Subject: [NEXTEL-1] Poor Security Leaves Many Philadelphia-Area Wireless Networks Vulnerable

From: [email-masked]
Date: Thu, 22 Apr 2004 01:37:25 -0400

Poor Security Leaves Many Philadelphia-Area Wireless Networks Vulnerable

Source: The Philadelphia Inquirer
Publication date: 2004-04-17
Arrival time: 2004-04-19

Apr. 17--Parked outside a swank Narberth block, it took a computer
consultant about five minutes to electronically thumb through several
houses' worth of long-distance access codes, personal mail and hotel
receipts -- complete with credit-card numbers.
In a single mile, only 12 of 58 houses with wireless computer networks
had any security measures to keep hackers out, a local indicator of an
impending national boom in identity theft, government officials worry.

"Everyone talks about how great wireless networks are, but no one talks
about security issues," said Naomi Lefkovitz, an attorney for the
Federal Trade Commission, which oversees identity fraud. "People just
think it's exciting, and they don't think about how it could be used for
less than positive ideas."

With households adding second and third computers -- a desktop PC in a
teenager's room, say, along with the family computer and mom's laptop --
wireless services have exploded from 4.5 million homes in 2003 to almost
7 million this year, according to the Yankee Group, a Boston research
team that tracks computer use. Using a box called a router and a
radio-wave technology called "wi-fi," people link their PCs wirelessly
to each other and to the Internet.

In addition to home networks, about 4,000 "hot spots," such as coffee
shops, parks and hotels, have free or paid wireless Internet access,
with an additional 8,000 expected by year's end.

Rob DeRubeis, chair of the University of Pennsylvania's psychology
department, installed a wireless network in his home 16 months ago so he
could work in the kitchen while listening to music. In his "shared file"
folder, he put pictures from his cousin's wedding, a few text documents,
and instructions on how to use his telephone long-distance access code.

Computer consultant Jamie Jamison could see it all, parked two blocks
away with the help of free software that allows computers to seek out
wireless signals.

"It's really so easy, it's scary," said Jamison, who said many of his
clients do not want to take the extra time to activate their computers'
firewall or encryption devices.

DeRubeis was more upset to learn his teenage daughter had downloaded
virus-laden games onto his laptop than he was about the security
invasion.  It had not occurred to him that his files were vulnerable.

"I didn't know people could go in and look at this stuff," he said. "I
just assumed it was secure."

Once a hacker locks in to a wireless signal such as DeRubeis', he can
use "sniffer" software to capture any data going through the air, such
as e-mail text and Web screens, unless that information is encrypted.
Jamison needed about two minutes to snatch a volunteer's password and
user name from an e-mail account while they used a wireless network at
Borders.

Some newer computers using the Windows XP operating system come with a
firewall, which blocks outsiders from getting in. But anyone using an
older version of Windows does not have automatic security and must take
steps to activate it.
"It comes down to a simple balance of security versus ease," Jamison
said. "Most people just plug the router into their modem and go."

A quick drive around Montgomery County found homes with hard drives full
of vacation pictures (Puerto Rico), music downloads (Dave Matthews Band
live snippets), and interesting user names (RoscoPColtrane from The
Dukes of Hazzard).
"I don't understand why anyone would want to look in my computer," said
author Judith Benn Hurley, who discovered she could see into several of
her neighbors' computers and vice versa when she installed a wireless
network in her Philadelphia apartment. She said she makes sure not to
put private material, such as Social Security numbers, on shared files.
"But I do notice which sites are secure when I'm online."

Security issues apply not only to homes, but to some wireless campuses
such as Penn. When students there log in, they use encrypted passwords,
but after that, all information, including e-mail, is sent in plain-text
format that allows a hacker to eavesdrop. Temple, in contrast, uses
encryption protection for all its wireless activity.

Security is also a big concern for open Internet areas. The T-Mobile
wireless systems offered by Starbucks and Borders encrypt password and
user-name information but cannot protect information typed into
unsecured Web sites or computers without firewalls. Love Park, which
hopes to offer free wireless access this June, will have no built-in
security measures.

"If you're anywhere on the Internet and not behind a firewall you're
vulnerable," said Brian Copeland, vice president of technology for
Syndeo, the Louisiana company installing the Love Park system. The
company said it would give users a head's up about the security issues
on a "terms of use" screen.

Router manufacturers say they have always left it up to their customers
to activate security measures even though most do not.
"When I talk to neighbors or consumers about why they did not turn on
security, they feel that their neighbors are not using wireless, so they
think, why bother," said Vivek Pathela, senior director at NetGear, a
major manufacturer of wireless routers.
There are no plans to make such measures automatic, Pathela said. That
makes Philadelphia computer security consultant Francis Rabuck sure that
the "big problem" of wireless security won't go away soon even though it
would be easy to fix.
"All people need is just to turn on basic security, and most people
don't," Rabuck said. "The casual person trying to hack in would see that
it's secure and move to the next house or block and find the one that's
open.  It's easier to walk the 100 feet than to try and crack it."

To see more of The Philadelphia Inquirer, or to subscribe to the
newspaper, go to http://www.philly.com

http://cnniw.yellowbrix.com/pages/cnniw/Story.nsp?story_id=50046057&ID=cnniw&scategory=Telecommunications%3AWireless&

--
    "NEXTEL-1 IT'S NOT JUST NEXTEL"
  Note The New address
Subscribe to Nextel-1: http://www.groups.yahoo.com/subscribe/NEXTEL-1

  "NEXTEL2 FOR iDEN SOFTWARE DEVELOPERS"
Subscribe to Nextel2: http://www.groups.yahoo.com/subscribe/NEXTEL2

  "WIRELESS FORUM HOMELAND SECURITY GROUP"
     The Complete Resource for Wireless Homeland Security.
Subscribe to WFHSG:  http://www.groups.yahoo.com/subscribe/WFHSG

------------------------ Yahoo! Groups Sponsor ---------------------~-->
Buy Ink Cartridges or Refill Kits for your HP, Epson, Canon or Lexmark
Printer at MyInks.com.  Free s/h on orders $50 or more to the US & Canada.
http://www.c1tracking.com/l.asp?cid=5511
http://us.click.yahoo.com/mOAaAA/3exGAA/qnsNAA/61FxlB/TM
---------------------------------------------------------------------~->

-- 
    "NEXTEL-1 IT'S NOT JUST NEXTEL"
  Note The New address 
Subscribe to Nextel-1: http://www.groups.yahoo.com/subscribe/NEXTEL-1

  "NEXTEL2 FOR iDEN SOFTWARE DEVELOPERS"
Subscribe to Nextel2: http://www.groups.yahoo.com/subscribe/NEXTEL2

  "WIRELESS FORUM HOMELAND SECURITY GROUP"
     The Complete Resource for Wireless Homeland Security.
Subscribe to WFHSG:  http://www.groups.yahoo.com/subscribe/WFHSG

Yahoo! Groups Links

<*> To visit your group on the web, go to:
     http://groups.yahoo.com/group/NEXTEL-1/

<*> To unsubscribe from this group, send an email to:
     [email-masked]

<*> Your use of Yahoo! Groups is subject to:
     http://docs.yahoo.com/info/terms/