question is about your servers, your networks, or desktops you support, anyway.)
    – Arjan
    Dec 21, 2010 at 12:36
  • 3
    Delete his files. He'll disconnect or disclose his identity eventually.
    – Daniel Beck
    Dec 21, 2010 at 12:41
  • 3
    Hmmm, instead of deleting, copying files and altering a bit might do the trick too? One might even find some photos to see which neighbour it is? (Now wondering if it's illegal in some countries to browse an unknown hard disk when someone connects to your computer.) Also, after having cracked WEP, it's a bit odd —or stupid— to have an AFP share open, so the things one finds might have been put there on purpose too?
    – Arjan
    Dec 21, 2010 at 13:14
  • 1
    @Arjan He even cracked the network to be able to share his data. Of course he wants others to access his data :-)
    – Daniel Beck
    Dec 21, 2010 at 16:33

3 Answers 3

10

WEP is laughably insecure; there's even a wikiHow article explaining how to crack WEP.

Consumer level WPA and WPA2 (both are forms of WPA-PSK), though, are also crackable. One can crack a weak WPA password by forcibly de-authenticating a connected computer then observing the traffic that the computer generates to reauthenticate. This gives the attacker enough data to perform a dictionary attack to get your wireless password.

If you use WPA with a strong password (long, uppercase and lowercase, numbers, symbols), you should be reasonably safe from people intruding in on your network.

2
  • 1
    "WPA and WPA2 (WPA-PSK)" might be read like "WPA2 is also known as WPA-PSK". That's not the case, is it? WPA-PSK is available in both WPA and WPA2. (Which makes me wonder what the WPA option in the screen capture is; if that doesn't work then @Yar should surely be able to use WPA-PSK in a home network.)
    – Arjan
    Dec 21, 2010 at 12:45
  • @Arjan good point, hopefully that edit makes it clearer. Dec 22, 2010 at 7:52
2

WEP has known weaknesses and should no longer be used. Switch to WPA (using a new password) as soon as possible.

0
1

The screenshot looks like an older version of the D-Link config interface I use – you're missing WPA2, and the radio selection is a drop-down in my interface. What you should do is:

  • Set SSID broadcast to disabled.
  • Switch to WPA.
  • Set up MAC filtering.
  • Update your firmware (Tools > Firmware > follow the instructions).
  • Switch to WPA2 if that option becomes available.

The end result is a network that does not advertise itself and requires both getting the security type and password correct and also that the connecting interface use an explicitly whitelisted MAC address.

To set up MAC filtering:

  • Go to Advanced > Filters.
  • Click on MAC filters.
  • Select to only allow the listed MAC addresses.
  • Populate the list with the MAC addresses of your machines using the drop-down and apply buttons.

The drop-down only lists the MAC addresses of interfaces that have connected in the past. When you later want to connect a new computer, or connect an old one via a new interface, you'll have to find a way to get the MAC address for the interface you want to use from the machine yourself; the router won't be able to help you out. Once you have it, you just type it in along with a name and add it to the list.

I get the MAC address using ifconfig en0 or ifconfig en1 (as appropriate) on my Mac; you can likely use ipconfig under Windows, but the MAC address is undoubtedly exposed in some graphical UI somewhere on every consumer system you'll want to connect to the router.

MAC spoofing is still a possibility, but if someone is that determined to get on your network, you'll either need to create a much more clever setup or just switch to using a cabled network.

4
  • 1
    You should mention that MAC filters are a real pain e.g. when having friends over or when trying to enjoy the new wireless gadgets Santa brought.
    – Daniel Beck
    Dec 21, 2010 at 20:13
  • not that much of a pain... very simple actually you just shut down MAC filtering when they're getting connected (usually just a few clicks), let them connect, then enable MAC filtering including the new mac address that is connected. If it's like anything I've used before, when you disable then re-able, the list of previous MACs will still be there.
    – g19fanatic
    Dec 21, 2010 at 20:32
  • 1
    MAC filtering is also useless for security, as the attacker can sniff connected clients' MACs. Still, it can protect against the least clueful attackers (script kiddies who haven't found the right scripts). Dec 22, 2010 at 0:06
  • I believe MAC filtering is conceptually wrong and shouldn't exist.
    – cregox
    Apr 1, 2011 at 17:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .