Mobile IoT Authors: Elizabeth White, Liz McMillan, Yeshim Deniz, Jyoti Bansal, Ed Featherston

Related Topics: Mobile IoT

Mobile IoT: Article

Drive-by Hacking?

Drive-by Hacking?

How can your corporate network possibly be susceptible to drive-by hacking if your IS department hasn't set up or authorized any wireless LANs? Easily! A significant number of employees are setting them up on corporate campuses...without authorization. Read on for tips on how to protect your company.

To define "drive-by hacking," let's first define a related term, "war driving." War driving is a popular hacker slang term for the act of roaming around (generally in a car), sniffing out wireless networks using a laptop and some necessary peripherals. Drive-by hacking is the crime of then gaining unauthorized access to a wireless network that has been discovered.

There are no solid numbers on frequency of occurrences of drive-by hacking; we aren't likely to see any. According to Scott Crenshaw, CEO, NTRU, "People who are attacked have every incentive to keep the information quiet, for internal reasons, for credibility with shareholders, and especially for credibility with customers and business partners."

Highly confidential partner and customer data entrusted to an enterprise is exposed during a wireless break-in. Financial institutions are prime targets and may represent the only public cases we are likely to hear of.

Don't think you're not a target just because you're not a bank. If you have a wireless 802.11b network you are a potential target to those seeking free Internet access. Worse yet you could be an entry point to the Internet for those who want to hack other networks while covering their tracks and getting away scot-free ­ meaning their attacks will be traced back to you.

Prevalent Insecurity
"We did a survey in 2001 of several hundred clients (which tend to be larger companies)," says John Pescatore, research director for Internet security, Gartner Inc. "We asked whether they were planning on buying 802.11b wireless LAN systems, and based on our research only 20% of them had plans to do so in 2001. But our estimate was that 60% of them already had wireless LANs in use within their company. So while only 20% of them were even talking about planning to buy them, we think that for close to two-thirds of them, their users had already gone out and deployed wireless LANs without going through the procurement system.

"A second related number is based on an informal survey we did of our clients and, of the ones using wireless LANs already, 60% hadn't even turned on the basic WEP level of security. They are basically just using it out of the box with no security turned on." So a resultant figure of 36% is arrived at, or about one third of all companies surveyed, that have WLANs running with no security at all.

Profiling the War Driver
Who gets involved in war driving? "There is a category of people who do this sort of thing who are not criminals, strictly speaking. They are what you might call Œtourists.' There is another element in which the person is an industrial spy or someone who does have criminal intent. For them it's just another way of getting on the network, one that may be easier than trying to break in through an Internet connection, a phone line, or by physically jacking into the network," says Scott Blake, VP of information security, BindView Corporation.

Once on the network, hackers can do anything they would with any other type of network entry. In this case, they also get free wireless broadband to the Internet. Other rewards include the challenge of the hack itself, corporate espionage, data theft, credit card theft, and data destruction. Some drive-by hackers will attempt to gain entry to your network in order to hack other networks, assured that their tracks are covered since the last traceable network entity will be your wireless network, which gave them access without asking that they even be identified.

Where the Legal Risks Lie ­ for the Hacker and for You
When hackers are caught tapping into a network protected by WEP it's definitely a computer crime, according to Chris Wysopal, director of R&D, @stake. But how do you catch them? If they establish a pattern of attack (against the same network and from the same location) @stake has services that can determine the physical location of the attacker. If WEP security isn't turned on, however, drive-by hacking may not be illegal, as the court system has not approached the issue of whether hackers should know that an open network is not necessarily a public one that is freely available.

So Simple a 'Script Kiddie' Can Do It
Why are even the less sophisticated hackers (referred to as "script kiddies") able to hack your wireless LAN? According to Crenshaw, of NTRU, "The development cycles for new technologies are several years, and the attacks we're seeing right now are on technology that was developed 3­5 years ago."

Earlier WLAN technologies weren't designed to be terribly secure and hackers and script kiddies alike have had ample time to figure out their security holes, not that they needed it. All you really need to perform a drive-by are a laptop, an 802.11 wireless LAN card, a directional antenna, and some software. A cylindrical potato chip can, used for its shape as the antenna, can boost a signal by up to 15 decibels, greatly expanding this setup's capability of finding wireless LANs.

There are numerous freely available choices in software for use in discovering WLANs. NetStumbler, AirSnort, and WepCrack are just three of the popular choices. Why is such software allowed on the market? Because the hackers can claim the programs are there just to test networks to see if they are vulnerable. There's no crime in that.

As Matthew Caldwell, chief security officer and co-founder, GuardedNet, puts it, "Listening to the airwaves to see who has an unsecured wireless network in the area is a passive activity, as is listening in to enough network traffic to gain the key to a secured network. What is against the law is trying to use that knowledge to log onto these systems without authorization."

