Amateur wireless LAN sniffers detected hundreds and potentially thousands of insecure business and home industry-standard wireless LANs in North America and Europe during the past week, in an electronic scavenger hunt dubbed the "Worldwide Wardrive".
Security analysts and wireless LAN industry executives said the results of the week-long Worldwide Wardrive indicate that many wireless LAN users still fail to use the most elementary form of security to protect their systems.
The Worldwide Wardrive was an exercise in detecting wireless LANs using free software called NetStumbler. While the demonstration was conducted by people who describe themselves as hobbyists, analysts warned that malevolent hackers and industrial or foreign espionage agents could easily exploit the holes found.
According to analysts, home users had the least secure wireless LANs but the hobbyists also detected hundreds of potentially vulnerable corporate or government networks.
Part of the problem concerns the Service Set Identifier (SSID), an identifier of up to 32 characters continuously transmitted by an 802.11b or Wi-Fi access point device.
Brian Grimm, a spokesman for the Wireless Ethernet Compatibility Alliance, a wireless LAN industry trade group said: "Everyone should turn off their SSIDs." If it is switched on a hacker can very easily detect the presence of a wireless LAN.
Grimm said enterprises should beef up their security with virtual private networks and filtering of Media Access Control (MAC) addresses. Each piece of hardware on a network has a unique MAC address, and filtering these addresses reduces the possibility of a hacker mapping and penetrating a network.
The large number of insecure LANs detected during Worldwide Wardrive week should serve as a wake-up call to corporate IT departments, said Chris Kozup, an analyst at Meta. "The enterprise needs to be taking a more activist approach to wireless LAN security," he said.
This was first published in September 2002