Securing your Linksys Wireless Router BEFW11S4 Abstract
Current implementations of the 802.11b wireless LAN standards have several potential pitfalls for security. However, built in security mechanisms in the 802.11b protocol can be used to mitigate most security risks. Out of the box, the Linksys default configuration is insecure. This paper examines how to configure the Linksys Wireless Access Point (BEFW11S4) in a manner which will improve the security of the of your Wireless LAN

Introduction

Wireless networks are becoming increasingly common due to the ease and cost of deployment of the LAN using wireless technologies. Wireless networks provide different challenges than wired networks, especially in securing data in transit between the client and the wireless access point. The wireless standard, 802.11b provides mechanisms for securing wireless data, and despite the limitations of the standard when the provided mechanisms are deployed and maintained in a systematic manner data can be secured against all but the most determined and patient attacker. This paper describes security strategies for the Linksys Wireless Access Point (WAP), model BEFW11S4, Version 2, and the Linksys Instant Wireless Network Adapter Version, model WCP11, version 3. This paper assumes the user is familiar with the Linksys web-based management interface, and how to use a web browser.
Configuration Recommendations
For the Linksys Wireless Access Point I recommend the following configuration settings to secure your wireless LAN. 1. Reset admin password 2. Reset default SSID 3. Disable SSID Broadcast 4. Change from default channel 5. Enable WEP with 128 bit key 6. Change Authentication Type to Shared Key The following sections will describe why and how you should do these steps.

Reset Admin Password

From the factory the Linksys WAP comes with a default password of admin. The Linksys WAP uses a web based interface, and this interface is accessible to anyone on your network. Because this is a wireless network, anyone who can access your network 1/Richard Wanner. All rights reserved. For information contact cerberus@whitehats.ca or rwanner@pobox.com.
will be able to access the GUI interface and attempt to make changes. By setting the password we will at least be able to prohibit unwelcome users from reconfiguring the WAP. The password is reset from the password tab. The password can be up to 63 characters.
Figure 1 Linksys Password Screen
The next three items are all on the setup tab of the GUI.
Reset Default Service Set Identification (SSID)
The service set identification (SSID) defines a network name for your wireless network. In order to communicate the WAP and the clients wireless interface must specify the same SSID. The Linksys WAP comes with a default SSID of linksys The SSID is easily sniffable, but changing it will at least deter the casual attacker. The SSID can be up to 32 characters in length.
2/Richard Wanner. All rights reserved. For information contact cerberus@whitehats.ca or rwanner@pobox.com.
Figure 2 Default Linksys Setup Screen

Disable SSID Broadcast

By default 802.11b broadcasts the SSID to the network to assist devices in finding the network. By default the Linksys WAP enables SSID broadcast. In a closed SOHO configuration this should be disabled.

Change Channel

By default Linksys is set to channel 6. Although it is a minor bit of obscurity it is a good idea to switch to a different channel so a wireless interface in the default configuration cannot access your network.
Enable Wired Equivalent Privacy (WEP)
By default 802.11b broadcasts network traffic in the clear. WEP is link-layer encryption designed to provide confidentiality to the wireless network. WEP has some flaws which limit its effectiveness, but WEP provides adequate protection to deter all but the sophisticated and patient attacker. In order to enable WEP, the WEP configuration needs to be set to Mandatory and the key set. The following figure shows the settings on the Setup tab after the above have been done.

3/Richard Wanner. All rights reserved. For information contact cerberus@whitehats.ca or rwanner@pobox.com.
Figure 3 Proper Settings Linksys Setup Screen

Setting the WEP Key

Linksys supports both 64-bit or 128-bit encryption. Because of WEPs inherent limitations, it is best to use the 128-bit encryption option. To set the WEP key, click the WEP Key Setting button on the main setup page. The default is 64-bit WEP. Start by changing the setting to 128-bit, that will result in a transformation of the page to that in figure 5 below.
4/Richard Wanner. All rights reserved. For information contact cerberus@whitehats.ca or rwanner@pobox.com.
Figure 4 Default WEP Key Setting Screen 128 Bit
To generate a key you can use two methods. Either a manual key, or through entering of a passphrase. I suggest the passphrase method since it is easier to remember, and duplicate. The passphrase can be up to 31 characters long. Enter the passphrase and then press the Generate button.
5/Richard Wanner. All rights reserved. For information contact cerberus@whitehats.ca or rwanner@pobox.com.
Figure 5 WEP Key Setting Screen 128 Bit
Shared Secret Authentication
The Linksys WAP supports three authentication setting; open systems authentication, shared-key association, and both. Open systems authentication permits any client to use the WAP as long as they know the SSID. Shared-key authentication uses the WEP key as a shared-key to be exchanged between the client and the WAP as a simple form of authentication. WEP must be enabled to use shared-key authentication. The both setting permits either or these methods to work. The default method in the Linksys WAP is Both. The authentication type is changed by going to the Advanced tab and then the wireless tab and selecting Shared Key from the Authentication Type drop down menu.
Figure 6 Authentication Type Setting Screen
6/Richard Wanner. All rights reserved. For information contact cerberus@whitehats.ca or rwanner@pobox.com.

