IT Jobs
Show survey uncovers Wi-Fi security chaos
Atrocious security, industrial sabotage, and hack tools galore.
By John E. Dunn, Techworld | Techworld
Published: 14:24 GMT, 16 January 08
A probe of Wi-Fi access points at a large US trade show uncovered abysmal security, widespread signal jamming, and evidence that hacking tools were routinely being used to probe access points.
The survey by Wi-Fi specialist AirDefense, carried out at this week’s annual National Retail Federation (NRF) Convention & Expo in New York, found that of 458 access points (APs) surveyed, fewer than 10 percent were using the most secure encryption protocol, WPA2 (Wi-Fi protected access 2). Sixty percent were using WEP (wired equivalency protocol), a now discredited and easily hacked equivalent.
The security of laptops and PDAs at the show was no better, almost 80 percent of which were reckoned to be vulnerable to ‘evil twin’ attacks, a method of fooling clients into connecting to bogus access points.
Disturbingly, the survey also found evidence of wireless the hacking tools, Karma, and Hotspotter being used to probe access points in the convention hall. The company even found 39 “attacks” that appeared to be trying to jam access points by overloading their bandwidth or by blocking signals on a given channel.
“It is evident that the majority of companies exhibiting are not taking wireless security seriously or there would be a much higher percentage of ‘bullet proof’ encryption practices in place protecting APs,” said Airdefense’s CTO Richard Rushing.
An extraordinary 96 laptops were discovered to have changed their hardware MAC addresses to try and bypass convention hall security, presumably as a way of hiding the device’s real identify.
The security chaos of such a show cannot be taken to be typical of Wi-Fi’s use in the real world. One possibility for the widespread bad security behaviour uncovered – the deliberate blocking of APs for instance - could be a simple case of companies carrying out industrial sabotage on disliked rivals.
Nevertheless, retail is the one sector that would be expected to be mindful of the need for security – the most infamous Wi-Fi hack of all time took was carried out on a retailer, TJX, which last year suffered a hugely expensive data breach as a result of ‘open’ access points.
.gif)
Add your commentComments