
They're in your neighborhood, just waiting to break into your home network, according to WXYZ-TV in Detroit
The biggest security threat most broadband users will encounter doesn’t come from identity thieves or kiddie porn rings roving neighborhoods looking for unsecured computers to exploit — it’s from your neighbors looking for free access to your broadband service.
Local newscasts have recently been running sensationalist stories of mysterious cars parked on neighborhood streets driven by ne’er-do-wells barging onto unsecured home wireless networks.
In fact, the most common threat isn’t from drive-by crime rings, but right next door. With most broadband accounts providing flat rate service, the occasional uninvited guest ‘borrowing access’ probably goes unnoticed. But should Internet Overchargers have their way, the consequences of account sharing in a world with paltry usage limits and usage-based-billing could show up on your monthly bill.
In countries where these overcharging schemes already have taken firm root, reports of customers receiving enormous broadband service bills are common. In Australia, rarely a week goes by without someone reporting a hacked wireless network incident. Consumers have been forced to become watchdogs, constantly checking usage statistics to ensure someone in the neighborhood hasn’t been “borrowing” their Internet account and blowing through their monthly usage allowance.
One customer, who lives in an apartment complex, shares a too-common story:
Over the past 24 hours someone (or something?) has been sucking the life out of my internet connection and chewed up 10Gb of my quota. How do I troubleshoot the cause of this? I have a Buffalo WHR-G54S Wireless Router and my network is secured. I live by myself in a small block of apartments; I have had no visitors either.
Another customer discovered when it’s your word against your provider’s, the provider wins:
Yesterday, I was checking my broadband bill and was surprised to find out that they had charged me for downloading an extra 4 GB of data. I checked my usage online for the current month and it was already 8GB! This is despite the fact that I have been on holiday for ten days, and my normal usage involves casual browsing and downloading e-mails.
Furthermore, I never exceeded my download limit since I started with my ISP. My ISP also confirms that this is quite unusual and against my normal usage pattern. I have asked them to provide me some usage statistics but they can only give me the data that I already see on my account online.
The cost of exceeding the limit can be enormous. BigPond in Australia, for example, has a few Internet plans that charge a $0.15 per megabyte overlimit penalty. That’s $150AUD per gigabyte.
[flv]http://www.phillipdampier.com/video/WXYZ Detroit Open Wi-Fi Risks 1-26-10.flv[/flv]
WXYZ-TV in Detroit ran this sensationalist report on drive-by hackers breaking into wireless networks. (3 minutes)
The solution suggested by most Internet Service Providers is to enable built-in wireless security. How much protection that provides and whether customers will be able to understand how to configure security remain open questions.
Some phone companies providing DSL service have plenty of older equipment still in customer homes that only supports the older WEP security standard. That’s insufficient to protect consumers from intrusion because WEP security has been seriously compromised.
“WEP as a security measure is so broken that your (and everyone else’s) kid sister can easily circumvent it,” computer security researcher Ralf-Philipp Weinmann told the BBC. Weinmann is co-author of the aircrack-ptw tool that can crack WEP in minutes.
Anyone caring about their privacy, said Weinmann, should not use WEP to stop others using their wi-fi hotspot.
Current generation wireless routers typically provide both WEP and the more secure WPA standard. But now there is evidence WPA can also be compromised, with a little help from “cloud computing,” which puts several high powered computers together to quickly work on cracking your password. A service has even been launched to let would-be crackers rent time on the “cloud” to “test” network security passwords, starting at just $17. In as little as 20 minutes, those with relatively simple passwords will find their network security compromised.
You can protect yourself by at least making sure your router is “secured” with a password. Most every router comes with instructions or software that make this process as simple as possible. When you have a choice of security standards, aim for WPA2, if available.
Thus far, most reported WPA network break-ins occur because the user is relying on a simple password — often a common word, name, series of numbers, or something similar that is much easier to break. Try to use a password that is not a word in a dictionary, doesn’t correspond to information anyone could mine off your Facebook page (city/town, school, birthday, parents or siblings names, etc.), and would be impossible to guess off-hand.
<
p style=”text-align: center;”>
How to secure your wireless network (6 minutes)