Subject: [NEXTEL-1] Wi-Fi Security Still Big Concern

From: [email-masked]
Date: Mon, 28 Jul 2003 18:07:25 -0400

Wi-Fi Security Still Big Concern

Army Lt. Col. Clifton H. Poole, who teaches wireless security classes at the
National Defense University, has monitored the same 23-mile route along I-66 in
Virginia, for Wi-Fi hotspots over the past two years. He's seen the number of
hotspots increase exponentially, but Poole estimates that 60 percent of them are
wide open and easy to hack.  Though no major hacking attack has occurred using
wireless, security experts warn that it's highly possible. Experts say that part
of the blame is on the users, who fail to turn on the security features of their
computers. Though current encryption technology is vulnerable to hackers, it's
better than leaving a network wide open.

==================================================================================

WiFi Is Open, Free and Vulnerable to Hackers
Sun Jul 27, 1:00 AM ET

By Jonathan Krim, Washington Post Staff Writer
Here's how Army Lt. Col. Clifton H. Poole, who teaches classes on wireless (news -
web sites) security at the National Defense University, gets his kicks on
I-66:Several times a month, Poole turns on a laptop computer in his car as he
commutes between his Reston home and the university campus at Fort McNair in
Southwest Washington. As he drives, a software program records the number of "hot
spots," areas where wireless transmitters allow Internet access over the air.
The results, Poole says, scare him.

After nearly two years of monitoring the same 23-mile route, Poole has watched the
number of hot spots boom, as the technology known as WiFi has become the latest
Big Internet Thing.  Setting up a home or business wireless network gives people
freedom to jump onto the Internet without their computers being tethered to
cables.

WiFi, short for wireless fidelity, is becoming so popular that increasing numbers
of airports, coffee houses, bars and other retailers offer public hot spots to
attract laptop-toting customers who want to sit and surf. But most of those
networks are unprotected, vulnerable to hackers who could steal data, introduce
viruses, launch spam or attack other computers.  Even as the number of wireless
networks has risen dramatically, Poole's surveys suggest that the rough percentage
of them that are unprotected remains above 60 percent.

Poole's findings mirror those of other experts, who say that WiFi vulnerability is
now one of the most serious threats to computer security. In their darkest
visions, consultants can imagine someone with a WiFi-enabled laptop walking
through an airport launching a destructive computer virus at every other
unprotected laptop in the vicinity, because users who tap into a vulnerable
network are just as exposed as its host.

Hackers could also use WiFi access to anonymously launch attacks at the broader
Internet, also threatening non-WiFi users.
WiFi speaks to the Internet's powerful allure of an always-on, connected world
where it is possible to share things that might normally cost money.  But like
other popular applications, such as software for trading digital music over the
Internet, WiFi is bumping into the hard realities of economics and security.

Although no calamitous hacking event via wireless has occurred, security
professionals say it is only a matter of time.
Last year, 3.1 million U.S. households had wireless networks, according to the
market-research firm IDC. IDC expects the number to double this year.

Gartner Inc. estimates that the number of public hot spots worldwide will increase
to 150,000 by 2005 from 20,000 last year. Gartner estimates that there will be 75
million users of hot spots by 2008.National estimates of vulnerable hot spots are
hard to come by. Like Poole, many computer hobbyists and hackers engage in "war
driving" to find open access points, and compile and compare their data at
conventions. An Internet-organized war-drive week last fall found 24,958 access
points, with only 6,970 using an encryption system to protect them from outside
use.

"We've been lucky, but you can't rely on luck in the future," said Edward Skoudis,
a security specialist with International Network Services in Santa Clara, Calif.
Skoudis, Poole and others say that some of the blame for lax security rests with
users. WiFi equipment comes with an encryption system known as WEP, for Wired
Equivalent Privacy.

But entering the required encryption codes can be confusing, time-consuming and
can lead to connected systems not functioning properly with each other. Many users
ignore the feature, or give up after trying to activate it."You want the access,
the freedom, the mobility and you say, 'I don't have to think about security until
I have a problem,' " Poole said.
Poole, Skoudis and others argue that WiFi software and hardware makers have
focused on making WiFi ubiquitous, glossing over anything that might slow down its
growth. "Manufacturers don't want to support it," Skoudis said of computer
security. "It's more complex and it means more help calls." Thus, he said, makers
of WiFi equipment set their products to come out of the box with encryption turned
off by default.

Matthew Tanase, president of Qaddisin LLC, a St. Louis-based network security
firm, said WiFi makers push security hard with business customers, who pay for the
services. But for consumers, Tanase said, "it's left up to the end user to worry
about security, and that's a sad state of affairs."California-based Linksys Groups
Inc., a leading WiFi equipment maker, says it takes security seriously but does
not want to force encryption on users.

"We're not going to do security by default because it adds an extra step and a
little bit of complexity to the start-up process," said marketing director Michael
Wagner. Although some operators of public hot spots charge for the service, they
too want maximum use with minimum hassle. A spokesman for T-Mobile, which operates
the WiFi network for Starbucks Coffee shops, said the company does not use
encryption. But he said T-Mobile encourages individuals to use other forms of
protection, such as firewall software. Poole, 39, said his foray into war-driving
began in part because one night he caught a teenager in a car outside his house,
piggybacking on the wireless network he had recently set up.

For the first few months in late 2000 and early 2001, Poole said he left the
laptop on in his car continuously.
"It got crazy after awhile, and I just stopped doing it," he said, because he
simply had a mound of data but was not doing anything with it. But he could not
kick the bug completely. "It's like plane spotting, or train spotting," he said.
"You do it because it's there." On Dec. 1, 2001, he recorded 62 access spots from
2 p.m. to 3 p.m.
Only six were using encryption. On July 7 of this year, he found 221 along his
route about the same time of day. But Poole thinks that number is low because many
people turn off their networks when they are not using them.
Of the 221, 86 were protected Security experts acknowledge that current WiFi
encryption technology is still highly vulnerable to hackers."It's broken; it has
holes and flaws," Skoudis said of WEP technology.  "It's kind of like a Band-Aid,
but better to have a Band-Aid than a big gaping hole."

Users can also require passwords for access to their networks. Several companies
and code-writing organizations are working on new encryption technology. And
although most WiFi-enabled laptops begin searching for and connecting to wireless
access points as soon as they are turned on, some new models provide security
warnings. Experts, though, worry that it may take a while for improvements to
cycle through product lines, and for consumers to upgrade their equipment.

Poole said the greatest danger is the anonymity enjoyed by users who piggyback on
WiFi networks. As a result, hackers can operate with little fear of being traced.
"It's like hanging a cable out your window for anyone to use," he said.

http://story.news.yahoo.com/news?tmpl=story&cid=1804&ncid=738&e=5&u=/washpost/20030727/tc_washpost/a51284_2003jul26

------------------------ Yahoo! Groups Sponsor ---------------------~-->
Free shipping on all inkjet cartridge & refill kit orders to US & Canada. Low prices up to 80% off. We have your brand: HP, Epson, Lexmark & more.
http://www.c1tracking.com/l.asp?cid=5510
http://us.click.yahoo.com/GHXcIA/n.WGAA/ySSFAA/61FxlB/TM
---------------------------------------------------------------------~->

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/