2008-08-10
LAS VEGAS -- Everyone connecting to the wireless network at the DEFCON hacking conference fears landing on the Wall of Sheep, a large projection screen displaying -- with some obfuscation -- any login credentials sent in the clear.
Yet, a large number of people appear to be unaware of all the ways that data can leak out from, not just their laptops, but their wireless-enabled cell phones, according to organizer Brian Markus. At both the industry-focused Black Hat Security Briefings and the DEFCON hacking conference, applications connecting to the Internet from mobile devices -- such as Apple's popular iPhone -- increasingly accounted for usernames and passwords leaked in easily readable format over the air. A Twitter application on the iPhone, for example, accounted for at least three entries on the Wall of Sheep.
"It's not necessarily the (device) vendors fault, because many of the applications are written by other people," Markus said.
Markus and the other organizers roughly guessed that a fifth of the leaked credentials were due to mobile device applications sending information in the clear.
Securing wireless networks has become a major focus of companies worldwide this year, according to recent study. More than a year ago, a researcher showed off a program -- dubbed Ferret -- that collects the information routinely sent out on the wireless network by devices and laptop computers. Last week, law enforcement officials nabbed the suspected data thieves that had allegedly stolen more than 40 million credit- and debit-card numbers from major retailers and restaurant chains. The security hole exploited by the attackers? Wireless.
Applications that immediately connect to the wireless network to check for new data also accounted for a large number of compromised credentials. Even before users can activate their virtual private network (VPN) software, some software will promiscuously connect to the wireless network and attempt to download e-mail or other data, Markus said.
"People understand that they need to use a VPN or use SSL," he said. "But they have applications that they don't know about auto connecting to the network."
The Wall of Sheep organizers urged wireless users to make sure that their devices are locked down and secure before they leave their home networks.
If you have tips or insights on this topic, please contact SecurityFocus.