|
Related Sites
Site Navigation
| |
The default
configuration of most Wi-Fi access points provides no protection from
unauthorized use of the network. Many business and residential users do not
intend to secure their access points, instead leaving them open to users in the
area. It has become etiquette to leave access points open for others to use just
as one can expect to find open access points while on the road.
Measures to
deter unauthorized users include suppressing the AP's service set identifier (SSID)
broadcast, allowing only computers with known MAC addresses to join the network,
and various encryption standards. Older access points frequently do not support
adequate security measures to protect against a determined attacker armed with a
packet sniffer and the ability to switch MAC addresses. Recreational exploration
of other people's access points has become known as wardriving,
and the leaving of graffiti describing available services as warchalking.
It should be noted that these activities are illegal in many countries,
including the United States.
However, it is
also common for people to unintentionally use others' Wi-Fi networks without
authorization. Operating systems such as Windows XP and Mac OS X automatically
connect to an available wireless network, depending on the network
configuration. A user who happens to start up a laptop in the vicinity of an
access point may find the computer has joined the network without any visible
indication. Moreover, a user intending to join one network may instead end up on
another one if the latter's signal is stronger. In combination with automatic
discovery of other network resources this can lead wireless users to send
sensitive data to the wrong destination.
From
http://www.pcmag.com/print_article2/0,1217,a=173326,00.asp
Right now your
laptop could be wirelessly connecting to any available network. That's unsafe.
The situation's all too common: You're at the airport and your flight is
delayed, so you open your laptop and start working. Unbeknownst to you, your
laptop's wireless could be putting your computer in danger.
Recent real-world experiments suggest that the default wireless settings on many
laptops could leave them vulnerable. During recent travel, researcher Mark
Loveless started poking into the reasons why a large number of laptops at any
given airport were broadcasting common network names, or service set identifiers
(SSIDs), such as "linksys" or "dlink." He gathered similar data on four flights.
He found a significant portion of laptops are configured by default to seek out
and connect to common SSIDs. If no such network is around, many computers create
their own wireless network using one of those names. Without any sort of
malicious intent, wireless laptops were connecting to each other, he found.
The issue isn't a vulnerability per se; it's a cascade failure of a set of
default configurations that Microsoft has set to make creating wireless networks
easier.
Many laptops are configured to attempt to connect to both infrastructure
networks and what are called ad hoc networks. In an infrastructure network, the
laptop is a client that connects to a base station, similar to the client-server
network design. In ad hoc networks, many individual laptops form a peer-to-peer
network sharing connectivity. This ad hoc networking is done in the background
on Microsoft Windows 2000 and Windows XP (up to Service Pack 1). Windows XP
Service Pack 2 notifies the user that it's connecting to an ad hoc network.
Other factors come into play as well. Many people's home networks connect
through a base station identified by the default name, such as "linksys."
Moreover, a laptop that connects to an ad hoc network of a different name adds
that name to its list of possible networks, possibly advertising that network
name to other computers in the future. Furthermore, Microsoft has a default
addressing scheme that results in each computer getting a valid address, even
without a central computer to assign network addresses to each member of the
network.
This all makes it possible for attackers to join and control ad hoc networks.
Because a laptop believes it's part of a network, it might check for e-mail,
letting the attacker get the owner's username and password. The attacking
computer can also advertise its connection as an Internet gateway and scan
traffic sent by other laptops for useful information, such as passwords to
automated accounts.
More aggressive attackers could use the network to try attacks on specific
vulnerabilities in a potential victim's laptop. In many cases, the laptop will
connect to the wireless network, believing that it is the user's home network.
Thus, the configuration may allow file sharing and printer sharing.
How can you protect yourself? First, turn off your laptop's wireless when not
attempting to connect to a known network. Also, make sure your laptop doesn't
turn on its wireless when it can't find an Ethernet connection. Most important,
disable ad hoc networking, by clicking the Advanced button of the Wireless
Network Connection Settings control panel to change it from Any available
network (access point preferred) to Access point (infrastructure) networks only.
|
