wifi Monitor WiFi access points

[c.grz]

Hi,

I work for a local government agency and we support both Police and Fire. We're currently having issues with people at the fire stations bringing in their own hotspots to bypass our proxy.

I'm wondering if there's a program that will scan for new wifi SID's and notify us via email when one pops up. These buildings are big and we rarely see any external wifi network show up so we know if a wifi SID pops up; it'll be from within the building.

Anybody know of a program that will give us that ability?

I've looked at a few but most don't have notifications of new networks. Cost isn't an issue.

All help is appreciated!!

[sc302 Veteran]

The simple answer is no. The more explained answer is you are asking a system to monitor the air waves for any new ssids that pop up. These can come from anywhere. The best you can do is lock down your computers to a certain ssid and do not allow them to connect to anything else. Their computers and phones are their problems and you do not support them. I worked at local government on the municipality level as it support. You have absolutely no right to stop someone from bringing in their equipment and using their equipment. You have absolutely every right to lock your computers down so tight that if they sneeze on it you get notified.

[Raa]

You could always introduce some wireless interference so their hotspots won't work. Bit on the dodgy side perhaps...

[Dot Matrix]

Maybe Inssider? Don't think it sends out e-mails, but it certainly logs the time first seen, and time last seen, for later study.

[francescob]

You can write a very easy script for that because there's the "netsh wlan show networks mode=bssid" command that returns all the data about the detected networks (also useful for knowing the wifi channels of nearby networks in case you need to avoid interference). There are many powershell examples that show how to parse the result of the command, you only need to add some conditions to exclude your own known wifis and a few commands to send the email (both very easy tasks for which you can find plenty of examples on the web).

[trek]

Cisco CleanAir can automatically tag and isolate rouge AP's. Though you're looking at a WLAN controller and Enterprise level AP's

[dvb2000]

  On 14/12/2012 at 07:23, trek said:

Cisco CleanAir can automatically tag and isolate rouge AP's. Though you're looking at a WLAN controller and Enterprise level AP's

Won't work, they are bringing in their own hotspots, not access points connected to the local network.

Actually what this guy wants to do is impossible, pretty much anyone with a phone these days can connect DIRECTLY to their own personal internet bypassing any proxy these guys are trying to use to filter THEIR corporate internet. Most smartphones will also allow their own broadband connection to be used as a hotspot too, or even using the USB port as a modem without broadcasting anything.

[dvb2000]

  On 13/12/2012 at 23:00, TheReasonIFailed said:

I work for a local government agency and we support both Police and Fire. We're currently having issues with people at the fire stations bringing in their own hotspots to bypass our proxy.

I doubt you can do what you want, but even if you tried to no doubt the staff would tell you to bugger off and mind your own business/network. You can't stop them using their own network on their own phones/devices.

  On 14/12/2012 at 02:55, Raa said:

You could always introduce some wireless interference so their hotspots won't work. Bit on the dodgy side perhaps...

that would be illegal :)

and would affect their own Access Points as well (if they are using them)

[sc302 Veteran]

It isn't the staffs choice. First the the township manager signs off (everybody in the municipalities boss) then the chief of police signs off. Fire chief has no pull against their wishes nor does any other director. Then I push policies using ad group policies, I don't touch their computers at all and the default image only gives users user rights, no power user or admin level access.

There is a hierchy that needs to be followed and the end users have no say in the matter, even the patrolmen. The patrolmen had access to about 30 approved government sites, they were ****ed and tried to get that lifted...that got them a big can of shut the hell up from management.

[c.grz]

I doubt it was possible but the IT Director asked that I pursue this per the request of the Fire Chief.

I guess we'll just have to update our IT policy forbidding the use of wireless devices not approved for use by the I.T. Department.

[Draconian Guppy]

  On 14/12/2012 at 15:11, TheReasonIFailed said:

I doubt it was possible but the IT Director asked that I pursue this per the request of the Fire Chief.

I guess we'll just have to update our IT policy forbidding the use of wireless devices not approved for use by the I.T. Department.

Not my business, but what's wrong with people using their own devices? Like pointed above, any smartphone can function as a hotspot :/ Are you going to forbid smartphones?

(Don't mean to sound like a jerk, just curious is all).

[Dot Matrix]

  On 14/12/2012 at 15:16, Draconian Guppy said:

Not my business, but what's wrong with people using their own devices? Like pointed above, any smartphone can function as a hotspot :/ Are you going to forbid smartphones?

(Don't mean to sound like a jerk, just curious is all).

From the sound of things, it sounds as if they are using their own hotspots with work-issued devices.

[xpablo]

  On 14/12/2012 at 15:16, Draconian Guppy said:

Not my business, but what's wrong with people using their own devices? Like pointed above, any smartphone can function as a hotspot :/ Are you going to forbid smartphones?

(Don't mean to sound like a jerk, just curious is all).

Are you kidding? on a corporate laptop or computer, it could be a huge security risk, not to mention any confidential data on the computers..

Here's some reading on securing your airwaves.

http://www.arubanetw...al_security.pdf

Here are some solutions to your problem.

http://www.arubanetworks.com/solutions/msp/

[Draconian Guppy]

  On 14/12/2012 at 15:56, xpablo said:

Are you kidding? on a corporate laptop or computer, it could be a huge security risk, not to mention any confidential data on the computers..

