Airports As Secure As 802.11b

INO_Fiend writes: "SF Gate is running a story about how at both Denver and San Jose Int'l American Airlines has been using unencrypted wireless to connect the curb check-in with the rest of their networks. They tested this by grabbing a laptop and hanging around the airport. I guess I might finally have something to do with a laptop and a WiFi card the next time I fly..."

Comments

Las Vegas airport

[Anonymous Coward]

It's not wireless, but the Las Vegas airport has these open Ethernet ports in the floor. You can walk up to them, plug in an Ethernet cable, and start prowling around the network (sniffing, going out to the Internet, etc.).

True in dallas too

[Kevinv]

I accidently connected to an AA wireless network in Dallas. This was way before 9/11. At first I thought it was a freebie for exec flyers, once i realized it was their business network i disconnected.

they had a dhcp server that assigned ip/dns to anyone that connected.

didn't even think about it again until i read this article.

Re:Great idea...

[ImaLamer]

This is cock and bull.

First we are talking about a network related to airport security. If you argue with the Flight Crew you can be arrested by the FAA... this is pre-sept 11th.

The open door thing? We aren't testing products or networks transmitting misc traffic. If you leave your door open you're stupid, but coming inside is still illegal. If somoene looks into your front door... that is legal. Cops can do this to provide a weak search.

Being that the reporters haven't been arrested, we know that it's ok to walk into the 'port and see if you can get on the network. But! when you start using that network to browse the web, or shift data to make it look like you are boarding the plane with your bomb....

I mean, if you are going to use someone else's argument... know what it is. The argument you are trying to use is about port scanning and the like, not abusing the private network of an airline. Last time I checked that was 100% illegal.

If I dial into Microsoft that's ok. If I connect and download the source to XP... thats' not. Even if I just want to use them as an ISP, it's illegal.

Just because you left the door open doesn't mean you invited the neighborhood in.

My experience

[Anonymous Coward]

Sorry, I am posting anonymous.

The airline that I worked at (until just after 9/11) had a similar setup. An average sized hub airport probably has roughly 1700 things with an IP address. To help out, I used a machine with arpwatch to help keep track of what was running and to monitor changes. About 5-15 times a week, I saw non airport workstation names and mac addresses of nic's that we did not have. Luckily we did not have anything with a DHCP server running or everyone of these computers would have fit right in. We had coverage at every ticketing area and every gate, not hard to get a good signal.
My purpose is not network security, only an installer and maintainer of the network and systems, so I made note of our insecure wireless network to our networking group and got nothing back. When I had left about a year after bringing this up, nothing had changed. With so many levels of IT support and groups of people protecting their specialized interests at the company, it was nearly impossible to find someone that could step back and look at more then what they were currently responsible for. I guess we needed a "wireless network security" position before anyone would care to address this.
I don't know what you would do once on the network. Sure you could sniff around but I doubt you would get anything useful from the scheduling and ticketing part of the traffic.

I am working for airport Check in IT branch

[aepervius]

It is a big firm in Europa. AFAIK we do not use the above mentionend standard but we use another standard for baggage check in and baggage follow up. The system is so complex that even *us* the programmer have sometimes difficulty with it. The hic is the following : would it be worth for a terrorist to learn the system when they can get it easier to fake the control band of the baggage with the so called "bag tag" (simple paper a serial number and a code bar) or have an insider in the baggage loading worker team. On the other hand 6 monthes ago I would have said "terrorist learning to fly a plane to pill it into a building ? Unprobable. They could do things in a far easier way than such a long term plan.". So maybe we have to starts worry...

Unencrypted and secure

[LinuxHam]

Drexel University does a great job of securing their otherwise unencrypted wireless traffic with a VPN.