From Dial-Up to Wireless
The early days of the internet, where dial-up connectivity was the norm, are gone for most users around the world. Even though some two million US users may still pay AOL for the privilege of internet access, especially in rural areas or where broadband costs are too high, this method is extremely rare: the relative privacy of the landline has given way to the digital age.
With the advent of wireless networks, introduced in 1998, users with WiFi-enabled devices have been increasingly finding free internet access readily available, perhaps without realizing that malicious actors are peering at—and even hacking—public wireless spaces from nearby locations, including places of business and even parking lots.
Enter the drive-by cyberattack scenario.
The Public Wi-Fi Space
Unlike the public switched telephone network (PTSN) of old, wireless local area networking (WLAN) has a special problem: anyone within range of an unsecured wireless signal can attempt to access the network, making public WiFi particularly vulnerable to cyberattack. Public wireless hotspots offer eavesdroppers wide reception ranges, particularly outdoors or through overlapped access points. These days, WiFi users need to be careful when choosing to connect in a public place, such as Starbucks, the local library, or Barnes & Noble. Eavesdropping on traffic or obtaining personal information is far easier than simply looking over a shoulder anymore. Free WiFi remains a popular way to attract customers or provide instant access, including hotels and even ISP providers who offer free hotspots on their networks as a perk. But research also indicates that hackers are increasingly targeting home WiFi networks, as users who do not rely on ISPs to provide wireless routers are not correctly securing their home routers or updating the firmware on a regular basis.
Malicious actors are therefore not only looking for free internet access, but are attempting to break in to the network and ‘listen’ to traffic to gain access to personal information, using techniques such as:
• Sniffing – intercepting wireless data that is being broadcasted on an unsecured network
• Wardriving – driving around a city picking up wireless data
• Spoofing – creating a new network with a stronger wireless signal and a copied SSID in the same area as a legitimate network
• Encryption Cracking – hitting a network with a brute-force attack that throws random words at a secured wireless network to gain access
Once access is nefariously gained, hackers can potentially access private information through the use of keyloggers (recording keyboard strokes on a victim’s machine) or other password decryption methods. Additionally, the Internet of Things (IoT)—physical devices, vehicles, home appliances, and other items embedded with electronics, software, sensors, and connectivity which enables these objects to wirelessly connect and exchange data—has also left consumers open to wireless network and device tampering.
Business Risk and Prevention
But malicious actors are not limiting themselves to unsecured or poorly secured wireless routers in the home or in public spaces. Businesses are on the rise for cyberattacks as well, with intrusions, spam, and social engineering attempts filtering in through wireless (and wired) networks, which can be considered additional ‘drive-by’ attack methods. Enterprises and other organizations are increasingly implementing monthly training to ensure that employees are aware of current cyber threats and what they can specifically can do to increase security and reduce risks on the job.
No business can completely eliminate drive-by attacks, but educating the workforce is a great step forward in reducing the overall risk, as drive-by attacks can also occur over wired networks through downloading of malicious attachments or clicking fraudulent links in emails.
Best Practices
As time passes, hackers are becoming more educated in the world of manipulating and bypassing computer security. Each year, more and more people and businesses are breached: for fun or to gain information. To a hacker, it is the thrill of gaining access to a system or obtaining confidential/private information and selling it for profit. For consumers and businesses, using free internet, when available or when necessary, is acceptable as long as the user understands that these networks are not secure and should never be used for personal activities, such as banking or confidential communications.
On home routers, it is always a best practice to not only create a password for a router and change it periodically, but also to create strong passwords with combinations of letters, numbers, and symbols for home routers. Strong passwords are less susceptible to brute force attacks that hackers use to surface passwords. Additionally, router vendors offer free firmware upgrades that keep pace with the changing security landscape; users with home routers should subscribe to vendor emails, checking for and updating the firmware frequently or as updates become available. In the workplace, it is a best practice to continually train employees through formal Security Awareness programs that educate them on what to look for so they do not become victims of drive-by cyberattacks.
