What are the dangers of running a wireless router with no encryption?

Question

I have an Airport Extreme and I've been having trouble running with WPA2 encryption. It intermittently loses the connection to the router. I turned encryption off and the problem seems to have gone away. I used to run with an open network all the time, and never really worried about it because I'm on a VPN most of the time. However, my new roommates aren't so keen on the idea. They're worried that it might be possible to connect to the same router and gain access to whatever they're working on. Would doing something like running under promiscuous mode give an attacker this kind of access, or do they have nothing to worry about?

Update: How much would MAC-address checking give me?

Answer 1

Though, I don't personally agree that WEP is no security, it's better than nothing. We can agree that easily hacked, but, I don't believe that there are WEP cracking gremlins running up and down the street hacking WEP encrypted APs (if there are, I demand pics!). Will it stop the average person from mistakingly connecting to your AP? Yes. Is it a good form of encrypting your data over the wire? No. WEP just uses a single key and XORs your data with it...it may be easily hacked but its better than nothing. WEP is like going to a jousting with just your clothes on, it may not help but its better than going there naked.

Having NO SECURITY is like leaving your front door open. Izzy made some good points. And to expand on MITM attacks, assuming there are gremlins who really want to mess with you, they can change DNS servers to their servers. This means that when you goto chase.com you will query their DNS server which will take you to a fake site. SSL wont even be able to protect you in this case either because the attackers chase.com wont have a certificate to present. The average person won't ever notice this.

If you don't want to use ANY encryption, then MAC address checking would be the best bet. I would personally try WPA and see if that is any better. Again, your data will be sent in the clear over the air if you just use MAC address checking, which any of the gremlins can possibly sniff.

Now the other question is really location. Are you in the middle of nowhere with the nearest neighbor miles away? I would say it would be safe to run without any protection. If you live in downtown Chicago and you can touch your neighbors house by just reaching outside your window, I would highly recommend that you use WPA2 or get a new router.

Answer 2

A linkpost about wi-fi security, in the begining of the "Security Now" podcasts series they discussed this topic (and it is quite good intro even thou it's from 2005).

• http://www.grc.com/securitynow.htm

The episodes I am thinking about is

• Episode #10 Open Wireless Access Points
• Episode #11 Bad WiFi Security (WEP and MAC address filtering)
• Episode #13 Unbreakable WiFi Security

---

Update: MAC-address filtering is pointless since it is false security, better to stay open and knowing the problems but to think you are safe when you are not...

Answer 3

If you use nothing (or WEP - same thing) you are open to other people connecting to your network, browsing your machine shares, and worse. It's a very real possibility that someone will use your connection to engage in illegal activities. To the outside world (read: the police) it's you that broke the law until you can prove otherwise. Downloading pirated materials, child porn etc.

It's also possible for man-in-the-middle attacks to be initiated this way.

Answer 4

WEP is uncrackable under these conditions:

If your pass-phrase is > 21 characters, whoever plans to crack your wireless AP or wireless router better have mad patient skills.

In the paper "Practical Attacks Against WEP & WPA" the authors emphasize that the PSK key has to be "weak" in order for this to work at the begining of the paper; in addition, to the fact that the clients must be using WPA+TKIP to associate to the AP or wireless router .

However, In 2003 Robert Moskowitz of ISCA Labs detailed the potential problems of deploying weak passwords/passphrases with WPA in his paper: "Weakness in Passphrase Choice in WPA Interface," where Moskowitz points out that a short passphrase < 21 characters is susceptible to a dictionary attack.

Furthermore, I also thought that this was an interesting statement at the end of the paper: " Practical attacks against WEP and WPA,"- "Our attack on TKIP in Section 5 shows that even WPA with a "strong" password is not 100% secure and can be attacked in a real world scenario."

So one would have to ask, how long was the password/passphrase they tested in their paper "Practical attacks against WEP and WPA."

And how long will it take to crack a passphrase that is greater than 21 characters, especially in Cynicalpsycho's case where the passphrase has a combination of alphanumeric characters+space+and other random symbols.

Maybe a lab is in order , never mind will never happen, I use WEP with a passphrase > 21 characters. Patiently waiting for someone to hack my AP/Router never going to happen, maybe I will be lucky and get hacked via my web browser or some zero-day vulnerability for one of my unpatched applications.

http://forums.remote-exploit.org/latest-public-release-backtrack4-beta/22280-wpa2-cracking-can-cracked-how.html

Mac filtering is silly if you want to secure you router this could help in combination with other strong security measures; however, if you think just using this with your AP/Router open, this might be a bad idea.

http://blogs.techrepublic.com.com/security/?p=395

Solution: regardless if you plan to filter you MAC's or not, you can use WPA or WEP, just make sure you have a strong pass-phrase not a password.

Get creative:http://www.iusmentis.com/security/passphrasefaq/strength/

Tools to test you newly created pass-phrase:

Video sucks, you can just Google Gerix Wifi Cracker on Youtube for a live demo, we went from typing commands to crack WEP/WPA to using scripts, now we are using GUI driven tools on Linux :-).

Or try this:

http://security-sh3ll.blogspot.com/2009/06/gerix-wifi-cracker.html

Only requirement: Gerix runs on Linux or Windows if you are into virtualization and whatnot.

Happy testing people, and stay secure...

Answer 5

MAC-address checking will give some additional protection, proof against most people, but not against professionals using MAC spoofing.

See for example:
How to Change or Spoof MAC Address in Windows XP, Vista, Server 2003/2008, Mac OS X, Unix and Linux

However, I believe that in the event you are MAC spoofed, you'll probably notice some weird behavior when the hacker and you are both online at the same time.

Conclusion: It adds to your protection and is easy to parameter, which is good, but is no barrier to a professional with the right tools.