Stealing Out of Thin Air
SHA Newsletter: Vol 2. No. 6

If you are like many people, you have a wireless network card in your laptop. There’s a subtle risk that you should know about.

Two Kinds of Wireless Network

The usual wireless networks you set up at your home or office are infrastructure networks. They have a piece of equipment (a wireless access point or wireless router) that connects to your Internet connection. They’re called infrastructure networks because your computer connects to a piece of your network infrastructure.

But you can also set up networks between computers when there’s no access point involved. These are called ad-hoc networks, and they can be dangerous.

What Happens When You Connect?

Your laptop begins by searching the nearby radio airspace for active networks. It first looks for networks you’ve connected to in the past. If it finds one of these familiar networks, it will connect automatically. That’s why you can usually turn on your computer and be working on your home or office network right away.

If the computer can’t find a familiar network, it listens to find out if there are new networks in the vicinity. Here’s where things get risky. If you are, say, visiting someone else’s office, that new network is probably another infrastructure network and it is likely safe to connect. But it might be an ad-hoc network of computers that are nearby. You have to decide whether you want the laptop to connect to infrastructure networks, ad-hoc networks, or both. The security risk exists when you allow your computer to connect to ad-hoc networks. The problem is that this is commonly how wireless cards are configured by default.

What’s the Problem?

Let’s say you’re on a cross-country airplane, and you decide to open up the laptop to do some work. Unknown to you, there’s someone else running a laptop and his computer is announcing that it is running an ad-hoc network (this is known as SSID broadcasting). If your wireless network card comes on in flight, it might connect to this ad-hoc network. Now the attacker in seat 3A might be able to read files on your computer, discover what programs you have installed, or steal information about you. When the attacker turns off his machine, he leaves no trace.

The same thing can happen at coffee shops, restaurants, and any location that has a wireless hotspot. These infrastructure networks often use SSID broadcasting to make it easier for customers to connect to the network. In these situations, you might confuse the attacker's SSID with the real one for the hotspot. It also might happen if an attacker has a computer or PDA nearby -- in a passing car, in the parking lot at work, on the commuter train. It’s up to you to protect yourself.

Even if you intend to connect to an infrastructure network, an attacker can overwhelm it with a special antenna. If the attacker’s signal is stronger than others, and the attacker can guess or discover the SSID, your network card might choose to connect to the attacker, unless you are careful.

What Can You Do About It?

1. Know your network. A wireless networks is known by its Signal Set ID, or SSID. When your computer connects to a wireless network, make sure you recognize the SSID. Many computers will pop up a message telling you the SSID of the network to which they are connecting.
2. If you have a wireless network at home or work, make sure that you do not use the default SSID set on your access point. For example, wireless devices made by Linksys, often use ‘linksys’ as their default SSID. If your home network does this, then an attacker could hook your laptop by using this SSID and a strong signal. Your computer will think it’s connected to its home network, and you won’t be able to tell the difference.
3. Make sure you enable encryption on your wireless network. Although encryption on wireless networks is not 100% foolproof, it can make attacks more difficult.
4. Periodically change the SSID and encryption keys on your network.
5. Find the radio switch for your wireless card and turn it off when you are traveling. For example, on my computer, I can press Fn-F2 to turn off my wireless card. Some computers have a small on/off switch, particularly on laptops. You might be able to take the card out completely, which will do the same thing.
6. Run a firewall program on your computer, and set it up so that it warns you about unexpected program activity.
7. Disable services, such as file or printer sharing and remote desktop services unless you really need them. These services provides pathways for an attacker to compromise your computer.
8. Set your wireless card so that you do not allow it to connect to ad-hoc networks.

Wireless networks are wonderfully convenient both at home and work. But you need to be careful to make them secure.

Please note: Any trademarks and trade names of others mentioned in this message are the property of their owners, and not Stoney Hill Associates, LLC. We respect the intellectual property of others. The information provided is believed to be reliable, but we cannot guarantee that the procedures and information given here will work correctly for your specific situation.

If you would like help with a computer or software problem you face, contact us. Send an email to request@stoneyhillassociates.com.

Want to subscribe to this newsletter? Just join our mailing list:

© 2006 Stoney Hill Associates, LLC