Hacking the Invisible Network

Architecture and Background

Michael Sutton and Pedram Amini - Hacking the Invisible Network: The Risks and Vulnerabilities Associated with Wireless Hotspots Hacking the Invisible Network: The Risks and Vulnerabilities Associated with Wireless Hotspots Wireless hotspots are emerging as an effective means of providing on-demand Internet access for users with 802.11x enabled devices. The networks typically exist in places frequented by business travelers, such as hotels, airports or in locations with persistent clientele such as coffee shops. The technology provides an efficient and cost effective way for companies to deliver Internet access to their customers and also offers an alternate revenue source, as many networks are "pay for play". Most users are enticed by the convenience of these networks, but are unaware of the security risks that they present. Companies have historically implemented security by building an impenetrable fortress around network assets. This system is flawed.

Vulnerability Analysis

It does nothing to protect the multitude of portable devices such as laptops and PDAs that are frequently used outside of this fortress. Hotspots are shared networks that broadcast traffic. By design, hotspots do not implement encryption schemes such as WEP, which provides a target rich environment for malicious attackers. Unencrypted network traffic can be intercepted and traditional remote attacks can be perpetrated on machines that are operating without protection from attack. This poses a significant risk for corporations as these devices commonly contain sensitive corporate data. Research conducted on numerous hotspot implementations has revealed that most leave end users unnecessarily exposed to both local and remote attackers.

Exploitation and Demonstrations

Most networks also have weak access controls that leave business owners exposed to loss of revenue from various attack scenarios such as session hijacking, data tunneling and connection sharing. The presentation will address the following: * The risks associated with using Hotspots * Specific attack scenarios -- identifying tools and techniques that were used * The network design of specific hotspot implementations * What users can do to protect themselves Michael Sutton Michael Sutton is the Director of Product Development for iDEFENSE, a private security intelligence company located in Reston, VA. He works on the Software Development division where he is responsible for designing and developing the technologies used by analysts for open and closed source intelligence gathering. Other responsibilities include business development and conducting research into security vulnerabilities. The primary focus of his research for the past two years has been in the area of 802.11x networking. Prior to joining iDEFENSE, Michael established the Information Systems Assurance and Advisory Services (ISAAS) practice for Ernst & Young in Bermuda.

Remediation and Defensive Strategies

He is a frequent presenter at information security conferences. Michael obtained his Certified Information Systems Auditor (CISA) designation in 1998 and is a member of Information Systems Audit and Control Association (ISACA). He is presently pursuing a Master of Science in Information Systems Technology degree at George Washington University, has a Bachelor of Commerce degree from the University of Alberta and is a Chartered Accountant. Pedram Amini Pedram Amini is a Security Engineer for iDEFENSE, a private security intelligence firm located in Reston, VA. Pedram works in the iDEFENSE Labs division where he is responsible for researching new information security vulnerabilities. He started and maintains redhive.com, a virtual community for friends and colleagues that among other things, houses his various programming initiatives (pedram.redhive.com). He is a recent graduate of Tulane University and holds a Bachelors degree in Computer Science.