Feeds

Drive-by hacking linked to cyberterror

ICC misses the mark

  • alert
  • submit to reddit

SANS - Survey on application security programs

Updated The most comprehensive study of the insecurity of wireless networks in London to date has discovered that 94 per cent are leaving their networks open to drive-by hacking.

This possibly worthwhile survey is undermined by the cyberterrorism FUD spin put on the release.

A seven-month investigation of 5,000 wireless systems was conducted by IT security specialists Digilog, in collaboration with the International Chamber of Commerce's Cybercrime (ICC) Unit, who are using the survey to promote an anti-hacking service.

Wireless networks have a built-in encryption system (WEP), but in nearly all the companies investigated it had not been set up to work securely. Best practice is for firms to plug wireless LANs into virtual private networks in order to provide make sure traffic is securely encrypted.

The ICC Cybercrime Unit says that financial institutions, law firms, media organizations and government offices are among those at risk - and the evidence suggests a similar picture exists in other commercial centres throughout the world.

So far so good; but then Pottengal Mukundan, director of ICC's crime-fighting division, and his partners from Digilog embark on a flight of fancy about the supposed link between drive by hackers and international terrorism.

A statement on the survey 'warns': "And networks are not only at risk from attacks at close-quarters. University research in Hawaii has shown that signals can be intercepted from a distance of over 25 miles, raising fears of large-scale cyber-terrorism [our emphasis]. Computer-controlled power grids, telephone networks and water-treatment plants are at risk."

IT network managers are not always radio engineers, as the release points out, but they know that 2.4GHz (much less 5GHz) signals typically work of a distance measured in metres rather than miles.

The ICC Cybercrime Unit, which is essentially a business focused organisation known for providing useful advice about security matters in the past, has over-steped the mark this time. ®

Updated

Numerous people have emailed us to say that WLANs CAN work over longer distances with the right antenna. This is true.

To clarify. What we said about WLANs operating over distances of metres rather than miles applies to stock omnidirectional antenna. Longer distances, stretching into kilometres, are possible with a small parabolic antenna.

But such antennas are highly directional and require direct line-of-sight to the other transceiver which totally defeats the whole "drive by" hacking concept.

From a “stationary” vantage point you could do some interesting snooping with a dish, pointing it here and there looking for a signal, but that's not particularly easy or clandestine.

The real threat, identified by the study, comes from thrill-seeking hackers with wireless-equipped laptops, or possibly industrial espionage.

There is NO evidence that terrorists harnessing the insecurity of wireless LANs to their nefarious ends. The idea that there’s an Al Queda cell in Watford snooping on wireless traffic from the City of London, contained in the press release, is (we believe) alarmist. After speaking to Simon Gunning from Digilog this morning we’re satisfied that this spin was put on the release by marketing people, not those who conducted the study.

Related stories

802.1X can be toppled 'like set of dominoes'
Cisco and MS team on wireless security
RSA supplies answer to drive-by hacking?
Secure the Wireless Network firmware
Tool dumbs down wireless hacking
Rogue WLANS - the next security battlefield?
Wireless security is even flakier than we thought
War driving by the Bay

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.