Network cloaking

Key takeaways

Network cloaking belongs to computer science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Network cloaking to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Network cloaking from memory before moving on to harder problems.

Reference excerpt

Network cloaking is a method of providing network security by hiding the devices behind the network gateway.

Overview Network cloaking may provide more operational security through obscuring devices from hackers. To access a network behind a gateway, an authorized user must authenticate themselves to the gateway before it allows them to see the devices they are permitted to by the security policy. Network cloaking obscures devices through the cloaking system. It differs from a firewall, which allows specific types of traffic in. The system does not respond to scans, and the devices behind it cannot be discovered or analyzed, preventing known or zero-day vulnerability exploitation. The internal devices cannot be accessed unless connected through a secure tunnel. Secondary Usage: The term has also been used to refer to wireless security by hiding the network name (service set identifier) from being broadcast publicly. Many routers come with this option as a standard feature in the setup menu accessed via a web browser. Network cloaking may stop inexperienced users from gaining access to a network but should otherwise be considered a minimal security measure. More secure forms of wireless security include WPA and WPA2. WEP, WPA, WPA2, and other encryption technologies can be used in conjunction with hiding the SSID.

Advantages

Mild security benefit Hiding the network name may not deter attackers from connecting to the network. Hiding the SSID removes it from beacon frames, but this is only one of several ways an SSID can be discovered. When users chooses to hide the network name from the router's setup page, it will only set the SSID in the beacon frame to null, but there are four other ways that the SSID is transmitted. In fact, hiding broadcast of the SSID on the router may cause the Network interface controller (NIC) to constantly disclose the SSID, even when out of range.

Usability improvement Hiding the network name improves the experience of users connecting to wireless networks in dense areas. When the network is not intended for public use and does not broadcast its SSID, it will not appear in a list of available networks on clients. This simplifies the choice for users. Organizations may decide to cloak the Wi-Fi SSID intended to be used by employees and pre-configured on corporate devices while keep networks intended for visitors (i.e., “Guest networks”) broadcasting SSID. This way, authorized users will connect to the corporate network as pre-configured while visitors will only see the “Guest network” and will be less confused about what SSID to use.

Disadvantages

False sense of security Although network cloaking may add a small sense of security, it is common for people not to realize just how easy it is to discover hidden networks. Because of the various ways an SSID is broadcast, network cloaking is not considered a security measure. Using encryption, preferably WPA or WPA2, is more secure. Even WEP, while weak and vulnerable, provides more security than hiding the SSID. There are many programs that are able to scan for wireless networks, including hidden ones, and display their information such as IP addresses, SSIDs, and encryption types. These programs are capable of "sniffing" out any wireless networks in range by essentially eavesdropping and analyzing network traffic and packets to gather information about those specific networks. The reason these programs can sniff out the hidden networks is because when the SSID is transmitted in the various frames, it is displayed in cleartext (unencrypted format), and therefore able to be read by anyone who has found it. An eavesdropper can passively sniff the wireless traffic on that network undetected (with software like Kismet), and wait for someone to connect, revealing the SSID. Alternatively, there are faster (albeit detectable) methods where a cracker spoofs a “disassociate frame” as if it came from the wireless bridge, and it sends it to one of the clients connected; the client immediately re-connects, revealing the SSID. Some examples of these sniffing programs include the following: Passive:

KisMAC Kismet Prads ESSID-Jack Active:

NetStumbler inSSIDer The downside of passive scanning is that in order to gather any information, a client already connected to that specific network needs to be generating and therefore providing network traffic to be analyzed. These programs are then able to discover the cloaked networks and their SSIDs through picking through frames of information such as:

Probe request frames. Probe request frames are sent unencrypted by the client computer when trying to connect to a network. This unprotected frame of information, which can easily be intercepted and read by someone willing, will contain the SSID. Probe response frames. In response to the probe request, the requested station will send back a frame of information also containing the SSID as well as other details about the network. Association request frames. An association request frame is what begins the process of initializing a relationship between the computer and the access point. Once associated properly, the AP will be able to assign some of its resources to the network interface controller (NIC). Once again, through this process, the SSID is transmitted. Re-association request frames. Re-association request frames are transmitted when a NIC notices a stronger signal from another access point and switches over from the previous one. This new access point will then "take over" and handle the data that may still be caught up in the previous session. The request of a new connection to a new beacon signal will of course require the transmission of a new SSID. Because of these multiple ways the network name is still being broadcast while the network is "cloaked”, it is not completely hidden from persistent hackers. Worse still, because a station must probe for a hidden SSID, a fake access point can offer a connection. Programs that act as fake access points are freely available; e.g. airbase-ng and Karma.

References

Worked examples

Example 1 — a first encounter with Network cloaking

Start with the simplest possible case. Write down what Network cloaking claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In computer science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Network cloaking before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Network cloaking ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Network cloaking

In research: Network cloaking appears in computer science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Network cloaking in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Network cloaking is common in secondary-school and first-year university syllabi. It links to neighbouring topics Computer network security, so understanding it makes those chapters shorter.
In everyday life: Look for Network cloaking outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

How to study Network cloaking in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Network cloaking means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Network cloaking out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Network cloaking in simple terms?

Network cloaking is a method of providing network security by hiding the devices behind the network gateway. Overview Network cloaking may provide more operational security through obscuring devices from hackers.

Why does Network cloaking matter?

Because it connects several computer science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Network cloaking?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Network cloaking.