The Dangers of Free Wireless

I know that a lot of people here try to log on during their travels and road trips, sometimes using internet cafes and sometimes searching for that unsecured wireless signal. I don't know what the US laws are on this issue, but in the UK, apparently it's illegal: http://www.msnbc.msn.com/id/20397843/.

apparently it's illegal:

so is speeding.

I think I've heard of a few similar cases here in the U.S. as well. Fortunately, when I've needed a wireless signal while traveling, I've generally been able to find free access somewhere. I will admit, however, then when I visit my parents back in Ohio, I avoid their dial-up connection and use my laptop to piggyback onto a neighbor's unsecured wireless signal. My parents have since entered this century and have broadband now, so I guess I won't need to do that anymore.

Apparently police in the UK have nothing better to do than find people using unsecured internet connections and make examples of them.

Personally, I was always very cautious about the internet connections I'd use when traveling. You never know who is hosting that free line and whether they are simply hosting your connection or monitoring your transactions.

Here is an interesting article on the BBC this morning regarding this subject. http://news.bbc.co.uk/2/hi/uk_news/magazine/6960304.stm

When you connect to a network you have to get an IP address via DHCP from the host. The owner can review the lease table and see what computers are connected, usually showing the computer name or something that would clue them in to intruders. I've seen people connect to my home network before I secured it. checking the lease table is usually manual but there are probably apps that could alert you to new connections if you were paranoid.

Also, there are some vulnerabilities to being connected to a wireless network. Of course, as Mel mentions, any packets passing through a router can be sniffed/inspected and reassembled (maybe), but beyond that, if you don't have a good firewall or other measures on your computer you can open yourself up to attack just by joining a net. It's not that prevalent but possible.

I agree with Darren, if you don't want people to syphon your wireless connection encrypt it!

Silly legislators, nets are for surfing.

"... the owner should be whooped for being so stupid for not putting a password on it."

Hey, I resent that remark!
I don't have a password for my wireless at home but then the nearest neighbor is about 100 yards away and the road is about 30. I don't think the signal could reach either. Maybe the road but someone would have to park at our driveway entrance to get out of the way - that would be a little obvious.
I haven't done much wireless connecting while traveling yet. It's a new frontier for me.

Packets can be monitored and decripted by those with the desire and knowledge to do so. There are actually fishing schemes where people will sit at airports and turn their laptops into wireless service providers, mimicking the AT&T or whatever system in the airport and gather CC info as people attempt to access the internet.

Its apparently not even that complicated to break the encryption on a WEP connection and simply eavesdrop on a connection. Some articles I've read indicate that it only takes about 30 minutes to gather enough data to break a 28bit WEP encryption. Once that is done someone can actually read the content in each of the packets you send and receive. When you interact with an HTTPS site, in theory, this data is still encrypted.

One other note. My neighbor is also a computer guy. When I first moved into the neighborhood, he told me of another type of scam that was happening in our area. People apparently drive around looking for open wireless connections and then park and use that point to send spam and phishing schemes. When the police track the scheme back (like they would ever do that), they would just get the IP address for the house hosting the wireless network.

This is why you should lock down your wireless network.

Actually, you don't even need to look for a stray IP address. Every wireless card has a unique identifier (out of the factory) which is a 6 hex-digit hardware address. Even if you don't get an IP address, most wireless base stations will log the hardware address of any card that tries to gain access. There's a feature on the base stations I've used to lock out unwanted hardware addresses. That would be the first step anyone should do to prevent access to their networks as that makes it harder (though not impossible) for bad guys to access your networks. Then turn on the best encryption scheme available for the station. If you have WPA available, I believe it's better than WEP.

On my wireless router, I use the following security options:
1. Disable SSID broadcasting. Easy enough. People won't see your network listed when they view available wireless networks. I know the name of my SSID, so I can set up a connection without having the name broadcast.

2. Set up WPA encryption.

3. Set up MAC address (the hardware address that Laurent mentions above) filtering so that the only computer that can access the network is my laptop. I've never had anyone else come over and want to use their own computer, so this isn't an issue. The only issue I had was when my company laptop got switched out, and I forgot to change the MAC address filtering. I had a heck of a time figuring out why I couldn't access my own network. Once I went through my router settings, I remembered the filtering, changed it, and I've been fine ever since.

This seems like a lot, but it only takes about 5 minutes to set up, and I never have to deal with it again (unless I switch laptops, of course).

Yep - I use MAC filtering as well and have been bitten by a change of motherboard (integrated Eth adapter) or adding a new laptop. If I can easily lock myself out of my own network, I figure it's a resonably good layer of security.

I'm sure you can spoof the MAC somehow, but why would someone go through all that trouble when there are so many easy targets out there.

For my home network, I do the same thing as Brent has described. It's not 100% fool proof, but unless someone was specifically targeting my network, they would probably just move down the street and use the open network my neighbors have.
As for when on the road (and even here at work) I use a Verizon aircard. Tight, proprietary system, and in many parts of the country, speeds equal to base level DSL. Not cheap , but pretty secure.