3 ms·
This smells of self-marked homework used as thinly veiled advertising to potential investors. If rogue access points are a legitimate concern, proper network c
by hsbauauvhabzb 6y ago
This smells of self-marked homework used as thinly veiled advertising to potential investors.
If rogue access points are a legitimate concern, proper network controls (PNAC, mac whitelisting, etc) would be better options.
- joosters 6y agoHow exactly are you meant to do that when you are dealing with devices like employees personal phones in an office, or antendees laptops at a conference?
- Triv888 6y agoHaving a secure and a non-secure network would probably be good in some instances.
- hsbauauvhabzb 6y agoThis. You either care about security, or you permit BYOD. They are mutually exclusive.
- GTP 6y agoI don't know about PNAC, but MAC whitelisting is easily circumvented by scanning for the devices connected to an AP and changing your MAC to one of those.
- hsbauauvhabzb 6y agoCorrect. The point is no COTS access point does this.
- GTP 6y agoSorry, I'm not sure to understand what you mean. Do you mean that no COTS access point does MAC whitelisting? I would say that they can do it, but it's not very useful
- hsbauauvhabzb 6y agoNo I’m saying not many COTS access points can spoof MAC addresses. Windows can act as a hot spot, but there’s group policies to solve that. I don’t think whitelisting is a solve-all, but it’s not easy to work around for unsophisticated actors.
- jeroenhd 6y agoMAC whitelisting is so easily circumvented that it's more of a hassle than a security measure, really. It also doesn't solve the rogue access point problem because with two devices you can capture a target on one part of the network, MitM it, and forward the traffic to a second device somewhere else on the network where you replicate the target's MAC address. Proper access control (enterprise WPA, deployed with valid certificates and correctly provisioned to company devices) would probably solve most issues when it comes to automatic credential stealing through WiFi access points. PNAC also works quite well in that context. The largest challenge in this area would be people using the guest network instead of the office network, but that can be worked around by requiring either access to the internal network or access through a VPN to get to any information that you're afraid might leak. Still, if you find a rogue access point, you would probably want to find out where it is so you can analyze and/or remove it. One of these tools can be quite handy for that, assuming they're cheap and available enough to have just lying around.
- hsbauauvhabzb 6y agoMac whitelisting isn’t to prevent sophisticated actors, it’s to prevent rogue access points by Jane on the front desk. Certificate based auth is a very good technique, but wifi level auth has no relation to rogue APs, iirc pnac is cert based also and that’s where it makes sense.