How to Crack a Wi-Fi Network's WPA Password with Reaver via lifehacker.com

Your Wi-Fi network is your conveniently wireless gateway to the internet, and since you're not keen on sharing your connection with any old hooligan who happens to be walking past your home, you secure your network with a password, right? Knowing, as you might, how easy it is to crack a WEP password, you probably secure your network using the more bulletproof WPA security protocol.

Here's the bad news: A new, free, open-source tool called Reaver exploits a security hole in wireless routers and can crack most routers' current passwords with relative ease. Here's how to crack a WPA or WPA2 password, step by step, with Reaver—and how to protect your network against Reaver attacks.

In the first section of this post, I'll walk through the steps required to crack a WPA password using Reaver. You can follow along with either the video or the text below. After that, I'll explain how Reaver works, and what you can do to protect your network against Reaver attacks.

First, a quick note: As we remind often remind readers when we discuss topics that appear potentially malicious: Knowledge is power, but power doesn't mean you should be a jerk, or do anything illegal. Knowing how to pick a lock doesn't make you a thief. Consider this post educational, or a proof-of-concept intellectual exercise. The more you know, the better you can protect yourself.

What You'll Need

You don't have to be a networking wizard to use Reaver, the command-line tool that does the heavy lifting, and if you've got a blank DVD, a computer with compatible Wi-Fi, and a few hours on your hands, you've got basically all you'll need. There are a number of ways you could set up Reaver, but here are the specific requirements for this guide:

• 

  The BackTrack 5 Live DVD. BackTrack is a bootable Linux distribution that's filled to the brim with network testing tools, and while it's not strictly required to use Reaver, it's the easiest approach for most users. Download the Live DVD from BackTrack's download page and burn it to a DVD. You can alternately download a virtual machine image if you're using VMWare, but if you don't know what VMWare is, just stick with the Live DVD. As of this writing, that means you should select BackTrack 5 R1 from the Release drop-down, select Gnome, 32- or 64-bit depending on your CPU (if you don't know which you have, 32 is a safe bet), ISO for image, and then download the ISO.

• A computer with Wi-Fi and a DVD drive. BackTrack will work with the wireless card on most laptops, so chances are your laptop will work fine. However, BackTrack doesn't have a full compatibility list, so no guarantees. You'll also need a DVD drive, since that's how you'll boot into BackTrack. I used a six-year-old MacBook Pro.
• A nearby WPA-secured Wi-Fi network. Technically, it will need to be a network using WPA security with the WPS feature enabled. I'll explain in more detail in the "How Reaver Works" section how WPS creates the security hole that makes WPA cracking possible.
• A little patience. This is a 4-step process, and while it's not terribly difficult to crack a WPA password with Reaver, it's a brute-force attack, which means your computer will be testing a number of different combinations of cracks on your router before it finds the right one. When I tested it, Reaver took roughly 2.5 hours to successfully crack my password. The Reaver home page suggests it can take anywhere from 4-10 hours. Your mileage may vary.

Let's Get Crackin'

At this point you should have BackTrack burned to a DVD, and you should have your laptop handy.

Step 1: Boot into BackTrack

To boot into BackTrack, just put the DVD in your drive and boot your machine from the disc. (Google around if you don't know anything about live CDs/DVDs and need help with this part.) During the boot process, BackTrack will prompt you to to choose the boot mode. Select "BackTrack Text - Default Boot Text Mode" and press Enter.

Eventually BackTrack will boot to a command line prompt. When you've reached the prompt, type startx and press Enter. BackTrack will boot into its graphical interface.

Step 2: Install Reaver

Reaver has been added to the bleeding edge version of BackTrack, but it's not yet incorporated with the live DVD, so as of this writing, you need to install Reaver before proceeding. (Eventually, Reaver will simply be incorporated with BackTrack by default.) To install Reaver, you'll first need to connect to a Wi-Fi network that you have the password to.

1. Click Applications > Internet > Wicd Network Manager
2. Select your network and click Connect, enter your password if necessary, click OK, and then click Connect a second time.

Now that you're online, let's install Reaver. Click the Terminal button in the menu bar (or click Applications > Accessories > Terminal). At the prompt, type:

apt-get update

And then, after the update completes:

apt-get install reaver

If all went well, Reaver should now be installed. It may seem a little lame that you need to connect to a network to do this, but it will remain installed until you reboot your computer. At this point, go ahead and disconnect from the network by opening Wicd Network Manager again and clicking Disconnect. (You may not strictly need to do this. I did just because it felt like I was somehow cheating if I were already connected to a network.)

Step 3: Gather Your Device Information, Prep Your Crackin'

In order to use Reaver, you need to get your wireless card's interface name, the BSSID of the router you're attempting to crack (the BSSID is a unique series of letters and numbers that identifies a router), and you need to make sure your wireless card is in monitor mode. So let's do all that.

Find your wireless card: Inside Terminal, type:

iwconfig

Press Enter. You should see a wireless device in the subsequent list. Most likely, it'll be named wlan0, but if you have more than one wireless card, or a more unusual networking setup, it may be named something different.

Put your wireless card into monitor mode: Assuming your wireless card's interface name is wlan0, execute the following command to put your wireless card into monitor mode:

airmon-ng start wlan0

This command will output the name of monitor mode interface, which you'll also want to make note of. Most likely, it'll be mon0, like in the screenshot below. Make note of that.

