Wireless hack,Wifi hack & security

Tech-savvy teens and tweens are often looked upon with a measurable amount of contempt, so much so that the image of the bored, listless, and ultimately despondent young person maliciously hacking for the simple thrill of it has become a modern archetype. Yet, as The Who once remarked, the kids are alright.

Jon Penn, a sixth grader at a small private school in Sherwood, Ark., is Exhibit A. When Victory Baptist School’s previous network admin jumped ship, 11-year-old Jon decided to help out his mother, the school librarian who suddenly found herself responsible for computer support, by taking the reins.

“His school needed a gateway to protect against attacks, filter viruses and spam, and block inappropriate sites. Keeping costs down is important since the school is operating on a shoestring budget to keep its 60 aging computers, a donation from years ago, working for the roughly 200 students permitted to use them, along with the teachers. ”

Jon set to removing viruses from the antiquated machines and installed a firewall and filtering software as a stopgap measure while he looked forward to instituting centralized system management. Along the way he became what may well be the nation’s youngest IT guy, and what’s very obviously any geek parent’s dream come true.  

via wiredblog

In the Field of IT security Breaches, wifi hacking is an illegal way of penentration of wifi Network, A wifi network can be penetrated in a number of ways. There are methods ranging from those that demand a high level of technological skill and commitment to methods that are less sophisticated and require minimal technologically skill. Once within a network a skilled hacker can modify software, network settings, other security items and much more. To counter the security threat of an intrusion into a wireless network, there are many precautions available.

Virtual Intrusion

The various methods used by hacker that enable them to exploit wireless connections typically begin with eavesdropping on a network, “sniffing”. A packet sniffer is a program that monitors that information contained on a network. The information that sniffer programs make available include emails, user names and passwords, among other sensitive information. There are different means of sniffing out wireless networks including passively scanning and collecting Media Access Control (MAC) addresses.

A hacker can passively scan each radio channel that wireless networks are broadcast on to check for activity. By passively scanning the presence of that scanner is not revealed since they are not actually transmitting any traceable material to the network at this point.

Detecting a wireless “sniffer” is extremely difficult. It is only after the hacker starts to probe and/or install packets onto the network that the location of the attacker and/or the device can be isolated. For some hackers the main goal of an intrusion is to obtain the WEP key. There are several methods that are used to achieve this. The main obstacle to intruders gaining the WEP key is a lack of computing power. The average home computer could take anywhere from hours to days to gain access through weak system frames.

The information that a hacker can collect from sniffing alone is limited, in order to gain all the information that they want hackers must then engage in actively probing a network. In actively probing a network a hacker increases the probably of detection. This risk comes as a result of the packets that are sent to the target in an effort to get back the desired information in return.

War Driving is another increasingly common method of gaining access to unprotected networks. The main equipment for war driving includes a WiFi enabled laptop or PDA, a GPS device.

Other Means of Gaining Access

Other means available and use by hackers to gain access to a wireless network include virtually probing, lost password and social spying. These methods are not as technologically intensive as virtual intrusions but they nonetheless pose a high security threat.

• A virtual probe is when hackers contact users on a network on the pretence of being a vendor that a company normally deals with. The hacker than asks for sensitive information concerning the wireless network. A commonly used example of this is when a hacker pretends to be conducting a survey. They then ask for information about the firewalls, or many other sensitive pieces of information.
• The lost password method of intrusion is when the hacker obtains a password to get past an organizations firewall or intrusion detection system. Then the hacker will develop an account for himself so they can access any information they want at any time they want.
• The social spying method of intrusion is when hackers spy on everyday people when they are entering passwords. The person targeted does not know that they are the target of the hacker. An example of this is when people enter their PIN while at the ATM, very few take the precaution of protecting this important information.

Security Measures

In an effort to protect a wireless network there are several security measures that can be employed.

• Encryption of all wireless traffic is the most secure way of reducing both hacking attempts, and successful breaches. There are several wireless encryption types available, including WEP, WPA and WPAv2. WEP is considered insecure, as given enough processing power, it can be broken. That said, WEP will still stop any passive scans, as well as casual hackers.
• Altering the network from the manufacturer’s defaults can also discourage hackers. The information about network defaults is easily accessible and will render any security enhancements useless. Settings such as default SSID, default admin password, and disabled encryption are the main items that need addressing.
• Data, especially passwords, should be encrypted when travelling over the network. A cracked system without encrypted passwords and other information is totally accessible to hackers.
• As with most technology updating security protocols and other information is crucial to maintaining the security of the system.

It is a common misconception that disabling broadcasting of the SSID and enabling MAC filtering is a sufficient security configuration. This is not the case. Disabling the SSID broadcast merely prevents casual nearby wireless users from detecting the presence of your network – war drivers and those who are already aware of your wireless network will not be disadvantaged at all by a disabled SSID. Similarly, MAC address filtering will only prevent accidental connection from casual users – MAC address’s can be spoofed to appear to be that of an authorised workstation or laptop.

Sources

• Peikari, Dr. Cyrus, Fogie, Seth (May 2004) Wireless Hacking Techniques. Maximum Wireless Security Retrieved on June 18, 2006 from http://www.computerworld.com/mobiletopics/mobile/story/0,10801,91313,00.html
• Crucial Paragidm Business Solutions(n.d) Hacking Attacks-Prevention. Retrieved on June 18, 2006 from http://www.crucialp.com/resources/tutorials/website-web-page-site-optimization/hacking-attacks-prevention.php
• Prabhaker Mateti. Hacking Techniques in Wireless Networks. The Handbook of Information Security. Retrieved from http://www.cs.wright.edu/~pmateti/InternetSecurity/Lectures/WirelessHacks/Mateti-WirelessHacks.htm. 2005.

