BACKGROUND

WiFi, or as Mac-lovers know it as “AirPort”, has revolutionized networking. Not only are we no longer tethered to our Ethernet cable at the office, we can have high-speed Internet at the corner cafe. Well over half the households with broadband internet access now also have WiFi.

This makes it incredibly easy to pull out your laptop anywhere in the home and get to play, er, I mean get to work.

Unfortunately, few home users know how to configure their wireless networking so that it prevents others from access.


WHY YOU DON’T WANT OTHERS ON YOUR WIRELESS NETWORK

It’s not because you don’t want to share your toys, it’s because having others on your network presents all sorts of problems you really don’t want to have in your life. At a minimum a piggybacker will slow your network. At its worst they could easily cause the interruption of your Internet service, hack your personal data, and potentially have you permanently blocked from any Internet Service Provider (yes, really).

Keep in mind that your wireless network operates in a “time-sharing” mode. If the total available bandwidth is, say, 54 Mb/s and you are the only person on the network, you get access to all 54. If there is another person on your network, that 54 is evenly divided between the two of you, so each gets 27. Should 10 be on your network, each gets 5.4 Mb/s. So the neighbor that is piggybacking on your WiFi is severely impacting your ability to quickly work on the Internet.

How about that kid a few houses down the block with tons of time on his hands. Your signal reaches him as well. Even if you have your WiFi password protected, with enough time he may well figure out your password, access your network, and then go to work on your computer login password (which statistically speaking, will be the same as your WiFi password). Now that kid has full access to everything on your computer, including user names and passwords for bank accounts, credit cards, etc.

(Note: As reported on 3/25/2010, a teenager in England hacked into President Obama’s Twitter account simply by guessing security information)

It can get even worse. What if someone uses your WiFi network to send spam? That action will have your Internet provider disconnect your service and place you on a black list. Getting off the black list is a herculean task, and as long as you are on it, no ISP will service you. No problem, you really wanted to go back to using a modem anyway, right?


STEPS TO SECURE YOUR WIRELESS NETWORK

For our purposes I will assume you are using an Apple AirPort Base Station. The steps are identical regardless of the brand of base station you are using, just the specifics as to what screen a setting is on will be different.

Change the default administrator user name and password

Just about half of all wireless networks have the default administrator user name and password in place. This makes it a cinch to get onto a network.

1. Launch AirPort Utility.
2. Click the “Manual” button.
3. Select the “Airport” icon in the navigation bar, then the “Base Station” tab. In the “AirPort Extreme Password” field, enter a new password of at least 14 characters–the longer the better. Then click the “Update” button.
   
   
   
   

Encrypt the data on your network

Using WiFi broadcasts your data as a radio wave. Off-the-shelf antennas can easily pick up your signal from over 20 miles away. And that signal is easily readable. To block the ability to read your data (such as user name and password when you access your bank on the Internet), you must encrypt your data.

There are two basic encryption schemes in use today, WEP and WPA. WEP has been broken, the guidelines for how to decrypt a WEP signal are available on the Internet. WEP now only provides a false sense of security. DON’T USE WEP. If your base station is only capable of encrypting in WEP, trash it and get another base station. An Apple AirPort Express can be purchased for $99, and the Extreme for $179 (my favorite choice).

1. Select the “Airport” icon in the navigation bar, then the “Wireless” tab. In the “Wireless Security” pop-up menu, select “ WPA/WPA2 Personal. Note: WPA has recently been hacked, but the details are not yet widely available. If you are certain that all of the computers that you want to access your network are capable of supporting WPA2, then you can select just that. Otherwise, use the WPA/WPA2 option.
2. In the “Wireless Password” field, enter the password that will be entered to access the WiFi and get onto the Internet. This password should be at least 14 characters long. Then click the “Update” button.
   
   
   
   

Hide your SSID

Your SSID is the name of your wireless network, as seen when scanning for a network to join. If you hide your SSID, it will keep your neighbor from piggybacking on your network, but it likely won’t have an impact on a serious hacker. In order to join a network with a hidden SSID, you have to know the name of the network.

To join a network with a hidden SSID:

1. From the desktop, select the AirPort menu item.
2. From the AirPort menu item, select the “Join Another Network” submenu.
3. In the “Join Another Network window, enter the name of the network to join, select the type of security it uses, then enter the password. Then click the “Join” button.
   
   
   
   

To hide your SSID:

1. Select the “Airport” icon in the navigation bar, then the “Wireless” tab. Near the bottom of the window click the “Wireless Options” button.
   
   
   
   
2. In the “Wireless Options” window, enable “Create a closed network”. Then click the “Done” button.

Restrict access via MAC address

Here we are getting very serious about security, possibly more so than a typical household requires, but not too much for a business.

Every networkable device has a MAC (Media Access Control) address. Most base stations permit restricting access based on MAC address–some go as far as specifying what days and times each MAC address can access the WiFi network.

To locate the MAC address of your Macintosh:

1. On the Macintosh, select Apple menu > System Preferences > Network.
   
   
   
   
2. Click the “Advanced” button.
   
   
3. In this window you will see the “AirPort Address”. This is the same as the MAC address. Write down this address. Then Quit out of System Preferences.
   
   

To restrict access based on MAC address:

1. Select the “Airport” icon in the navigation bar, then the “Access” tab.
2. In the “Mac Address” field, enter the address retrieved in the previous steps. Assign a description of the computer. Then specify when this computer may have access. When finished, click the “Done” button.
   
   
   
   
3. Click the “Update” button.
4. Repeat steps 1-3 for every device that will access your WiFi. All other devices will be blocked, even if they can crack your password!

Install anti-malware software on your computer

Currently there are over 600,000 malware products (viruses, trojan horses, etc.) running in the wild on Windows, and fewer than a dozen for Macintosh. The likelihood of becoming infected on a Mac is low, but it is real. I have a dozen or so client machines each year that become infected.

An infected computer can be turned into a zombie, performing at the command of the creator of the malware, including sending user names and passwords without your knowledge and bypassing all of your security measures. Because of this, it is vital to protect your Mac against malware.

I’ve written in earlier articles on the use of anti-virus applications. I currently only recommend Intego Virus Barrier for Macintosh as a comprehensive anti-malware solution.

Tags: airport, Security, wifi