Find the BSSID of the router you want to crack: Lastly, you need to get the unique identifier of the router you're attempting to crack so that you can point Reaver in the right direction. To do this, execute the following command:

airodump-ng wlan0

You'll see a list of the wireless networks in range—it'll look something like the screenshot below:

When you see the network you want, press Ctrl+C to stop the list from refreshing, then copy that network's BSSID (it's the series of letters, numbers, and colons on the far left). The network should have WPA or WPA2 listed under the ENC column. (If it's WEP, use our previous guide to cracking WEP passwords.)

Now, with the BSSID and monitor interface name in hand, you've got everything you need to start up Reaver.

Step 4: Crack a Network's WPA Password with Reaver

Now execute the following command in the Terminal, replacing bssid and moninterface with the BSSID and monitor interface and you copied down above:

reaver -i moninterface -b bssid -vv

For example, if your monitor interface was mon0 like mine, and your BSSID was 8D:AE:9D:65:1F:B2 (a BSSID I just made up), your command would look like:

reaver -i mon0 -b 8D:AE:9D:65:1F:B2 -vv

Press Enter, sit back, and let Reaver work its disturbing magic. Reaver will now try a series of PINs on the router in a brute force attack, one after another. This will take a while. In my successful test, Reaver took 2 hours and 30 minutes to crack the network and deliver me with the correct password. As mentioned above, the Reaver documentation says it can take between 4 and 10 hours, so it could take more or less time than I experienced, depending. When Reaver's cracking has completed, it'll look like this:

A few important factors to consider: Reaver worked exactly as advertised in my test, but it won't necessarily work on all routers (see more below). Also, the router your cracking needs to have a relatively strong signal, so if you're hardly in range of a router, you'll likely experience problems, and Reaver may not work. Throughout the process, Reaver would sometimes experience a timeout, sometimes get locked in a loop trying the same PIN repeatedly, and so on. I just let it keep on running, and kept it close to the router, and eventually it worked its way through.

Also of note, you can also pause your progress at any time by pressing Ctrl+C while Reaver is running. This will quit the process, but Reaver will save any progress so that next time you run the command, you can pick up where you left off-as long as you don't shut down your computer (which, if you're running off a live DVD, will reset everything).

How Reaver Works

Now that you've seen how to use Reaver, let's take a quick overview of how Reaver works. The tool takes advantage of a vulnerability in something called Wi-Fi Protected Setup, or WPS. It's a feature that exists on many routers, intended to provide an easy setup process, and it's tied to a PIN that's hard-coded into the device. Reaver exploits a flaw in these PINs; the result is that, with enough time, it can reveal your WPA or WPA2 password.

Read more details about the vulnerability at Sean Gallagher's excellent post on Ars Technica.

How to Protect Yourself Against Reaver Attacks

Since the vulnerability lies in the implementation of WPS, your network should be safe if you can simply turn off WPS (or, even better, if your router doesn't support it in the first place). Unfortunately, as Gallagher points out as Ars, even with WPS manually turned off through his router's settings, Reaver was still able to crack his password.

In a phone conversation, Craig Heffner said that the inability to shut this vulnerability down is widespread. He and others have found it to occur with every Linksys and Cisco Valet wireless access point they've tested. "On all of the Linksys routers, you cannot manually disable WPS," he said. While the Web interface has a radio button that allegedly turns off WPS configuration, "it's still on and still vulnerable.

So that's kind of a bummer. You may still want to try disabling WPS on your router if you can, and test it against Reaver to see if it helps.

You could also set up MAC address filtering on your router (which only allows specifically whitelisted devices to connect to your network), but a sufficiently savvy hacker could detect the MAC address of a whitelisted device and use MAC address spoofing to imitate that computer.

Double bummer. So what will work?

I have the open-source router firmware DD-WRT installed on my router and I was unable to use Reaver to crack its password. As it turns out, DD-WRT does not support WPS, so there's yet another reason to love the free router-booster. If that's got you interested in DD-WRT, check their supported devices list to see if your router's supported. It's a good security upgrade, and DD-WRT can also do cool things like monitor your internet usage, set up a network hard drive, act as a whole-house ad blocker, boost the range of your Wi-Fi network, and more. It essentially turns your $60 router into a $600 router.

Further Reading

Thanks to this post on Mauris Tech Blog for a very straightforward starting point for using Reaver. If you're interested in reading more, see:

• Ars Technia's hands on
• This Linux-centric guide from Null Byte
• The Reaver product page (it's also available in a point-and-click friendly commercial version.

Reddit user jagermo (who I also spoke with briefly while researching Reaver) has created a public spreadsheat intended to build a list of vulnerable devices so you can check to see if your router is susceptible to a Reaver crack.

Have any experience of your own using Reaver? Other comments or concerns? Let's har it in the comments.

via lifehacker.com

Posted via email from ://allthings-bare

Firesheep Sniffs Out Facebook and Other User Credentials on Wi-Fi Hotspots via lifehacker.com

Firefox: Firesheep sniffs out and steals cookies—and the account and identity of the owner in the process—of popular web sites (like Facebook and Twitter) from the browsing sessions of other users on the Wi-Fi hotspot you're attached to.

Firesheep is a proof-of-concept Firefox extension created by Eric Butler to show how leaky the security many popular web sites (like Facebook, Flickr, Amazon.com, Dropbox, Evernote, and more) employ is. The problem, as Firesheep shockingly demonstrates, is that many web sites only encrypt your login. Once you are logged in they use an unsecured connection with a simple cookie check. Anyone from your IP address (that of the Wi-Fi hotspot) with that cookie can be you. When using Firesheep on a public hot spot any session it can intercept is displayed in the Firesheep pane with the user's name and photograph (when available). Simply click on their name to intercept the session and start browsing the website as though you are them.

