Network Signals Just Scream to Be Exploited

Source: Security Focus

Organizations ignore the security risks of wireless networking at their peril.

I recently strolled past federal buildings along Connecticut Avenue in Washington, carrying a beta-test model of a tablet PC equipped with an integrated IEEE 802.11b wireless PC Card.

In no time, it auto-detected a wireless network. The tablet asked me if I wanted to connect. I declined, but as I kept walking, the tablet detected signals for three more wireless networks. (Apparently, the Secret Service is curious about these free-ranging signals, too, and has sent teams around Washington snooping for wireless networks that broadcast signals onto the street.)

I did no probing, so I don't know whether the signals my tablet PC detected came from government, corporate or home networks. Nevertheless, they're out there, just waiting for someone to exploit them.

If a wireless connection extends beyond a network's firewall, or if no firewall exists, any passerby with a wireless notebook PC can tap the network's resources. Even if the network is protected, the passerby might manage to get Internet access.

Say, for example, that the wireless network assigns the intruder a numerical Internet address, as many wireless networks routinely do. That makes a great starting point for hacking. The numerical, or Internet protocol, address lets the intruder guess at the range of IP addresses, which could lead to probing and denial-of-service attacks. Furthermore, passersby who have modern operating systems such as Microsoft's Windows XP can learn the names of the network servers. The GCN Lab found this out during a recent review of XP Service Pack 1. We couldn't connect to the servers, but we could see them.