D
Don Y
- Jan 1, 1970
- 0
Hi Jeff,
I'm not worried about a client being "vulnerable". Recall my
approach: "like having a firewall on EVERY network connector!"
The problem is an attacker can flood the airwaves and prevent clients
from *intentionally* intercommunicating. Then, things fall to
pieces.
E.g., I prevent anyone from injecting foreign traffic into the
*wired* network (current implementation). Even if you unplug
a cable and try to "confuse" the device on the other end of
that cable, you can't coerce it into doing anything. All you
can do is DENY it access to the other nodes in the system.
So, if that node was a security camera, the system would know
that "security camera X" is now offline -- and it shouldn't be!
(you couldn't inject phony video masquerading *as* that camera)
With a wireless network fabric, you can effectively interfere
with *all* communications simultaneously. Like taking an
axe to *the* network switch.
Because they are probably targeting you with in-band traffic?
Have you looked at any of the traffic to see what they are
trying to do? I.e., which ASSUMPTIONs they are trying to
exploit?
Google for known vulnerabilities with that kit?
Look into what is misnamed "AP isolation" but is really "client
isolation". I use it heavily in my few remaining hot spots and coffee
shop networks to prevent customers computers from attacking each
other. It's standard on most wireless routers and access points. It
blocks any traffic between two wireless clients. The catch is that it
does nothing between the various computahs on the ethernet switch,
which can still merrily attack each other.
I'm not worried about a client being "vulnerable". Recall my
approach: "like having a firewall on EVERY network connector!"
The problem is an attacker can flood the airwaves and prevent clients
from *intentionally* intercommunicating. Then, things fall to
pieces.
E.g., I prevent anyone from injecting foreign traffic into the
*wired* network (current implementation). Even if you unplug
a cable and try to "confuse" the device on the other end of
that cable, you can't coerce it into doing anything. All you
can do is DENY it access to the other nodes in the system.
So, if that node was a security camera, the system would know
that "security camera X" is now offline -- and it shouldn't be!
(you couldn't inject phony video masquerading *as* that camera)
With a wireless network fabric, you can effectively interfere
with *all* communications simultaneously. Like taking an
axe to *the* network switch.
Yep. However, putting the phone behind the router/firewall isn't
helping much. Ports 5060-5064 (SIP) are still exposed to the internet
via port forwarding and UPnP. So, I still get attacked. I've tried
various firewall rules, which help, but not completely. It also
doesn't help when I'm traveling. Yet another project.
Because they are probably targeting you with in-band traffic?
Have you looked at any of the traffic to see what they are
trying to do? I.e., which ASSUMPTIONs they are trying to
exploit?
Google for known vulnerabilities with that kit?