Maintenance

According to research, the limitations of the WEP encryption mean that the key can be derived if five to six million packets are captured and analyzed. If you want to ensure the security of your data changing your WEP key regularly should be part of your maintenance steps. I would recommend changing it once a week or more depending on usage.

References

Linksys Corporation, BEFW11S4 Version 2 - Wireless Access Point Router with 4-Port Switch User Guide, 2002 Craiger, Phillip J., 802.11, 802.1x, and Wireless Security, June 23, 2002, URL: http://rr.sans.org/wireless/802.11.php

7/Richard Wanner. All rights reserved. For information contact cerberus@whitehats.ca or rwanner@pobox.com.

Installing the Linksys Wireless Router with a Westell 6100 Modem
1. Open your Web browser and enter http://192.168.1.1 in the Address field.
2. Click Home in the top menu to verify you are on the Home page. 3. From the Configuration menu, select VC Configuration.
4. Enter your user name and password. It is suggested that you use your Verizon primary account login information.
Verizon Online 5. Click Edit for the row that has "PPPoE" in the Protocol column and "Enable" in the Status column.
6. Select Bridge from the dropdown list for the Protocol field.
7. Verify that the Mode field is also set to Bridge.

Verizon Online

8. Click set VC. 9. Click OK at the Set this Bridge VC Configuration prompt. 10. Click OK at the prompt asking if you want to reset your configuration now.
A message displays to indicate the modem is resetting. When the modem is reset, you are returned to the Home page. 11. Verify that the DHCP LAN server is turned off by selecting DHCP Configuration from the Configuration menu.
Verizon Online 12. Select Off from the drop-down list for the DHCP Server field.
13. Select Save. 14. Select OK at the Save and reconfigure DHCP prompt. 15. Select Private LAN Configuration from the Configuration menu. 16. Verify that Private LAN DHCP Server Enable is unchecked.
Verizon Online 17. Select Save. 18. Close your browser window. 19. Shut down and power off your computer. 20. Verify that the router power cord is plugged in to an outlet and that the Power light on the router is lit.
21. Disconnect the modem Ethernet cable from the back of the computer only. Do not disconnect it from the modem.
22. Plug the Ethernet cable you just removed from your computer into the WAN port on the back of the router.
Rear view of the Linksys BEFW11S4 Series Router 23. Using a new Ethernet cable, plug one end into one of the numbered ports on the back of the router (1-4 or 1-8, depending on the model). 24. Plug the other end of the new Ethernet cable into the back of your computer (where the cable coming from the modem was previously plugged in). 25. Power on the computer. 26. Check the status lights on the modem and on the router. o Verify that the following lights on the Westell 6100 modem are on (green). Power light DSL light Ethernet light
Verify that the following lights on the Linksys router are on (green). Power light Link/Act light Link light in the WAN section
27. Open a web browser like Internet Explorer or Netscape. 28. Enter 192.168.1.1 in the Address field and press Enter.
29. When the dialog box displays, leave the Username field blank and enter admin in the Password field. 30. Click OK. 31. Verify that the Setup tab is selected in the Linksys window.
32. Select PPPoE from the drop-down list for the Select the Internet connection type you wish to use field. 33. Enter your Verizon Online user name and password. 34. Click Apply. 35. Click Continue to return to the Setup screen. 36. Close the Linksys window to complete the setup. After you've entered the information into the fields on the Setup tab, it's important to verify the status of your router. 37. Select the Status tab.
38. Verify that "Connected" displays as the status. If "Disconnected" displays, click Connect. 39. Close your web browser and then reopen it to apply the new settings. The final step in the router installation is to test your home network connections by verifying your connectivity to the Internet. 40. Double-click on the Internet Explorer icon on your desktop or open any Web browser. 41. Enter www.verizon.com in the Address field to verify that you can connect to the Internet. o If you can't connect to the Internet, use the Linksys troubleshooting steps to identify the problem.