What can you do to protect yourself against such a painfully easy attack against your privacy and security? You can set up an SSH SOCKS proxy to encrypt your traffic, effectively sending your site sessions and accompanying cookies through a sniff-proof tunnel. For a less involved alternative, however, you could use something like the previously mentioned HTTPS Everywhere Firefox extension or Force-TLS (highlighted by TechCrunch). Essentially, these extensions will force popular sites to send data via the more secure HTTPS protocol, which encrypts data as it's sent, and while it's slightly slower, it's definitely worth using HTTPS when available.

Firesheep is free, works wherever Firefox does, and requires a wireless card capable of operating in promiscuous mode.

Firesheep [Code Butler via TechCrunch]

via lifehacker.com

Posted via email from ://allthings-bare

Know Your Network, Lesson 4: Access Your Home Computers from Anywhere via lifehacker.com

via lifehacker.com

You've picked out your hardware and set up the basics, and configured your network to perform at its best and fastest. Now it's time to open the gates to the outside world. In this lesson, we're going to walk you through how to set up your router so you access your home computers from anywhere—and with your own friendly, easy-to-remember URL.

Setting up remote access to your local network is one of the coolest things you can do with your router, as it allows you to remotely view your screen, access files, control services like BitTorrent remotely, and so on. Basically, anything you can do at home can be made possible by just opening a few ports on your router. It can seem a little daunting if you've never done it before, but once you understand what everything means and where to find the information you need, you should have no trouble getting things to work. We're going to go over basic setup and then talk briefly about a few bonus options as well.

Port Forwarding and More

By default, your local network is local and cut off from the rest of the internet. In most cases you have just one IP address that's shown to the world, despite the many that your router distributes to your individual computers and devices locally. What port forwarding does is take a port on that shared IP address that's available to the rest of the web and forwards it to one of your local machines. This lets people from outside access services on your local network.

Setting up port forwarding is pretty straightforward, but before you get started, you need to know what ports you want to open up. Most of the time, you'll set up port forwarding on an as-needed basis—say after you've set up a new service on your computer For example, if you're trying to run a web server off your machine you'll need to open up port 80. If you want to open up SSH access, you'll need to open up port 22. Those are just two of many possibilities, and you probably don't have every port for every service memorized.

This is where a site like PortForward.com can help, as it provides a handy list of common ports for specific services. You can use this list to check which ports you need to open for whatever services you want to make available from outside your home network.

Once you've figured out all the ports you want to open, just head on over to the port forwarding section of your router (if you don't know where it is, just click around a little). In DD-WRT, it's in the NAT & QoS section. Other routers may list it simply as Port Forwarding (all on its own) or Virtual Servers. Let's take a look at what a filled-out port forwarding table looks like:

While things may differ slightly depending on your router's firmware, this table is pretty standard. Here's what all of those fields mean:

1. Application - The name of the application you're forwarding this port for. You can use any descriptive text you want—this field is here to help you remember why you set this up; like the name suggests, you normally want to use the name of the application you're setting up port forwarding for. I also include my computer's name along with the service, since I forward ports for the same applications on different computers. For example, you'll see VNC service set up for both Grey and Hunter. I include their names in the Application section so I know which port forwarding rule is for which computer.
2. Port to - "Port to" is the port on your local IP address. If you were setting up VNC for a local computer, you'd fill this in with 5900 as that's the port number VNC uses.
3. Port from - "Port from" is the port on your external IP address. Generally you'll also enter the same port as you would in the "Port to" field. This works just fine when you're configuring only one machine for one type of service. But say you wanted to be able to remotely access two or more computers using VNC. If you used 5900 on a single, external IP address they would be in conflict. The router would see a request for port 5900 and not know which local IP address should handle that request since the port forwarding table has two. To solve this problem, you can use the standard port for one and not for the other—kind of like an apartment building has a single address but multiple apartments. As you can see in the sample routing table above, Grey's "Port from" is set to 5900 while Hunter's "Port from" is set to 5901. If you try to use VNC normally on my external IP address, you'll be asked to log in to Grey because it uses the standard port. If you want to access Hunter, however, you can easily do so by just using port 5901 instead of the default. This way you can set up identical services with a single external IP address without conflicts.
4. Protocol - This is where you specify whether or not your service uses the TCP protocol, UDP protocol, or both. When you look up your ports you'll also want to make note of the protocols used. In most cases it will just be TCP.
5. IP Address - This is where you specify the LAN (local area network) IP address of the computer you want to use for this port forwarding rule. You can easily find this information in your computer's network settings. The IP address will generally be in the 192.168.x.x or 10.0.x.x format. Because these IP address are generally dynamic (meaning they can change), you'll want to either set up static IP addresses or DHCP reservations. More information on that is available below.
6. Enable - You need to check this box to enable the port forwarding rule. If you don't check it, you'll still be able to save the rule but it won't be active or function in any way.

Now that you understand what these fields mean, click the "Add" button at the bottom to add a new port forwarding rule. Fill everything out with the desired information (such as port 21 for FTP, 22 for SSH, 5900 for VNC, etc.) and don't forget to check the enable box to make sure everything works. When you're done entering all your rules, save it and you're all set.

Port Range Forwarding

Sometimes you want to open a range of ports on a particular machine and not just one at a time. Some routers offer the option of port range forwarding in addition to regular old port forwarding (like we just discussed). This works in the same way, except you specify a range (e.g. ports 21 - 80).

