NWA-PCUG Newsletter Article, June 2008
Secure Your Wireless Network
By Ira Wilsker, APCUG Director;
Columnist, The Examiner, Beaumont, TX; Radio & TV Show Host

Iwilsker@apcug.net
(click to email author)


http://www.fbi.gov/page2/may08/wifi_050608.html http://www.pcmag.com/article2/0,2817,2293406,00.asp http://www.fbi.gov/cyberinvest/protect_online.htm

Many of us have wireless networks (Wi-Fi) at home, and often use other wireless networks at the office, coffee shops, restaurants, hotels, airports, and a variety of other places. Many of us blissfully connect to whatever network is available, either free or pay networks, oblivious to the security threats we will likely encounter. We may feel safe behind the locked doors of our homes while we leisurely surf the net on our home Wi-Fi, unaware that our wireless signal can be picked up, without the use of any sophisticated hardware, a few hundred feet from the security of our home. When traveling, and using a hotel or restaurant wireless network, we may feel safe because we are in somewhat secure surroundings, with lots of innocent looking people all around us doing the same as we are. The problem is that unless we have implemented proper security precautions with out Wi-Fi, we are open to attack by electronic eavesdroppers, identity thieves, and an assortment of hackers, crackers, and other miscreants, many of which may be bent on doing us harm. According to the FBI, “… odds are there’s a hacker nearby, with his own laptop, attempting to "eavesdrop" on your computer to obtain personal data that will provide access to your money or even to your company's sensitive information.”

Several years ago, while working on a cyber security grant, I took the liberty of driving down the major thoroughfares in town, including the downtown area, equipped with my notebook computer with wireless adapter, and my Garmin EMap GPS, carefully logging the many wireless networks I was receiving. About 80% of the networks that I received on my computer did not have adequate security, and could have been easily accessed from the road. This practice of driving around a city looking for open wireless networks is known in hacker circles as “war driving”, and there are many illicit websites that have detailed city street maps that accurately show the locations of these vulnerable networks. On a trip to New York City, one of my daughters asked me what the chalked symbols on the sides of buildings meant; I explained that “war chalking” was the practice of labeling the buildings themselves that housed inadequately protected wireless networks. Anyone with a little larceny in his heart who was aware of the symbolism could easily penetrate the wireless networks thus disclosed. There is a large group of hobbyist hackers who delight in seeing how many wireless networks that they can penetrate in a given period of time. What the Wi-Fi hacker can do to the computer infrastructure and data of a vulnerable wireless network is only limited by his conscience.

Wireless hotspots, now common in fast food restaurants, coffee shops, airport waiting areas, and hotel lobbies, are other places that the innocent web surfer can be attacked while accessing the internet. Many of these business locations actively advertise their Wi-Fi hotspot status and availability. Again, according to the FBI, “…there are 68,000 Wi-Fi "hot spots" in the U.S., at airports, coffee shops, hotels, bookstores, schools, and other locations where hundreds or thousands of people pass through every day. While many of these hot spots have secure networks, some do not, according to Supervisory Special Agent Donna Peterson of our Cyber Division. And connecting to an unsecured network can leave you vulnerable to attacks from hackers.”

Hackers have a variety of tools and methods that they can use to penetrate your wireless computer. One that I have personally experienced (but did not fall for) is the phony “free wireless access” or inexpensive wireless connection that often appears on the list of wireless networks at airports and other areas. Hackers set up these hotspots in areas where there are likely to be many potential users (victims). Last January, in the Las Vegas airport (LAS), I picked up a very strong wireless signal from a source using the name (SSID) of “Free LAS Internet”. I happened to know as a fact that in the area and terminal I was in, there was no free Wi-Fi access provided by the airport. What this most likely represented was a hacker trolling for nearby victims in the terminal. They commonly dangle the bait of free or cheap internet access, and wait for the hapless user to connect. Once connected, unless proper security precautions are in place and functional, the hacker may have access to any data that is on the victim’s computer. Popular items to steal are user ID’s, passwords, credit card numbers, and other personal information; this may also be used for sophisticated identity theft. Some hackers will install keylogging Trojans to record all of the victims’ keystrokes.

Other hackers may redirect the user to counterfeit websites for the purpose of stealing information. The FBI says, “Another thing to remember,” said (FBI) Agent Peterson, “is that the connection between your laptop and the attacker's laptop runs both ways: while he's taking info from you, you may be unknowingly downloading viruses, worms, and other malware from him.”

There are several tips on wireless security that the FBI has published; they are mostly common sense precautions that we should all be doing anyway. First, try not to connect to an unknown Wi-Fi network; just because an available network carries the name of the hotel, restaurant, or airport does not necessarily mean that it is legitimate, as the SSID (name) can be easily forged. Other recommendations from the FBI include, “Make sure your laptop security is up to date, with current versions of your operating system, web browser, firewalls, and antivirus and anti-spyware software; don’t conduct financial transactions or use applications like e-mail and instant messaging; change the default setting on your laptop so you have to manually select the Wi-Fi network you’re connecting to; turn off your laptop's Wi-Fi capabilities when you're not using them.”

Our home wireless networks are every bit as vulnerable to attack as is the road-warrior. One of my acquaintances has periodically used the wireless network of his neighbor (without his knowledge or consent) for broadband internet access, rather than subscribing to an internet service himself. This home user who had the open wireless system did not have any of the protective security features, like encryption, activated. It should be noted that firewalls generally do not provide any significant protection against unscrupulous wireless access.

Virtually all home and office wireless systems utilize a router of some type to broadcast the signal. Wireless routers offer some encryption, which should be utilized; many models turn off encryption by default, while others require it. It should be noted here that an encrypted signal is difficult for unauthorized users to utilize, and a very necessary security implementation. The two most common types of encryption available are the older and less secure WEP (Wired Equivalent Privacy), and the newer and more secure WPA2 (Wi-Fi Protected Access). Vista supports both forms of encryption, but XP generally only supports the older and less secure WEP. In setting up the encryption the user will initially be required to create a passphrase used to create the encryption key. Never use a default key if it is offered, and never use easy to guess phrases, words, family names, phone numbers, or other readily determinable passphrases. Instead, be sure to use a combination of random appearing upper and lower case letters and numbers, which will be harder for a hacker to crack. Security experts recommend that the encryption key and passphrase be changed on a regular basis, often every month or two. When the passphrases are changed, the keys on any computers connected to the wireless router must also be changed or they will lose their access.

Wireless connectivity is a great convenience, and I use it frequently both at home and when traveling. Just be very careful when using wireless wherever you are.

Click here to return to top



==================================================================