Brute force tools crack Wi-Fi security in hours, millions of wireless routers vulnerable

computerworld.com

If you set WPA/WPA2 security protocol on your home or small business wireless router, and you think your Wi-Fi is secure, there two recently released brute force tools that attackers may use to bypass your encryption and burst your security bubble. The irony is that the vulnerability which can be exploited was intended to be a security strength, a usability issue to help the technically clueless setup encryption on their wireless networks. Wi-Fi Protected Setup (WPS) is enabled by default on most major brands of wireless routers including Belkin, Buffalo, D-Link, Cisco's Linksys and Netgear, leaving millions of wireless routers around the world vulnerable to brute force attacks which can crack the Wi-Fi router's security in two to ten hours.

Most wireless routers come with a WPS personal identification number (PIN) printed on the device. When a user is setting up a wireless home network via a network setup wizard, enabling encryption is often as easy as pushing a button on the router and then entering the eight digit PIN which came with it. When an attacker is attempting to brute force the PIN and an incorrect value was entered, a message is sent that basically tells an attacker if the first half of the PIN was right or not. Additionally, according to Stefan Viehbock, the security researcher who reported the flaw, "The 8th digit of the PIN is always the checksum of digit one to digit seven," meaning it only takes an attacker about 11,000 brute force guesses to own the password. Unfortunately most wireless routers don't have a lockout policy after several failed password attempts.

More...

Feds: Trio hacked Wi-Fi or burglarized 50 firms

Seattletimes.nwsource.com

Seattle police detectives say they've unraveled a theft ring that operated both in cyberspace and through old-fashioned burglaries with a technological twist — breaking into a company with the sole purpose of installing malicious software to enable future thefts.

It took nearly three years, but Seattle police detectives say they've unraveled a theft ring that operated both in cyberspace and through old-fashioned burglaries with a technological twist — breaking into a company with the sole purpose of installing malicious software to enable future thefts.

Federal prosecutors have indicted three men — Joshua Allen Witt, 34; Brad Eugene Lowe, 36; and John Earl Griffin, 36 — on charges of conspiracy and eight other counts including accessing a protected computer to further fraud, access device fraud and aggravated identity theft.

The 20-page indictment lays out a scheme that U.S. Attorney Jenny Durkan on Wednesday said was "both sophisticated and rudimentary," and combined high technology with broken glass and jimmied locks.

The trio is accused of targeting at least 53 companies, with losses expected to mount into the hundreds of thousands of dollars.

"In some cases, the victims were both burgled and cyber-burgled," Durkan said at a news conference.

The indictment accused the men of "wardriving" — cruising in a vehicle outfitted with a powerful Wi-Fi receiver to detect business wireless networks. They then would hack into the company's network from outside, cracking the security code and accessing company computers and information.

More...

Flying Drone Can Crack Wi-Fi Networks, Snoop On Cell Phones

forbes.com

How do one ex-Air Force official and one former airplane hobby shop owner, both of whom happen to have decades of experience as network security contractors for the military, spend their weekends? Building a flying, unmanned, automated password-cracking, Wi-Fi-sniffing, cell-phone eavesdropping spy drone, of course.

At the Black Hat and Defcon security conferences in Las Vegas next week, Mike Tassey and Richard Perkins plan to show the crowd of hackers a year’s worth of progress on their Wireless Aerial Surveillace Platform, or WASP, the second year Tassey and Perkins have displayed the 14-pound, six-foot long, six-foot wingspan unmanned aerial vehicle. The WASP, built from a retired Army target drone converted from a gasoline engine to electric batteries, is equipped with an HD camera, a cigarette-pack sized on-board Linux computer packed with network-hacking tools including the BackTrack testing toolset and a custom-built 340 million word dictionary for brute-force guessing of passwords, and eleven antennae.

More...

Woman allergic to electricity, "electromagnetic sensitivity"

telegraph.co.uk

A British woman cannot use an electric kettle, keeps her washing machine in a concrete outhouse and cannot have neighbours with wireless internet because she is allergic to electricity.

Janice Tunnicliffe spends every night playing Scrabble by candlelight with her husband because she claims to have a rare condition called electrosensitivity.

She cannot bear to be anywhere near electromagnetic fields of any kind and, as a result, she cannot watch television, listen to the radio or talk on a mobile phone and has been left completely isolated from the modern world by her condition.

Mrs Tunnicliffe, 55, was struck down with the illness after receiving chemotherapy for bowel cancer three years ago.

Since then she has suffered constant headaches, chest pains, nausea and tingling in her arms and legs whenever she is near electrical devices or items that emit a signal.

Her only relief in this time was when her village, near Mansfield in rural Nottinghamshire, suffered a temporary power cut.

More...

Five tips for protecting mobile devices

techrepublic.com
Attacks against information assets — government, corporate, and personal — have been going on for some time. Yet many users and organizations have blatantly ignored recommendations for protecting mobile devices, exposing themselves, their businesses, their customers, and often employees to harm. These devices in the hands of mobile workers are exposed to a variety of threats:

• Hotel wired networks are often wide open to eavesdropping by cybercriminals or other guests. Jacking into a network frequently equates to sending and receiving information over a single collision domain. This means all packets for a set of rooms, a floor, several floors, or even the entire hotel/motel are seen by all other systems on the network. Unprotected packets are prime targets for capture, analysis, and data extraction.
• Connecting to unencrypted hotel or other public wireless networks, sending sensitive information out into the ether, is a well-known problem. I won’t beat it to death.
• Improper configuration of firewalls or the total lack of an end-user device security perimeter, allows anyone, anytime, and anywhere to use public networks to peruse private information on laptops, smartphones, or PDAs.
• Some unencrypted stolen or lost devices are a treasure chest of information, including passwords, customer and employee information, and user identity data. In large, chaotic venues, it isn’t difficult to lose a laptop or PDA.

This is not a complete list of potential attack vectors, but proper attention to those four issues reduces risk to a reasonable and appropriate level. The following steps are a good start in preventing information or system compromise.

More...

Anti-spy Window Film to Reduce Electronic Eavesdropping

yourfirstserver.com
In the last 5 years there has been a significant increase in the popularity of wireless (Wi-Fi) networks. People can now access the Internet in the most unlikely of places: in bars, on the street or even in public parks. This increase in Wi-Fi usage has also been seen in many businesses, where employees regularly access the Internet away from their desks. But whilst the rise in popularity of wireless networks has brought with it many advantages, they continue to pose a number of significant security risks.

Additionally, with the widespread use of mobile phones, the airwaves are becoming increasingly congested. More powerful frequencies are being used and problems caused by E.M.I (Electro-Magnetic Interference) are becoming all the more prevalent.

More...

Google's Wi-Fi Spying: What Were They Thinking?

pcworld.com
"Don't be evil" has gone all 1984 on us. Or so it seems after Google revealed Friday that its Street View cars, in addition to snapping photos of the world's roadways, have also been collecting sensitive personal information from unencrypted wireless networks.

It was no secret that Google's cars had already been collecting publicly broadcast SSID information (Wi-Fi network names) and MAC addresses (unique numbers for devices like Wi-Fi routers). But this techie data, which is used for location-based services such as Google Maps, didn't include any "payload data," or personal information sent over the network.

Or so "Big Brother" Google claimed on April 27. But yesterday the search behemoth 'fessed up to a security gaffe of Orwellian proportions. Due to a piece of code written in 2006 by an engineer for an experimental Wi-Fi project, Google had in fact been collecting those private bits after all.

More...