The DMZ

DMZ stands for De-Militarized Zone and is a simple way to open up every port on a single computer. If your router has this feature, just visit the DMZ page and enter that computer's IP address. While convenient if you only have one computer you want available for remote access, this isn't very secure. You're essentially allowing any kind of traffic to be forwarded to this machine. Even if you only have one computer, you're still better off manually entering each service you want to open. Only use this if you really have a good reason to do so.

DHCP Reservations

One of the annoying aspects of port forwarding is that your router dynamically assigns IP addresses to your computers. That means the local IP addresses of you computers may change, which can render that port forwarding you did incorrect or non-functional. While setting up static IP addresses on your local machine is one option, DHCP reservations are better if you've got the option in your router. This is common in Linksys and D-Link routers but generally not included in Belkin. It's also available in DD-WRT in the Services section, but it's easy to miss.

DHCP reservations let you specify static local IP addresses on the router's side so that when your computer connects to your network, your router will always assign it the same local IP address. To set it up, decide what local IP address you want for a given computer (or other device) and find it's MAC address. Your MAC address is a 12-digit alphanumeric string separated by two digits at a time. It generally looks like 1A-2B-3C-4D-5E-6F or 1A:2B:3C:4D:5E:6F. To locate it on Windows, click the Start menu and choose run. Then type ipconfig/all. The "Physical Address" is your MAC address. On Mac OS X, just open System Preferences, choose Network, click More Info, and then the Hardware tab. Your MAC address should be the first thing displayed. Once you've got that you can just enter it in the reservation list with the local IP address you want and you're also set. Just be sure to save and enable it. You may need to restart your router to see the changes take effect, but once you do the computers and devices in the reservations table will retain the same local IP addresses. This solves pretty much every kind of problem. For information on setting this up, check out our guide to DHCP reservations.

Assign a Friendly Domain Name to Your Router with Dynamic DNS

DNS is a service that lets you access your home computers using a nice doman name (e.g. myfancyrouter.net) instead of a numeric IP address (e.g. 72.54.34.90). Depending on your internet provider, however, your external IP address may periodically change. That's why you need Dynamic DNS. It points a friendlier domain name to your numeric IP address just like regular DNS, but compensates for that IP address' proclivity to change. So, rather than typing in 76.xxx.xx.xx every time you want to remotely access your home computer, you can type something friendly like myawesomecomputer.dyndns.tv.

You can accomplish this task in a couple of ways. First, you can download some software from your dynamic DNS provider that will automatically check and update your external IP address at a set interval. Second, your router may already support some dynamic DNS providers and can perform this update for you automatically (which is the easier method). Two of the most popular providers of dynamic DNS services are DynDNS and No IP, but there are others. These services are generally free but offer perks at a cost. Some routers only support one of these services, but custom firmware like DD-WRT support both and more.

To set up dynamic DNS, you just need to sign up for an account with one of these services and enter your account credentials into the dynamic DNS section on your router. If your router doesn't support your service of choice, you can just download software from your service provider like we mentioned earlier. You'll need to keep this software running pretty much 24/7, so it's definitely better if you can leave the task of dynamic DNS to your router.

If you want further setup instructions, here's how to set things up with DynDNS and No IP. Your router may support other services, but it's likely to support at least one of those.

That's all for today's lesson. In our final lesson, we'll be taking a look at some fun and useful bonus features you may have on your router plus resources for learning more. As always, if you're behind on our lessons, you can always find everything you've missed on the Lifehacker Night School tag page. You can follow Adam Dachis, the author of this post, on Twitter, Google+, and Facebook.  Twitter's the best way to contact him, too.

via lifehacker.com

Posted via email from ://allthings-bare

Know Your Network, Lesson 3: Maximize Your Speed, Performance, and Wireless Signal via lifehacker.com

via lifehacker.com

You've picked your router and set up all the basics, so now it's time to optimize your network. In this lesson, we're going to look at how to improve your network's speed and wireless signal so it's operating at full capacity.

In theory, your network should work just fine as-is, but we all know that reality can differ from what should ideally be the case. How well your router performs is going to depend on a lot of factors, so these tips and tricks might work better for some than others. For example, strategies for improving your wireless signal aren't going to do much unless your router is dealing with some interference. On the other hand, tweaks can only do so much if you're dealing with really bad interference. That said, whether the improvement is marginal or great, we're going to look at all sorts of ways to get your network running as fast and efficiently as possible.

Use Your Wires Whenever Possible

Wi-Fi is nice, but it's rife with signal issues and slower than a wired ethernet connection—even when Wi-Fi is performing its best. If you can wire up your devices, you should. When transferring files between devices you'll always get better performance over a wire, and internet connections over 25mpbs will also benefit from wires. That may seem strange when many routers advertise wireless speeds that are much higher, but real-world performance is generally far lower.

If you can't wire up your home, power line ethernet adapters (like Belkin's gigabit option) can be a good alternative. It's pretty rare that you'll have a power line capable of maintaining gigabit speeds, but you may still achieve better performance than you would over the air with 802.11n. If you want to give power line adapters a shot, just buy a set from a store with a good return policy and see how they work. If they don't, you can always take them back. If they do, you can buy as many as you need. Just be sure to test them on every outlet you're going to use, since some outlets work better than others with power line adapters.

Check out our guide on ditching wireless and going completely wired in your home for more tips.

Improve Your Wi-Fi Signal

There are plenty of tricks you can employ to improve your Wi-Fi signal. Your mileage may vary depending on your situation, but most methods are pretty easy and worth a look. In this section, we're going to take a look at our favorites. They're all things you can accomplish with very little effort.

