The Chroma Group, Ltd.
Transnational Conflict Prevention and Interdiction Programmes
Transnational Conflict Prevention and Interdiction Programmes
Wireless Network VulnerabilitiesNot long ago, nearly all government and private computer networks were limited to hard-wire connections with desktop PCs. Although many employees had laptops, they generally connected to the Internet or to a network via modems and phone lines, which are relative easy to secure. Today, there is explosive growth in wireless computing, both at the office and at home, and this presents entirely different security problems. Wireless computing is often called Wi-Fi, which stands for Wireless Fidelity. It is useful to distinguish two different types of wireless networks. The office network that is meant to serve only authorized users, and the public network that is open to all. Public networks are increasingly being set up in airport waiting areas, hotels, coffee shops, pubs, community centers, and other public locations where people may find it convenient to send or receive e-mail, link to their office network, or simply surf the Internet. By design, every wireless access point -- which serves as a gateway into the Internet or to an internal computer network -- transmits "beacons" announcing that there is an access point available for use. The beacon currently has a limited range, usually about 150 feet, although several networks can be linked to cover a larger area and wide-area wireless networks are also becoming available. Each wireless device, such as a laptop or PDA, that is equipped with a wireless card and is turned on is constantly sending out signals called "probes," indicating that it is seeking to "hook up" with a nearby access point. This probe automatically detects the nearest access point, called a hot spot. A screen is then displayed to instruct the user on how to gain access to this network, which is usually as simple as entering a username and password. Under these circumstances, it is easy for a hacker to gain access to any network that is not fully protected with a firewall, strong passwords, and encryption. "For a potential hacker, it is almost a case of walking down the street and trying all the doors until one opens -- it is almost inevitable that one will," according to John Worrall, vice president of RSA Security's worldwide marketing. A survey that picked up WiFi emissions by driving along the streets of New York, San Francisco, London, and Frankfurt, using free software downloaded from the Internet, found that between 34% and 39% of wireless access points in each of these cities were unprotected. That means they were transmitting information that would assist a hacker in launching an attack.1 Hackers call driving the streets to identify vulnerable wireless networks "war driving," which is comparable to "war dialing," the automated dialing of hundreds or thousands of telephone numbers to identify vulnerable modems. The office and public wireless networks present distinctly different security problems. For the office networks, a principal problem is that the individuals setting up the network sometimes fail to understand the security requirements. The WiFi equipment comes with a default setting configured by the manufacturer. If this default setting is not changed, and it often isn't, then any hacker who knows the default setting, as most of them do, can gain access to that wireless network. And sometimes the network fails to require identification and authentication of all users. The problem of insecure office networks can be partially solved by encryption, which will be built into some future WiFi systems. The security problem is quite different at public wireless hotspots, as they are intended to be accessible to the public. A person walking on the street with a digital personal assistant (PDA) or a special device small enough to be attached to a keychain can identify when they are in range of a wireless network. Many hotels and airports have installed high-speed wireless networks so that people can surf the Internet or access their office network while traveling. However, there is considerable variation in the security measures built into these networks. Although many of these networks employ some security precautions, the wireless network is not responsible for the security of your communications. There are three kinds of risk:
The bottom line is that all public wireless access points are inherently insecure. That does not mean, however, that you cannot use them. They can be used securely, but the burden for using them securely rests squarely on you. You cannot count on the hotel, airport, coffee shop, or whoever to provide secure, publicly available, wireless access to the Internet. Most companies provide what is called a virtual private network (VPN) so that traveling employees can access their office network. This sets up a secure "tunnel" for the transmission of information between the traveler and the home office, but even a VPN is vulnerable to hackers if it is not set up properly or if the hacker can piggyback on your access to that network. Here is what you need to do if you are using a wireless network to access the Internet:
The following are some of rules for use of wireless devices that apply to all Department of Defense personnel, contractors, and visitors that enter DoD facilities or that have access to DoD information.2 Similar rules may apply in other federal agencies. These rules apply to defense industry only to the extent that they are specified in the National Industrial Security Program Operating Manual (NISPOM) or directed in a classified contract.
References |
|
HOME | COMPUTER VULNERABILITIES CONTENTS | TOP OF PAGE | HELP |
|
INFORMATION
| CONDUCT
| THREATS |
TECH
VULNERABILITY | ASSISTANCE |