4

I'm responsible for configuring a small business network (50-60 devices) and we have some ancient devices that must connect wirelessly to the network. Our regular wireless accepts AES WPA and WPA2 only, but I've configured a Virtual AP with a hidden SSID pulling from the same DHCP pool as our endpoints for the older devices that don't support AES.

The password for the TKIP network is much longer and more complicated, but what I'm wondering is does this increase the security of a WPA TKIP Access Point? Or are the vulnerabilities of WPA-TKIP not substantially mitigated by increasing the length of the PSK? If not, what else can I do to reduce the risk of malicious connections or attacks to this Access Point?

Improve this question
3
  • I'm curious to know the details of these devices that support TKIP but not AES. In my experience, there were vanishingly few devices that fit that description. I'd like to add your devices to my list.
    – Spiff
    Apr 16, 2015 at 0:50
  • The device we've had an issue with is a really old MacBook, an A1260. It's also running Bootcamp so it's possible it has to do with the Windows 7 drivers we're using. It had consistently given us problems over the Wifi which uses WPA and WPA2 AES, but seems to connect fine to the AP using TKIP.
    – AlecDL
    Apr 16, 2015 at 17:52
  • It definitely must be your Windows drivers. Macs have supported WPA2 since c. 2003, and it's always been rock solid. I was expecting you to say you had an old 802.11b-only clamshell iBook from 1999 or something.
    – Spiff
    Apr 16, 2015 at 20:49

1 Answer 1

Reset to default
1

A more complex password will help, as the common attacks on WPA are offline dictionary attacks - you may wish to download the common dictionaries to confirm your password isn't in them.

If there are a limited number of devices Mac filtering might be appropriate and using a fixed IP address.

The other measures would be physical ones; - restrict the signal strength - use a directional antenna to restrict the angle and if you want to get carried away... - Shielding (Faraday cage etc.) round the office.

All these are of limited benefit (especially vs cost) against a determined attacker (as is hiding the SSID), but would increase the complexity to a "not worth the effort" in for an opportunistic.

You might wish to look at restricting access from the WPA Access Point to the rest of your network, that way any breach would be restricted in impact. I'd assume that the legacy device has a specific role? If so you can look at setting blocking un-required ports etc.

Again this increases the cost benefit ratio for the attacker.

Improve this answer
2
  • My research reinforced this as well, reading documentation on aircrack-ng suggests TKIP's main weakness is still dictionary attacks and that the longer passwords will thwart this type of attack. Downloading dictionaries and searching for an included password is a good idea, and I think I'm going to use MAC filtering as that's going to be the safest option. Thanks for the assistance.
    – AlecDL
    Jun 2, 2015 at 15:30
  • remember MAC addresses can be spoofed, one other thought was that if continuous access is not required schedule the AP to be off out of hours.
    – Nate
    Jun 2, 2015 at 15:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .