Quarter Of London Wi-Fi Networks ‘Unsecure’

Over a quarter of London Wi-Fi networks are poorly protected and open to on-the-move hackers, otherwise known as ‘war drivers’, looking to pilfer data, a security firm has warned.

Research from Sophos showed that out of nearly 107,000 wireless networks, 27 percent either had no encryption whatsoever or else used the WEP encryption, a form of protection known to have numerous flaws.

Way back in 2001, researchers showed how it was simple to crack the key used in WEP. Since then, automated tools have been created, such as aircrack-ng, making it easy to crack keys in minutes. Wi-Fi vendors have responded, and the more secure WPA protocol should be in use everywhere.

Sophos’ director of technology strategy James Lyne showed how poor Wi-Fi security was across London by cycling around the capital equipped with a solar-powered computer designed to scan networks. Whilst no major organisations were shown to be guilty of poor Wi-Fi security, a large number of small and medium-sized businesses and residential areas were using weak or no encryption on their networks, Lyne told TechWeekEurope.

His research showed eight percent of hotspots used no encryption, whilst 19 percent were running WEP. Others were using the WPA and WPA2 standards.

‘Alarming data’

“The data is alarming but it is nothing compared to what a penetration tester or a hacker could do,” Lyne said. “The real picture is far worse.”

Once a hacker has cracked the network, they can do a host of nasty things. Lyne showed how simple tools in the Backtrack penetration testing platform could set up phishing pages that look like popular webpages, such as a Gmail login page. When users then search for gmail.com, they are presented with what looks like a genuine page, but is in fact only a fake page designed to dupe people out of their login details.

Otherwise hackers can simply watch over users’ Internet activity or hijack their Facebook or Twitter sessions, amongst other nefarious activities.

Whilst users should wise up, Lyne called on those selling Wi-Fi network gear to enforce better security on users and to phase out the use of WEP.

“The guys using WEP think they are secure and have done the right thing, but their networks can be broken in the worst case in the couple of minutes, in the best a couple of seconds. There is no success for that category of users,” he added.

“The levels of vendor responsibility vary massively… Why call it WPA2, WPA and WEP? Why not say ‘very high security’ or warn people when low security is being used? Engineer it to getting people more secure. There is no reason not to.

“No products do that. They are all very matter-of-fact configuration. It’s not very friendly for a small business or a home user. I would call on people to make this more secure out of the box.”

He mooted the idea of a security standard, which Wi-Fi kit manufacturers would have to comply with. “It’s not like there’s a downside,” he added

The Sophos director uncovered other bad practices. Nine percent were using default network names with no random element, making password hacking even easier for cyber criminals. Many service providers’ packaged offerings did not include a router that automatically generated truly random names.

Lyne made it clear Sophos didn’t “do a Google” and take data whilst on the rounds, or break the law in any way. Sophos has also issued advice for businesses to ensure they are following best practices when it comes to Wi-Fi security, which you can find here.

How well do you know Internet security? Try our quiz and find out!