[MLB-WIRELESS] another stupid q, about dhcp

[Tony Langdon, VK3JED]

At 08:59 PM 3/04/2002 +1000, Adrian Close wrote:

>1. Assigning yourself an address and using the network anyway (DHCP is not
>designed as a security tool).  Maybe this could be defeated by having the
>gateway/router only accept traffic from known MAC addresses, but there's
>nothing to stop you...

This involves a little sniffing, but that never put anyone off, especially 
on a wireless network! :)

>2. Sniffing the network for a valid MAC address, setting your own MAC
>address to the same value and requesting a DHCP lease.

This would be even easier than #1. :)

>I spent a fair bit of time trying to come up with some kind of trivial but
>reasonably strong means of authenticating known clients using existing
>features in DHCP in creative ways, but haven't found anything good yet.  I
>suspect this is mostly because anything you might use as a "token" to
>prove the client is a known one as far as the server is concerned, can be
>sniffed and reused by a third party (Microsoft, take note).

Yes, there's no true "unique and secure identifier".

>What is needed if you really want to do this is some cryptographically
>good challenge-response thing.  IPSEC strikes me as nicely standardised
>way of achieving this.  Unfortunately IPSEC configuration can be downright
>tricky and more importantly, support is not ubiquitous.  It is getting
>there, but currently as soon as you venture out of open source land you
>have to pay extra, which most people will be disinclined to do (unless, of
>course, you make it a pre-requisite for connection to your public access
>node, at which point people who want to use your node will become quite
>interested!).

Yeah, the big problem with IPSec are the Win9x boxes floating around, and 
NT as well.  Win2k supports it out of the box, as does XP.  And yeah, the 
config side is a pain.  I've looked over the FreeS/WAN docs and hmmmm. :)

>Of course, from DoS kind of "hacking" perspective, NOTHING will save you
>from Tony's 2.4GHz noise generator.  ;)

Well, that's the wireless equivalent to cutting the network cable... 
:-)  However, when that's all running, you should be able to watch the 
pictures if you have an old analogue satellite receiver and a pre-Galaxy 
downconverter (older then the normal Galaxy ones).


>Adrian Close                    email:  adrian at close.wattle.id.au
>1 Old Gippsland Rd.             web:    http://www.close.wattle.id.au/~adrian
>Lilydale, VIC, 3140, Australia  mobile: +61 412 385 201
>
>Echelon teaser: MD5 RX-7 SSL Kiwi TRD DEADBEEF Bubba
>
>
>To unsubscribe: send mail to majordomo at wireless.org.au
>with "unsubscribe melbwireless" in the body of the message
>
>
>
>---
>Incoming mail is certified Virus Free.
>Checked by AVG anti-virus system (http://www.grisoft.com).
>Version: 6.0.343 / Virus Database: 190 - Release Date: 22/03/2002

73 de Tony, VK3JED
http://vk3jed.vk.irlp.net