Wireless perils are nothing new

NETWORK WORLD NEWSLETTER: M. E. KABAY ON SECURITY
06/07/05
Today's focus: Wireless perils are nothing new

Dear security.world@gmail.com,

In this issue:

* A short history of security hazards of wireless communications
* Links related to Security
* Featured reader resource
_______________________________________________________________
This newsletter is sponsored by Good Technology
Network World Executive Guide: Wireless Security. New Standards
make it easier than ever

As wireless LAN technology reaches the mainstream of enterprise
IT, security continues to be the top barrier to adoption. In
this report, we detail the possible approaches to wireless LAN
security and talk to experts who provide analysis and
recommendations on which ones to use. Register today and get a
free copy of Network World's Wireless Security Executive Guide.
http://www.fattail.com/redir/redirect.asp?CID=106130
_______________________________________________________________
Exclusive new event eliminates analysis-paralysis in the world
of anytime-anywhere broadband

Working in any of these key wireless spaces?--LAN * WAN * Mobile
Services * Subscriber Units * Remote Applications. ÊWireless &
Mobility: Commanding Broadband Everywhere is the breakthrough
event and expo youÕve been waiting for. ÊTools, tech, and
solutions. ÊClick for cities and dates, reg details and
qualifications that get you in free
http://www.fattail.com/redir/redirect.asp?CID=105731
_______________________________________________________________

Today's focus: Wireless perils are nothing new

By M. E. Kabay

When wireless telephone handsets (ordinary phones useful for
short-range wandering around the house and garden, not cellular
telephones) were introduced into the home market years ago,
teenagers very quickly discovered that it was the handset that
controlled connection to the public switched telephone network.
In other words, putting the handset down on the cradle or
picking it up had nothing to do with whether the phone could
connect to the PSTN.

Kids began walking around their neighborhoods with their
parents' wireless handsets turned on; after a few hundred feet
from home base, they would lose the dial tone. If they kept the
handset on, though, sometimes they'd get another dial tone -
this one from a compatible wireless phone in a neighbor's house.
The kids could then place long-distance or other chargeable
calls at someone else's expense with little chance of discovery.
Sometimes they'd hear a conversation in progress and eavesdrop
for a while.

These no-security phones suffered from several design problems:

* Phones from different manufacturers nonetheless had
  considerable interoperability.
* The transmissions were unencrypted.
* It was difficult to detect an intrusion while it was
  happening.

Manufacturers scrambled to fix the problems by introducing a
wider range of frequencies (so that the handset and the base
station could communicate but other phones would be less likely
to hit the same frequency) and some simple encryption methods.
Even so, I remember warning corporate clients never to allow a
wireless handset into their offices for confidential
communications. And as for the idea of using those wireless
handsets in airline clubs, ptooie - never use one of those to
talk about sensitive details. You never know who might be
listening:
<http://www.spybusters.com/wireless_phone_alert.html>

Cellular (mobile) phones are relatively secure today.
Nevertheless, some security experts routinely answer calls on
these devices with, "Hi, this is <name>. This line is not
secure." See:
<http://www.tinhat.com/cell_phone/mobile_phone_security.html>

Similar problems of excessive transparency occurred in the 1980s
when wireless LANs began arriving into the world of IEEE 802.3
Ethernet communications. Early wireless LANs offered
dramatically lower installation costs (retrofitting LAN cable
into a ceiling or wall is a dusty, tiresome and expensive job),
but they had no encryption at all. People worried even then
about the safety of using such systems for any kind of sensitive
or critical application.

A similar set of problems has developed with wireless
communications using the newer protocols that allow access to
the Internet as well as to intranets.

For those who want a six-page overview of wireless LAN security,
I recommend Christopher Klaus' excellent FAQ:
<http://www.iss.net/wireless/WLAN_FAQ.php>

For those even more interested in detail, see Matthew Gast's new
book from O'Reilly.
<http://www.oreilly.com/catalog/802dot11/index.html?CMP=IL7015>

In my next column, I'll look at mobile phones that are designed
for industrial espionage.

