honoluluadvertiser.com

Sponsored by:

Comment, blog & share photos

Log in | Become a member
The Honolulu Advertiser
Posted on: Sunday, March 25, 2007

Hackers steal your secrets at Wi-Fi hotspots

By Tami Abdollah
Los Angeles Times

As communities push to turn themselves into massive wireless hotspots, unsuspecting Internet users are stumbling directly onto hacker turf, giving computer thieves nearly effortless access to their laptops and private information, authorities and high-tech security experts say.

It's an invasion with a twist: People who think they are signing on to the Internet through a wireless hotspot might actually be connecting to a look-alike network, created by a malicious user who can steal sensitive information, said Geoff Bickers of the FBI's Los Angeles cyber squad.

It is not clear how many people have been victimized, and few suspects have been charged with Wi-Fi hacking. But Bickers said that over the past couple of years, these hacking techniques have become increasingly common and are often undetectable. The risk is especially high at cafes, hotels and airports, busy places with heavy turnover of laptop users, authorities said.

"Wireless is a convenience, that's why people use it," Bickers said. "There's an axiom in the computer world that convenience is the enemy of security. People don't use wireless because they want to be secure. They use wireless because it's easy."

For Mark Loveless, it was a just a single letter of the alphabet that separated security from scam.

Logging on to his hotel's free wireless Internet in San Francisco last month, Loveless had two networks to choose between on his laptop screen — same name, one beginning with a lowercase letter, one with a capital. He chose the latter and, as he had done earlier that day, connected. But this time, a screen popped up asking for his log-in and password.

Loveless, a 46-year-old security analyst from Texas, immediately disconnected. A former hacker, he knew an attack when he saw one, he said.

Most Internet users do not.

About 14.3 million U.S. households use wireless Internet, and that figure is projected to grow to nearly 49 million households by 2010, according to JupiterResearch, which specializes in business and technology market research.

"There's literally probably millions of laptops in the U.S. that are configured to join networks named Linksys or D-Link when they are available," said Corey O'Donnell, vice president of marketing for Authentium, a company that provides security software. "So if I'm a hacker, it's as easy as setting up a network with one of those names and waiting for the fish to come."

Linksys and D-Link are two of the many commercial brands of wireless routers, products that connect a user to the Internet using radio frequency.

More than 300 municipalities across the United States are planning or already operating Wi-Fi service. Google and Earthlink plan to bring wireless access to all of San Francisco.

A September survey at Chicago's O'Hare Airport by Authentium revealed 76 peer-to-peer networks, or access points that are connected to via another user's computer, with 27 advertising access to free Wi-Fi — a trademark term for the technical specifications of wireless local area network operation. The company also found three networks had fake or misleading addresses, a sign that these hotspots could be hacker sites.

"At a busy place like O'Hare, in one hour a bad guy could get 20 laptops to connect to his network and steal the users' account information," said Ray Dickenson, an Authentium vice president.

Corporate networks are sometimes the most vulnerable, as employers push for a more mobile work force without always educating its users on the security risks of wireless Internet. "Once they've (hackers) got a toehold in a network, it's pretty much game over," Bickers said.

• • •

Here are some tips for safer Internet surfing, from Roland Dobbins, a network engineer who helps develop security solutions for Cisco Systems.

Do it yourself

Connect and disconnect from the Internet manually by right-clicking on the wireless Internet icon and either enabling or disabling the connection. This prevents your computer from searching out Internet and possibly fake access points automatically without your knowledge.

Be unique

Change default names of your network from "Linksys" to a unique name (not your home address) and change any default passwords as soon as possible.

Don't share

Keeping your network open or allowing others access to shared files leaves a big hole in your system for hackers. Deactivate all sharing. If you must share because you are on a corporate network, make sure you change these settings when you are outside the office.

Be selective

In the computing world, promiscuity is a sure way of getting yourself a virus or attracting a hacker. Connect to "infrastructure" points, or official access points, rather than "peer-to-peer" connections, or another user's computer. Set your Network Connections to only connect to infrastructure points. The default searches for all open hotspots.

Sensitive material must be secure

Only do sensitive computing — banking or anything else you would hate to have a hacker gain access to — on your personal wired (to the wall) home computer.

Make sure you enable at least WEP, a basic encryption on your computer, when setting up your home network. The default setting is usually no encryption.

Stay trendy

This means making sure your browser, all your software, antivirus programs and firewalls are up to date. Stop clicking the delay button and have antivirus and firewalls installed on your computer.

Be wary

If you get an e-mail from your bank, make sure the e-mail is indeed from your bank and that you are being routed to the bank. Put your cursor over the link and look at the address, or right click on properties and see where it will lead you. Always go to the bank site via its home page in a new window, not via a link in an e-mail.

Also, if your computer pops up a security certificate warning, do not click away without inspecting the certificate and the signature. Even then, certificates are easily faked. If you must continue using the Internet at that point, do not do anything sensitive. Best thing to do? Walk away.

Go exclusively corporate

If you can, use a Virtual Private Network while surfing wirelessly.

... And if you fail?

Computers get compromised all the time. Your response can save you a lot of agony. First, turn off your computer immediately, do not reboot, and disconnect it. Then call your help desk. Once you get your computer back up, change all passwords.