It's Not Only Rogue WLAN Setups That Are Vulnerable
According to Dave Juitt, CTO, Bluesocket, "Enterprise wireless networks are often thought of as a cable replacement for their wired counterparts. There's an educational component that should go along with deploying a WLAN since these networks are a different animal. For starters, you are broadcasting your network outside of your building walls. You have no idea where your packets are flying off to."

Additionally many network admins find WEP management to be difficult at best and don't use it.

Laying Out the Problem Technically...
WEP or no WEP, the 802.11 standard was never designed for broad campus, highly confidential, or mission-critical uses because it is not that secure, nor was it designed to be. According to Dr. John McEachen, Department of Electrical and Computer Engineering, Naval Postgraduate School:

Compared to wireless telecommunications standards, the IEEE 802.11 standard is very simple and straightforward ­ which is what the IEEE 802.11 subcommittee has hoped for to encourage vendor interest. Consequently, it's pretty easy for someone who is technically savvy to go in and see how an IEEE 802.11 network is supposed to respond to certain signals/messages. The downside is that hackers can use this to their advantage to insert certain signals to get the response they want as well, such as "turn off."

Although this may seem trivial, another barrier of significance is the cost of the standard itself. The IEEE 802.11 standard is free on the Internet (http://standards.ieee.org/getieee802/download/802.11-1999.pdf). Compare this to some of the wireless telecommunications standards such as IS-95, IS-136, Mobitex, and UMTS, which cost anywhere from $500 to thousands. (An interesting exception is CDMA2000, which is being given away for free on an experimental basis ­ clearly they feel some economic pressure from 802.11).

Wireless networks broadcast their IDs, known as the Service Set Identifier ­ the Service Set ID or SSID ­ which identifies a WLAN as being available and in the area. So the WLAN will appear in the list of available wireless networks on the laptop being used. These WLANs are open to anyone within range. Almost any corporation with a wireless 802.11 LAN is a target. These systems are generally sold with the security turned off by default because it makes them easier to set up (improving the sales of the hardware in the first place). Because they are easily set up, they can be installed by end users and not just IT professionals.

In most cases the appropriate security questions are never asked. Wireless networking hardware is often configured to automatically hand out Internet Protocol (IP) addresses and user identifiers, right out of the box, to any user device joining the network. In this mode, the device gives out IP addresses as a DHCP server (Dynamic Host Configuration Protocol), meaning they are automatically assigned, just as many dial-up Internet customers are automatically assigned an IP address. By using this identifier, you can join the network and get access to all the services without confronting any authentication process.

At the End of the Day...
You can secure your wireless network appropriately by installing a wireless gateway or VPN. 3COM and others have also addressed the 802.11 holes with new security measures in new 802.11 hardware.

Here are some solutions from Matt Caldwell, of GuardedNet, and Al Potter, manager of Network Security Labs, ICSA Labs:

  • Use application-layer encryption methods like Secure Sockets Layer.
  • Use a TCP/IP layer encryption like IPSec.
  • Encrypt all traffic that crosses the wireless network.
  • Use secure authentication. Require users to authenticate before their traffic is accepted or gatewayed over to the wired LAN.
  • Use appropriate antennas. Don't boost your signal needlessly.
  • Consider shielding external walls near access points.
  • Power down wireless access points when not in use.
  • Turn on WEP.
  • And take a walk through company property actually looking for wireless access points so you know whether you have WLANs attached to your network.

More Stories By David Geer

David Geer is a contributing writer to WBT, a journalist, and a computer technician. He graduated from Lake Erie College in 1993 with a BA in psychology and has worked in the computer industry and in the media since 1998.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.

