How a Pringles can cracked the City
Home Up About Us Contents Search

Home

                           

 

How a Pringles can cracked the City's most secret networks

Richard Fletcher slid through the cyber defenses of dozens of London firms with just a car, llaptop and an empty snack can

Source: The Sunday Telegraph - London
Publication date: 03/10/2002

 

 
More than 40 City firms have left their computer networks wide open to "amateur hackers" who can access their systems using just a normal laptop computer and an empty snack carton, an investigation by The Sunday Telegraph can reveal.

Not only are the firms - which include one of the UK's largest technology companies and a leading European investment bank - leaving their networks open to attack, but thousands of amateur hackers are using the shocking security flaw to "piggy back" corporate networks and gain free high-speed access to the internet.

Numerous hackers websites - which can be found using any internet search engine - not only reveal the location of the firms vulnerable to attack, but also provide hackers with the software and detailed instructions necessary to access wireless networks.

Once they gain access they can read confidential e-mails and other secret data including trading records, using code-breaking software to unscramble even the most heavily encrypted files.

Last week The Sunday Telegraph - in conjunction with I-Sec, one of Britain's leading independent security firms - identified more than 60 vulnerable networks during a controlled 45-minute drive around the City of London.

"I hope this exercise raises awareness at board level of the risk that this security flaw poses to confidential information," said Geoff Davies, the managing director of Brighton-based I-Sec.

This shocking breach of commercial security centres on the increasing use of wireless networks, which give employees quick and easy access to a company network when using a laptop computer.

In an increasing number of buildings, employees no longer have to connect their laptop or handheld computer to the system with wires or cables, but can gain access using a wireless network.

For corporate customers and staff - more and more of whom are using laptops - wireless networks not only save staff time, but also generate huge cost savings.

Last year worldwide sales of wireless equipment increased by 80 per cent to more than $1bn, according to IDC, the IT research consultancy. The networks are also being installed in airports, hotels and coffee shops.

But in the US the security flaws in wireless networks have prompted a number of government departments - led by the Lawrence Livermore National Laboratory (a weapons laboratory) to switch off their wireless networks.

The decision sent shockwaves through the IT sector, yet during a 45-minute drive around the City of London The Sunday Telegraph discovered 42 wireless networks that were completely unprotected. These were companies that had not even bothered to switch on the basic encryption security features on their equipment.

All these networks were identified using Netstumbler, freely available software which can be found in seconds on the internet. The only other equipment necessary was a pounds 60 network card and a converted tube of Pringles crisps, the dimensions of which make it ideal to convert into an antenna.

The 45-minute drive began on the western edge of the City near Spitalfields. Netstumbler identified its first unprotected wireless network before we had even driven off.

As well as revealing the identity of the network, Netstumbler also identifies the manufacturer of the wireless system, the strength of the signal and the channel number or wavelength.

But most importantly the software - which works by constantly sending out a message requesting access to wireless networks and then analysing the responses - can detect whether a network is using WEP, the security system for wireless networks.

After driving 500 metres, Netstumbler had already found seven unprotected networks. We drove on, although a hacker would have been able to access the majority of these networks simply by adjusting the settings on his network card and working in his car.

On Farringdon Street we found an unprotected wireless network bearing the same name as an FTSE250 technology company whose headquarters stood just yards away. Even when a network did not bear the company name, working out its identity was not difficult.

Driving past the London headquarters of a leading European investment bank elsewhere in the City, Netstumbler found a wireless network bearing the name "equities trading desk". Others bore company initials or the name of specific departments, such as "IT projects room" - another unprotected network.

But many of the networks had not even been renamed and still bore the default identities set by the manufacturer.

"The biggest problem is that people are just taking these things out of the box and plugging them in," Davies explains. "The fact that a network still bears the default name suggests that they haven't even changed the basic settings. It is an invitation to hackers. Default settings suggest to a hacker that security is low on the priority list of the system administrator. They know that they will almost certainly get access in seconds and then remain undetected."

As we turned into Cannon Street, Netstumbler found six more networks and by the time we reached Monument, we had found 25 networks, only three of which had any protection.

At no point did The Sunday Telegraph or I-Sec attempt to log onto any of these wireless networks or to download confidential information. But had we done so, in the vast majority of cases the system would have assumed that we were a legitimate employee, says Davies.

Other IT security experts agree and explain that with the help of additional software we would not only have been able to access the internet, but also e-mail and any internal systems, including databases containing confidential client data.

"Companies have opened up an enormous back door into their corporate networks," warns Davies.

Many of the hackers have no interest in the firms' own systems, but just use the companies' high-speed internet access to download large files from the web - clogging up valuable bandwidth in the process. But access at this level also gives a serious hacker a huge platform from which to delve further into the system.

"Wireless networks are a fantastic conduit for hackers to access the corporate network," explained Davies as we reach Bank. By now the total number of networks detected has topped 50, yet it would take just five minutes for a "techie" to make the adjustments necessary to hide a wireless network from Netstumbler.

"City and financial institutions are well known for embracing leading-edge technology and there are significant business benefits of using wireless networks, including cost and efficiency savings. But by using this technology unmodified, companies are leaving themselves open to attack," said Davies.

As we head back towards Spitalfields, Davies explains that many of the hackers accessing wireless networks are driven by curiosity. They start, he says, by simply driving around identifying vulnerable networks - a process described by hackers as "wardriving".

Surf the web and you can find websites entirely devoted to wardriving. Many include tips and hints, alongside detailed instructions on building suitable antennae and buying communication cards. On the sites' bulletin boards wardrivers exchange messages and arrange to meet. One group appears to meet in Soho every Friday night.

Other websites include London-wide maps of vulnerable networks, others the precise location - with grid reference - of wireless networks. On a number of the sites surfers can also download other hacking tools including software that can be used to crack passwords.

But whether hackers are accessing wireless networks to use a firm's high-speed internet connection or access confidential data is irrelevant in the eyes of the law. Hackers could be prosecuted under the Regulation of Investigatory Powers Act, although not a single prosecution has ever been bought.

Ironically, it's the companies themselves that could find themselves on the wrong side of the law.

Mark O'Halloran, who heads the Media & Technology unit at Stevens Drake solicitors, believes that by leaving their wireless networks wide open companies are breaching the Data Protection Act.

But implementing the necessary security to secure wireless networks is not easy. Even companies that have installed WEP - the security system for wireless networks - are vulnerable to attack by a determined hacker. WEP encrypts data sent across the network, effectively blocking hackers from logging on.

But late last year a new program - AirSnort - was released on the internet. The software monitors the encrypted traffic and uses the information gathered to create an encryption key, a process that can take hours or days.

The developers of the program - Jeremy Bruestle and Blake Hegerle - hoped that the software would prove once and for all that wireless networks were not secure. "AirSnort is all about opening people's eyes," he says.

"Yes it can be used as a cracking tool, but it can also be used as a really big stick in an argument over the safety of wireless networks," Hegerle told Wired.com last year.

The warnings, however, would appear to be falling on deaf ears.

 
 

 

Click below for more developments and tutorial articles:

 

Home ] Up ]

Send mail to webmaster@infomatek.com with questions or comments about this web site.
Copyright © 2001 Infomatek Consulting and Marketing Services