As we saw in the last article, Wi-Fi uses radio frequencies as the medium of communications between the Wi-Fi router and devices on the Local Area Network (LAN). In some locations of my house, my tablet sees signals from the Casa Conde Hotel, which is over a block away. Radio signals do not stop at the walls of a building, or a property line. If the your Wi-Fi router is not secured, it is an open invitation for others to use your network

I used to teach Linux and Unix seminars all over the USA, Canada, and many other countries. In most cases, I was not allowed to use the clients Internet to access the Internet for my business. So, at lunch and dinner, the exercise was to find a coffee shop, or restaurant, that provided public Wi-Fi access. I used a Wi-Fi radar app on my phone to determine were I was going to dine. It always amazed me how many businesses, and residences, had no security on their Wi-Fi network. Not only were they inviting others to use their Internet connection, but they were exposing all the computers on their network. Laptops, netbooks, tablets, and phones have the habit of connecting to the Wi-Fi hotspot that has the strongest signal. This can lead to accidental, but still unauthorized, use of someone’s network.

The first step to securing your Wi-Fi network is to require a password to access the network. Using a clear text password is like writing the password on your terminal, so routers encrypt the password using one of three encryption protocols. The oldest, and least secure, is WEP (Wired Equivalent Privacy). An individual can decode a WEP password in less then 10 minutes (it takes the FBI only 3 minutes). WEP is like using a suitcase padlock to protect a case of precious jewels. Wi-Fi Protected Access (WPA) addresses this weakness, but is still breakable. WPA2 creates the strongest security. Even WPA2 can be decoded, if the passwords are dictionary words, in any language, or are too short. A string of 14 characters (mixed alphanumeric, and special characters) is virtually impossible to break. With a good WPA2 password, your network is more secure, but not totally secure.

Every Wi-Fi router has an administrative account that has a default name and password. The default name and password are in the setup guide, which is available on the Internet. If someone gets access to your network, they can reconfigure your network, without your knowledge. One of the favorite tricks is to enable remote access to your network. This means that they can access your router from the Internet, at any time, from any place. To protect your router from unauthorized access, you need to change the name of the administrative account, use a secure password, and disable remote access. It goes without saying that this password should be different than the WPA2 password. While much more difficult, it is still possible for someone to gain unauthorized access to your network.

From past articles, we know that every machine has a unique IP address, but this is not the address used for communications to the device. Every network interface on a device has a unique MAC (Media Access Control) address. Most Wi-Fi routers allow you to define what devices are permitted to access your network based on its MAC address. The MAC looks like this example: 01:23:45:67:89:ab. To find the MAC address on Microsoft XP, Vista, and Windows 7, you need to open a Command window and enter ipconfig /all. On Unix / Linux, the command is ifconfig -a. On Macintosh computers the MAC address is found under the TCP/IP Control Panel. For an Android phone, it is under Settings -> About Phone -> Status. On some devices, you may find multiple MAC address, one for each network interface. Once you know the MAC address, you can configure the router to only accept connections from those addresses.

It is possible to monitor your network, after all it uses radio frequencies, and collect MAC addresses. Someone can then use MAC address spoofing to gain access to the network. You can make this very difficult by creating a hidden network. Wi-Fi radars depend on finding the name (SSID) of the network. A network with no SSID is called a hidden network. It takes a bit more work to configure a device to connect to a hidden network, but it puts a definite crimp on anyone’s ability to find the network, in the first place.

When you use your phone to tether to the Internet, the only security available is use a good WPA2 password. An ad-hoc network must have an SSID, so there is no way to hide the network.

To see what your network looks like try these tools: AirSnare for Windows, Wireshark for Linux, and Fing for Android. Besides, these tools simplify the task of collecting the MAC address that you need for your router.

There is no such thing as absolute security, but we can make it more difficult. Many years ago, I was an adult probation officer in Phoenix, Arizona. Over the years that I held this job, I performed hundreds of pre-sentence investigations. Of all those investigations, only a few were true professional criminals. One individual was charged with 50 counts of auto theft, after a deal that closed over a thousand auto thefts. He didn’t steal just any car, he stole to order. His rule was that if it took more than 30 seconds to steal a car, it was not worth the risk. So it is with protecting your WiFi network. Each step we take makes it more difficult, and not worth the effort to a potential unauthorized user. We are not just preventing access to the Internet, we are protecting the confidential information stored on our computers.