How to hide a wireless network?

[barbaz]

I'm trying to help set up a wireless network and I thought that hiding SSID and using proper encryption would be enough to secure it, but a Windows 7 computer with no special tools still detects it as "Other Network". Is there any way to configure a wireless network so that ONLY computers that are manually given the SSID can see and connect to the network?

[Thrawn]

Is it definitely your own network that was being detected? Not a neighbour?

Hiding SSID is basically security through obscurity; good encryption is more important.

[barbaz]

Is it definitely your own network that was being detected? Not a neighbour?

Yes - it consistently disappears a few seconds after powering off the router.

Weird thing is, on a Mac and on Win XP all looks good (the network is not detected, but can still connect knowing the SSID). It's only Win7 that sees there's another network.

[dhouwn]

so that ONLY computers that are manually given the SSID can see and connect to the network?

Router/AP will send beacons in any case all the time. So while you can do something concerning connecting there is no way of making it totally any standard way (unless you create your own solution where it itself will listen for some sign and only then turn on or something like that).

[barbaz]

there is no way of making it totally any standard way

totally what? Hidden from devices not already connected?

And why does only Windows 7 pick up on those beacons?

[GµårÐïåñ]

Even with the SSID not broadcasting, WIFI is nothing more than waves in the air. What is being detected is the presence of such waves. HOWEVER, unless you know the SSID and the proper Password when accessing it to set it up, you will get nowhere. It can be brute forced but that requires specialized equipment, mad skills, and motivation to get something valuable enough to justify their effort. I have done it as part of intrusion detection for a living. DO the following and I will assure you that you will not be hacked unless you are facing a very motivated RED hat hacker like myself.

DO NOTS
1) DON'T Broadcast your SSID
2) DON'T use WEP its useless
3) DON'T use a lame password

DOS
1) Change the SSID from the manufacturer's default
2) Use WPA/WPA2 in AES mode (TKIP Is ok if you must)
3) Use a very long and strong password (at least 20+ characters, UC/LC/SYM + SPACES)
4) Use MAC Address Filtering (its a pain in the ass but at least you know the ones allowed are the ones you EXPLICITLY allowed) - in theory it can be hacked by cloning a legitimate MAC but not practical)

That's it, make sure you setup FIREWALL (on the router) and disable DMZ and if you are going to do port forwarding (for servers) then you better know what you are doing and make sure the system it routes to is secure, because that's the easiest way into your network is an improper setup.

[barbaz]

Thanks for the clarification. Good to know that the network is secure despite being (sort of) detectable

(If there are multiple wireless networks in the same area all hiding their SSID, would they show up as multiple "Other Network"s on Windows 7?)

[GµårÐïåñ]

Its the nature of the beast. WIFI is nothing but microwaves, it has mass, energy and like TV, Radio signals can be detected and just grabbed out of the air. The only saving grace is that encrypted and difficult to segregate the signal its hard to access the data. Unless you are on a WEP or open network in which case you might as well bend over and kiss your behind goodbye because what you do is as visible as the TV show on a 72" screen. Hence public hotspots a big no no unless you can guarantee that the traffic YOU generate is end to end encrypted. It won't stop the capture, but it will make it nearly impossible to see what's in it, unless weak encryption. No different than you talking on the phone, its only as secure as how many hopes in between you and the other person are listening.

[GµårÐïåñ]

(If there are multiple wireless networks in the same area all hiding their SSID, would they show up as multiple "Other Network"s on Windows 7?)

Generally bundles as one giant soup of OTHER NETWORK (meaning unidentified or tagged network singals) once you click on other network, put in the ssid and the password it say aha this batch in the soup is tomato sauce instead of chicken broth or cream of mushroom. But until then its just a soup of ingredients with no identity. Think of the SSID, password and the type of security as the recipe for a handshake that identifies your machine to the router and says, these signals out of the air can go here and there because the solution to the riddle matched when we plugged in these items.

[Thrawn]

Hence public hotspots a big no no unless you can guarantee that the traffic YOU generate is end to end encrypted. It won't stop the capture, but it will make it nearly impossible to see what's in it, unless weak encryption.

Or the BREACH attack.

[GµårÐïåñ]

Or the BREACH attack.

Yes of course, countless vectors. I just didn't think the audience cared about all of it

[dhouwn]

Another tip: If you are using a WiFi router from your provider make sure there it doesn't broadcast additional 'hidden' networks, has happened before.

[barbaz]

Another tip: If you are using a WiFi router from your provider make sure there it doesn't broadcast additional 'hidden' networks, has happened before.

Thanks, but this router is not from the ISP.

And thanks again to all who helped.

[GµårÐïåñ]

Another tip: If you are using a WiFi router from your provider make sure there it doesn't broadcast additional 'hidden' networks, has happened before.

Clarify? The only difference between ISP and non-ISP routers is that ISPs will brand the SSID with their own name (example: charter123456, comcast1233456, twc123456, etc.) and the manufacturers will brand it with their brand (example: linksys1234456, dlink123456, netgear1233456, etc.) and both of which is covered in my "change your SSID from the default" and "don't broadcast it". So what exactly are you talking about?

[GµårÐïåñ]

Another tip: If you are using a WiFi router from your provider make sure there it doesn't broadcast additional 'hidden' networks, has happened before.

Thanks, but this router is not from the ISP.

And thanks again to all who helped.

Another thing to note, while having a GUEST access seems attractive and many access points now offer it, DO NO USE IT. Someone like myself can still get into your protected band (aka the mac listed, hidden, password protected, etc) portion as long as the SAME device is giving me guest access. So while convenient way of allowing guests on your wifi without having to vet and include them in the backend, don't do it.