Security doesn't have to be such a problem on wireless

May 08, 2004|By Dawn Fallik, Philadelphia Inquirer.

PHILADELPHIA — Parked outside in a swank neighborhood, it took a computer consultant about five minutes to electronically thumb through several houses' worth of long-distance access codes, personal mail and hotel receipts--complete with credit card numbers.

In a single mile, only 12 of 58 houses with wireless computer networks had any security measures to keep hackers out, a local indicator of an impending national boom in identity theft, government officials worry.

"Everyone talks about how great wireless networks are, but no one talks about security issues," said Naomi Lefkovitz, an attorney for the Federal Trade Commission, which oversees identity fraud. "People just think it's exciting, and they don't think about how it could be used for less than positive ideas."

With households adding second and third computers, wireless services have exploded from 4.5 million homes in 2003 to almost 7 million this year, according to the Yankee Group, a Boston research team that tracks computer use. Using a router and a wireless connection, people link their PCs to each other and to the Internet.

In addition to home networks, about 4,000 "hot spots," such as coffee shops, parks and hotels, have free or paid wireless Internet access, with an additional 8,000 expected by year's end.

Rob DeRubeis, chairman of the University of Pennsylvania's psychology department, installed a wireless network in his home 16 months ago so he could work in the kitchen while listening to music. In his "shared file" folder, he put pictures from his cousin's wedding, text documents, and instructions for his telephone long-distance access code.

Computer consultant Jamie Jamison could see it all, parked two blocks away with the help of free software that allows computers to seek out wireless signals. "It's really so easy, it's scary," said Jamison, who said many of his clients do not want to take the extra time to activate their computers' firewall or encryption devices.

DeRubeis was more upset to learn his teenage daughter had downloaded virus-laden games onto his laptop than he was about the security invasion. It had not occurred to him that his files were vulnerable.

"I didn't know people could go in and look at this stuff," he said. "I just assumed it was secure."

Once a hacker locks in to a wireless signal, he can use "sniffer" software to capture any data going through the air, such as e-mail text and Web screens, unless that information is encrypted. Jamison needed about two minutes to snatch a volunteer's password and user name from an e-mail account while they used a wireless network at Borders.

Some newer computers using the Windows XP operating system come with a firewall, which blocks outsiders from getting in. But anyone using an older version of Windows does not have automatic security and must take steps to activate it.

"It comes down to a simple balance of security versus ease," Jamison said. "Most people just plug the router into their modem and go."

"I don't understand why anyone would want to look in my computer," said author Judith Benn Hurley, who discovered she could see into several of her neighbors' computers and vice versa when she installed a wireless network in her Philadelphia apartment.

She said she makes sure not to put private material, such as Social Security numbers, on shared files. "But I do notice which sites are secure when I'm online."

Security is also a big concern for open Internet areas. The T-Mobile wireless systems offered by Starbucks and Borders encrypt password and user-name information but cannot protect information typed into unsecured Web sites or computers without firewalls.

"If you're anywhere on the Internet and not behind a firewall you're vulnerable," said Brian Copeland, vice president of technology for Syndeo, the Louisiana company installing a system in a Philadelphia park. The company said it would give users a head's up about the security issues on a "terms of use" screen.

Router manufacturers say they have always left it up to their customers to activate security measures even though most do not.

"When I talk to neighbors or consumers about why they did not turn on security, they feel that their neighbors are not using wireless, so they think, why bother," said Vivek Pathela, senior director at NetGear, a major manufacturer of wireless routers.

There are no plans to make such measures automatic, Pathela said. That makes computer security consultant Francis Rabuck sure that the "big problem" of wireless security won't go away soon even though it would be easy to fix.

"All people need is just to turn on basic security, and most people don't," Rabuck said. "The casual person trying to hack in would see that it's secure and move to the next house or block and find the one that's open. It's easier to walk the 100 feet than to try and crack it."

- - -

Protect your network privacy

- Change the password for your router. When you first plug it in and connect it to your DSL or cable line, a set-up screen takes you through the process. Don't keep the log-in as "default" or "administrator."

- Use ID filtering. Each computer networking device comes with its own ID number, much like a car's vehicle identification number. On the wireless set-up screen, go to the section called access restriction or MAC ID and type in all the numbers from each of the computers in your home. The number is usually found on the computer or the wireless card itself.

- Purchase a software firewall or download one free from a reputable Internet site. This prevents anyone from connecting directly to your computer. Be sure the firewall knows you have a network.

- Enable WEP, which stands for wired equivalency protocol. This means that the information you send will be encrypted and not in plain text.

-- Philadelphia Inquirer