untangling_the_web

DOCID: 4046925
UNCLASSIFIEDiiFO~OfflelAL liSE m.L¥
connection.!" In fact, if you use WiFi without encryption, expect that anyone and
everyone can read everything you read and write, and track every move you make.
You also need to be aware of the WiFi "evil twin" scenario, an attack that is
remarkable both for its simplicity and its effectiveness. Here's how it works. The bad
guy takes his laptop to a popular coffee shop where lots of people like to use the
Internet while enjoying a cup 0' joe. The bad guy has set up his computer to transmit
a signal that turns his laptop into an Internet gateway or access point, one that looks
and sounds remarkably legitimate. Here you come, mocha frappuccino in hand; you
open your laptop, start searching for a local WiFi connection, and-bingo-in
addition to that coffee shop's fee-for-service Mobile Hotspot, there is a second
option Cheap & Friendly Mobile Hotspot or maybe even a Free Mobile Hotspot. If
you are like most people, you might well log into the cheap or free service, assuming
they are legitimate WiFi hotspots. And what happens if you do log into an evil twin
WiFi access point? The bad guy will have software on his computer to capture every
keystroke you make, so whatever you have entered once you've logged in, he now
owns. And if you used a credit card to log into the cheap WiFi hotspot, the bad guy
now has that. Even if you sent any encrypted data, such as a password, that's still
probably not a problem for the bad guy because he also undoubtedly has software
to break that, too.
The problem is obvious: you don't want to fall prey to this evil twin attack, but how to
avoid it and still use WiFi hotspots? Here are good suggestions from PCWorid
Magazine:
"Check Your Wi-Fi Settings: Many laptops are set to constantly search and log
on to the nearest hotspot. While this option might seem convenient, it does not
allow you to monitor which hotspots you are logging on to and determine if they
are legitimate. Turning off this option will prevent your computer from logging on
to a hotspot without your knowledge.
Pay Attention to Dialog Boxes: Pop-up warnings are there for a reason-to
protect you. If you are lucky enough to have not clicked the "never show this
again" option, make sure you read these warnings carefully before agreeing to
send information.
Use One of Your Credit Cards on the Web Only: Open a credit card account that
is used solely for the purposes of shopping on the Web. Ideally, you should be
able to access account records online so you don't have to wait for monthly
statements to monitor any activity. "Be prepared to close that account on short
notice if it's been compromised," says Schiller.
Conduct Private Business in Private: "Maybe you don't need to move money
around or check your bank statements when you are connected to a public
175 David Pogue, "How Secure is Your WiFi Connection," Pogue's Posts, The New York Times, 4
January 2007, , 16 January 2007.
UNCLASSIFIEDHFOR OFFISIAL l-:JSE g~Jb¥ 523