Network cloaking is an attempt to provide wireless security by hiding the network name (service set identifier) from being broadcast publicly. Many routers come with this option as a standard feature in the setup menu accessed via a web browser.
Contents
Although network cloaking may stop some inexperienced users from gaining access to your AP, for this class of users, network cloaking is less effective than using static WEP (which itself is vulnerable, see Wired Equivalent Privacy).
If the goal is to secure the wireless network, it is recommended to use WPA or preferably WPA2.
Sense of Security
Hiding the network name may prevent less technically inclined people from connecting to the network, but will not deter a determined adversary. Use of WPA or WPA2 is recommended instead. Hiding the SSID removes it from beacon frames, but this is only one of several ways an SSID can be discovered. When one chooses to hide the network name from the router's setup page, that only sets the SSID in the beacon frame to null, but there remain four other ways that the SSID is transmitted. In fact, hiding broadcast of the SSID on the router may cause the Network interface controller (NIC) to constantly disclose the SSID, even when out of range.
False Sense of Security
Although network cloaking may add a small sense of security, it is common for people not to realize just how easy it is to discover hidden networks. Because of the various ways an SSID is broadcast, network cloaking is not considered a security measure. Using encryption, preferably WPA (Wi-Fi Protected Access) or WPA2, is more secure. Even WEP (Wired Equivalent Privacy), while weak and vulnerable, provides more security than hiding the SSID. There are many programs that are able to scan for wireless networks, including hidden ones, and display their information such as IP addresses, SSIDs, and encryption types. These programs are capable of "sniffing" out any wireless networks in range by essentially eavesdropping and analyzing network traffic and packets to gather information about those specific networks. The reason these programs can sniff out the hidden networks is because when the SSID is transmitted in the various frames, it is displayed in cleartext (unencrypted format), and therefore able to be read by anyone who has found it. An eavesdropper can passively sniff the wireless traffic on that network undetected (with software like Kismet), and wait for someone to connect, revealing the SSID. Alternatively, there are faster (albeit detectable) methods where a cracker spoofs a "disassociate frame" as if it came from the wireless bridge, and sends it to one of the clients connected; the client immediately re-connects, revealing the SSID. Some examples of these sniffing programs include the following:
Passive:
Active:
The downside of passive scanning is that in order to gather any information, a client already connected to that specific network needs to be generating and therefore providing network traffic to be analyzed. These programs are then able to discover the cloaked networks and their SSIDs through picking through frames of information such as:
Because of these multiple ways the network name is still being broadcast while the network is "cloaked," it is not completely hidden from persistent hackers.
Worse still, because a station must probe for a hidden SSID, a fake access point can offer a connection. Programs that act as fake access points are freely available; e.g. airbase-ng and Karma.