Network cloaking is an attempt to provide
wireless security
Wireless security is the prevention of unauthorized access or damage to computers or data using wireless networks, which include Wi-Fi networks. The term may also refer to the protection of the wireless network itself from adversaries seeking to ...
by hiding the network name (
service set identifier
In IEEE 802.11 wireless local area networking standards (including Wi-Fi), a service set is a group of wireless network devices which share a ''service set identifier'' (''SSID'')—typically the natural language label that users see as a network ...
) from being broadcast publicly. Many routers come with this option as a standard feature in the setup menu accessed via a web browser.
Network cloaking may stop inexperienced users from gaining access to a network, but should otherwise be considered a minimal security measure. Network cloaking is less effective than static WEP (which itself is vulnerable, see
Wired Equivalent Privacy
Wired Equivalent Privacy (WEP) was a security algorithm for 802.11 wireless networks. Introduced as part of the original IEEE 802.11 standard ratified in 1997, its intention was to provide data confidentiality comparable to that of a traditional wi ...
).
More secure forms of wireless security include WPA (
Wi-Fi Protected Access
Wi-Fi Protected Access (WPA), Wi-Fi Protected Access II (WPA2), and Wi-Fi Protected Access 3 (WPA3) are the three security and security certification programs developed after 2000 by the Wi-Fi Alliance to secure wireless computer networks. The All ...
) and preferably WPA2.
It is possible for WEP, WPA, WPA2, and other encryption technologies to be used in conjunction with hiding the SSID.
Advantages
Minimal security benefit
Hiding the network name may prevent less technically inclined people from connecting to the network, but will not deter a determined adversary. Use of WPA or WPA2 is recommended instead. Hiding the SSID removes it from beacon frames, but this is only one of several ways an SSID can be discovered.
When one chooses to hide the network name from the router's setup page, that only sets the SSID in the beacon frame to
null
Null may refer to:
Science, technology, and mathematics Computing
* Null (SQL) (or NULL), a special marker and keyword in SQL indicating that something has no value
* Null character, the zero-valued ASCII character, also designated by , often use ...
, but there remain four other ways that the SSID is transmitted. In fact, hiding broadcast of the SSID on the router may cause the
Network interface controller
A network interface controller (NIC, also known as a network interface card, network adapter, LAN adapter or physical network interface, and by similar terms) is a computer hardware component that connects a computer to a computer network.
Ear ...
(NIC) to constantly disclose the SSID, even when out of range.
Usability improvement
Hiding the network name improves the experience of users connecting to wireless networks in dense areas. When the network is not intended for public use and does not broadcast its SSID, it will not appear in a list of available networks on clients. This simplifies the choice for users.
Organizations may decide to cloak the Wi-Fi SSID intended to be used by employees and pre-configured on corporate devices while keep networks intended for visitors (i.e., “Guest networks”) broadcasting SSID. This way, authorized users will connect to the corporate network as pre-configured while visitors will only see the “Guest network” and will be less confused about what SSID to use.
Disadvantages
False sense of security
Although network cloaking may add a small sense of security, it is common for people not to realize just how easy it is to discover hidden networks. Because of the various ways an SSID is broadcast, network cloaking is not considered a security measure. Using encryption, preferably WPA or WPA2, is more secure. Even WEP, while weak and vulnerable, provides more security than hiding the SSID. There are many programs that are able to scan for wireless networks, including hidden ones, and display their information such as IP addresses, SSIDs, and encryption types. These programs are capable of "sniffing" out any wireless networks in range by essentially eavesdropping and analyzing network traffic and packets to gather information about those specific networks. The reason these programs can sniff out the hidden networks is because when the SSID is transmitted in the various frames, it is displayed in
cleartext
In cryptography, plaintext usually means unencrypted information pending input into cryptographic algorithms, usually encryption algorithms. This usually refers to data that is transmitted or stored unencrypted.
Overview
With the advent of comp ...
(unencrypted format), and therefore able to be read by anyone who has found it. An eavesdropper can passively
sniff
Sniff may refer to:
* Sniff (Moomin character), a character in the Moomin stories
* ''Sniff'' (film), a 2017 Indian Bollywood film
* Sniff, the action of inhaling
* Sniff, odor sampling, see olfaction
* Sniff (domino game)
Muggins, sometimes ...
the wireless traffic on that network undetected (with software like
Kismet), and wait for someone to connect, revealing the SSID. Alternatively, there are faster (albeit detectable) methods where a cracker spoofs a “disassociate frame” as if it came from the wireless bridge, and sends it to one of the clients connected; the client immediately re-connects, revealing the SSID. Some examples of these
sniffing programs include the following:
Passive:
*
KisMAC
KisMAC is a wireless network discovery tool for Mac OS X. It has a wide range of features, similar to those of Kismet (its Linux/ BSD namesake). The program is geared toward network security professionals, and is not as novice-friendly as simi ...
* Kismet
* Prads
* ESSID-Jack
Active:
*
NetStumbler
NetStumbler (also known as Network Stumbler) was a tool for Windows that facilitates detection of Wireless LANs using the 802.11b, 802.11a and 802.11g WLAN standards. It runs on Microsoft Windows operating systems from Windows 2000 to Windows XP ...
* inSSIDer
The downside of passive scanning is that in order to gather any information, a client already connected to that specific network needs to be generating and therefore providing network traffic to be analyzed. These programs are then able to discover the cloaked networks and their SSIDs through picking through frames of information such as:
* Probe request frames. Probe request frames are sent unencrypted by the client computer when trying to connect to a network. This unprotected frame of information, which can easily be intercepted and read by someone willing, will contain the SSID.
* Probe response frames. In response to the probe request, the requested station will send back a frame of information also containing the SSID as well as other details about the network.
* Association request frames. An association request frame is what begins the process of initializing a relationship between the computer and the access point. Once associated properly, the AP will be able to assign some of its resources to the network interface controller (NIC). Once again, through this process, the SSID is transmitted.
* Re-association request frames. Re-association request frames are transmitted when a NIC notices a stronger signal from another access point and switches over from the previous one. This new access point will then "take over" and handle the data that may still be caught up in the previous session. The request of a new connection to a new beacon signal will of course require the transmission of a new SSID.
Because of these multiple ways the network name is still being broadcast while the network is "cloaked,” it is not completely hidden from persistent hackers.
Worse still, because a station must probe for a hidden SSID, a fake access point can offer a connection.
Programs that act as fake access points are freely available; e.g. ''airbase-ng'' and ''Karma''.
[
Demonstrates the use of "Karma" to respond to any probe request beacons.
]
References
{{Reflist
Computer network security