Thats it. Im ripping out my wireless cards and throwing them in the garbage. I just heard the most terrible thing: According to heavily covered and overly hyped news stories, an insidious new attack method called Evil Twin will make public wireless networks terribly insecure and dangerous.
Oh, wait a second. We already know that wireless networks arent secure. In fact, weve been saying that since the networks first emerged. And there is nothing more insecure than a publicly accessible and unencrypted wireless network.
I think the recent stories about Evil Twin fit into the same category as news flashes about sharks attacking swimmers in shark-infested waters.
For those of you who missed or avoided the many Evil Twin stories, they described a potential hack that was recently disclosed by a group of researchers in the United Kingdom. These researchers found that a high-powered wireless access point could jam a legitimate public access point; the high-powered access point could then pretend to be the public access point, luring users to connect to it (thus earning the Evil Twin moniker).
By pretending to be, say, an open access point at a popular coffee joint, the Evil Twin would be able to easily log the traffic of connecting users and to steal passwords and information. (This assumes, of course, that the users and the sites they are connecting to never heard of or used encryption.)
The Evil Twin scenario is somewhat interesting but hardly newsworthy. When I read about it, I thought I might be able to get some widespread news coverage by disclosing my “new” Smooth Jerk attack. Using the Smooth Jerk method, someone could call a new hire, pretend to be “Joe” in IT and get the new hire to give up his or her password information.
I also find the Evil Twin coverage absurd because the attack being described is so unnecessarily complex. Lets see: Im a malicious guy who wants to steal information from people who are using a public wireless network. I can employ the Evil Twin tactic, which incurs expense, hassles and risk, or I can quietly sit on the network with my laptop and free downloadable tools, sniffing the connections of all the unsuspecting lambs around me. Id definitely go for the latter option (if I were a bad guy, that is).
I mean, why even bother to spoof a known public access point when people will happily connect to any open access point they can find?
During the holidays, my wife and I stayed with relatives. To connect to the Internet, I logged on to one of their neighbors open wireless networks. I dont know this neighbor, and, for all I know, he regularly logs in to shadowy sites and chat rooms with the handle 3v1ltw1n (hackerese for Evil Twin).
But I treat any access point the way I treated the neighbors. Whether Im at Starbucks or sitting in Bryant Park in New York, I connect to a VPN—before doing anything—to encrypt all my traffic.
For those of us who have been using wireless for a while now, this is standard operating procedure. But a lot of people, both home and business users, dont even know what the risks are. If these people find an open access point, their only reaction is, “Cool, I have an Internet connection!” And off they go, throwing passwords and log-ins around like confetti at a parade.
The Evil Twin stories basically remind us that, yes, fire is hot, and IT workers should use this reminder to make sure that mobile workers dont get burned.
When setting up mobile workers on laptops with wireless capabilities, make sure the users have been properly trained to use a VPN for all Internet connections on unknown networks—wireless or wired. And if you have a work force for whom training isnt always effective, you may want to invest in system management tools that will lock down connections and enforce secure communications.
Unfortunately, home users dont have an IT person to help them. And they often dont have access to a VPN, something that companies such as Apple and Intel should be providing as part of their wireless bait to attract new customers.
So, yes, sharks bite, fires burn and wireless networks arent secure—Evil Twins or no. But thanks for the reminder.
Labs Director Jim Rapoza can be reached at [email protected].
To read more Jim Rapoza, subscribe to eWEEK magazine.