Mobile IoT Authors: Elizabeth White, Yeshim Deniz, Zakia Bouachraoui, Pat Romanski, Liz McMillan

Related Topics: Mobile IoT

Mobile IoT: Article

Drive-by Hacking?

Drive-by Hacking?

How can your corporate network possibly be susceptible to drive-by hacking if your IS department hasn't set up or authorized any wireless LANs? Easily! A significant number of employees are setting them up on corporate campuses...without authorization. Read on for tips on how to protect your company.

To define "drive-by hacking," let's first define a related term, "war driving." War driving is a popular hacker slang term for the act of roaming around (generally in a car), sniffing out wireless networks using a laptop and some necessary peripherals. Drive-by hacking is the crime of then gaining unauthorized access to a wireless network that has been discovered.

There are no solid numbers on frequency of occurrences of drive-by hacking; we aren't likely to see any. According to Scott Crenshaw, CEO, NTRU, "People who are attacked have every incentive to keep the information quiet, for internal reasons, for credibility with shareholders, and especially for credibility with customers and business partners."

Highly confidential partner and customer data entrusted to an enterprise is exposed during a wireless break-in. Financial institutions are prime targets and may represent the only public cases we are likely to hear of.

Don't think you're not a target just because you're not a bank. If you have a wireless 802.11b network you are a potential target to those seeking free Internet access. Worse yet you could be an entry point to the Internet for those who want to hack other networks while covering their tracks and getting away scot-free ­ meaning their attacks will be traced back to you.

Prevalent Insecurity
"We did a survey in 2001 of several hundred clients (which tend to be larger companies)," says John Pescatore, research director for Internet security, Gartner Inc. "We asked whether they were planning on buying 802.11b wireless LAN systems, and based on our research only 20% of them had plans to do so in 2001. But our estimate was that 60% of them already had wireless LANs in use within their company. So while only 20% of them were even talking about planning to buy them, we think that for close to two-thirds of them, their users had already gone out and deployed wireless LANs without going through the procurement system.

"A second related number is based on an informal survey we did of our clients and, of the ones using wireless LANs already, 60% hadn't even turned on the basic WEP level of security. They are basically just using it out of the box with no security turned on." So a resultant figure of 36% is arrived at, or about one third of all companies surveyed, that have WLANs running with no security at all.

Profiling the War Driver
Who gets involved in war driving? "There is a category of people who do this sort of thing who are not criminals, strictly speaking. They are what you might call Œtourists.' There is another element in which the person is an industrial spy or someone who does have criminal intent. For them it's just another way of getting on the network, one that may be easier than trying to break in through an Internet connection, a phone line, or by physically jacking into the network," says Scott Blake, VP of information security, BindView Corporation.

Once on the network, hackers can do anything they would with any other type of network entry. In this case, they also get free wireless broadband to the Internet. Other rewards include the challenge of the hack itself, corporate espionage, data theft, credit card theft, and data destruction. Some drive-by hackers will attempt to gain entry to your network in order to hack other networks, assured that their tracks are covered since the last traceable network entity will be your wireless network, which gave them access without asking that they even be identified.

Where the Legal Risks Lie ­ for the Hacker and for You
When hackers are caught tapping into a network protected by WEP it's definitely a computer crime, according to Chris Wysopal, director of R&D, @stake. But how do you catch them? If they establish a pattern of attack (against the same network and from the same location) @stake has services that can determine the physical location of the attacker. If WEP security isn't turned on, however, drive-by hacking may not be illegal, as the court system has not approached the issue of whether hackers should know that an open network is not necessarily a public one that is freely available.

So Simple a 'Script Kiddie' Can Do It
Why are even the less sophisticated hackers (referred to as "script kiddies") able to hack your wireless LAN? According to Crenshaw, of NTRU, "The development cycles for new technologies are several years, and the attacks we're seeing right now are on technology that was developed 3­5 years ago."

