Slashdot Mirror
CNN Notices that WiFi is Insecure
josh3736 writes "From CNN comes an article that makes painstakingly obvious to the public what we already knew: 802.11 security is horrible. The article points out that nearly 40% of wireless network APs haven't even been changed from defaults and as many as 80% of home APs have encryption disabled. The article goes on to say that '[t]o make matters worse, users who don't secure their networks are often the very people who don't keep their computers up to date with the latest security patches and antivirus software.' It also accuses WiFi manufacturers of disabling security measures by default to make wireless easy to the lowest common denominator. My favorite quote? 'Experts say that while Wi-Fi hardware makers have made initial setup easy, the enabling of security is anything but. Meanwhile, average users are no longer tech savvy.' Which is to say that they at one point were?"
One major flaw I see in telling people to enable WEP on their WiFi is the first question I'm sure to get back is "How do I do that?" and, well, the instructions for doing that are different for each and every item on their network.
What's more annoying is that people think the "passphrase" they type into their router a the WiFi key rather than what it usually really is, the random seed from which their router generates the actual keys. They type their passphrase into their other devices when they're supposed to type a key value, and then they wonder why it doesn't work anymore when it was working just fine before they tried this security stuff.
I've had friends who I thought were tech savvy get tripped up over this stuff. I blame the router-makers for not providing software that makes this a whole lot more of a user-friendly experience. We as the IT industry are badly failing at this... and having a lot of open WiFi points will just make our other headaches such as spam and viruses worse in the end. This really needs to be addressed for the good of the Internet.
...I kept my Linksys WAP11 box wide open until one day I sat down at my computer to see that some fellow using the machine name "god" had joined the network and sent me a NetBIOS "net send" message. Ho ho, how clever.
Sigh... OK, fun time's over, no more sharing, hook up USB cable, generate hex key, etc. Kind of depressing.
The Army reading list
Not only do WiFi equipment manufacturers disable most of the security by default. Some blame any connectivity issues you are having on the encryption (see How stable is WEP).
Personally, I would love to see some more options when it comes to turning WEP on. Since my laptop connects in both a wired and wireless manner to my network, it would be great is some software generated a new WEP key to use each time I went wired. I see no reason that the end user would need to be involved, any weakess on the part of the pseudo-random generation of a new WEP key would be less insecure than having the same one for months on end.
paul reinheimer
The very reason that Wi-Fi networks exist is that they provide simple, easy-to-use network connectivity wherever you are. Security takes a backseat to ease of use. The equipment manufacturers don't want to have to deal with the support calls if they would enable security features, such as WEP, out of the box. Adding security to Wi-Fi networks makes them harder to use and less appealing to the average consumer. Thus, it's easier for manufacturers if consumers remain blissfully unaware of the huge backdoors into their networks. But then again, anonymous internet access from my neighbor isn't that bad.
users who don't secure their networks are often the very people who don't keep their computers up to date with the latest security patches and antivirus software
I wonder if this would be a new, easy way for people to start a new worm/virus infection. Wardrive down the street, map a few hundred potential victims, and come back later and put the bugger in the "Startup" menu on Windows PCs. Ack.
Once the 'puter became a household appliance instead of a hacker's toy, that's when things started to go downhill.
Yeah, right.
... has the not surprising statistic that 90% of home users DONT GIVE A FLYING FUCK if the family PC (which they consider no more than an expensive Nintendo/source of free music) is hacked.
I don't need no instructions to know how to rock!!!!
The WAP I'm using is in out-of-the-box factory default insecure mode.
I really wish I knew which of my neighbors owns it.
-JDF
He said, "As long as I live in this city, I'll never pay for Internet again." We'll see if that remains true when consumers with wireless routers wise up and turn on some of the security features.
--Residential Interior Design
I have intentionally left WEP off on my AP at home. I use ssh or https for anything sensitive, but I want my visitors to be able to connect via my home
network without sophisticated configuration on their side (and of course, without telling them my WEP password).
My home network is connected via Linux firewall, so I can cut the access or install traffic shaping when the problem occurs.
-Yenya
--
While Linux is larger than Emacs, at least Linux has the excuse that it has to be. --Linus
The problem is not the product, but the consumers. Now, I might be wrong about this, but I am willing to bet that all access points, WNIC's and other accessories come with something called a "manual"! If you were to actually *read* one of those, by accident or intent, you might discover how to acutally use your newly accuired product! Only thing is that people don't bother anymore... They expect everything to be so userfriendly that it will install itself and automatically know how you want the settings to be!! Maybe they could put little warnings on the packs like with ciggaretts.. "warning, the DOJ says that not properly securing your accesspoint can be hazardous to your privacy bank account, and or bandwith".. Heh
If cheap-o consumer routers getting 0wned thanks to pathetic Wi-Fi security seems bad, consider this: at least one vendor of e-voting systems depends on WEP as the only security measure between their voting machines and the ballot-counting system.
Yes, that's right -- ballots are passed wirelessly, and only protected via standard 802.11 WEP. How long until someone tries to 0wn a polling place? Or, worse, just sniffs the ballots out of the air and dumps them to a log file (so much for the secret ballot), say?
