During the Black Hat 2007 Conference, a quick display of hacker technology demonstrated just how secure –or not– Wi-Fi hotspots are. In the middle of a conference presentation, session identifiers and cookies were captured from the internet browser of a random user accessing an unsecured wireless signal. The result? The helpless audience member could only look on as his Gmail inbox was suddenly presented for all to see.
Though this was eye-opening for many, it shouldn’t be. Wireless networks have been unsecure for years; in 2006 the University of Cambridge surveyed 2,500 access points of Wi-Fi networks around the University and found 46% were unencrypted (1). An overall estimate puts that number even higher – around 95% (2).
The reason behind the high rate of unsecured hot spots is simple: “People just really don’t care about Wi-Fi security” (1). The general public doesn’t view unsecure networks as a problem. People commonly offer to share their connection with friends and neighbors, and log on to public hotspots.
Despite the past apathy regarding unsecured hotspots, there is clearly a reason to be concerned. Connecting to an unsecured network is an invitation for hackers to easily snoop through people’s inbox and cookies, putting an unsuspecting user at risk for data and identity theft.
Convenience of public Wi-Fi hotspots mistakenly puts security on the back burner. Few are willing to sacrifice checking their email in the library or a coffee shop due to the potential threat of a hacker. But increasingly, hackers are creating fake access points that appear to be real, easily deceiving wireless internet users.
“If you’re connecting to a hacker’s fake Access Point and
everything you send and receive is transmitted in clear
text with no encryption…Anyone who doubts that this is a
problem should ask themselves if they would post their email
account passwords … at the bottom of this blog or go in to
an airport and yell out their user account names and passwords
as loud as they can. If the answer is no then they should
be concerned with Hotspot security” (3).
Current Wi-Fi stats state that wireless internet use will only increase. Wireless users are expected to grow by over 970 million users in the next three years, bringing the number of Americans with wireless subscriptions up to 87% (4). By 2010 wireless internet use will double that of cell phone use (5).
These astounding figures should create some unease. The high number of unsecure connections increases the potential for data and identity theft, as well as the loss of control of sensitive information.
Though the new attitude towards Wi-Fi has recently shifted towards concern,
the low use of encryption is still a problem. Many wireless network products have included built-in security features that offer added protection or encryption,
but customers struggle with the setup, and the features go unused.
Setting up your own network
When setting up Wi-Fi at home, follow these guidelines to increase the security of the network:
• Change the default name of your access point (that it does not read Linksys, or Netgear, for example) that does not disclose your name, company, or location
• Make sure your Wi-Fi Protected Access (WPA) is enabled or turned on, and check often for security upgrades
• Change the default router password
• Disable remote access via the router
• Use MAC authentication to validate only a specific list of users allowed
to access your network
Browse at your own risk
If you connect to a public access point, there are fewer options. Simply put, unsecured Wi-Fi use is a major threat. By connecting to an unsecured wireless network, you are a sitting target for any interested hacker. Information passed through unsecured web pages is accessible. Is it worth sacrificing all the information within your inbox just to check your email?
Although there are problems created by unsecured wireless networks, options are available to protect emailed documents. It’s possible to create secure, encrypted documents that are invulnerable to hackers, when accessed over a wireless network. If you plan to work on an unsecured access point, using extra security on sensitive files will assist in guarding against the vulnerabilities created by using a hotspot.
by Ashley Westling