Here's some reading on securing your airwaves.

http://www.arubanetw...al_security.pdf

Here are some solutions to your problem.

http://www.arubanetw.../solutions/msp/

Yeah i'm probably "desensitized" on sensitive information... :p

BUTT that said, disabling wifi is easy, installing group policies as well. Eg email SHOULDn'T if not in same domain. Most desktops shouldn't have admin. privileges to install a wifi dongle (seeing as how most desktop don't come with built in wifi) etc...

[sc302 Veteran]

The solution to the problem is a cell phone jammer. But that creates issues on a whole different level.

[n_K]

  On 14/12/2012 at 08:08, dvb2000 said:

"You could always introduce some wireless interference so their hotspots won't work. Bit on the dodgy side perhaps..."

that would be illegal :)

and would affect their own Access Points as well (if they are using them)

Not sure about in the US but it's illegal in the UK...

Unless you're part of the government or a government service (which includes fire and police) in which case it's legal :p

[xendrome]

Also working for a local government LE agency I can tell you the BEST way to handle this type of situation is through policy with strict warnings/actions. And as to the comment above saying that introducing wireless interference is not illegal simply because you are part of the government or government service is incorrect.

[c.grz]

  On 14/12/2012 at 15:16, Draconian Guppy said:

Not my business, but what's wrong with people using their own devices? Like pointed above, any smartphone can function as a hotspot :/ Are you going to forbid smartphones?

(Don't mean to sound like a jerk, just curious is all).

We know that we can't control what people do on their phones/tablets/personal pc's. The issue is when these people use city owned equipment along with their personal hotspots/smart phones to bypass security we have in place to protect our network.

[+BudMan MVC]

^ exactly, its not that they can browse porn (example) on their smartphone. Its that they are bypassing the company internet filtering, connecting the work device to an unsecured network, etc.

Your best bet is to lock down the work devices to only be able to connect to specific wifi APs and not allow the users to change these settings.

As to warning of these hotspots popping up, yeah the netsh script should be easy enough to setup so that you get a warning and details about the hotspot that is around.

[c.grz]

  On 14/12/2012 at 16:30, sc302 said:

The solution to the problem is a cell phone jammer. But that creates issues on a whole different level.

Everyone relies on their cellphones to communicate. Using a cell phone jammer would probably lead to a revolt...

[sagum]

  On 14/12/2012 at 16:45, TheReasonIFailed said:

We know that we can't control what people do on their phones/tablets/personal pc's. The issue is when these people use city owned equipment along with their personal hotspots/smart phones to bypass security we have in place to protect our network.

Firstly, it'd be very easy to create a simply bit of software that'll monitor the airwaves for new networks that show up and report them back. You can setup applications such as netstumbler that'll log the time and date of the networks as they come and go. That could be sent off at the end of the day for example.

A better bet would be to use something the common Linux wireless air* tools, usually used to crack networks, to monitor the active networks, including networks that do not broadcast their SSID and you'll also be able to see what devices are connecting to what network, by their MAC address. This would be proof that such dept hardware is connecting to say a Nokia cell phone acting as a access point.

However, its unlikely that you'll be able to block or do anything about people using their own devices to setup access points if they really wanted to.

What I would suggest is looked at enforcing a network policy on the dept machines so they can't join additional networks. That'd be the best option as even if the employees setup their own AP, they wouldn't be able to use the dept machines to connect to them (without a lot of spoofing, but that is possible anyway)

[f0rk_b0mb]

  On 13/12/2012 at 23:00, TheReasonIFailed said:

Hi,

We're currently having issues with people at the fire stations bringing in their own hotspots to bypass our proxy.

Are you sure they are bringing their own and not using a program like ultrasurf or such?

Anyway, I don't believe there is anything you can do other than install a key logger to see who's typing in a blocked address. Give every firefighter and officer their own account so they can't point fingers, etc.

[sc302 Veteran]

  On 14/12/2012 at 02:43, sc302 said:

The best you can do is lock down your computers to a certain ssid and do not allow them to connect to anything else.

  On 14/12/2012 at 16:48, BudMan said:

Your best bet is to lock down the work devices to only be able to connect to specific wifi APs and not allow the users to change these settings.

  On 14/12/2012 at 16:58, sagum said:

What I would suggest is looked at enforcing a network policy on the dept machines so they can't join additional networks. That'd be the best option as even if the employees setup their own AP, they wouldn't be able to use the dept machines to connect to them (without a lot of spoofing, but that is possible anyway)

all of this, then you can stop playing games with trying to monitor crap. Know that they can't connect vs trying to bring the hammer down when they do connect.

[c.grz]

  On 14/12/2012 at 17:15, sc302 said:

all of this, then you can stop playing games with trying to monitor crap. Know that they can't connect vs trying to bring the hammer down when they do connect.

Yeah I know; but I was told by my boss to go down this route...so down this route I go.

I tend to disagree with his way of going about things; I've learned that it's easier to just do what he asks and when then that doesn't pan out I can do what the right thing is...but that's another story for another day.

Thanks all!!!

[sc302 Veteran]

might want to remind your boss that it is better to prevent aids then try to cure the aids breakout over the network.