Wireless networks, as we all know, are everywhere today. All the way back in 2004 Denis did a wardriving exercise to check how widespread the use of encryption and other security measures were in wireless networks deployed in and around Leeds. The results were summarised in the article Open all Hours – Wardriving in Leeds, West Yorkshire, England.

The arrival of the new JDSU ValidatorPRO-NT NT1155, which includes a wireless detection module (including 802.11n networks), gave me the opportunity to repeat the exercise and see how the situation has changed over the intervening period.

Well, nobody will be surprised to discover that there are even more wireless networks around today. Within 300 metres of our office in a quiet market town ten miles outside Leeds I detected 27 separate networks. Most shops and offices have them and many apartments and homes, thankfully though no banks.

The good news from a security perspective is that most now have some kind of security enabled. This is a big step forward, though I would wager it is in large measure due to manufacturers’ configuring security on by default rather than expecting their users to configure their access points themselves.

All but one network was broadcasting its SSID the vast majority were using the manufacturer default SSID. Strangely most shops and businesses that changed the default seem to view the SSID as an advertising opportunity, making the SSID the business name. I’m not entirely sure this is a good thing, though it must be said that hiding the SSID is hardly the greatest security measure you could take and makes configuring wireless enabled devices that much harder for very little real gain so far as security is concerned.

It would appear that most access points are set to the default channel,  9 of those detected were using channel 11, 7 used channel 1, and 4 were on channel 6. I expect with all this interference on the same channels that the effective throughput may not be as good as it could be.

WPA was the most commonly used encryption, which is also good news and fine for most users. Only one network used WPA2, presumably a new access point/router. Reasonably enough most users will accept whatever security comes preconfigured in their access point.

So judging by this quick test, the situation today is much better than the snapshot taken in 2004. Security is being taken more seriously, at least by the manufacturers. Most new access points come with WPA enabled. It probably always was too much to expect users to configure security for themselves. However there are still plenty of unsecured networks around so using someone else’s bandwidth is still a possibility for those that way inclined.

An easy way to increase your available bandwidth would be to check for other networks close by and ensure that you are not using the same channel. Clearly though very few of the user of wireless around here take the time to configure their wireless at all.

As for the NT1155 Validator it could hardly be easier to use for wireless detection, just select the menu option, let it scan and watch the networks appear. Press the Save button to record the results onto an external USB memory stick in CSV format. It’s a very useful addition to the Validator for those installing and maintaining networks.

Wi-Fi Scan Result in Excel

Here at Teapot Towers we are pretty paranoid about security. One of the things we’ve done to improve our security is lock down our web sites with a nice phat firewall.

Outside of the firewall, you just get to see the standard web & incoming email ports. Internally, from the company network, we bypass the firewall meaning we can see everything, most notably the SSH service for doing all of the nice server admin work.

We use quite a number of Google services including Google Adwords. Our Adwords account got hacked a few weeks ago causing no end of inconvenience.

I asked Google about the cause of the account compromise and they said it was caused by my machine being compromised with a key logger. I scanned all of the machines from which I log in and could find no evidence of any malicious software. The absence of key logging software leeds me to believe that my account was compromised by a brute force password cracker somewhere out in the wild west that is the internet.

It strikes me as odd that Google don’t permit us to specify good IP addresses, a so called white list, from which I am permitted to log into my account. They could then bounce all requests from IP addresses outside of the white list.  It would make cracking your Google account a whole lot harder because the hacker would have to fake a white list IP address as well as crack your password.

Just today, having checked The Tech Teapot’s security log, there have been at least 30 hack attempts so far today (and it isn’t even lunch time yet.) Just goes to show how you have to be very wary about putting anything on the internet these days. At my first company, back in 1992, the whole network was using a class C address with all of the client machines available on the public internet with no firewall. You’d never get away with that now.