... a plethora of networks! In my experience, at least a third of them are completely unprotected by security. We're in a strange state of affairs where just anybody can walk into Wal-Mart (never mind Circuit City) and pick up everything you need to set up a home or office wireless network. It's relatively easy to set this up with no security enabled. It takes a little bit of extra work to turn on the security and set the passwords on all of the computers using the net... sooo... a lot of people don't bother to do it. This makes it really easy to find a place to check your email. [UPDATE: Read comments for some good information on wireless security from Oncee.]
4 comments:
The people who make wireless routers and cards should really turn on WEP by default. It always concerns me that law offices and medical offices don't have WEP turned on in light of HIPPA and other laws related to the protection of medical, financial, and legal information. Some of these people might be breaking the law and not even know it.
Other don't turn on WEP by choice, but you can never tell from looking at there open WAP if they did it by choice or just didn't bother to correctly configure their router.
I'm not a security expert by any means. I honestly don't know how these people might be vulnerable. Perhaps they aren't. They might have file sharing turned off.. they might have internal passwords on their network activated... but I'll bet that most of them would be surprised that they are sharing their Internet bandwith with their neighbors or passersby.
The biggest threat is if someone used a packet sniffer on one of these business networks. Many passwords and other private information are passed over local area networks via plain text. Sharing your internet connection with strangers really isn't much of a security problem. The problem comes from keeping the information on your network secured from the eyes of strangers who might gain from stealing some of your data.
If you aren't running a business network and just have couple of computers for internet and email the risk is much less.
Part of my career has been spent securing law office network, so I've seen the good, the bad, and the ugly when it comes to network that really need to have WAP turned on.
The other issue that comes to mind is how Windows some other operating systems by default handle wireless connections when you turn your computer on. Windows is really bad about joining the closest and strongest wireless network with WEP turned off. The user really should have more control when connecting to wireless networks.
I had one client that had a misconfigured wireless router and half the time he wasn't even using his own wireless network. His was a problem since he practiced law. His email, his internet banking, and all his password were being passed over a network that didn't belong to him. Someone could have sniffed his traffic and found all kinds of things: his bank balance, client names and address, client/attorney communications. I'm not saying anything bad happened. I have no proof that he lost any sort of information, but it could have happened. He would notice that he couldn't share documents with his staff, but he didn't know why. After one or two restarts he noticed he was asked for a password for his own network and everything would work fine.
Wireless security really is a two-way street. I enjoy and use public connections like the ones at Taylor Books and First Watch, but I would never check my email (the password is passed via plain text) or check my bank balance on a public connection.
Packet sniffing isn't that hard. I sniff my own network to see if someone is trying to hack into my home network all the time. Packet sniffing works like a wiretap. You don't even know when you are being sniffed. Sniffing someone else's network is highly illegal and can land one in federal prison. But that doesn't stop some bored high school kid in his parent's basement from doing it.
For the record I have WEP turned on on my home network. My rule of thumb is to turn off services you don't use, use WEP if you don't want to share you connection and your network, and always using a strong firewall. Hardware firewalls are the best.
Some people share their connections by putting a WAP in front of their firewall, which works just as well. Once again we have the problem of wants to share their connection and has configured their network to do so safely, and those who have never configured their wireless network in the first place.
Sorry for the geek rant. I know you don't want your blog to look like Slashdot, but I hope anyone who reads this knows a little bit more about wireless security.
Well ok then... that explains a lot. I'm always looking at things from the point of view of the casual user without taking into consideration what can be done by the informed malicious player.
Post a Comment