When network security vendor Cirond Corp. publicized a potential threat looming over wireless laptops eight months ago, there seemed to be no takers. Not until the company decided to call it the “wiphishing” threat six months later.
So, what’s in a name? Everything, if you ask Cirond president and chief executive officer Nicholas Miller. By giving this potential wireless problem a name, the company gained all the hype it could handle – 45,000 hits for ‘wiphishing” on Google, coverage by nearly 50 television stations, and numerous articles on the topic.
Wiphishing, said Miller, involves hackers attempting access to a wireless laptop by setting up a rouge access point similar to the wireless user’s default network. The ingredients: a laptop and a $50 access point.
“This is a problem we started talking about eight months ago, but we did not get a huge amount of coverage until we came up with a very catchy word to describe it,” Miller said.
Actually, “wiphishing” does not accurately describe what the threat is about, according to Tom Slodichak, chief security officer for WhiteHat Inc., an IT security provider based in Burlington, Ontario.
“We all know that in phishing, people set up bogus Web sites to collect financial information and perform financial fraud or some sort of identity theft,” Slodichak said.
He added wiphishing was formerly known as the “man-in-the-middle” attack, where Wi-Fi access points and client workstations are used to gain network access.
Whatever its name, this threat has placed the vulnerability of Wi-Fi connectivity under scrutiny.
“This is significant because there are over 100 million wireless laptops in use today,” Miller said, adding that a simple mistake of leaving a wireless switch on could give hackers a big window of criminal opportunity.
This is particularly true for wireless notebooks with operating systems such as Windows XP, which Miller said, retains the name of the network it initially connected to. The next time XP sees a network with the same name, it automatically connects to it.
Once hackers connect with a wireless laptop through a “mini” wireless network, they can collect any personal or corporate data that is in the computer, said Miller.
The Cirond chief said it is very easy to engage in this illegal activity because most access points can be guessed.
“When people buy wireless equipment for their home, they generally don’t change the default setting. They just buy a Linksys access point (for example), take it home, plug it in, and turn it on,” Miller said.
What a hacker simply needs to do is situate himself near a building, call his access point Linksys, then all the laptops inside the building with Linksys equipment will start connecting to the hacker’s deviant system, Miller said. “It’s exactly the same as a corporate network being connected to the Internet without a firewall in place.”
An even worse scenario, Miller said, is when these hacked laptops plug into the corporate Ethernet, the hacker will be authenticated into the company network.
While Miller admitted there are no known incidents of wiphishing, he said wireless security attacks are often undetected.
“There have been very few published Wi-Fi security breaches, but that is not surprising,” Miller said, adding that more often, nobody actually knows when an actual breach happens, leaving no footprints behind.
This is particularly true in the US, according to Slodichak, where US companies generally don’t report security attacks because of possible legal consequences and their intention to increase their business.
In their joint 2004 Cyber Security Report, the Computer Security Institute and the US Federal Bureau of Investigation found a substantial decrease in financial costs to corporations as a result of cyber attacks.
“We all know that is simply not possible,” Slodichak said, adding that with the number of underreported incidents of cyber attacks, he believed the financial damage on companies actually increased “dramatically”.
The increasing risks faced by wireless technology, however, are being addressed by the new IEEE 802.11x, which consists of WLAN standards, said Slodichak. This standard is currently under review and expected to be released early next year.
In the meantime, Cirond continues to caution wireless laptop users against wiphishing. As a first line of defense, Miller said, users must always turn off their wireless switch, if they can find where it is.
Related links:
Five essentials to wireless security
