(Cross-posting from my organization’s blog – http://niiconsulting.com/checkmate/2014/03/insecure-implementation-guest-wireless-networks/)
Most large organizations provide wireless facilities for their guest, which may include vendors, consultants, business associates, employees from other regions etc.
Certain points should be considered while implementing a guest wireless network.
- Encryption in use
- Captive Portals or Guest Authentication
- Network Segregation
Finding the SSID of a Hidden wireless network
To simplify the connectivity for guest devices some organizations configure their networks without encryption i.e. ‘OPEN’. To prevent un-authorized entities from connecting to their networks most of these networks are configured as HIDDEN. As is well known, this configuration does not really provide any security. It is simply a method of obfuscation (Non-Broadcast Wireless SSIDs Why hidden wireless networks are a bad idea).
To identify the SSID of a hidden network you would need:
- Wireless adapter which supports packet injection (http://www.aircrack-ng.org/doku.php?id=compatible_cards)
- Aircrack-ng wireless suite (http://www.aircrack-ng.org/)
I will be using an Alfa AWUS036H adapter. This card is well supported by Aircrack-ng.