1

I have a hidden SSID network. I know that although the SSID is hidden, someone can sniff the Wi-Fi channels to get my SSID, and with that SSID he can use some OpenWRT-ish things to spoof my Wi-Fi network to force me type my password to authenticate his device. That is unacceptable, and I am looking for better security for my Wi-Fi network.

What options do I have? How can 802.1X be used, I need to keep it as simple as possible.

UPDATE:

I have D-Link DWS-4026 that manages D-Link wifi access points, user credentials are stored in AD. My AD is not the CA of my infrastructure, I can change that, should I? Will users be asked to input their logins and passwords two times, for windows login and for connecting to wifi?

Improve this question
5
  • 1
    To answer this we need to have more details about your infrastructure. Autonomous accss points or centrally controlled ? brand / model / software version and so on. We also need some detail about your network (Windows based with active directory, linux?) and the kind of devices that must use this wifi, etc...
    – JFL
    Commented Feb 26, 2016 at 9:53
  • JFL is correct, more details would vastly assist. If you want EAP for your network read this link : en.wikipedia.org/wiki/Extensible_Authentication_Protocol
    – user4565
    Commented Feb 26, 2016 at 20:49
  • 1
    I suggest a bit of searching around on security.stackexchange.com and various other websites, and then coming back with a bit more detail.
    – JZeolla
    Commented Mar 5, 2016 at 0:56
  • @YLearn I was just about to make the same change ;)
    – Ron Trunk
    Commented Mar 5, 2017 at 20:39
  • @RonTrunk, well, great minds and all that. I also noticed that the 802.1X tag's descriptions were using a mix of upper and lower case x's, so fixed that too.
    – YLearn
    Commented Mar 5, 2017 at 20:42

1 Answer 1

Reset to default
2

To answer your first question, Yes someone with a wireless sniffer will be able to find your "hidden" SSID by examining probe requests from clients that are already configured to connect to that SSID.

Implementing 802.1x can provide the security you are looking for IF it is configured correctly. At the very least you will want to configure your clients to verify the RADIUS server's TLS certificate and server name to prevent the attack you are concerned about (I believe it's referred to as an "evil-twin" attack).

Implementing 802.1x is not easy. It requires setting up, configuring, and maintaining a RADIUS server as well as TLS Certificates. It will require end user education and training.

Without understanding more about your infrastructure and risk profile that's the best answer I can give.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.