Choose the Best Wireless Channel

Full size

While radio frequency interference is going to be an issue in your home, one of the biggest causes of interference that'll slow down your Wi-Fi speed is other Wi-Fi routers in your area. That's often because most Wi-Fi routers default to the same channels: 6 or 11. (You don't need to understand all of this to fix the problem, but we'll explain.) Additionally, the standard channel width is 20 MHz, which means that even though you're on channel 6, which has a frequency of 2.437 GHz, your channel width spans 20 MHz around that frequency. Since each channel is only 5 MHz apart from the next, your signal is bleeding into the others. While you can adjust the channel width, this may only help some of the time as your router's needs will change. Ideally channel width would be adaptive, but since that isn't a reality the best thing you can do is pick a channel as far from the others as possible.

Previously mentioned wireless network locater WiFi Stumbler is a webapp that provides a simple way to check what channels are in use in your computer's range. Simply look for the channel with as much space around it as possible and use that channel instead of what you're currently using. Also note that while you may pick up competing signals on the same channel, if they're all very weak that can be a better choice than choosing a lesser-used channel with a strong, competing signal.

Basically, if your neighbor's on channel 1 and a few people down the block are using channel 4 (and you're somehow picking up their Wi-Fi), you're still probably better off using channel 4 for your Wi-Fi. That is, unless there's a huge amount of interference on channel 5. As you can see it can get a little tricky, but the goal is to pick a channel that keeps its distance from other signals with the same or overlapping frequencies.

We discussed where to change this settings in the previous lesson, but you'll generally find it in your basic wireless settings on your router. It tends to sit in the same section as your SSID.

Boost Your Signal's Transmit Power

Full size

Your Wi-Fi router transmits its signal with a set amount of power, but that's something you can adjust. In theory, if your signal sucks you'd want to just transmit it as powerfully as possible. In reality, boosting your router's transmit power too much can actually make things worse. But there's a magic number: 70 mW.

In general, your router's transmitting at 28 mW, but most routers can handle 70 mW without issue. According to the DD-WRT documentation, setting this any higher could fry your router's radio chip because your router's not designed to handle the excess heat. You technically can turn it all the way up to 251 mW, but if you do you're just asking for trouble. If your router overheats, it's going to perform far worse—or die. Staying in a safe range may only show marginal improvements, but that's much better than a dead router.

Unfortunately most routers don't allow you to boost your transmit power, so if you're not using custom firmware like DD-WRT or Tomato, you're probably out of luck on this one. If that includes you, just read on as the next section can help solve signal issues with virtually any router.

Extend Your Signal with DIY Projects

Full size

Sometimes router settings just aren't going to cut it, so you need to put on your tinkering hat and make a DIY booster. In episode four of the Lifehacker Show, we built this simple Windsurfer booster out of card stock and tinfoil. On top of that, we have many more Wi-Fi boosting projects, such as this tin can extender or a repurposed satellite dish. There are also several range-boosting products on the web (like this one), but if you can avoid shelling out another $70, it's worth giving a DIY option a try.

Use QoS to Help Prevent Bandwidth Hogging and Network Overloads

Full size

In our previous lesson we talked a little bit about Quality of Service, which is essentially a set of rules that throttles bandwidth when a person (your roommate) or application (BitTorrent) is trying to hog it all. Say, for example, you want to video chat while your roommate is downloading a movie. QoS helps make sure both endeavors have enough bandwidth. We have a full guide on configuring QoS, but here's a quick overview of what you need to do.

First things first, navigate to your router's QoS page (if it exists—not all router firmwares have this feature) and enable QoS. That's not going to do anything yet, because we have some settings to fill out first, but I always forget to enable features so I like to do that first. In your QoS settings you should have a few settings and toggles to deal with. Here's a quick look at your options in DD-WRT (note: this will vary from router to router, but obviously we can't go over every single brand's firmware):

• WAN, LAN, or Both - Generally QoS is used to handle traffic from outside your local network, so it defaults to WAN (Wide Area Network). Unless you have a reason to change it, just leave this setting as-is.
• Packet Scheduler - This can be set to HTB or HFSC. HTB is the default method that uses a "token" system to manage bandwidth. Don't change this to HFSC unless you know what you're doing.
• Uplink and Downlink - Here you can set a limit for the total network bandwidth can be used on your network. If you don't want to max out your connection, you can set these speeds to less than their theoretical maximums. DD-WRT recommends 80-95% for uplink and 80-100% for downlink.

Once you've got those global settings taken care of, you can start specifying rules. DD-WRT splits these rules up into three categories: Services, Netmask, and MAC priorities.

Services Priority will let you set bandwidth priorities for different applications. These applications are pre-set and include everything from SMTP to BitTorrent to Xbox Live. If a particular service isn't listed, you can add it yourself.

Netmask Priority can give bandwidth priority to a range of IP addresses. For example, if you have three computers that use the IP addresses 192.168.1.10, 192.168.1.11, 192.168.1.12, you can specify that range to receive priority. This can be useful if you want to ensure that your machines will always take priority over any guest computers that show up on your network.

MAC Priority is a way to set which specific devices receive priority over others. Here you enter your device's MAC address (a MAC address is a unique identifying address for your computer's network adapter) and set a relevant priority.

Once you've chosen a service, IP range, or MAC address, and added it to your priorities list, you have to actually define the priority. By default the priority will be set to Standard, but you can promote it to Express or Premium to give it a higher bandwidth priority over other items on the list. These categories are good for applications that will sometimes require additional bandwidth, such as video chat and VOIP. You can also set any item to Exempt to let the app or computer use as much bandwidth as it wants and Bulk if you want it to only use bandwidth that is left over from other applications.

