'Evil twin' Wi-Fi access points proliferate

There is little consumers can do to protect themselves from hackers eavesdropping on wireless communications

Head this warning to be wary of rogue Wi-Fi access points masquerading as legitimate counterparts at hotels and airports. IDG News Service's Jeremy Kirk interviews Phil Cracknell, president of the U.K. branch of the Information Systems Security Association, who warns, "With the growth in wireless networks, the 'evil twin' type of attack is on the rise."

In April I was on the road in North Carolina and changed hotels in the Raleigh area. The new hotel had fee-for-access Wi-Fi, so why did I boot and immediately access the Wild Wild Web without ponying up my credit card? Thanks to the office of the community church visible from my window, I stumbled into their open, insecure network. At least, that's what a potential Evil Twin access point would want me to think.

Whether your access is for free or for fee, encrypt your communications before entering passwords or other sensitive data to at least provide some modicum of security. Redirect to TLS-encrypted web pages (https://) when available, and use a VPN tunnel to get back to the office or even your home network. Or even better, remember your ethernet cable and jack into the wall port. Although a crafty insider could still eavesdrop your communications, at least the drive-by sniffers in the parking lot will be left out in the dark.

Q. Would my hotel time have been better spent at the pool, anyway?

Shown: USBGEAR 802.11b/g USB Wi-Fi adapter

RIM adds APIs for new types of applications

New APIs will allow developers to build social networking, mapping, audio/visual, and other types of applications for Blackberry handhelds

It looks like the Blackberry development environment will be shedding its business persona and adopting the trappings of the 24-hours lifestyle, where mobile devices are ego-centric (an extension of the 24-hour person), and not role-centric (a tool to help a person fulfill one specifice role). And what does an ego-centric device require? Music. Lots of music. Movies--full multimedia capability. And of course a camera. Email is already at the core of the Blackberry offering, but the new APIs will also embrace the textual bailiwick of mobile phones, SMS. Don't forget MMS. And why not enable GPS while we're at it?

The list of extensions being made available are numerous. Buy why? Because the competition offers them, of course. The allure of multi-function phones that have been offering all of the above have outstripped the need for, well, email on the road. I could debate the advantages of leaving my camera-enabled Zire (designed for the "home user" market) at home while bringing my Blackberry (designed for the "business attire" crowd) to the gym, for example, when I first noticed the "No Cameras Permitted" sign that appeared on the wall outside the locker room, just below and to the left of... a security camera. Have you tried to de-camera yourself lately? It's getting difficult as these devices become more pervasive as they become more commoditized. Have you checked out your daughter's teddy bear lately? If he's a model SCI-TB300, he might be recording.

Here's the rundown on API enhancements to help BlackBerryistas build more audio, messaging, and mapping, to build social networking, location-based, multimedia, and other kinds of applications."

• Audio formats: MP3, WAV, WMA, AAC
• pictures
• BlackBerry Messenger API for peer-to-peer messages
  
• GPS (local and/or external)
• BlackBerry Maps
• 3D graphics
• MMS
• SMS

Q. Will your company issue you a business communication device that enables an employee to play the latest video game while listening to ripped industrial MP3s?

Picture: Research in Motion Limited

RSA 2007: Wi-Fi hacking, with a handheld PDA

Ryan Naraine posts on his blog that Silica was perhaps the "most scary device" at the 2007 RSA Security Conference. Silica is Aitel Immunity's palmtop tool that is able to covertly scan for open Wi-Fi access points and optionally launch hundreds of exploits at local networks. Silica runs Debian Linux on the Nokia 770 Internet Tablet and has 802.11 capabilities. Migration of the system to other hardware platforms is planned, as are capabilities for Bluetooth, ethernet-by-USB, and GPS, for automatic location identification.

The market for Silica is clearly penetration testing, not enablement of criminal hacking. From Naraine's article,

Aitel said Immunity is careful to do due diligence when selling its products, which can fall into the wrong hands and end up being used for illegal purposes. "We don't sell to anonymous users. We make a fair effort to vet buyers and know where the money is coming from and who we're shipping to," she explained.

Despite all good intentions, Aitel goes on to admit there is no way to guarantee units sold through proper channels could not fall into unintended hands.

A greater concern to me is that I'm guessing the hundreds of exploits are not proprietary to Aitel. Aitel's differentiator is in packaging them into a mobile and seductively easy-to-use, $3,600 platform. This is a convenience for large, legitimate organizations. However, there is nothing to prevent a determined hacker form purchasing a Nokia 770 in consumer retail channels for $360, and all to many exploits are already freely available to them. Now that's something really scary.

Q. Are wireless exploits scary to your organization?

Photo: from zdnet.com.