A new study published by researchers at RSA Security finds that as the number of wireless networks located in some of the worlds largest cities is growing, so is the number of those systems protected by encryption or other IT defenses.
While in years past researchers found that businesses and consumers were often setting up wireless networks without thoroughly applying security measures, RSA said its most recent tests found that many people are taking additional steps to make sure that their systems are protected from unauthorized use and so-called war-driving attacks.
Authentication and encryption specialist RSA, with help from an independent research firm, gathered its information by engaging in war-driving in cities such as London, New York and Paris.
The process involves moving around the city in a vehicle while searching for wireless hotspots on a laptop, and then trying to break into the systems to determine whether they are defended.
Criminals are known to engage in the scheme to gain access to unprotected corporate or home networks where they can infiltrate user devices or carry out attacks using the unmonitored Internet connections.
In addition to testing security, RSA also tracked the number of wireless networks it could find on its war-driving missions. According to the study, the largest yearly increase in hotspots was found in London, where the company detected 57 percent more wireless access points than found by RSAs similar study in 2005. New York now has 20 percent more wireless networks than it had in 2005.
RSA did not provide year-over-year results for Paris, as it did not test there in 2005, but the company said that since 2004 the city has seen the number of wireless systems grow by an impressive 119 percent.
Paris also claimed a leadership spot in the percentage of wireless access points protected by WEP (Wired Equivalent Privacy) security settings, the technology most often included by networking gear makers as a default defense mechanism in their products. Roughly 78 percent of all WLAN (wireless LAN) and Wi-Fi systems found by RSA in Paris were encrypted with WEP, compared to only 69 percent of the systems RSA located in the city in 2004.
In London, RSA found that WEP usage increased to 74 percent of all networks in 2006, up from 65 percent in 2005, while 75 percent of networks found in New York use WEP defenses, up from 62 percent in 2005.
Despite the improvement in the volume of protected systems, RSA indicated that the large number of unencrypted networks remains a troubling situation for all IT users. Malicious parties who gain access to such networks can use them for everything from breaking into the data stores of the computers they are connected to, to using them to deliver malware code to other systems, or to distribute illegal materials such as child pornography.
Another security issue still present in many wireless hotspots is the use of the systems default network settings, which can make it easier for outsiders to infiltrate the access points, RSA said. In London, 22 percent of all the WLANs the company detected were still using their default settings, an improvement on 2005s figure of 26 percent.
In New York, some 28 percent of all wireless networks used the default settings, compared to 30 percent last year, while Paris led the way again with only 21 percent set to default, compared to 39 percent in 2004.
Researchers said they were encouraged to see the proportion of protected wireless networks increasing even as the systems take off, and warned that firms with unprotected wireless access points will eventually pay the price.
“While the halting of what appeared to be a downward spiral is good news, we should not forget that around a quarter of business networks in these cities remain open to attack,” Tim Pickard, vice president of international marketing at RSA Security, based in Bedford, Mass., said in the report. “Such companies risk the theft of confidential and sensitive data, planting of malicious code such as viruses and back-door Trojans, and potentially allowing their systems to be used as a launch pad for denial-of-service attacks and other security breaches; wireless security may have been bolstered, but we cant relax yet.”
RSA also highlighted the growing popularity of so-called rogue hotspots, or temporary wireless access points designed to look like legitimate networks in order to lure users and steal their data for purposes of identity theft.
For example, researchers at IT consultancy Capgemini UK, based in Surrey, England, built a rogue hotspot to see if outsiders could tell the difference between it and genuine access points. Company officials said a significant number of devices attempted to connect to the illegitimate network.
“Rogue hotspots currently constitute one of the most serious and most likely vehicles for wireless security breaches—they are easy to set up and an attacker is almost guaranteed a valuable crop of data in a short period of time,” said Phil Cracknell, a security consultant at Capgemini UK. “For this reason, they could be used as the next platform for phishing attacks and identity theft. In order to prevent this, all mobile users—either business or personal—need to be educated about the potential risk from rogue hotspots and taught not to send confidential user names, passwords and personal information over unencrypted networks.”
