Insecure WiFi At 30,000 Feet

Last week I attended Agora,  an elite cyber-security gathering at the University of Washington campus in Seattle. This is an event that is held every few months for security experts in business, academia, government and law enforcement. One of my colleagues, steeped in the skills of network penetration, flew to the conference on a cross-country Delta flight.

He told me with great interest all about how he used the Gogo WiFi internet service on his iPad 2 tablet during the flight. You might think he was surfing, doing email, or reading the New York Times during the long flight, like a normal passenger. Nope, our penetration specialist was instead port-scanning the wireless router on board the aircraft. He was gathering information on all the passengers logged into the service, which is now prevalent on board many Delta, United, Continental, Air Canada, U.S. Airways, Air Trans, Virgin America, Alaska, and Frontier aircraft throughout the United States. The connectivity is quite good, in fact so good that it allowed my associate to use this wireless router as a launch-point to connect to a  server in Asia that is suspected of being a hacker haven and examine and document its local configuration.

Passengers need to be aware of the security vulnerabilities of accessing any public wireless network from a laptop  while on board an aircraft or cruise ship or from other public venues. Earlier this year I contacted Gogo and sent them a detailed request for technical information on how they secure their environment and that of their clients.  Although they initially said they would provide the requested data, they later refused to offer any information whatsoever.

Their service allows access to email, web, banking and virtually anything you can do from the office or home. I use my Android phone and tablet to receive and respond to email, although my Blackberry will not work on the system. I have obtained speeds of up to 250 Kb/s, which is not bad considering the environment. I find many passengers are using the service on their laptops and tablets and smartphones. The problem is that it is no more secure than any other public network, and depending upon the status of the computers that are accessing the network, can pose a real security threat to users, especially if the flight has a “hacker” passenger on board.

I spent several hours with my colleague in order to understand exploits and potential risks on Gogo and other public access services. Because all users on board will likely be using one IP subnet, all of their computers can be easily scanned for open ports that can be compromised.

Every computer has a unique MAC address, or machine ID. The first four characters of this address identify the manufacturer, so if you walk down the aisle, you can begin to associate traffic with one or more target computers. If someone is using a Lenovo, for example, you can begin to target that particular computer. This would be especially troublesome if you were a person who was actually in the sights of a sophisticated hacker as part of an effort to compromise critical corporate or personal information.

If you were under surveillance and followed, this could be a problem. I was just in Tel Aviv and Zurich meeting with a colleague who has been quite successful in tracking major fraudsters through various tools that are all based upon Internet usage including popular VoIP communications facilities which can yield a great deal of information with the proper access.

You may feel you're secure by logging into your mail server, office, bank, or brokerage with SSL or TLS encryption. Yes, the session is secure, but your computer is a different story. If it has security vulnerabilities that have not been fixed by software updates, then it can be compromised at a lower level and the contents of your session captured in an unencrypted state.

An application such as a key-logger can be secretly installed on your computer while you are online. This can capture in plaint-text all of your session traffic and screen shots. All of your traffic can then be monitored real-time, uploaded to an email address later, or upon command by the bad guys. You will not know it. We used to employ this piece of software to monitor and catch pedophiles that were accessing child pornography sites. They never knew we were watching them until they were arrested.

Your greatest vulnerability is the failure to keep your computer updated from Microsoft, Apple, or Google for security patches, not only for your laptop but for the software it runs as applications. Up to ninety percent of all computers are not routinely updated and are at risk, according to FBI studies. If there is a way in, it may be easily exploited.

My colleague explained that he was using a program on his iPad called Scany,which was available on the App Store. It scans packets and all of the traffic on the subnet. He explained that code could be injected into a target computer to obtain personal information.

It gets better.

Your computer can be used as a launching pad for other attacks or to exploit access to your computer remotely.  So on the plane, you could use another passenger's computer to launch attacks against other passengers.  If one of the passengers was smart enough to trace back the attack, the wrong computer/person would be identified as the hacker.

If you want to insure the security of your session, you should, at a minimum do the following:

• Be certain that your computer and tablet has the latest security patches and is fully protected with ALL vendor patches, and that Anti-Virus is running, together with a firewall, and the system is being monitored for malware;
• If you are running a Mac it may be less vulnerable, but vulnerable nonetheless
• My experts prefer the following programs: MalwareBytes and Emsisoft, Webroot and Norton or McAfee for Anti-virus
• Use a Virtual Private Network if possible, or at least an encrypted session
• Use an iPad or Android tablet rather than your laptop. It is less prone to malware and the ability to inject Trojans and other executable programs. These devices may be much more secure than Windows or the MacOS
• Turn Bluetooth discovery off. Bluetooth can act as a gateway just like WiFi
• Use an encryption level of WPA2 personal, at the very minimum

If you really want to be certain that your data and sessions are absolutely secure, then use a hardware encrypted USB memory device loaded with the operating system for your computer.

The U.S. Navy does this, through a secure system currently on a USB device called “NMCI on a Stick”, This was a McAfee security offering to the military which was released through NMCI-McAfee partnership. The acronym NMCI means Navy and Marine Corps Intranet. NMCI came into existence about eight years ago and was an EDS project, which is now owned by HP.  McAfee partnered with MXI Security to develop this product. The same device is offered in the commercial sector from MXI in the U.S.

In my next article, I interview Christian Gunning, one of the founders of Boingo Internet service, which has more than 325,000 hotspots in their network. His company is defining security risks for all of their locations in order to protect its users.