Wireless Security
Easily secure your wireless network Free software – get it now!
www.NetworkMagic.com

Wireless Networking
Secure Wireless Solutions RF Site Surveys & Installations
www.AdvancedMobileGroup.com

Wi-Fi Spectrum Analyzer
Low cost packages ($89.95 – $395) -Test & optimize wireless networks
www.NutsAboutNets.com

Dan Egerstad, man behind controversial “hack of the year 2007″ was taken for questioning by Swedish National Crime and Swedish Security Police few days ago, The Age informed. Also his house was raided and police took his computers and hard drives. Anyway no charges have been set.Egerstad published in August this year usernames and passwords to email accounts from embassies and governments from different countries. As he explained, he created exit TOR nodes and intercepted traffic and on such way he obtained these informations. What is maybe worser, logins acquired on this way were according to him not used by legit users but actual malicious people that compromise these accounts and tried to hide in TOR network when using them. Many would say this is unethical approach, but what is here more important: ethics or security (and in this case it applies maybe to world-wide security)?

So he turned to notifying affected governments, because if contacting Swedish authorities there was a risk, that his experiment could be misused by intelligence services. Except few calls from Swedish security police the only serious response was from Iran. As he said, “they wanted to know everything i knew”.These are facts that create different points of view.1. Those who used TOR for communicating sensitive informations probably didn’t read carefully it’s homepage and all the warnings included. Building secure communication channels in government environments should be mandatory, but use TOR for this… excuse me, please, this is stupid.2. Please note the fact, that most of the accounts were already used by malicious people – Egerstad discovered only top of iceberg.3. Even he has intercepted traffic on exit node, and this is from ethical point of view something unacceptable, he didn’t misused it and selected the best solution he could – informing governments of affected countries – and this could be considered as ethical approach. The fact, that except Iran nobody seriously investigated this issue. What a shame for more developed countries!

4. He posted account informations to public – another controversial move from ethical point of view. But, let me place here question: if you give out informations for free to governments and become not even “thank you”, what will you do?

5. Egerstad showed only, than anybody can do the same – and have the same informations as he got, with no special and expensive intelligence. And because he published the details, lot of intelligence agencies may become angry.

Now, let me please repeat one of my examples: if you forget to lock your car, it can be stolen and that would be your fault, but if your neighbor tells you, that you forgot to lock that car, who becomes most angry? Usually, a thief…

Mujahedeen Secrets 2 – newest version of encryption tools was released by Global Islamic Media Front. As ZDNet Australia informed, “Asrar Al-Mujahidin” or “Mujahedeen Secrets” contains also encrypted chat and forum supported instant messaging.

Password protected archive contains except executable also help file, where all features are described. First version contained these features:
- five strongest encryption algorithms in cryptography. (AES finalist algorithms).
- symmetrical encryption keys 256-bit (Ultra Strong Symmetric Encryption).
- encryption keys for symmetric length of 2048-bit RSA (private and public).
- ROM compression (the highest levels of compression)
- stealthy ciphering
- cipher auto-detection.
- sile shredder
Now second has some new features:
- secure messaging
- files to text encoding
- checking digital signatures of files
- creating digital signature of the file

London, England, 3^rd March 2008 – News that an 18-year-old New Zealand teenager allegedly at the centre of an international cybercrime network has been charged with various hacking crimes on Friday is proof that advances in hacking techniques are moving at an astonishing speed and that millions of users don’t have adequate protection against the latest threats, says Tier-3’s Geoff Sweeney. The CTO with the behavioural analysis software specialist added that news that Own Thor Walker now faces up to ten years in prison if found guilty illustrates the seriousness of his alleged actions. 

“The 18-year-old is thought to have written the software used to hack into 1.3 million computers and even brought down the computer system at a major US university,” said Sweeney.

Unconfirmed reports suggest that Walker’s network had allegedly skimmed about 10 million pounds in total from the victims’ bank accounts, as well as crashing a supposed robust server at University of Pennsylvania in 2006,” he added. 

According to Sweeney, if true, then Walker would have been just 16 years old at the time of these events which is evidence that the opportunity to construct and use software that can compromise so many machines is within the reach of almost anyone who has the skills.

“Regardless of whether he is guilty or not, or whoever committed these crimes, the message has once again been repeated – criminal hacking has moved into a new phase, and companies need to protect their IT resources with security systems that reflect these changes,” he said.

For more on the alleged Kiwi hacker’s exploits: 

http://tinyurl.com/yq76bk

Google is real giant. We have now Google powered search, email, office applications, blogs, satelite maps… We would like to not make any commercial to these services, everybody can make his decision and use it at own risk.

Of course, every activity you do on Google is logged – your searches, emails, even documents you open using Google Docs are saved. And, don’t forget – all this can be used one day against you. Maybe a bit paranoid view, but, considering latest initiative from Google house, we should really take care about our privacy.

It is about interesting project called 23andMe (investors are Google and New Enterprise Associates – NEA). This service offers DNA analysis and services in style of social network page. Only saliva sample is enough to perform such test and after few weeks result is posted online. When database grows up, it can help also specialists to discover dangers through DNA. It looks like good idea, but it also collects data about individuals – and diseases and such are most sensitive and intimate data. Privacy in this case has to be protected on higher level, and since the system is online, it is only matter of time, when it become a target of cyber attacks.

Google has also another interesting projects regarding everyday’s life. Some of the ideas are really good and we also believe in good intentions, like in the case of financing renewable energy projects (and their own contribution to energy saving is Blackle.com). More or less, Google is moving into all fields and it has lot of informations about us, our needs, activities… Just think about it.