@ThingsExpo Stories
The 21st International Cloud Expo has announced that its Call for Papers is open. Cloud Expo, to be held October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, brings together Cloud Computing, Big Data, Internet of Things, DevOps, Digital Transformation, Machine Learning and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding busin...
Existing Big Data solutions are mainly focused on the discovery and analysis of data. The solutions are scalable and highly available but tedious when swapping in and swapping out occurs in disarray and thrashing takes place. The resolution for thrashing through machine learning algorithms and support nomenclature is through simple techniques. Organizations that have been collecting large customer data are increasingly seeing the need to use the data for swapping in and out and thrashing occurs ...
SYS-CON Events announced today that DivvyCloud will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. DivvyCloud software enables organizations to achieve their cloud computing goals by simplifying and automating security, compliance and cost optimization of public and private cloud infrastructure. Using DivvyCloud, customers can leverage programmatic Bots to identify and remediate common cloud problems in rea...
In his opening keynote at 20th Cloud Expo, Michael Maximilien, Research Scientist, Architect, and Engineer at IBM, will motivate why realizing the full potential of the cloud and social data requires artificial intelligence. By mixing Cloud Foundry and the rich set of Watson services, IBM's Bluemix is the best cloud operating system for enterprises today, providing rapid development and deployment of applications that can take advantage of the rich catalog of Watson services to help drive insigh...
SYS-CON Events announced today that Tintri, Inc, a leading provider of enterprise cloud infrastructure, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Tintri offers an enterprise cloud platform built with public cloud-like web services and RESTful APIs. Organizations use Tintri all-flash storage with scale-out and automation as a foundation for their own clouds – to build agile development environments...
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices that will soon be in each of our lives. Enter the conversational interface revolution, combining bots we can literally talk with, gesture to, and even direct with our thoughts, with embedded artificial intelligence, whic...
SYS-CON Events announced today that Cloudistics, an on-premises cloud computing company, has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Cloudistics delivers a complete public cloud experience with composable on-premises infrastructures to medium and large enterprises. Its software-defined technology natively converges network, storage, compute, virtualization, and management into a ...
Every successful software product evolves from an idea to an enterprise system. Notably, the same way is passed by the product owner's company. In his session at 20th Cloud Expo, Oleg Lola, CEO of MobiDev, will provide a generalized overview of the evolution of a software product, the product owner, the needs that arise at various stages of this process, and the value brought by a software development partner to the product owner as a response to these needs.
SYS-CON Events announced today that delaPlex will exhibit at SYS-CON's @ThingsExpo, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. delaPlex pioneered Software Development as a Service (SDaaS), which provides scalable resources to build, test, and deploy software. It’s a fast and more reliable way to develop a new product or expand your in-house team.
SYS-CON Events announced today that Technologic Systems Inc., an embedded systems solutions company, will exhibit at SYS-CON's @ThingsExpo, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Technologic Systems is an embedded systems company with headquarters in Fountain Hills, Arizona. They have been in business for 32 years, helping more than 8,000 OEM customers and building over a hundred COTS products that have never been discontinued. Technologic Systems’ pr...
With major technology companies and startups seriously embracing Cloud strategies, now is the perfect time to attend @CloudExpo | @ThingsExpo, June 6-8, 2017, at the Javits Center in New York City, NY and October 31 - November 2, 2017, Santa Clara Convention Center, CA. Learn what is going on, contribute to the discussions, and ensure that your enterprise is on the right path to Digital Transformation.
SYS-CON Events announced today that Tappest will exhibit MooseFS at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. MooseFS is a breakthrough concept in the storage industry. It allows you to secure stored data with either duplication or erasure coding using any server. The newest – 4.0 version of the software enables users to maintain the redundancy level with even 50% less hard drive space required. The software func...
SYS-CON Events announced today that Outscale will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Outscale's technology makes an automated and adaptable Cloud available to businesses, supporting them in the most complex IT projects while controlling their operational aspects. You boost your IT infrastructure's reactivity, with request responses that only take a few seconds.
New competitors, disruptive technologies, and growing expectations are pushing every business to both adopt and deliver new digital services. This ‘Digital Transformation’ demands rapid delivery and continuous iteration of new competitive services via multiple channels, which in turn demands new service delivery techniques – including DevOps. In this power panel at @DevOpsSummit 20th Cloud Expo, moderated by DevOps Conference Co-Chair Andi Mann, panelists will examine how DevOps helps to meet th...
SYS-CON Events announced today that EARP will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. "We are a software house, so we perfectly understand challenges that other software houses face in their projects. We can augment a team, that will work with the same standards and processes as our partners' internal teams. Our teams will deliver the same quality within the required time and budget just as our partn...
Most technology leaders, contemporary and from the hardware era, are reshaping their businesses to do software in the hope of capturing value in IoT. Although IoT is relatively new in the market, it has already gone through many promotional terms such as IoE, IoX, SDX, Edge/Fog, Mist Compute, etc. Ultimately, irrespective of the name, it is about deriving value from independent software assets participating in an ecosystem as one comprehensive solution.
In his keynote at @ThingsExpo, Chris Matthieu, Director of IoT Engineering at Citrix and co-founder and CTO of Octoblu, focused on building an IoT platform and company. He provided a behind-the-scenes look at Octoblu’s platform, business, and pivots along the way (including the Citrix acquisition of Octoblu).
SYS-CON Events announced today that A&I Solutions has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Founded in 1999, A&I Solutions is a leading information technology (IT) software and services provider focusing on best-in-class enterprise solutions. By partnering with industry leaders in technology, A&I assures customers high performance levels across all IT environments including: mai...
Five years ago development was seen as a dead-end career, now it’s anything but – with an explosion in mobile and IoT initiatives increasing the demand for skilled engineers. But apart from having a ready supply of great coders, what constitutes true ‘DevOps Royalty’? It’ll be the ability to craft resilient architectures, supportability, security everywhere across the software lifecycle. In his keynote at @DevOpsSummit at 20th Cloud Expo, Jeffrey Scheaffer, GM and SVP, Continuous Delivery Busine...
SYS-CON Events announced today that Progress, a global leader in application development, has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Enterprises today are rapidly adopting the cloud, while continuing to retain business-critical/sensitive data inside the firewall. This is creating two separate data silos – one inside the firewall and the other outside the firewall. Cloud ISVs ofte...