In the past I have written about the proliferation of Wi-Fi and the pitfalls that come with such technology. New technologies evolve and continue to deploy until they are commonplace. Such is the case with Wi-Fi, with many municipalities looking at public networks and traditional carriers putting “hot spots” in public phone booths. Threats to security have continued to increase with the exponential gain in viruses, trojans, worms, rootkits and no doubt threats that are yet to be named. While the convenience of wireless access has made it a mainstay for travelers, security should still be an area for vigilance and concern.

Wi-Fi Openness presents complex issues
Just as with open sources applications and operating systems, public WI-FI hotspots present a serious and complex set of security issues just as do open source code programs. In order to be open, most Wi-Fi hotspots have no encryption or filtering protections for users. This makes the people who use those public hotspots easy targets for hackers and cyber-criminals. Hackers have often spent time on public Wi-Fi networks with a simple, single purpose; to sniff out passwords and credit card numbers in the network traffic. If users have sharing turned on (with the Everyone group included) the cyber-thieves can have direct access to their hard disks. As a user, you trust that the Wi-Fi hot spot is “real” and not a “covert” one. There are many documented cases of malicious hotspots, set up by cyber-criminals, as "free" Wi-Fi networks in public places like airports and parks to trap unsuspecting users. Just as malware often mimics the names of real processes, these hotspots can mimic the names of real hotspots. We were all taught what happens when you assume. Well, it applies to public Wi-Fi hotspots with a vengeance! What can you do to protect yourself at public hotspots?

How do I protect my computer?
Actually, it is rather easy. You just need to follow this twelve step program for public Wi-Fi security! Here is a very basic list that all mobile users who access public Wi-Fi hotspots should follow:

1. Make sure you're connected to a legitimate access point. Check for a sign that indicates there is a legitimate hotspot provider located where you are.

2. Turn off your Wi-Fi Network Card when not in use.

3. Use encrypted / secure connections for e-mail. This could be setup in your client (i.e. Outlook) or use a secure web connection.

4. Use a personal firewall and make certain it is turned on

5. Use anti-virus software and make certain it is active!

6. Update your anti-virus software before you travel. Make it a daily practice!

7. Update your operating system regularly. Consult your IT Department for guidance!

8. Be aware of people around you, especially when typing your username
   / password.

9. Turn off file sharing, or make sure you are in compliance with the setup put in place by your IT department.

10. Password-protect your computer and important files and don’t have it stuck to a Post-It note on the computer!

11. Use a virtual private network (VPN) if available. If not, use legitimate connections, as noted above, from sources you know (i.e. Starbucks, the airline, restaurants, etc.)

12. Do Not Connect to anything reporting itself as an Ad-Hoc network. These are often man-in-the-middle connections set up by cyber-criminals. Make sure the ad-hoc connection is not enabled on your machine, per the policies of your IT Department

Security is Everyone’s Problem
The bottom line is that security, no matter where or how you are connected, is everyone’s problem. If your machine is not secure and you have connected via Public Wi-Fi connection to your home broadband network and via the hardwired Ethernet network at the office, you are the pariah, putting everyone and every computer at each of those locations at serious risk of Virus / Worm / Malware / Trojan or Rootkit infections you picked up while connected to public Wi-Fi. Vigilance is the key, just as with any other security issue. If you have questions or comments about this article, contact me.
 

All product names / logos, company names / logos are copyrights of their respective holders. John Boline is an MCSE, CNE, USE and a member of the Network Professional Association. The content herein is often based on late-breaking events. Much of the material is based on information from sources that are believed to be reliable. Hagerman & Company, Inc. disclaims all warranties as to the ultimate accuracy or completeness of the information. Hagerman & Company, Inc. and its employees shall have no liability for errors, omissions or inadequacies in the information contained within this article or for any interpretations thereof. The recommendations, positions and best practice policies outlined herein represent Hagerman & Company, Inc. initial analysis and therefore are subject to change as further information which may have bearing on these positions is made available. The reader assumes sole responsibility for the selection of these materials to achieve its intended results. The opinions expressed herein are subject to change without notice. Entire contents © 2007 Hagerman & Company, Inc. All rights reserved. Reproduction of this publication in any form without prior written permission is forbidden.