I wrote the article linked to above when the systems were being evaluated in Fairfax County, Virginia -- a wealthy and populous suburb of Washington, DC -- but they've since been approved by the county board of elections and used in two elections to date. Who knows how many other local governments have bought into similar systems?
Read my blog.
My upstairs neighbor (apt. building) has an unencrypted Wireless Linksys router hooked up to his Broadband connection. If I wasn't hosting my domain's e-mail from one of my home machines, I would have cancelled my broadband a long time ago.
You're joking. C'mon, I mean... like, no way. It all makes sense now... if CNN is this far behind on technology, which moves pretty fast, then they are probably a good 25-30 years behind on their political reporting and viewpoints.
Damn hippies.
-- Liberalism is a mental disorder.
Couple of years ago when 802.11b was kinda new, i did some testing of this sort of thing.
The fast crack using weak frames worked then. It doesn't work much now, if the boxes are using newer hardware.
The slow crack where you get enough packets to figure out the key worked then and now, but in order to actually do it back then I had to set up some continous traffic to get enough packets to make it work. We're talking millions of packets here, and it just takes forever to see enough to do it, with 112/128 bit WEP.
Can they get in? Sure.
Will they get in? They're going to have to really want in pretty badly or live nearby and be bored enough to capture for a long period of time. And if they just want free network access, they'll find the easier target like the unsecured one down the street. Or pay the 3 bucks at the nearest hotspot for the hours worth of access.
WEP is not secure, but in 99% of cases, it's secure *enough*.
- Give a man a fire and he's warm for a day, but set him on fire and he's warm for the rest of his life.
Which is to say that they at one point were?
The average computer user in 1970 could probably figure out how to turn on WEP, were he/she transported to the present day. This is the same thing that happened with automobiles. In the early days, automobile owners had to be adept at mechanical repairs. If you read "The Grapes of Wrath" , at one point one of the characters is honing the valve seats on his truck in a campground. That was the 30's. By 1960 you'd be hard pressed to find a car owner that could do a valve job on his car. Computers have become a commodity item, just as cars did.
If a job's not worth doing, it's not worth doing right.
Rudeboy1, there is just one problem with this snotty "it's not our product that's crap, it's those idiot users" attitude that's plaguing the industry.
The problem is that those "idiots" are paying your salary. In fact, if the industry remained an exclusive club where only the High Priests of The Sun (or IBM) have access to the Sacred Computer Room, your employer likely wouldn't even be in business. We'd still not need much more than whatever proprietary peripherals are officially blessed by the computer's manufacturer.
The growth of the whole computer industry was done precisely by promising ease of use to idiots. The fact that you can sell hundreds of thousands of cards, and not just hundreds, is precisely _because_ you're selling stuff to those idiots. Under the explicit promise that it'll be secure enough and easy to use.
And I'd like to see the people in this industry actually keeping their promises for a change. Because what everyone, including your employer, is doing is _fraud_. They're making some very explicit promises to get those people's money, but have no intention of respecting those promises.
You know what's the only difference between the computer industry nowadays and the snake oil peddlers of the old days? The snake oil charlatans knew that they're frauds. They didn't feel a need to call their victims "idiots" and other insulting names. That's all.
In a sense, the snake oil con artists were actually more honest. And a lot less snotty.
Just something to keep in mind the next time you feel a need to insult the user for your product's shortcomings.
A polar bear is a cartesian bear after a coordinate transform.
I run an open access point and my neighbor does as well. Anything (and I mean anything) more than computer games and unimportant chat sessions I tunnel through ssh/ssl or something similar.
/. aren't in favor of open access points. They seem to fit very well into the whole 'information should be free' value system that many geeks have.
Why do I leave my access point open then? Because on average I only use maybe 3% of my bandwidth and I don't see any reason that one of my neighbors shouldn't be allowed to use some of it when I don't need it. When I first moved in and didn't have my own broadband yet I was very happy one of my neighbors left his router unsecured.
I'm actually quite suprised that more people on
It is hard to break WEP. Even though attacks are theoretically possible, my experience is that it takes too long to collect enough packets. I let AirSnort run for most of a day. It collected nothing. On a low traffic home network, WEP is quite good.
I really do not know the details of attacking WEP, so maybe there are fast cracking approaches. Writing as someone who uses WEP and casually tried to break WEP, WEP provides a high barrier to network infiltration. A stranger would have to make a lengthy effort to do it.
Look, the Internet is not a secured network - not just WiFi but in general. Let's keep it that way.
I'm glad it doesn't take a license to make a telephone call or use the Internet, even though somewhere, some terrorist is making phone calls. Trying to turn the Internet into some little closed system would be cutting off your nose to spite your face.
As for WiFi security, it's funny how we're still getting this endless deluge of "OH NO! WIFI IS INSECURE!!!" alarmists. The reason people don't care is because it doesn't matter very much. There just aren't many good horror stories about somebody's life getting ruined because their wireless network was compromised.