2012-07-24

Wireless SSID Cloaking

Is wireless SSID cloaking good for security? Short answer, no. Cloaking doesn't provide any real measure of security and in some circumstances could actually negatively impact security.

Long answer. Cloaking the SSID only prevents an access point from including the name of the SSIDs in the beacon and probe response frames but does nothing for any active wireless clients transmitting data. The 802.11 standard requires the SSID name be a part of all data carrying frames, there is no way around this. If someone has a active sniffer running that can read the full 802.11 frame then they will see the SSID regardless if the AP is set to run SSID cloaking. Also, using encryption (WPA/WPA2/WEP) does not hide the SSID in the 802.11 frame since the SSID is part of the frame header and the encryption only hides the frame payload.

This gets even dicier because in some circumstances SSID cloaking can actually be a security risk. When configured to join a non-broadcasting network Windows will  cycle through the PNL first looking for any broadcasting networks and if non are found Windows will then send out probes containing the SSID of the cloaked network. If an attacker is sniffing wireless they can see the SSID in the probes and then use a tool like Karma / Karmetasploit to go phishing for computers setup to auto-connect.