Robert Siciliano
Online Security and Safety Evangelist to McAfee Robert is an identity theft expert who is committed to ...
The ability to connect wirelessly has a lot to do with the indispensability of the Internet in our daily lives. Wireless Internet is available in our homes, offices, cafes, restaurants, parks, hotels, airports, cars, and even airplanes. The mobility factor allows us to work anytime, anywhere, on numerous devices. “Being connected” is at an all-time high.
Wireless Internet is amazing. But is it safe?
The short answer is: no. Wi-Fi was born to be convenient, not secure. Unsecured, unprotected wireless is everywhere. When a device connects to unprotected Wi-Fi, all the data stored on that device is available to a hacker with the proper sniffing tools.
The longer answer is: it depends on what kind of wireless we’re talking about. I’m going to speak in generalizations, since most of this is debatable and at this point, there are no absolutes when it comes to wireless security. So here we go.
Free, unsecured Wi-Fi is the least secure. Any Wi-Fi connection, whether in public, at home, or in the office, that is shared with anyone with any wireless device, lacks encryption of the data packets streaming from the connected devices.
A simple Firefox add-on called Firesheep can allow anyone with a Firefox browser to sniff out other devices using the same Internet connection, and to spy on their browser activity. Even if the victim’s login is encrypted, once they visit an unencrypted site, their data becomes vulnerable.
Home or office Wi-Fi with a WEP encryption is slightly more secure. Wired Equivalent Privacy was introduced in 1997 and is the original version of wireless network security. But WEP has been cracked, hacked, and decimated.
Home or office Wi-Fi with a WPA encryption is better. Wi-Fi Protected Access is a certification program that was created in response to several serious weaknesses researchers found in WEP, the previous system. WPA and WPA2 are tougher to crack, but not impossible.
Mobile Broadband has a degree of encryption that has been cracked, but the necessary hardware isn’t widely deployed by criminals. Researchers have demonstrated how the system can be hacked, but it’s still more secure than other options.
For the most security, use WPA2 wireless Internet from a home or office environment that isn’t internally shared. If you must go online while traveling, use your carrier’s mobile broadband and forgo the hotel or café’s free wireless.
Identity theft can happen to anyone, regardless of how they connect to the Internet.
To ensure peace of mind, subscribe to an identity theft protection service, such as McAfee Identity Protection, which offers proactive identity surveillance, lost wallet protection, and alerts when suspicious activity is detected on your accounts. For additional tips, please visit CounterIdentityTheft.com.
Robert Siciliano is a McAfee consultant and identity theft expert. See him discuss wireless hacking on Fox News. (Disclosures)
Tags: Firesheep, identity theft expert, internet identity trading surveillance, mobile wireless internet security concerns, personal identity theft fraud, sniffing tools, unsecured unprotected wireless, unsecured unprotected wireless security risks, Wi-Fi WEP WAP protection breach
Hello Robert,
very good blog indeed. I would like to add few comments:
1. Both WPA and WPA2 provide security as good as the passphrase used to derive the keys.
2. Even if one knows WPA/WPA2 passphrase one cannot decipher someone-else’s traffic as each communication between AP and client is encrypted suing its own session key (pairwise transient key). This means WPA/WPA2 is ideal even for environments where passphrase must be shared (such as an Internet cafe) yet security of individual connections is required.
Regards
Vladimir Jirasek
Submit your own comments / message for this post