You may remember me harping on wireless (WiFi) security in the past. A surprising number of people have wireless routers set up in their home without having the WPA security set. I have an app that runs on my smartphone that allows me to drive down the street and find “open” wireless routers that I can connect to freely without having to know a password, and most streets have several. Since most people are also running PC’s running some version of Windows, and Windows has all the security of a butterfly net without the net, this seems pretty risky. Granted that we live in an area that doesn’t have that many techno-geeks running around, but all it takes is one. It doesn’t have to be someone who is acting maliciously, it could just be your neighbor “borrowing” some of your network bandwidth. Not only are your files at risk, and your computer is at risk of damage due to viruses and other exploits that may be introduced through unfettered access to your home network, but access to your online banking accounts, email, facebook, and anything else that would be better if only you had access.
Recently there was a lot of hoopla on the internet about a new Firefox plugin called “Firesheep”. I’m not sure why the author chose to call it “sheep,” maybe it’s because it’s like a wolf in sheep’s clothing. In technical terms the plugin allows the user to intercept session “cookies,” which then allows the user to take over an unsuspecting victim’s web session. A “cookie” in this context is a packet of information that is used to maintain a session with a website such as Facebook. When you log into Facebook, the server passes your web browser a “cookie”, which your browser then uses to maintain your login session with the server.
So, let’s say you’re teenager is spending their usual 8 hours a day on Facebook. Somewhere within 1/4 mile is another teenager who is experimenting with what he can do with his computer and manages to get a connection on your wireless network. They then run this cool new Firesheep tool (or a long list of other freely available hacking tools) to capture the Facebook session, which they later use to start posting things they shouldn’t using YOUR teenager’s facebook account. You’d be hard pressed to figure out how it happened, and having unauthorized stuff posted to your teen’s facebook could have very serious consequences.
Public hotspots are another place where this could happen. Many businesses now offer free WiFi hotspots, including Starbucks, McDonalds, and even many local mom-and-pop businesses around town. Some of them require a password, but even that doesn’t guarantee security if the security method is the older WEP protocol. If you’re using a public PC or even your own laptop from one of these places, you’re at risk.
Now that I’ve scared the bejabbers out of you, next week we’ll talk about how to keep yourself safe at public WiFi hotspots and at home.