The problem with SSID cloaking is that you force your client systems to constantly ask every AP they see "Are you my mother?" (queue the Dr. Seuss book ... SNORT!)  If you cloak the SSID of your work AP and the user is stuck in Terminal C of O'Hare Airport*, they are constantly sending out probe requests with the cloaked SSID.

A friend made the analogy to a military officer.  The officer is lost, and he is looking for his military base.  He asks everyplace he sees "Are you my military base?", "Are you?"  Eventually, someone will say "yes", which we otherwise would call Karmetasploit (http://trac.metasploit.com/wiki/Karmetasploit).

Other reasons SSID cloaking doesn't make sense:

1. It provides no security.  As any Kismet user will tell you, watching a legitimate user login to the AP discloses the SSID.
2. It leads to user confusion.  Users who can't find their wireless network are 18 times as prone to click on "Free Public WiFi" or any other nonsense SSID they come across (I read that statistic in the Journal of Clinical Neuroscience).
3. Users call your helpdesk more.  If they need special shared information about the SSID, they are going to call your helpdesk all that much more.  I found it was better to make friends with the helpdesk people than ... enemies.

I wrote a short article about this topic a few years ago for Network World which states similar points with more penache than I can muster at the moment:

http://www.networkworld.com/columnists/2007/030507-wireless-security.html

Thanks to all who attended the webcast!

-Josh

* The best place to eat in O'Hare Airport is a take-out place in the K concourse called "Burrito Beach".  You'll thank me for it.  If you know of a place in the C concourse where there are more than a handful of working electrical outlets for public use, please let me know and I think kindly of you often!

I sent the Garland a note asking what is going on with the release; I'll let you know shortly!

Thanks for coming to the webcast.

-Josh

I seldom find Bluetooth AP's using the RFCOMM, PPP or Bluetooth Network Encapsulation Protocol (BNEP).  Most of my experience with Bluetooth AP's has not been in manipulating clients using the device, but in leveraging it as a network access mechanism that escapes 802.11 rogue AP identification.

It's probably not common to find users leveraging a Bluetooth AP for wireless connectivity due to the greater cost associated with the hardware and the relative popularity of 802.11.  However, that doesn't mean there aren't other uses for Bluetooth AP's...

Thanks,

-Josh

We use the BT3 CD in my SANS Ethical Hacking Wireless course.  During labs, sometimes people will have problems getting X running properly.  Something I've learned that can work is to kill X Windows (press Ctrl+Alt+Backspace), then from the shell prompt, run:

 X -config

This will autoconfigure X and give you a simple window manager.  Press Ctrl+Alt+Backspace to kill this simple window manager.

IIRC, this step will write a new configuration file as /etc/X11/xorg.conf.new (or similar; read the output on the screen when you kill X).  I move this file over the default xorg.conf file:

 mv /etc/X11/xorg.conf.new /etc/X11/xorg.conf

Then run "startx".

NOTE: If this works (I hope it does), you'll have to repeat these steps each time you boot.  Open a bug on the Backtrack Wiki if this solves the problem to let them know.

Best of luck,

-Josh

One thing I have found tremendously helpful is the ability to digest tech books.  I have a Safari account with O'Reilly and make good use of that resource.  I'm thinking of picking up a Kindle too, since O'Reilly is publishing more in DRM-free e-book format:

http://toc.oreilly.com/2008/06/select-oreilly-books-soon-on-kindle-and-as-drm-free-digital-bundle.html

Best of luck,

-Josh

No worries, you can catch the recorded version.  Visit:

https://www.sans.org/webcasts/show.php?webcastid=91601

And click "Click here to register for this webcast."; you'll need to fill in a form but you can de-select "share this information with the sponsor".

-Josh

Certainly, this depends on the negotiated terms and goals of the engagement with the customer.  I have a few dictionaries I'll try and have pre-established mechanisms to accelerate the testing process (using nVidia GPU's, available hosts and FPGA's), and I'll run that to completion for a test.


Determining if the passphrase choice is acceptable requires more evaluation than just what you can determine from a penetration test.  I try to work out with the client what the resources would be of a potential adversary ($1,000? $10,000? $1,000,000?) and then use math to figure out how long it would take to figure out the selected passphrase (usually, this is by ignoring the entropy of the selected passphrase, and just using the character selection and length of the passphrase, factoring in probability).


For me, PSK's aren't acceptable in anything by the environments of least risk (perhaps a guest network, or a home network with little to no valuable resources).  It's less about being able to brute-force the PSK, and more about how the PSK (or derived PMK) is stored on each and every workstation.  I can use a combined pen-test approach to leverage physical security with wireless attacks and a tool like Aircrack-ng's WZCOOK to extract a PMK which is shared by all the other usrers on the network, all without having to resort to dictionary attacks.

Good post.

-Josh

I second that recommendation, also available at http://www.netgate.com/product_info.php?products_id=665 (no affiliation).

-Josh

Yokoso!, by Kevin Johnson, et al, release imminent, to be available at http://sourceforge.net/projects/yokoso/.

Yokoso! is a tool to identify the administrative interfaces used through fingerprinting techniques.  This can be helpful to sort through the page history of a browser controlled by a pen-tester to identify valuable targets to exploit (e.g. previously logged-in administrative pages).

-Josh

A lot of people really like the Alfa card; it is USB and high-powered (500 mW with external antenna connector!) and is plug-and-play with just about any modern Linux distribution.  Here is one site that sells this card (no affiliation):

http://www.netgate.com/product_info.php?products_id=665

I still use Atheros 5211 cards with the madwifing drivers.  One madwifing-compatible card that supports 802.11a/b/g with an external antenna connector is at:

http://www.netgate.com/product_info.php?products_id=130

The madwifing cards work great with distributions like Backtrack 3, but will require patching and recompiling your kernel for other Linux distributions.  The patch for this card is on the Aircrack-ng site:

http://patches.aircrack-ng.org/

Best of luck!

-Josh

Thanks Don, and thanks to everyone who caught the webcast today.  Please post your questions and comments here; looking forward to hearing your thoughts!

-Josh