After you've finished adding all your devices and setting their priorities, you can save your settings and let your router reboot (if necessary). That's really all you have to do to get QoS working.

That's all we've got for today's lesson. Join us again tomorrow when we'll be going over how to set up your computers for remote access. If you've missed any previous lessons, you can always find them on the Lifehacker Night School tag page. You can follow Adam Dachis, the author of this post, on Twitter, Google+, and Facebook.  Twitter's the best way to contact him, too.

via lifehacker.com

Posted via email from ://allthings-bare

How to Boost Your Wi-Fi Network Signal and Increase Range with DD-WRT - How-To Geek

Wireless is really convenient until you drop your connection or get really low speeds. Thanks to DD-WRT, it’s easier than ever to extend your home networks range with a few simple tweaks and a spare router.

DD-WRT is a fully feature-packed alternative firmware for your router. If you don’t know what it is or how to get it on your device, you should start off with Turn Your Home Router into a Super-Powered Router with DD-WRT.

Boosting Your Signal

Fire up your web browser and direct it to your router’s configuration page. Go to Wireless > Advanced Settings.

There are three settings of interest, the first being TX Power. This is the broadcasting power of your transmitting antenna. The default is a safe value of 70, but we can kick it up a bit. Most people report that jumping up to a 100 is safe. Pushing it higher can cause excessive heat which can damage your router. I don’t have to worry about that since my “server area” is cold and I’m also a bit reckless, so I kicked mine up to 150. It’s been that way for a few weeks and I haven’t had a problem yet, but your mileage may vary. Use your common sense and discretion.

Next up is the Afterburner setting. If your wireless router and adapters support Afterburner – also known as SpeedBooster, SuperSpeed, Turbo G, and G Plus (but not Super-G) – you can enable this to get a boost. Things may slow down if they don’t support it, though, so be sure to do your homework. B-only devices won’t see any problems and N-based devices shouldn’t be negatively affected, either.

Finally, we get to Bluetooth Coexistence Mode. If you use bluetooth a lot, then you may have noticed a drop in reliability or speed with both wireless and bluetooth devices. Turning this setting on should keep the two from interfering too badly with one another.

Use a Spare Device as a Repeater

Most of us have upgraded our networks with new routers over the years. If you have your old one lying around, why not throw DD-WRT on it? I had a spare Linksys wireless access point, but after putting alternate firmware on it, I had a full-blown router on my hands. We can put our spare device to work as a repeater, which can act as a range-extender for a new section of your house or yard.

Under Wireless > Basic Settings, change the mode to Repeater.

You’ll see two sections, Wireless Physical Interface (wl0), and Virtual Interfaces (wl0.1). The physical interface is going to be receiving the signal from your main router. Plug in the SSID, configure the network mode, and decide if you wanted it to be bridged (connected with the old network) or unbridged (isolated from it). Next, come up with a new SSID for your repeater. This way, you can choose which access point to use, depending on where you are.

Click on save, then go over to the Wireless Security page.

Enter the wireless security settings for your main router, then enter the details for your new repeater’s signal. Lastly, we need to make sure that your repeater is connected to your main router. To do that, go to Status > Wireless.

At the bottom of the page, you’ll see a button that says Site Survey. Click on it.

Find you main router’s wireless SSID and click Join. That’s it! Place your repeater on the other side of your house, but not so far that it doesn’t get a good signal. Then, you can connect to your new repeater and test it out.

Use Your Repeater as a Wireless Receiver

An added benefit of DD-WRT is that you can configure your repeater to act as a wireless receiver for a computer that doesn’t have one. Return to where you configured the repeating function, under Wireless > Basic Settings.

Change the mode to Repeater Bridge. Now, you can plug in a device into the router’s ethernet ports and it’ll act just like it’s wired into your main router. If you’re not using it then you should turn if off, as it can cut your bandwidth otherwise.

If you’re looking to speed up browsing, Removing Advertisements with Pixelserv and Find a Faster DNS Server with Namebench can both help your cause – with or without extended ranges – thanks to DD-WRT.

via howtogeek.com

Posted via email from ://allthings-bare

How to Boost Your Wi-Fi Network Signal and Increase Range with DD-WRT

Wireless is really convenient until you drop your connection or get really low speeds. Thanks to DD-WRT, it’s easier than ever to extend your home networks range with a few simple tweaks and a spare router.

DD-WRT is a fully feature-packed alternative firmware for your router. If you don’t know what it is or how to get it on your device, you should start off with Turn Your Home Router into a Super-Powered Router with DD-WRT.

Boosting Your Signal

Fire up your web browser and direct it to your router’s configuration page. Go to Wireless > Advanced Settings.

There are three settings of interest, the first being TX Power. This is the broadcasting power of your transmitting antenna. The default is a safe value of 70, but we can kick it up a bit. Most people report that jumping up to a 100 is safe. Pushing it higher can cause excessive heat which can damage your router. I don’t have to worry about that since my “server area” is cold and I’m also a bit reckless, so I kicked mine up to 150. It’s been that way for a few weeks and I haven’t had a problem yet, but your mileage may vary. Use your common sense and discretion.

Next up is the Afterburner setting. If your wireless router and adapters support Afterburner – also known as SpeedBooster, SuperSpeed, Turbo G, and G Plus (but not Super-G) – you can enable this to get a boost. Things may slow down if they don’t support it, though, so be sure to do your homework. B-only devices won’t see any problems and N-based devices shouldn’t be negatively affected, either.

