Reis Barrie
Research Paper
CNT4514
Wireless Vulnerabilities

The world of wireless networks as we all know is one of the most rapidly growing areas in our world today. With the massive amount of data that is going on, “the cloud” the security of all of our data is questioned. As well with so many of our day to day tasks relying on our wireless capabilities it make you wonder how safe is it to rely so heavily on something. We have to ask the questions what are the key vulnerabilities of wireless networks and even just of networks in general. Different types of networks have different levels of safety and it is a good idea to know not only which are safe but the vulnerabilities of said networks to keep our information out of the wrong hands and keep our day to day life moving as smoothly as possible. Unlike wired LANs the wireless LAN users are not restricted to the physical area of a wired system. While this may feel beneficial to the user it is also very beneficial to sniffing and eavesdroppers who are listening to the radio waves that are broadcasted through the air. Intercepting these packets they can pick up messages that may contain sensitive information. Seeing how the range of a wireless LAN can extend beyond the building the eavesdroppers don’t even need to be inside the building. A simple thing you can do is open up your wireless adapter on your computer and see how many open wireless networks are around you. From my house I currently have 4 open wireless networks that I can connect to and if I had the correct skill set could be intercepting messages being transmitted over the wireless LAN. As well using a program such as insider Home you can see how many time someone has tried to connect to your network and attempted to join your network to possibly try to obtain sensitive information. As another example while I was visiting my parents in late March I decided to do a little test. I walked through the mall with my phone to see just how many open networks I could find from the stores around me. I was shocked to see that the mall which is fairly small and consisted of over 100 stores I stopped counting when I got to 42 open networks, as well for the stores with a closed network I tried the name of the store and I connected to 6 stores with a closed network simply by trying 1 time to break the password. Now all of these stores are in serious danger someone with the right skill set and a bad motive. All of the stores have the very real potential to have sensitive data breached and let loose into the wrong hands. Moving on, denial of service attacks or DDoS attacks are increasingly popular and for me the type of harassment that I have seen the most and have the most experience with. The denial of service attacks at the most basic definition flood your IP with so much “noise” that the legitimate packets can’t reach the final destination. Now the thing about this attack is that the attack does not need access to your wireless LAN, it can be done simply with an IP address. The DDOS attack effectively shut down the wireless network until the attacker stops the attack. Now it is good to note that not all interference is from attacks just because your service slows down, it could be from many other household things such as a 2.4 GHz cordless phone or a microwave. DDoS can attack many different things, for instance if a website is DDoS’ed then it won’t load for people that are wishing to look at the site. If you are to DDoS a network itself it can cause bandwidth saturation to the point that the network in unusable and it causes and outage. You can DDoS a server that is hosting something say, an online video game server could be DDoS’ed and the game would not be accessible until the attacker stopped. Recently DDoS attacks have been very popular because of how easy they are to execute and many companies have been the victim of these attacks. Late 2014 we saw many DDoS attacks that effected many people on a large scale scene, where normally these attacks would go untold last year a group decide to DDoS PlayStation networks causing the PlayStation online network to go off and on for about a week straight. As well as PlayStation we the same group hit another gaming community named Blizzard and launched many DDoS attacks taking down their online gaming servers for hours at a time over the period of a few days. The group that took responsibility was called LizardSquad, they have also been known to target a website called KrebsonSecurity[dot]com. On KrebsonSecurty they have proof of people from the LizardSquad organization trying to find new “hackers” which is a debatable term for someone that DDoS’s considering DDoS’ing requires virtually no skill, and asking for them applicants to take down one of two sites. If they could accomplish this task then they could join the LizardSquad group of “hackers” or as KrebsonSecurity calls them, “a gaggle of young misfits that has long tried to silence this web site.” Another example of DDoS is a more drastic when the hacktivist anonymous used DDoS attacks in 2006 and 2007 to cost Hal Turner and his radio show that some considered to be politically incorrect thousands of dollars in bandwidth bills that his radio show eventually went under. Hal Turner eventually attempted to sue the hacking group but the suit was soon dropped by the courts. Another growing section of wireless technologies is Bluetooth. Every day a new Bluetooth device is released, these devices are security nightmares for the most part. Bluetooth has been proves to have significant security vulnerabilities that include, “unauthorized access, information disclosure, remote eavesdropping, device manipulation and full compromise” according to the SANS technology institute. As well they add saying, “While many organizations disregard Bluetooth threats, thinking the technology is limited to short-range communication, the reality is that tests have shown it is possible for an attacker to communicate to a short-range Bluetooth device from over a mile away!” Now this means that a potential threat can easily upload malware to a phone that then sends all sorts of sensitive information such as contacts, calendar information, or note files. Adding to that Bluetooth networks are an ad-hoc network meaning that you generally don’t notices the amount of Bluetooth activity taking place. Rogue access points, what are they? Well a rogue access point is exactly what it sounds like, a malicious individual attempting to gain access to a network creates an access point that adopts the SSID of another network in order to attempt to gain access to that network by making the network believe that it is a legitimate part of the network. From the Cisco Press website which is a network related news site they said, “In August 2001, Gartner Group reported that at least 20 percent of enterprises already have rogue WLANs attached to their corporate networks from authorized network users. Thus, risk-adverse organizations that consciously decide to delay WLAN deployment because of the security risks need to monitor their airspace to ensure that rogue WLANs do not inadvertently open a door for intruders.” By installing an unauthorized access point you greatly increase the opportunity for a hacker to gain much easier access to your company’s personal files or for that matter anything else connected to the company’s network. One of the main defense against this is properly configuring the networks client system, it is extremely important to change all the default settings. For example, I know from experience that the default login for a router is usually admin/admin and using this I can gain access to all of the router settings including changing the login information. If these are left unchanged, they are very well known and very exploitable by hackers. It is also a good idea to change the password often and actively monitor the settings to see if something has changed because of a possible breech. As well using an 802.1x authentication system is important it is very difficult to get rogue access points through the 802.1x authentication. In conclusion we can see that while the work of wireless technologies is massively growing as well is the opportunity for cyber criminals to become more effective at taking sensitive information from innocent people. People need to take it upon themselves to either understand the way their systems work and how to properly secure them, or find someone(maybe someone from this class in the future) to help them setup a secure network in order to conduct their business on as safe as possible. The more we move into this wireless age the more danger that will always be around the corner, which just means the more we need to as a community understand our technology and not put ourselves or our companies in a vulnerable situation.

References
"Denial of Service Attacks." DoS or DDoS Attacks: What's the Difference? N.p., n.d. Web. 1 Apr. 2015.

Singhal, Sandeep. "Top 10 Vulnerabilities in Today's Wi-Fi Networks." Computerworld. N.p., 15 July 2002. Web. 1 Apr. 2015.

Thomas, Thomas M. "Wireless Security." Wireless Threats. Cisco Press, 27 June 2013. Web. 12 Apr. 2015.

Wright, Joshua. "Security Laboratory." Five Wireless Threats You May Not Know. N.p., n.d. Web. 3 Apr. 2015.