AirSnort Programmers with Way to 'Sniff' of Network Information

If you're running a wireless computer network in your office or home using one of the more common technologies for this purpose, two St. Cloud computer programmers have potentially disquieting news: The information you're zapping back and forth through the ether may be much less private than you think.

The pair of computer-security experts have set the wireless-networking world on its ear with AirSnort, a program that lets anyone with even modest know-how "sniff" network data and ultimately breach a security barrier meant to keep the information private....

Programmers with Way to 'Sniff' of Network Information

: By Julio Ojeda-Zapata

This has profound implications for corporations, airports, hospitals, schools, coffee shops and others that have networked two or more computers using the increasingly popular 802.11b wireless technology, also known as Wi-Fi.

The bottom line for Wi-Fi users: Security features built into 802.11b may be next to useless if someone with enough determination tries to "crack" the networks.

Unless additional precautions are taken, "data flying through the air (essentially consists of) plain text" that anyone can read with a little effort, says Jeremy Bruestle, head of the St. Cloud-based Cypher42 computer-security consulting firm.

Wi-Fi networks incorporate WEP -- short for Wired-Equivalent Privacy -- a form of data encryption that wireless-network users have long assumed would scramble their confidential information so that no one could access and potentially misuse it.

But experts have recently shown Wi-Fi to be "crippled with numerous security flaws," Bruestle said.

"Most damning of these," he said, is a weakness recently exposed by a team of researchers in California and Israel. This flaw in WEP encryption means malicious hackers can potentially eavesdrop on a wireless network and, given time, breach it.

AirSnort, developed earlier this month, is based on a paper the researchers published on the Internet. Bruestle and Blake Hegerle, an independent St. Cloud programmer, said they assembled AirSnort to make wireless-network administrators keenly aware of a security problem they may have chosen to ignore.

"They need to know they can't trust just WEP to secure data," he said.

At hospitals, for instance, "patient information needs to remain safe," he said. "If hospitals are trusting bad technology to keep that information safe, a lot of people could be harmed by that."

Additional layers of security, such as Virtual Private Networks or VPNs, can be added with relative ease to bolster wireless networks, said Bruestle, but many network administrators haven't bothered to do so.

Home users of wireless networks, including those that incorporate Apple Computer's Wi-Fi-based AirPort products, have less cause for concern if they are simply browsing the Web or even making online purchases, Bruestle said. Such electronic transactions typically involve encryption separate from WEP, which means they're probably safe from prying eyes, he said.

Bruestle and Hegerle acknowledged that "black hat" hackers could potentially misuse AirSnort, but they said releasing the program was necessary to show that the computer industry "has been overstating (Wi-Fi's) security capabilities."

SNP.