Finally, we get to Bluetooth Coexistence Mode. If you use bluetooth a lot, then you may have noticed a drop in reliability or speed with both wireless and bluetooth devices. Turning this setting on should keep the two from interfering too badly with one another.

Use a Spare Device as a Repeater

Most of us have upgraded our networks with new routers over the years. If you have your old one lying around, why not throw DD-WRT on it? I had a spare Linksys wireless access point, but after putting alternate firmware on it, I had a full-blown router on my hands. We can put our spare device to work as a repeater, which can act as a range-extender for a new section of your house or yard.

Under Wireless > Basic Settings, change the mode to Repeater.

You’ll see two sections, Wireless Physical Interface (wl0), and Virtual Interfaces (wl0.1). The physical interface is going to be receiving the signal from your main router. Plug in the SSID, configure the network mode, and decide if you wanted it to be bridged (connected with the old network) or unbridged (isolated from it). Next, come up with a new SSID for your repeater. This way, you can choose which access point to use, depending on where you are.

Click on save, then go over to the Wireless Security page.

Enter the wireless security settings for your main router, then enter the details for your new repeater’s signal. Lastly, we need to make sure that your repeater is connected to your main router. To do that, go to Status > Wireless.

At the bottom of the page, you’ll see a button that says Site Survey. Click on it.

Find you main router’s wireless SSID and click Join. That’s it! Place your repeater on the other side of your house, but not so far that it doesn’t get a good signal. Then, you can connect to your new repeater and test it out.

Use Your Repeater as a Wireless Receiver

An added benefit of DD-WRT is that you can configure your repeater to act as a wireless receiver for a computer that doesn’t have one. Return to where you configured the repeating function, under Wireless > Basic Settings.

Change the mode to Repeater Bridge. Now, you can plug in a device into the router’s ethernet ports and it’ll act just like it’s wired into your main router. If you’re not using it then you should turn if off, as it can cut your bandwidth otherwise.

If you’re looking to speed up browsing, Removing Advertisements with Pixelserv and Find a Faster DNS Server with Namebench can both help your cause – with or without extended ranges – thanks to DD-WRT.

via howtogeek.com

Posted via email from ://allthings-bare

How to guard yourself and your Mac from Firesheep and Wi-Fi snooping

The prevalence of free/cheap and open Wi-Fi networks in coffee shops, airports, offices and hotels is a great boon to the traveling Mac or iPad user; it makes connectivity and remote work much easier than it used to be.

Unfortunately, since most of those networks don't employ WEP or WPA passwords to secure the connection between device and hotspot, every byte and packet that's transmitted back and forth is visible to all the computers on the wireless LAN, all the time. While certain sites and services use full-time browser encryption (the ones that have URLs beginning with https:// and that show a lock in the browser status bar), many only encrypt the login session to hide your username and password from prying eyes. This, as it turns out, is the digital equivalent of locking the door but leaving the windows wide open.

Firesheep is a Firefox extension which makes it trivially easy to impersonate someone to the websites they log in to while on the same open Wi-Fi network. It kicks in when you login to a website (usually in a secure fashion, via HTTPS) and then the site redirects you to a non-secured page after login. Most sites that operate this way will save your login information in a browser cookie, which can be 'sniffed' by a nogoodnik on the same network segment; that's what Firesheep does automatically. With the cookie in hand, it's simple to present it to the remote site and proceed to do bad things with the logged-in account. Bad things could range from sending fake Twitter or Facebook messages all the way up to, potentially, buying things on ecommerce sites.

That process is known as "HTTP session hijacking" (informally, "sidejacking") and has been a known problem for several years, but many sites have not changed to protect their users. Firesheep has made this process of sidejacking very easy, and a reported 104,000+ people have downloaded it. It is important to realize that the security problem exists for users of all browsers. Firesheep is available only for Firefox, but that's just the exploit side; it will gladly harvest cookies from Safari, Chrome, IE or anything else. Unfortunately, you've got to assume that any unencrypted site you go to while on an open Wi-Fi network is susceptible to compromise by this attack.

Read on for some suggested ways to combat this security challenge.

Photo by adactio | flickr cc

The solution -- if your site supports it -- is quite simple: after you connect, the site should keep your session secure using SSL or https. Some sites, including most banking sites, already do this. However, encryption requires more overhead and more server muscle, so many sites (Facebook, Twitter, etc.) only use it for the actual login. Gmail has an option to require https and has made it the default setting, but you should make sure that it's enabled if you use Gmail (Google Apps has a similar feature). This also doesn't necessarily help if you're using an embedded browser in an iPhone or iPad app, where the URL is hard-coded.

Protecting yourself from Firesheep if you use Firefox or Chrome is possible with extensions like the EFF's HTTPS Everywhere, Secure Sites or Force-TLS. These work by forcing a redirect to the secure version of a site, if it exists. The obvious problems with these solutions are: a) you have to install one for each browser (and we have not yet found one for Safari), and b) it only works if a secure version of the site exists.

If you want to protect yourself more completely, you have a few options.

A) Don't use open networks. This is the easiest option, but also the least convenient or practical in some circumstances. What happens if you "need" to get online and an open network is your only option? [You can also suggest to your network provider that they implement WPA security. If they complain that users won't know the network password, tell them they can include the WLAN password in the name of the network, which keeps it effectively 'open' yet encrypts the connections to block this vulnerability. –Ed.]