Earlier WLAN technologies weren't designed to be terribly secure and hackers and script kiddies alike have had ample time to figure out their security holes, not that they needed it. All you really need to perform a drive-by are a laptop, an 802.11 wireless LAN card, a directional antenna, and some software. A cylindrical potato chip can, used for its shape as the antenna, can boost a signal by up to 15 decibels, greatly expanding this setup's capability of finding wireless LANs.

There are numerous freely available choices in software for use in discovering WLANs. NetStumbler, AirSnort, and WepCrack are just three of the popular choices. Why is such software allowed on the market? Because the hackers can claim the programs are there just to test networks to see if they are vulnerable. There's no crime in that.

As Matthew Caldwell, chief security officer and co-founder, GuardedNet, puts it, "Listening to the airwaves to see who has an unsecured wireless network in the area is a passive activity, as is listening in to enough network traffic to gain the key to a secured network. What is against the law is trying to use that knowledge to log onto these systems without authorization."

It's Not Only Rogue WLAN Setups That Are Vulnerable
According to Dave Juitt, CTO, Bluesocket, "Enterprise wireless networks are often thought of as a cable replacement for their wired counterparts. There's an educational component that should go along with deploying a WLAN since these networks are a different animal. For starters, you are broadcasting your network outside of your building walls. You have no idea where your packets are flying off to."

Additionally many network admins find WEP management to be difficult at best and don't use it.

Laying Out the Problem Technically...
WEP or no WEP, the 802.11 standard was never designed for broad campus, highly confidential, or mission-critical uses because it is not that secure, nor was it designed to be. According to Dr. John McEachen, Department of Electrical and Computer Engineering, Naval Postgraduate School:

Compared to wireless telecommunications standards, the IEEE 802.11 standard is very simple and straightforward ­ which is what the IEEE 802.11 subcommittee has hoped for to encourage vendor interest. Consequently, it's pretty easy for someone who is technically savvy to go in and see how an IEEE 802.11 network is supposed to respond to certain signals/messages. The downside is that hackers can use this to their advantage to insert certain signals to get the response they want as well, such as "turn off."

Although this may seem trivial, another barrier of significance is the cost of the standard itself. The IEEE 802.11 standard is free on the Internet (http://standards.ieee.org/getieee802/download/802.11-1999.pdf). Compare this to some of the wireless telecommunications standards such as IS-95, IS-136, Mobitex, and UMTS, which cost anywhere from $500 to thousands. (An interesting exception is CDMA2000, which is being given away for free on an experimental basis ­ clearly they feel some economic pressure from 802.11).

Wireless networks broadcast their IDs, known as the Service Set Identifier ­ the Service Set ID or SSID ­ which identifies a WLAN as being available and in the area. So the WLAN will appear in the list of available wireless networks on the laptop being used. These WLANs are open to anyone within range. Almost any corporation with a wireless 802.11 LAN is a target. These systems are generally sold with the security turned off by default because it makes them easier to set up (improving the sales of the hardware in the first place). Because they are easily set up, they can be installed by end users and not just IT professionals.

In most cases the appropriate security questions are never asked. Wireless networking hardware is often configured to automatically hand out Internet Protocol (IP) addresses and user identifiers, right out of the box, to any user device joining the network. In this mode, the device gives out IP addresses as a DHCP server (Dynamic Host Configuration Protocol), meaning they are automatically assigned, just as many dial-up Internet customers are automatically assigned an IP address. By using this identifier, you can join the network and get access to all the services without confronting any authentication process.

At the End of the Day...
You can secure your wireless network appropriately by installing a wireless gateway or VPN. 3COM and others have also addressed the 802.11 holes with new security measures in new 802.11 hardware.

Here are some solutions from Matt Caldwell, of GuardedNet, and Al Potter, manager of Network Security Labs, ICSA Labs:

  • Use application-layer encryption methods like Secure Sockets Layer.
  • Use a TCP/IP layer encryption like IPSec.
  • Encrypt all traffic that crosses the wireless network.
  • Use secure authentication. Require users to authenticate before their traffic is accepted or gatewayed over to the wired LAN.
  • Use appropriate antennas. Don't boost your signal needlessly.
  • Consider shielding external walls near access points.
  • Power down wireless access points when not in use.
  • Turn on WEP.
  • And take a walk through company property actually looking for wireless access points so you know whether you have WLANs attached to your network.

