Ultimate Router Guide: How to Optimize Security and Performance

Posted 10/06/2009 at 8:00am | by Justin Kerr

19

Comments

Print

Security – The Basics

The first thing you should do if your working with a new router is to change the default user name and password. Leaving the defaults in place is like leaving the front door open, and anybody within range of your router can gain access to your network, no matter how strong your wireless encryption password is. Some routers also give you the option to “remotely configure” or “remotely access” your router. You’ll want to make sure that these are disabled. Basically this feature gives you the ability to access your router configuration via the Internet. Sounds innocent enough, but I honestly can’t think of a circumstance where this would be useful, and you simply expose another surface for attack.

It is also a good idea to change your routers SSID (Wireless Network Name). Broadcasting to the world that you are using a Linksys for example might not be a problem if you’ve changed the default passwords, but the trick to security is to always keep your attackers guessing. Many routers give you the ability to make the wireless network invisible, but don’t bother with this feature. Setting your network to invisible might keep people from accidentally latching on to your connection, but anyone using the right tools can find it easily. A very common security mistake with wireless routers is to set them to “invisible” and then run with no security.  All of your data is still being transmitted in the clear and don’t kid yourself, the bad guys won’t be fooled.  Security through obscurity alone isn’t enough to protect your wireless network.

Security – Wireless Basics & How To Safely Isolate A WEP Network

Plugging devices in using the RJ-45 Ethernet connectors on your router is the safest way to setup your home network, but let’s face it, its rather inconvenient. Wireless networking has made it possible to roam around the house and connect devices no wire could ever reach, but its important to remember that it comes with a slew of security considerations. Everyone has heard the terms WEP, WPA, WPA2, etc tossed around, but what is the best option? When it comes to wireless security, WPA2 is always the way to go, but WEP is still better than nothing at all. Here is a summary of the most popular options.

Pros & Cons of Each Security Method

No Security

Connecting to an unsecured wireless access point is like having a conversation in public. Anybody within range of your signal can see the information passing through the air “in the clear”. This basically means that when you type in your usernames, and passwords, they can be easily recorded by anyone who feels the need to listen in. The same is true outside of your home when you connect to unsecured wireless hotspots, so beware of what services you login to on open networks. Sessions on open networks can still be conducted safely if you notice an “https://” in the address bar (also look for the lock icon in your browser).

Running with no security on your home router doesn’t just allow your neighbors to share your Wi-Fi, but in addition to monitoring and recording your sessions, they can also access shared drives on your machines that are connected to the network. On my last vacation I got a kick out of browsing through peoples iTunes libraries that automatically appeared courtesy of the unknowing souls who were connected to the hotels wireless network. Logging into a VPN will also allow you to safely work on unsecured wireless networks, but if you don’t know what a VPN is, you probably don’t have access to one.

WEP

Wired Equivalent Privacy might sound like a fancy and secure acronym, but sadly it’s a flawed, and painfully inadequate encryption method. WEP is generally good enough to keep out nosy neighbors, but it can be easily cracked within minutes using freely available software tools, so it’s definitely not to be trusted for your everyday use. Some find themselves using this method to ensure backwards compatibility with older devices such as the Nintendo DS, but anyone who wants to get into your network can do so in a matter of minutes. Some routers offer the ability to enable a “guest mode” and run a separate unsecured or lower security network in addition to something stronger, but these generally still aren’t recommended.

If you absolutely must maintain a WEP or No Security enabled router, the only safe way to go about this is to create a “Y” configuration with one router just for your insecure WEP traffic, and a third for trusted WPA capable devices. To do this you need to have a central router to connect you to the Internet, and then have a WPA access point and a WEP access point.  Basically you would be running two wireless networks.  One is secure, and one is not. With this configuration, even if someone cracks your WEP protected router, the best they can hope for is to mooch off your Internet connection. Fancier solutions to this problem exist, but with consumer grade routers going for around $20 these days, you won’t find anything cheaper.  

WPA

Wi-Fi Protected Access was implemented to replace the much weaker WEP encryption mentioned above, but we now know that it too is vulnerable to attack.  The underlying encryption method behind WPA is called TKIP (Temporal Key Integrity Protocol) and it is now known to be vulnerable to a “key stream recovery attack” that will allow hackers to inject packets onto your network.

For the most part this attack isn’t as serious as those found on the WEP side, because it doesn’t actually review your master key, and they still won’t be able to eavesdrop on your session or monitor your traffic. Of course, once they start injecting code into your connection, the possibilities are endless, but most home users can get away with running this if they have devices that don’t support the newest WPA2 encryption method.

WPA Enterprise

This setting typically isn’t for home users, and is designed to work with a RADIUS server which allows for centralized authorization of clients.

WPA2

Wi-Fi Protected Access 2 replaces the beleaguered TKIP encryption from its predecessor with one of the most powerful algorithms available, AES. Advanced Encryption Standard is a robust, lightweight solution, which only has one known weakness, a brute force attack. Somebody wishing to crack into a WPA2 protected network will need to try random combinations in the hopes of guessing your passkey, that’s why its important to avoid using common dictionary words. The headline “WPA has been cracked” has been in the news recently, but rest assured this applies to WPA, which uses TKIP, and not WPA2, which exclusively uses AES. Some routers will offer the ability to run both WPA and WPA2 encryption on the same wireless connection, but keep in mind your security is only as strong as the weakest link. This approach should be taken only if you have hardware that won’t work with WPA2.

The Bottom Line

Pretty much every new client device I’ve tested within the last five years (except the Nintendo DS) supports WPA2. This offers up unbeatable protection that will allow you to fearlessly do even your banking from any room in the house. Of course, any encryption is only as powerful as the Pre-Shared Key (pass-phrase) that you select as your password. WPA2 is still vulnerable to “brute force” style attacks which attempt to guess your pass phrase, and they often try combinations from various common passwords. Simple word combinations might “feel secure”, but these simply aren’t enough these days to keep out a determined brute force attacker. New GPU assisted crackers have significantly improved the efficiency and viability of brute force, so as a rule of thumb, your password shouldn’t be easy to remember.

Want to grab a random and secure password? Surf over to the passwords section on GRC to get a peek at what a really strong password looks like, or grab one that is randomly generated for you. With one of these passwords protecting your router, a brute force attacker is more likely to die of old age (or get evicted from his parents basement) before he ever breaks in.