Wherefore broadcast SSIDs?

It really is amazing how many open wireless network you can find. If you are somewhat technical, get a wireless scanner (like NetStumbler) and see what you can find. Once you are in there, you can use an open source tool like Metasploit to attack, I mean test, the machines you find on the open network. Statistically, you'd probably be successful in compromising machines a majority of the times you try.

Yes, that's scary stuff. It's also why the first step on Security Mike's Guide is to secure your networks. One of the common misconceptions is that you need to stop broadcasting your SSID, which is the network identifier of your wireless network. I'm with Steve Riley on this one. He does a pretty good treatment about why it doesn't matter whether you broadcast or not.

Whether someone can see your network or not is besides the point. The real question is whether they can access it. By doing some very simple security configurations on your wireless router, you can make it a LOT harder to penetrate.

Photo credit: dasmart

Don't bank at Starbucks

The Wall Street Journal's Walt Mossberg has some sage advice here about what you should and SHOULD NOT do on public Wi-Fi networks. The reality is that it's easy to compromise your machine and your data on these networks. A bad guy can set up a fake access point, or compromise your internal routing tables, or download a Trojan onto your machine.

I know, I know - what else are you going to do at Starbucks? You've got a couple of options. Personally, I use a 3G EVDO wireless service from Verizon (Sprint and AT&T also have competing services) to provide my connectivity when I'm out of the office.

Yet, the reality is that I do connect on some public WiFi networks. It's not frequent, but it does happen. To protect those sessions, I use a public VPN service to encrypt the traffic from my machine to the Internet. The service I use is from WiTopia. There are a bunch of other one's and you could also set up a proxy server on your own network if you are technically-inclined.

The main point is to reiterate Mossberg's view. Don't do anything sensitive on a public WiFi network. It's bad for the health of your identity.

Don't weep for WEP

I'm going to preview Step 1: Securing Your Network tomorrow for those of you that have already purchased Security Mike's Guide. Not to steal my own thunder (or give away the store), but one of the defenses is to encrypt your wireless connection.

But you shouldn't use WEP. Or Wired Wireless Equivalent Privacy, which pretty much has more holes than Swiss Cheese. The folks at Symantec cover a new WEP attack that can break a long WEP key in less than 60 seconds. You may as well not have any security.

WEP was a start, but at this point it's no good and you shouldn't use it. Don't take it from me, listen to world renowned security expert - Bart Simpson.