More Stories By David Geer

David Geer is a contributing writer to WBT, a journalist, and a computer technician. He graduated from Lake Erie College in 1993 with a BA in psychology and has worked in the computer industry and in the media since 1998.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.

IoT & Smart Cities Stories
DXWorldEXPO LLC announced today that All in Mobile, a mobile app development company from Poland, will exhibit at the 22nd International CloudEXPO | DXWorldEXPO. All In Mobile is a mobile app development company from Poland. Since 2014, they maintain passion for developing mobile applications for enterprises and startups worldwide.
Nicolas Fierro is CEO of MIMIR Blockchain Solutions. He is a programmer, technologist, and operations dev who has worked with Ethereum and blockchain since 2014. His knowledge in blockchain dates to when he performed dev ops services to the Ethereum Foundation as one the privileged few developers to work with the original core team in Switzerland.
Cloud-enabled transformation has evolved from cost saving measure to business innovation strategy -- one that combines the cloud with cognitive capabilities to drive market disruption. Learn how you can achieve the insight and agility you need to gain a competitive advantage. Industry-acclaimed CTO and cloud expert, Shankar Kalyana presents. Only the most exceptional IBMers are appointed with the rare distinction of IBM Fellow, the highest technical honor in the company. Shankar has also receive...
DXWorldEXPO LLC announced today that ICOHOLDER named "Media Sponsor" of Miami Blockchain Event by FinTechEXPO. ICOHOLDER gives detailed information and help the community to invest in the trusty projects. Miami Blockchain Event by FinTechEXPO has opened its Call for Papers. The two-day event will present 20 top Blockchain experts. All speaking inquiries which covers the following information can be submitted by email to [email protected] Miami Blockchain Event by FinTechEXPOalso offers sp...
Headquartered in Plainsboro, NJ, Synametrics Technologies has provided IT professionals and computer systems developers since 1997. Based on the success of their initial product offerings (WinSQL and DeltaCopy), the company continues to create and hone innovative products that help its customers get more from their computer applications, databases and infrastructure. To date, over one million users around the world have chosen Synametrics solutions to help power their accelerated business or per...
DXWordEXPO New York 2018, colocated with CloudEXPO New York 2018 will be held November 11-13, 2018, in New York City and will bring together Cloud Computing, FinTech and Blockchain, Digital Transformation, Big Data, Internet of Things, DevOps, AI, Machine Learning and WebRTC to one location.
@DevOpsSummit at Cloud Expo, taking place November 12-13 in New York City, NY, is co-located with 22nd international CloudEXPO | first international DXWorldEXPO and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time t...
When talking IoT we often focus on the devices, the sensors, the hardware itself. The new smart appliances, the new smart or self-driving cars (which are amalgamations of many ‘things'). When we are looking at the world of IoT, we should take a step back, look at the big picture. What value are these devices providing. IoT is not about the devices, its about the data consumed and generated. The devices are tools, mechanisms, conduits. This paper discusses the considerations when dealing with the...
Charles Araujo is an industry analyst, internationally recognized authority on the Digital Enterprise and author of The Quantum Age of IT: Why Everything You Know About IT is About to Change. As Principal Analyst with Intellyx, he writes, speaks and advises organizations on how to navigate through this time of disruption. He is also the founder of The Institute for Digital Transformation and a sought after keynote speaker. He has been a regular contributor to both InformationWeek and CIO Insight...
Digital Transformation is much more than a buzzword. The radical shift to digital mechanisms for almost every process is evident across all industries and verticals. This is often especially true in financial services, where the legacy environment is many times unable to keep up with the rapidly shifting demands of the consumer. The constant pressure to provide complete, omnichannel delivery of customer-facing solutions to meet both regulatory and customer demands is putting enormous pressure on...