[ISN] A latte, a Wi-Fi link and a hacker

From: InfoSec News (isn@private)
Date: Tue Nov 25 2003 - 23:45:32 PST

  • Next message: InfoSec News: "[ISN] Scripting flaws pose severe risk for IE users"

    http://www.computerworld.com/securitytopics/security/story/0,10801,87523,00.html
    
    Story by Andrew Brandt
    NOVEMBER 25, 2003 
    PC WORLD
    
    If you have ever connected to the Internet through a wireless hot spot
    at a Starbucks, McDonald's or other business, you know how convenient
    it can be. Unfortunately, the setup is convenient for other people,
    too -- hackers intent on stealing your log-in information for their
    own use.
    
    At most businesses that offer wireless access, connecting is as simple
    as setting up an account and choosing how you'll be billed (either on
    a pay-as-you-go basis or at a flat rate for unlimited access). Then
    you sign in with the user name and password that you set up in
    advance.
    
    But a group of clever independent security analysts has created a
    program that makes it easy for a hacker to slurp up your log-in
    information before you've even quaffed the foam on your cappuccino.  
    The miscreant can then use the information to obtain free wireless
    Internet access and make you foot the bill.
    
    The new tool, called Airsnarf, broadcasts a powerful signal that
    disconnects any nearby hot spot users from the Internet. Then it
    broadcasts a sign-in page that looks like the log-in site of the
    legitimate Wi-Fi provider. When users, figuring they were knocked off
    the Internet momentarily, log in again, their user name and password
    go to the hackers, not the ISP.
    
    The Airsnarf program could be running on the laptop -- or even the PDA
    -- of the person sitting next to you. With the right antennas,
    crackers intent on stealing passwords wouldn't even need to get out of
    their cars. All they'd have to do is park in front of the cafe, sit
    for a while running Airsnarf and then move on.
    
    The program was never intended to be used as a tool for theft,
    according to its creators, members of a loosely affiliated group of
    computer security experts who call themselves the Shmoo Group.  
    "Airsnarf was developed and released to demonstrate an inherent
    vulnerability of public 802.11b hot spots," the group writes on its
    Web site.
    
    Spokespeople for two of the largest wireless access providers,
    T-Mobile (the provider for Starbucks) and Wayport (which serves many
    airports across the U.S.), say they don't know of any subscribers
    whose log-in information was stolen this way and don't anticipate the
    problem being widespread enough to warrant major changes to the way
    they run their services. Both say that if you notice odd usage
    patterns in your account, you should report them to your provider's
    customer service department, which will issue credits for stolen
    service. But can a hacker use your log-in information to get at more
    sensitive personal data? Both companies say no. Though you may use the
    same user name and password to connect to the Internet and to manage
    your account online, the ISPs report that credit card numbers and
    other sensitive data are hidden from view when you log in to your
    account information.
    
    If you use a wireless hot spot, the best defense against this kind of
    service theft is to change your password regularly -- at least once a
    month. And keep close tabs on your monthly bill, even if you're on a
    flat-rate plan; you may not be losing money, but you still shouldn't
    let crime pay for data thieves, who might be using your wireless
    account for other nefarious purposes.
    
    
    Andrew Brandt is senior associate editor for PC World. E-mail him at
    privacywatch@private Click here to read more Privacy Watch
    columns.
    
    
    
    -
    ISN is currently hosted by Attrition.org
    
    To unsubscribe email majordomo@private with 'unsubscribe isn'
    in the BODY of the mail.
    



    This archive was generated by hypermail 2b30 : Wed Nov 26 2003 - 02:07:49 PST