Subject: [NEXTEL-1] A Wireless Security Disaster

From: Greg Smith <[email-masked]>
Date: Sun, 19 Jan 2003 06:24:06 -0500

So can you post a copy of the "70 page manual" please

Message text written by INTERNET:[email-masked]

      A Wireless Security Disaster

      By Lance Ulanoff
      January 9, 2003

      I couldn't believe my ears. There I was sitting across from
a PR representative for a major peripherals manufacturer when, in
response to a standard but important wireless networking
ease-of-use question, she told me I could find the answer "in our
[company's] 70-page manual." Unbelievable. I mean, really. Thanks
for nothing. I mean..Actually, I should back up a bit.
      I had just witnessed a product demonstration where the
vendor rep explained (and supported with a series of chart- and
graph-covered slides) the company's belief that wireless
networking in the home would eventually become as widespread-and
easy to use-as the refrigerator (I'm paraphrasing, somewhat). It's
an assessment I wholeheartedly agree with. Home networking has
been a growing trend for years, and now lower costs coupled with
the rapid adoption of 802.11b and devices that combine the a, b,
and even g 802.11 wireless capabilities propel the growth even
faster.

      The rep even talked about the wizards that would speed
installation of the company's products and mentioned the company's
24-hour tech support. I asked what sort of guidance users would
receive for WEP (Wired Equivalent Privacy) setup and for changing
the default SSID (Service Set Identifier). The PR person stared
blankly at me and then said that users could find the information
about how and why to use such critical settings not in the setup
wizard, but in the browser interface that lets you control the
router and in "the 70-page manual."

      To be fair, I should say that this is the common practice.
The information on WEP and SSID configuration for my SMC Barricade
wireless cable/DSL router is poor. The WEP configuration portion
of the manual is abysmal and the information in the Web-based
router setup is even worse. The only reason I knew to change my
SSID and apply WEP encryption was because Craig Ellison, the PC
Magazine Labs director of operations, recommended that I do so.

      In order for WEP to work, you must set all systems on the
wireless network in accordance with the WEP configuration of the
router, which you modify via a browser-based interface on a
computer wired to the router. You must enter the matching
encryption level and WEP ID (a 10-digit code) in each client PC's
wireless configuration utility.

      The Barricade router setup gives you four WEP encryption
choices: 64- or 128-bit manual or automatic. I selected one, but
the WEP fields filled with bullets, not numbers. I had no idea how
to get the values I would need to enter into my other systems, and
neither the manual nor the router configuration app offered any
assistance. Without the proper WEP ID on the other systems, they
would not be able to access the wireless network.

      The vendor with whom I spoke readily admitted that the WEP
setup assistance is buried in the manual, along with the important
advice on changing the default SSID.

      If wireless networks become as prevalent as refrigerators,
we can expect users to treat the equipment much the same way-plug
it in and, beyond some initial setting up, forget about it. If a
wireless network works (and it probably will) after the purchaser
has followed the instructions on the quick-setup sheet, most
people will never go further and see the information about setting
up WEP or changing the SSID. In other words, I believe we're
heading for a security disaster.

      Here's the scenario. In roughly three to five years,
wireless networking will have achieved the kind of explosive
growth in the home market that everyone is predicting. A good
portion of those homes will have first- and second-generation
equipment that's cheaper than state-of-the-art products. So
whatever improvements have been made in security setup and
enabling will not be in wide use. This means that all around the
world, those with a little networking savvy will be able to sniff
WEP-free wireless networks simply by sitting on street corners or
in apartment-building hallways or even outside small offices and
typing "default" as the SSID in their wireless configuration
utilities. I tried doing this on my recent trip to Comdex and was
shocked by how many wireless networks at the show were set to
"default" or something else that was way too easy to figure out.
Hackers are bound to hit an open network. And because early
adopters of wireless connectivity will also be broadband users,
hackers will be tapping right in to the Internet and maybe even,
if security-free users are tunneling into their office LANs via
Virtual Private Networks, right into the networks of corporate
America and beyond.

      This is not that far-fetched. Those who read PCMag.com
regularly already know this. So this warning is really for the
wireless-networking product manufacturers. If you want to play in
the consumer electronics space and don't want the blame for a
widespread security crisis dumped in your lap, you better learn
how to speak the consumer's language

      http://www.pcmag.com/article2/0,4149,815705,00.asp
<

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/