Security Holes in NYC Retailers' Wireless Nets
638467
WLAN security company AirDefense disclosed the findings of its four-day scan of New York City retailers' wireless nets. The results: Not good.
337372
Wireless networks giving computer users  Internet access from anywhere in the home could expose them to  eavesdropping and programmers should make their security  software easier to use, researchers say.
216335
A vulnerability in AOL's instant messenger could allow attacks. Also: A new Bagle variant rumbles across the Net.
91037
Researchers in the U.S. say they've shown how a network designed to make it harder to trace Internet surfers could be compromised.
345683
Point-of-sale (POS) systems pose a clear but often overlooked danger to consumer credit card data, according to a whitepaper from Hacker Factor Solutions.
365302
People sniffing wireless network traffic have many tools at their disposal to intercept sensitive data from PCs.
106796
New York is on the verge of becoming a wireless city, but not everyone is happy about the prospect.
222872
Be afraid: There's no such thing as a secure network.
112205
Software update patches bug in wireless drivers that left systems vulnerable.
565372
(InfoWorld) - The fast growth in wireless Internet use throughout Asia leaves users vulnerable to data theft over unsecured networks and lost or stolen mobile devices, a security expert warned Tuesday. Citrix Systems Inc. Chief Security Officer Kurt Roemer said during an interview that trends in Asia suggest increasing vulnerability as time goes on because wireless use is growing much faster than fixed-line use in many countries. Japan, for example, is a global leader in developing 3G (third-generation) mobile networks and applications, which is increasing demand for smarter phones that can handle more data and computing work -- the kind that increases the likelihood of stolen data. Taiwan is another example. At one point, there were more mobile phone accounts than people on the island, and the propensity to live wirelessly has prompted the government to implement a plan to ensure wireless Internet access via Wi-Fi and WiMax networks islandwide over the next few years. And in developing countries such as China and India, there are more wireless networks going up than fixed-line networks, a danger because fixed-line networks are easier to secure. As mobile applications increase, and people use mobile networks more and more often to log onto the Internet for work and play, Roemer sees the danger of users failing to protect themselves. He reckons the smartest solution for companies and Internet service providers is to take proactive steps to protect users, and keep user tasks simple. Wi-Fi helped popularize the idea of taking a laptop to the coffee shop, or using one in an airport on wireless networks that might not be secured, while WiMax, the wireless standard to follow Wi-Fi, will likely increase such activity. Mobile telecommunications network operators are also offering more high speed Internet connection options for Internet users, such as HSDPA (High-Speed Downlink Packet Access). Workers in the field trying to send data back or access sensitive company data need security they can handle without too many time consuming tasks and protocols. "The more you make your users have to think about it, the worse it gets," he said. Citrix, Fortinet, Foundry Networks, and other companies sell software that helps secure company networks no matter where a user logs on. And there are varying levels of security, depending on how much access different users need to company data, as well as for other considerations, such as complexity and cost. The dangers for IT managers are only going to grow, due to the quick expansion of wireless networks and devices worldwide, he said. Mobile devices themselves are also cause for security concern. Hard drive memory space is growing so fast that users can keep an awful lot of sensitive information on one device, he said. Losing such a machine, or having it stolen can really create problems. One way for companies to secure devices is by removing hard drives from the equation, he said. IT managers can buy thin client notebook PCs, for example, that store data on a server back at company headquarters instead of offering workers laptops with huge hard drives. Roemer suggested Neoware as one company with a strong line of thin client products.ADVERTISEMENTNEW IT SERVICES FROM IBM: EASIER TO BUY AND IMPLEMENTDiscover a simpler, more cost-effective way to get the solutions your company needs to grow more flexible and efficient.
55540
Two-way filtering is touted as a new security feature, but Preston Gralla discovers it's impossible to practically configure outbound filtering.
