College students do it. Coffee shop customers do it too. Your neighbor in Apartment 3C is probably doing it right now.
Many computer users search for an available wireless network to tap into -- at the mall, at school, at home -- whether they have permission to use that network or not. Knowingly or unknowingly, these wireless "parasites" may be doing more than filching a signal. When they connect, they can open up the network -- and all the computers on it -- to an array of security breaches.
These problems are compounded when someone allowed to use an organization's wireless network adds an unauthorized wireless signal to increase the main network's signal strength. These unauthorized access points are especially vulnerable, often unprotected by any security measures that may exist on the main network.
At home, people usually use passwords to protect their wireless network from unauthorized access. But a new study by the A. James Clark School of Engineering's Michel Cukier indicates that passwords alone may not provide enough protection for home wireless networks and are particularly inadequate for the wireless networks of larger organizations.
At many organizations and locations around the country, thousands of users access widespread wireless networks legitimately at any given time. But, in turn, some of these users set up their own wireless networks, linked to the official network, to increase the signal in their office or home -- what computer experts call an unmanaged wireless access point.
If these secondary connections are not secure, they open up the entire network to trouble. Unsecured wireless access points pose problems for businesses, cities and other organizations that make wireless access available to customers, employees and residents. Unsecured connections are an open invitation to hackers seeking access to vulnerable computers.
Cukier recommends that wireless network owners and administrators take the following precautions to better secure wireless networks from "parasites" trolling for access and unsecured connections set up by legitimate users:
Limited signal coverage
Limit the strength of your wireless network so it cannot be detected outside the bounds of your home or office.
Turn off SSID broadcasting
A Service Set IDentifier (SSID) is a code attached to packets (bits of information) on a wireless network that is used to identify each packet as part of that network. When SSID broadcasting is enabled on a wireless network, this network can be identified by all wireless clients within range. Conversely, when SSID broadcasting is disabled, the wireless network is not visible (to casual users) unless this code is entered in advance into the client's network setting.
WPA/WEP encryption
Encrypted communication will prevent confidential information from being disclosed. If the traffic over the wireless network is encrypted, an attacker must decrypt the password before retrieving information transmitted over the network. There are two encryption schemes available -- Wired Equivalent Privacy (WEP) and Wi-Fi Protected Access (WPA). In practice, only one of them can be used at a time. Regular changing of the encryption key may also help to protect the network. Whenever possible, WPA should be used because WEP can be decrypted by hackers equipped with special software.
Key management
Even if encryption is used, if the key to this encryption (generated by the network) is not changed often, a hacker may crack the key and decrypt the communication, so the key must be regularly changed.
MAC address
If a wireless access point accepts connections only from known MAC addresses (essentially a serial number unique to each manufactured network adaptor), a potential attacker will need to learn the addresses of legitimate computers in order to access the wireless network.
About the author:
Professor Michel Cukier is an Assistant Professor in the Center for Reliability Engineering in the Department of Mechanical Engineering at the University of Maryland, College Park.
Michel Cukier received a physics engineering degree from the Free University of Brussels, Belgium, in 1991, and a Doctor in Engineering degree from the National Polytechnic Institute of Toulouse, France, in 1996. From 1991 to 1992, he was an instructor at the Free University of Brussels. From 1992 to 1996, he was at LAAS-CNRS, Toulouse, for his doctoral work on coverage estimation of fault-tolerant systems.
From 1996 to 2001, he was a researcher in the Perform research group in the Coordinated Science Laboratory at the University of Illinois, Urbana-Champaign. His research interests included intrusion tolerance by adaptation in distributed systems, adaptive fault tolerance in distributed systems, the evaluation of fault-tolerant systems combining modeling and fault injection, and the estimation of fault tolerance coverage. As part of this work, he is a co-developer of the AQuA Architecture, an architecture that provides dependable distributed objects.
His current research interests include security evaluation, intrusion tolerance, distributed system validation, fault injection, and software testing.
He is a member of the IEEE and the IEEE Computer Society.
About the A. James Clark School of Engineering
The Clark School of Engineering, situated on the rolling, 1,500-acre
University of Maryland campus in College Park, Md., is one of the premier engineering schools in the U.S.
The Clark School's graduate programs are collectively the fastest rising in the nation. In U.S. News & World Report annual ratings of graduate
programs, the school is 15th among public and private programs nationally, ninth among public programs nationally, and first among public programs in the mid-Atlantic region. The school offers 13 graduate
programs and 12 undergraduate programs, including degree and certification programs tailored for working professionals.
The school is home to one of the most vibrant research programs in the country. With major emphasis in key areas -- communications and networking, nanotechnology, bioengineering, reliability engineering,
project management, intelligent transportation systems, and space robotics, as well as electronic packaging and smart small systems and materials -- the Clark School is leading the way toward the next generation of engineering advances.