RELATED EDITORIAL LINKS

Companies rush to plug 'data leaks'
Network World, 06/06/05
http://www.networkworld.com/news/2005/060605-data-leaks.html?rl

Network World, 06/06/05
http://www.networkworld.com/news/2005/060605-data-leaks.html?rl

3Com quarantines malicious traffic
Network World, 06/06/05
http://www.networkworld.com/news/2005/060605-3com.html?rl
_______________________________________________________________
To contact: M. E. Kabay

M. E. Kabay, Ph.D., CISSP, is Associate Professor in the
Division of Business and Management at Norwich University in
Northfield, Vt. Mich can be reached by e-mail
<mailto:mkabay@norwich.edu> and his Web site
<http://www2.norwich.edu/mkabay/index.htm>.

A Master's degree in the management of information assurance in
18 months of study online from a real university - see
<http://www3.norwich.edu/msia>
_______________________________________________________________
This newsletter is sponsored by Good Technology
Network World Executive Guide: Wireless Security. New Standards
make it easier than ever

As wireless LAN technology reaches the mainstream of enterprise
IT, security continues to be the top barrier to adoption. In
this report, we detail the possible approaches to wireless LAN
security and talk to experts who provide analysis and
recommendations on which ones to use. Register today and get a
free copy of Network World's Wireless Security Executive Guide.
http://www.fattail.com/redir/redirect.asp?CID=106129
_______________________________________________________________
ARCHIVE LINKS

Archive of the Security newsletter:
http://www.networkworld.com/newsletters/sec/index.html

Security Research Center:
http://www.networkworld.com/topics/security.html

Instant sign-up for Security News Alert:
http://www.networkworld.com/isusecna

Instant sign-up for Virus & Bug Patch Alert:
http://www.networkworld.com/isubug
_______________________________________________________________
How well do you know your customers?

Accurate customer data directly impacts loyalty and business
planning, yet few companies update data regularly. Experts
address the challenges of ensuring a consistent, coherent
customer view across the enterprise.
http://www.fattail.com/redir/redirect.asp?CID=105732
_______________________________________________________________
FEATURED READER RESOURCE
CALL FOR ENTRIES: 2005 ENTERPRISE ALL-STAR AWARDS

Network World is looking for entries for its inaugural
Enterprise All-Star Awards program. The Enterprise All-Star
Awards will honor user organizations that demonstrate
exceptional use of network technology to further business
objectives. Network World will honor dozens of user
organizations from a wide variety of industries, based on a
technology category. Deadline: July 8. Enter today:
<http://www.networkworld.com/survey/easform.html?net>
_______________________________________________________________
May We Send You a Free Print Subscription?
You've got the technology snapshot of your choice delivered
at your fingertips each day. Now, extend your knowledge by
receiving 51 FREE issues to our print publication. Apply
today at http://www.subscribenw.com/nl2

International subscribers click here:
http://nww1.com/go/circ_promo.html
_______________________________________________________________
SUBSCRIPTION SERVICES

To subscribe or unsubscribe to any Network World e-mail
newsletters, go to:
<http://www.nwwsubscribe.com/Changes.aspx>

To unsubscribe from promotional e-mail go to:
<http://www.nwwsubscribe.com/Preferences.aspx>

To change your e-mail address, go to:
<http://www.nwwsubscribe.com/ChangeMail.aspx>

Subscription questions? Contact Customer Service by replying to
this message.

This message was sent to: security.world@gmail.com
Please use this address when modifying your subscription.
_______________________________________________________________

Have editorial comments? Write Jeff Caruso, Newsletter Editor,
at: <mailto:jcaruso@nww.com>

Inquiries to: NL Customer Service, Network World, Inc., 118
Turnpike Road, Southborough, MA 01772

For advertising information, write Kevin Normandeau, V.P. of
Online Development, at: <mailto:sponsorships@nwfusion.com>

Copyright Network World, Inc., 2005