With Wireless, Who Can You Trust? No One No Threat of Danger Here... Linda LeBlanc
No Threat of Danger Here...
OK, you say, but you don't use any public wireless networks. You check your email every once in a while over at your friend's house, but that's it. And besides, you only check your junk email account on Hotmail. You don't do anything that could remotely endanger your personal data.
Fine. Let's look at that a bit closer though for a second.
This friend of yours, is she paying for her Internet access? Is she running wireless? Does she really know that much about computers and networks? Is she shrewd enough to keep her computer patches up-to-date, and does she have her firewall turned on? Does she get all sorts of junk mail that she clicks on, along with little programs that she installs, infesting her computer with spyware and adware and any number of little malicious tidbits? If she's running wireless, does she have her data encrypted? Is her wireless password protected, or is she naively beaming access to the entire apartment building?
Now let's think about something else.
Let's think about this junk email account of yours on Hotmail. Let me guess: You only use this for eBay, uBid, and onsale.com. This is the account you use for stuff you don't want coming to your work email address. Maybe you even use it for your PayPal account. And you're thinking that even if your spamjunkbin@hotmail.com address is compromised, no harm will come to you.
But don't forget that, most likely, all of your transactions are on that server, allowing any intruder to reconstruct your account numbers, or possibly even get your passwords, or at the very least your password hint question. It's always a possibility.
Now, Microsoft suggests you use a firewall. This doesn't protect your data after it leaves the machine. The company also suggests "hiding your files." I won't even dignify that with a comment. Finally, Microsoft suggests that you not send credit card numbers or passwords over a public network. Certainly, the most effective protection against an untrusted public network is to not use it.
The Virtual Private Network (VPN) is probably the best answer easily available. A VPN works by building an encrypted tunnel back to your home network (either your office or your ISP), and then forwards all your traffic from there, as if it were originating on your trusted network. The idea is that the path from the VPN to mail server or Web server is on a trusted path and is not likely to be sniffed.
If you don't know whether you have access to a VPN, you should go speak to your most trusted IT guru. He will either get you hooked up with a VPN or let you know that it's unavailable. If it's unavailable, contact your ISP and ask them about availability.
The moral of the story is that you might never guess who is capable of digital snooping, of sniffing your wireless traffic.
Who can you trust to not sniff your traffic? Can you trust that guy hunched over his computer in the corner? How about the chick playing with her PDA? (Yes, they make sniffer packages for PDAs.) What about the person in the back room who fires up his laptop and sets it to full promiscuous mode to save-to-file everything that goes by, all before he puts on his cheerful uniform and comes out to make your latte?
Face it, you can't trust any of them.
Sometimes when I meet people for the first time and I try to explain to them what I do, just saying I'm a network security analyst isn't sufficient. I try to explain that I look at the world in a way that allows me to see the hazards that might be used against my customers. Many think I'm paranoid, including my parents, who don't really understand exactly what I do. But I'm not paranoid. I'm simply very pragmatic, and I'm very aware of the wolf in sheep's clothing.
I believe if I can think it up, someone else has already thought it up and implemented it.