76351
If you use a secure wireless network, hackers may be able to steal data from your computer in the time it takes to have a cup of coffee.At the Toorcon hacking conference in San Diego this coming weekend, security researcher Vivek Ramachandran, will demonstrate a technique he&#39;s developed to attack laptops that use the WEP encryption system to log on to secure wireless networks.Developed in the late 1990s, WEP was the default method of securing Wi-Fi networks. Though the WPA (Wi-Fi Protected Access) system replaced it, about 41 percent of businesses continue to use WEP. That percentage is even higher among home users, security experts say.That&#39;s unfortunate because WEP has been riddled with security problems. In fact, WEP was blamed for the recent&#160;TJX Companies data breach&#160;in which thieves were able to access 45 million credit- and debit-card numbers.To date, however, researchers have tended to focus on exploiting WEP flaws in order to break into wireless networks. That generally meant that the attacker would roll up near the WEP-encrypted router, crack the WEP key used to encrypt network traffic, and then log on to the network.Ramachandran, a senior wireless security researcher with AirTight Networks, has taken a look at the client side of things and developed a way of tricking a WEP-enabled client into thinking that it is logging on to a network that it already knows.His technique, which he calls the Cafe Latte attack, allows an attacker to circumvent firewall protection and attack the laptop or to set up a &quot;man in the middle&quot; attack and snoop on the victim&#39;s online activity. &quot;Until now, the conventional belief was that in order to crack WEP, the attacker had to show up at the parking lot,&quot; he said. &quot;With the discovery of our attack, every employee of an organization is the target of an attack.&quot;There are several steps to Cafe Latte, all of which exploit known flaws in the WEP architecture. First, the attacker programs a laptop computer to act like a malicious wireless network, setting up shop in an Internet cafe or an airport. The malicious PC then begins communicating with other Wi-Fi laptops in range, figuring out the name of the WEP-enabled routers that these laptops are programmed to look for and then cracks the keystream encryption code required to send messages to the victim&#39;s laptop.Knowing the keystream only gets the attacker halfway. To truly crack the WEP encryption key and read messages coming from the victim, the attacker must somehow trick the victim into sending a large amount of information -- about 70,000 messages, actually -- to the malicious network. Those messages could then be analyzed and cracked using WEP-cracking tools.Cafe Latte does this by taking advantage of the way the Internet&#39;s ARP (Address Resolution Protocol) ensures that two computers do not share the same IP address. ARP is used when a new computer joins a LAN to announce the IP address it will be using and to ensure that no other machine shares that address. These network messages are ignored by the victim&#39;s PC unless it shares that address. Then it sends a message back to the attacker&#39;s PC saying that the IP address in question is already being used.Once the attacker gets a response from the victim&#39;s PC, he knows he has guessed the correct IP address and he can bombard the victim&#39;s PC with the same message, essentially saying over and over again &quot;I&#39;m joining the network and I&#39;d like to use this IP address. Are you already using it?&quot;As the victim&#39;s laptop continues to reply, &quot;Yes, I am,&quot; the attacker eventually stores up enough samples of encrypted messages to be able to figure out the WEP key. Now messages from the victim can be read by the attacker.&quot;It&#39;s definitely a novel attack,&quot; said Jon Ellch, a Wi-Fi security researcher who also goes by the name johnny cache. While an attacker could use this WEP key to log on to the victim&#39;s WEP network, the real danger here is from the man-in-the-middle attack, which would let the attacker see everything the victim is doing on the Internet, he added.Still, a victim might notice that something was up during the estimated 30 minutes that Cafe Latte requires in order to crack the WEP key, Ellch said. The attack would have a better chance of succeeding if the laptop were simply turned on and trying to connect to the Wi-Fi network in the background, he said. &quot;If they&#39;re trying to do something with the Internet, obviously it&#39;s not going to pan out so well.&quot;Toorcon runs from Friday to Sunday.
365929
(InfoWorld) - Using a credit card at a gas station could pose more of a risk for data theft than shopping online, as point-of-sale terminals have emerged as a weak link in the security chain, according to a Gartner analyst. When a card is swiped, point-of-sale (POS) terminals often collect and store the data held in the magnetic stripe on the back of a credit card, said Avivah Litan, a Gartner vice president and distinguished analyst. Retailers are often unaware that their POS applications collect so much information. In the hands of sophisticated hackers and counterfeiters, the data collected from the magnetic stripe is enough to create a replica card. "It's almost more dangerous to go to the gas station than it is online," Litan said at Gartner's Identity and Access Management Summit in London on Monday. "The data is just sitting there. No one even thought about what data is on a POS controller." Retailers' network configurations are partly to blame. Many are using the Internet to transmit data in place of dial-up networks, and many have incorporated wireless access points into their networks using WEP (Wired Equivalent Privacy), Litan said, which is not considered a strong form of encryption. Hackers lurk in parking lots looking for weak networks to penetrate. Since the POS terminals are linked via IP, once a hacker has accessed a network they can try out neighboring IP addresses until they locate a store of data, Litan said. Data breaches that occur offline are common. Of 160 breaches investigated for one major credit card brand, 128 took place in the brick and mortar world where the card was physically present for the transaction, rather than being used online or over the telephone, according to Gartner. To strengthen security, card brands such as Visa and Mastercard are pressuring retailers to comply with the Payment Card Industry (PCI) Data Security Standard, a code of best practices created by the card industry. The standard forbids the storing of magnetic stripe data on POS terminals, and Visa plans to start fining retailers in the coming months if they don't comply, according to Gartner. Implementing security is cheaper in the long run than having a data breach, which can be expensive and hurt a company's reputation. Gartner calculates that a data breach costs companies around $300 per exposed account because of investigations, fines and lawsuits. On the other hand, beefing up security costs around $16 per account for the first year, and that cost falls over time, according to Litan. The short-term forecast for POS security doesn't look great, however. Gartner predicts that by next year, most attacks against retailers will be directed at their POS terminals, and only 30 percent of POS software will be compliant with the prevailing security standards by 2009. "The thieves always find the path of least resistance," Litan said. Â
617853
Next-generation RF tags touted as a way to boost network security.
453054
A vulnerability in radio-frequency ID chips could put millions of users of wireless car key tags or speed pass payment devices at risk, according to a recent study by researchers at Johns Hopkins University and RSA Laboratories.
482931
Asia's seen rapid growth in wireless Internet use recently, but unsecured Wi-Fi networks and lost or stolen mobile devices leave users vulnerable to a rising tide of data thefts and other attacks according to Citrix CSO Kurt Roemer.
78443
Flaw in the way the Net phone software handles Web links could enable an attacker to launch arbitrary code on some Macs.