« Consumers have a win with the iPod nano | Main | Bit Torrent to go commercial? »
September 30, 2005
Homeland (wireless) defence
It took only a couple of hours in the company of Neal Wise to cause considerable alarm here in the Bleeding Edge Homeland Defence Department. We have tightened up the strap on our tin helmet, and are preparing to launch a barrage balloon.
We first met Neal, of assurance.com.au, when he delivered an address to the Face the IT Media conference in the Hunter Valley on computer security. His thesis is that the increasing availability of Wi-Fi networking and VoIP (internet-based telephony) represents a growing threat beyond the competence of the “Mum and Dad” user to handle.
Then we sat next to him in the Newcastle airport departure lounge, while he scanned for Bluetooth phones and PDAs. There were half a dozen of them within range, all still in “discoverable” mode, which makes them visible to other devices.
The most basic Bluetooth security mechanism is the user's ability to choose if a device is in discoverable or non-discoverable mode, but unfortunately, your phone or other Bluetooth is probably discoverable, because that's the default, and you didn’t know that you should change it.
`
Once you’ve paired it with another device – and Neal’s advice is to make sure you do that at home, or in some other isolated situation – you should go into the Bluetooth settings and turn off the discoverable mode.
If not, it’s possible that someone could scan for it using a PC, and retrieve your address book and notes, etc, which could include some sensitive information.
Then there’s your Wi-Fi network. Neal has been “war driving” in Melbourne with a laptop, wireless antenna and scanning software since mid-2001. Some war drivers search for W-Fi access points because they have mischief on their mind. Neal was doing it to evaluate corporate security risks.
In four years, he’s found the number of Wi-Fi connections along St Kilda Road from Southbank to St Kilda Junction has jumped from about 70 to about 1400. In fact the number is probably much greater than that, because the device only picks up networks on the first couple of floors. The alarming thing, however, is that most of them aren’t secure.
We’ve written recently about measures you might take to improve that. He believes that one of the reasons people don’t take adequate precautions is that they believe things like encryption aren’t particularly effective. The fact is, although the earlier form of encryption, WEP, can be quickly broken by someone who knows what he’s doing, it’s better than nothing, particularly if you live in an apartment building.
But if your device supports the newer WPA encryption, you’ll find it’s much more robust, and you should use it. Many earlier wireless routers and access points can be upgraded to support WPA with new firmware. It’s a good idea to check out the manufacturer’s Website, and if possible, install the update.
Bleeding Edge received several reminders of the practical barriers to improved computer security at the conference. A spokesman for Clearswift, a UK-based company which provides email and Web filtering, had some statistics which were particularly depressing.
Despite all the stories about the dangers of spam, and universal distaste for the stuff, in 2004 US consumers alone spent $US11.7 billion on products marketed via spam. They almost certainly got more than they paid for, in the form of malware.
But there are other highly visible reminders. It’s always instructive to have a look at the top right corner of the screen of someone using the Firefox browser. If there’s a small red, upward-pointing arrow, it means that the user hasn’t updated the latest bug-fix and security updates.
Ironically, in addition to having the best user interface and performance of any browser – with the possible exception of Opera – Firefox is probably the most security conscious. It releases patches for any vulnerability much faster than Microsoft, for instance, and it’s set to look for updates automatically.
Unfortunately, its visible reminders are possibly too discreet for many users.
Once you click on that reed arrow – or a second reminder at the bottom of the screen – it downloads the new version. Unfortunately, at the moment, it downloads the entire program, which can be annoying on a slow connection.
If you’re an Opera user, you might think about checking for an update. There’s a flaw in versions of 8.02 and earlier which affects the e-mail client, causing attachments to be opened without any interaction by the user, which could have nasty results if the attachment includes malware.
The other interesting news from Opera is that they’ve abandoned their advertising-supported version, so that you can download and use it free of charge. That’s probably been forced on the company by the popularity of Firefox, but it’s a good move, and the browser is worth trying out.
Posted by cw at September 30, 2005 09:40 AM

