Subject: [NEXTEL-1] Tests Prove Wireless Security a Major Concern

From: [email-masked]
Date: Mon, 02 Jun 2003 17:48:00 -0400

Tests Prove Wireless Security a Major Concern

A test conducted in Albany, NY, proves that although nearly 600 hot spots
were located, security remains a great concern. Two individuals spent one full
week driving through Albany neighborhoods searching for access points. Their
vehicle was equipped with laptops and Wi-Fi cards, a GPS system, two
antennas, power inverter and a satellite radio. Many of the access points
originated from sources that were extremely care free when it came to wireless
security, an oversight that could result in free Internet access for many.

========================================================================

Prowling for wireless access
points

Albany -- Road show demonstrates many hot spots, but
security remains an issue

By KENNETH AARON, Business writer
First published: Sunday, June 1, 2003

The pale blue Chevy parked on a Pine Hills side street Wednesday night
might have been the most technologically advanced Cavalier to ever hit
the road.

A Pocket PC sat in a cradle fastened to the dashboard. A laptop rested
on a passenger's knees. Wi-Fi Internet cards were inserted into both
computers, which also had their own global positioning systems atop the
dash. Two antennas, the kind with the little squiggle that look like pigs'
tails, were stuck to the car's rooftop. A hot pink power inverter was on
the floor. (A satellite radio receiver was in the sedan too, but it wasn't
turned on.)

"Are you guys with NASA or something?" one man asked as he walked
by the parked car, peering inside the geekmobile.

Nope. They're war driving.

Over the past month, Tom Morgan, 31, and Anthony Hersko, 34, have
spent one night a week cruising through Albany's neighborhoods to sniff
out wireless Internet signals.

So far, their weekly war drives -- so named after war dialing, the
old-school practice of using automated dialers to blitz sequential
telephone numbers to find those with computers on the other end --
have proven two things. First, there are more people using Wi-Fi in
Albany than even they expected -- Morgan and Hersko have found
nearly 600 access points on their travels. And second, that the vast
majority of those people have little regard for computer security, an
oversight that could lead to interlopers filching free Internet access, or
worse.

They do it because they're interested in the data. ("But I'm a nerd, so
most people don't find it interesting," Morgan admitted.) But they're also
in it for the techno-evangelism.

They want more businesses to install access points for customers. They
want more residential users to create neighborhood networks. And,
finally, they want more people to pay attention to security before a
hacker forces them to.

Growing numbers of cigar-box-size wireless access points are out there,
used by people who surf the Internet on laptops from the comfort of
their sofa or create a wireless network where computers can talk to
each other without cables.

But those wireless signals don't stop when they reach a wall. In some
cases, they can travel hundreds of feet. So as Morgan and Hersko drive
along, they pick up those signals, just as if they were picking up a radio
station.

The free "NetStumbler" software they use marks signal locations with
latitude and longitude derived from the GPS units. Eventually, they'll
assemble a map showing all the points. There already are early versions
posted on Morgan's Web site, http://www.albanywifi.com, which also
offers a forum for those seeking security tips and other techie
information.

Morgan (screen name "r00t 4orce") and Hersko ("termnatr") say they
just want to figure out where the points are, not hijack them. "I find it
interesting information," said Morgan, a confessed data junkie who is a
computer technician in Albany. "What we'd like to try to do is start
pushing cafes and stuff to offer wireless access."

The men figure that if businesses see how many people are using the
technology, they may feel more compelled to jump on the Wi-Fi
bandwagon. Not many area businesses have taken the plunge so far.

On Wednesday's drive alone -- a two-hour loop concentrated mostly
around Central Avenue, Lark Street and several residential
neighborhoods off New Scotland Avenue -- Morgan and Hersko found
154 spots issuing Wi-Fi signals.

As they drive along, their computers bleep regularly, indicating when a
signal is found. Near Lark Street, the units started sounding like pinball
machines. "I told you Lark Street is pretty hot," Morgan said.

If their owners have thought to lock them down with computerized
security measures, those hot spots aren't of much use.

But most owners don't think to lock them down. Of all the access points
Morgan and Hersko drove by last week, just 42 had activated a
security standard known as Wireless Encryption Protocol, or WEP.
Wardrivers know who's using what because NetStumbler tells them.

In fact, many owners take their shiny new Wi-Fi equipment out of the
box, plug it in and let it go -- not even touching the protection-free
default settings.

"Default is very, very bad," Hersko said.

It leaves users wide open to attack, security experts say. "When people
are running without any sort of encryption on their network, it allows you
to become part of their network," said Christopher Labatt-Simon,
president of D&D Consulting Ltd., an Albany computer networking
firm.

And while businesses typically lock down their systems, an unprotected
home user who connects to a workplace network can open that system
up to outsiders, Labatt-Simon said.

Lance Biesele, a Pine Hills resident, was among the many whom
Morgan and Hersko stumbled across Wednesday who was using a
wireless network without WEP. Reached Thursday, Biesele said he had
considered using WEP but decided against it because it was
cumbersome and he has other protection in place.

Will he change things now?

Probably not. But "I'd like to see that map," he said of albanywifi.com --
so he could figure out where in Albany he could get free access.

That's not necessarily legal. While there's nothing illegal about war
driving, piggybacking atop another's Internet access constitutes theft of
service; more serious mucking about can mean felony charges. And
while Morgan, Hersko and others would like if people invited outsiders
to use their Internet service to create a kind of community network,
Web service providers like Time Warner Cable aren't thrilled with the
possibility.

The terms of service agreed to by the company's Road Runner
subscribers prohibits that kind of activity.

Morgan isn't worried that the maps on his Web site will be used to
propagate mayhem. "My Web site, as much as I want it to be the next
Yahoo, doesn't get a lot of traffic," Morgan said. "I want to provide the
information. What people want to do with it after that is up to them."

http://www.timesunion.com/AspStories/story.asp?storyID=139085&category=BUSINESS&newsdate=6/1/2003

Also see:

http://community.albanywifi.com/modules.php?name=News&new_topic=3
-- 
  		"NEXTEL-1 IT'S NOT JUST NEXTEL"
		Note The New address 
Subscribe to Nextel-1: http://www.groups.yahoo.com/subscribe/NEXTEL-1

		"NEXTEL2 FOR iDEN SOFTWARE DEVELOPERS"
Subscribe to Nextel2: http://www.groups.yahoo.com/subscribe/NEXTEL2

		"WIRELESS FORUM HOMELAND SECURITY GROUP"
 	   The Complete Resource for Wireless Homeland Security.
Subscribe to WFHSG:  http://www.groups.yahoo.com/subscribe/WFHSG

------------------------ Yahoo! Groups Sponsor ---------------------~-->
Get A Free Psychic Reading! Your Online Answer To Life's Important Questions.
http://us.click.yahoo.com/Lj3uPC/Me7FAA/ySSFAA/61FxlB/TM
---------------------------------------------------------------------~->

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/