B) Use a SOCKS proxy and SSH tunnel. By redirecting your web traffic over a secure encrypted connection to another computer, you can lock down all your browsing and work worry-free. If you know your way around the command line, you can do this for free. If you're looking for an easy solution, though, I recommend Meerkat (which we have mentioned before). The developer has a page devoted to protecting yourself from Firesheep. Setting up Meerkat will take some initial time and effort (and it assumes that you have access to an shell account somewhere, perhaps via your web hosting company; you can also use your home Mac if you turn on Remote Login in the Sharing preference pane). After that, it works very well and, once set up, will protect all of your browsers. For $20 it will make the process much easier, especially if you aren't familiar with SOCKS and SSH tunnels. The developer is also very responsive to questions.

For $25, you can use Slink, which connects you directly to your home machine for access to your data and services. Adding in a Firefox plugin will automatically load your proxy settings for safe and secure browsing. The same approach works with ShareTool, also $25 for a pair of licenses.

C) Use a VPN. This is the easiest solution of all, as well as the most thorough. It will not only encrypt your web browser traffic, it will encrypt all of your Internet traffic (including IMs, email, etc) at least from your computer all the way out to the web. I used Witopia some time ago with both my MacBook and my iPhone. It was very easy to configure and use. For $40/year you can use their "personalVPN – PPTP" service, which will work for both iOS devices and Macs. Their products page describes some important differences between some of their offerings. Their $70/year "personalVPN – SSL/PPTP Combo" is worth a look if you have the budget for it, but the $40/year version will probably suit most people's needs. Of course, if your employer or school offers a VPN client for your use, that will do the job as well.

Although my name is the only one on the byline, TUAW editor Mike Rose also contributed to this article, including several significant additions. He's a goodnik. - TjL

via tuaw.com

Posted via email from ://allthings-bare

How To Set Up A Wireless Network Using WPA/WPA2 With Radius Authentication With CIITIX-WiFi

How To Set Up A Wireless Network Using WPA/WPA2 With Radius Authentication With CIITIX-WiFi

Preface

For more documentation downloads and support head to http://ciitix.ciit.net.pk and remember to check out the forums. This document serves as quick guide on how to set up a wireless network using WPA / WPA2 with radius authentication. This document will only cover the basics and is not exhaustive of all possibilities and features but with this information and basic networking skills you should be able to get running very soon. No knowledge if Linux is assumed in this guide and for the most part its spelled out with screen shots.

I'd like to thank the team who created this easy way of implementing radius authentication for WiFi and believe it's the only package around which is aimed at a turn key solution meaning no compiling, setting up databases and the like. After all everyone has enough to worry about keeping there IT infrastructure working. I decided to do this guide for the users wanting to try out and implement radius authentication for WiFi security. This project is still very new, and at time of writing the latest version is v1.1.

 

Prerequisites

1) You have downloaded the ISO file and have that ready to install; see http://ciitix.ciit.net.pk for downloads.

2) You have an access point / wireless router which is capable of WPA / WPA2 enterprise setup.

3) Basic networking skills and computing skills, and hardware ready to install CIITIX-WiFi

The PC which you will be installing CIITIX-WiFi on does not need to be a super spec machine, but if is being deployed as a mission critical assset you will be better off using new hardware or a virtual machine.

The installation hardware which was used for this tutorial was VMWare ESXi server, 1 vCPU, 1 vHDD (4gb), 768 Ram.

And just for trivia while sitting idle it is using 10Mhz and 7mb ram. Anything Pentium 3 based and up will suffice.

 

Let's get started

Burn your ISO onto CD and place that into your drive, and boot from the CD drive. Make sure you have no important data on the hard disk because the installation will destroy all existing data on the drive you install to.

1) After your system is booted you will see the following screen, at this point you choose 'Start GUI Install' and hit enter.

(JavaScript must be enabled in your browser to view the large image as an image overlay.)

2) On the next screen you will choose your language.

(JavaScript must be enabled in your browser to view the large image as an image overlay.)

3) Choose your geographic region:

(JavaScript must be enabled in your browser to view the large image as an image overlay.)

4) Configure the host name for the system, if unsure leave it as debian:

(JavaScript must be enabled in your browser to view the large image as an image overlay.)

5) Configure the system clock / choose your time zone:

(JavaScript must be enabled in your browser to view the large image as an image overlay.)

6) Partition your installation disk, choose Guided - use entire disk:

(JavaScript must be enabled in your browser to view the large image as an image overlay.)

7) Choose your hard disk:

(JavaScript must be enabled in your browser to view the large image as an image overlay.)

8) Select All files in one partition:

(JavaScript must be enabled in your browser to view the large image as an image overlay.)

9) Choose Finish partitioning and write changes to disk:

(JavaScript must be enabled in your browser to view the large image as an image overlay.)

10) Choose Yes - this will destroy any data on the disk!

(JavaScript must be enabled in your browser to view the large image as an image overlay.)

11) Relax while everything installs...

(JavaScript must be enabled in your browser to view the large image as an image overlay.)

12) The installer will now ask for usernames and passwords you will use later on to administer the system. Fill these out, not all screens are here as it's very simple.

Remember the root password!

(JavaScript must be enabled in your browser to view the large image as an image overlay.)

13) Select Yes to install the GRUB boot loader to the drive:

(JavaScript must be enabled in your browser to view the large image as an image overlay.)

14) The installation is now complete.

(JavaScript must be enabled in your browser to view the large image as an image overlay.)

• How To Set Up A Wireless Network Using WPA/WPA2 With Radius Authentication With CIITIX-WiFi - Page 2

next

How To Set Up A Wireless Network Using WPA/WPA2 With Radius Authentication With CIITIX-WiFi - Page 2

Copyright © 2010 David
All Rights Reserved.

via howtoforge.com

Posted via email from ://allthings-bare