2KKUU7ita

176
Part III: Hacking Network Hosts
Walk around your building or campus (warwalk, if you will) to perform this
test to see what you can find. Physically look for devices that don’t belong
and keep in mind that a well-placed AP or WLAN client that’s turned off won’t
show up in your network analysis tools. Search near the outskirts of the building
or near any publicly accessible areas. Scope out boardrooms and the
offices of upper-level managers for any unauthorized devices. These places
may be off-limits, but that’s all the more reason to check them for rogue APs.
When searching for unauthorized wireless devices on your network, keep
in mind that you might be picking up signals from nearby offices or homes.
Therefore, if you find something, don’t immediately assume it’s a rogue
device. One way to figure out whether a device is in a nearby office or home
is by the strength of the signal you detect. Devices outside your office should
have a weaker signal than those inside. Using a WLAN analyzer in this way
helps narrow the location and prevent false alarms in case you detect legitimate
neighboring wireless devices.
It’s pays to know your network environment. Knowing what your surroundings
should look like makes it easier to spot potential problems.
A good way to determine whether an AP you discover is attached to your
wired network is to perform reverse ARPs (RARPs) to map IP addresses to
MAC addresses. You can do this at a command prompt by using the arp -a
command and simply comparing IP addresses with the corresponding MAC
address to see whether you have a match.
Also, keep in mind that WLANs authenticate the wireless devices, not the
users. Criminal hackers can use this to their advantage by gaining access
to a wireless client via remote-access software, such as telnet or SSH, or by
exploiting a known application or OS vulnerability. After they do that, they
potentially have full access to your network and you could be none the wiser.
Countermeasures against
rogue wireless devices
The only way to detect rogue APs and wireless hosts on your network is to
monitor your WLAN proactively (say weekly, even daily), looking for indicators
that wireless clients or rogue APs might exist. A WIPS is perfect for such
monitoring. But if rogue APs or clients don’t show up, that doesn’t mean
you’re off the hook. You might also need to break out the wireless network
analyzer, wireless IPS, or other network management application.
Depending on your AP, a couple of configuration changes might keep hackers
from carrying out these hacks against you: