With the advancements in technology, the networks today aren’t the same as I learned on nearly 20 years ago. We’ve evolved from wired only networks using hubs to the PC, to switched networks. Used mostly for Voice Over IP (VoIP) phones, the switched networks are still there, while our computers have now given up the wires to operate wirelessly. Yet, even the wireless networks have changed. Originally, they were expensive—now, you can find a good wireless access point in many forms like commercial-grade access points; consumer-grade wireless routers; specialized devices, such as the WiFi Pineapple; to cell phones and mobile hotspots. Any of these can be found in almost any corporate environment. The question is: who owns them and why are they there? Is it a developer trying to figure out why his code isn’t working when connected to the corporate network but works fine when connected to his mobile hotspot? Is it someone who got tired of walking back and forth from the plant floor to his desk and put up a wireless router to “save time”? Is it someone on the third shift hooking up a cellphone to the serial port on a computer to download torrents? Could it be a pentester who tossed a device in the ceiling of the bathroom to connect to the network later? In the last 10 years, I’ve come across all four of those. There are two ways I have performed wireless detection. One is to walk the building looking for the rogue access points. This could fail due to being seen and having equipment turned off or not present while the staff is hunting for it. The other way is to have a real-time wireless intrusion detection system (WIDS) installed, but there is usually a high cost involved: ~$12,000 to $32,000, from what I have seen. At CircleCityCon 2015, I’ll be presenting on building WIDS with consumer equipment based on the Raspberry Pi single board computer. This set-up would work well for a small business that can’t afford the larger solution or as a proof-of-concept for management to get funding for a vendor solution. After the presentation, I’ll be in the common areas to help people set them up.* *Parts: Raspberry Pi model B+ or Pi 2 with Kali Linux installed on a 16gig SD; a TP-Link WN722N Wireless adapter; a portable switch; network cable, a laptop; and a Raspberry Pi power supply.
About the Author: Chris Jenks is an Information Security Professional from Detroit, Michigan. He holds a B.S. in Applied Information Assurance and is continuing with an M.S. in Cybersecurity. Chris’ day job is policy reviews on network designs and firewalls, and secure network design. One of his previous publications is "Real-Time Rogue Wireless Access Point Detection with the Raspberry Pi" in the Linux Journal. He has also spoken at BSides Detroit, GrrCon, DerbyCon and CircleCityCon. Editor’s Note: The opinions expressed in this and other guest author articles are solely those of the contributor, and do not necessarily reflect those of Tripwire, Inc.
Meet Fortra™ Your Cybersecurity Ally™
Fortra is creating a simpler, stronger, and more straightforward future for cybersecurity by offering a portfolio of integrated and scalable solutions. Learn more about how Fortra’s portfolio of solutions can benefit your business.
