iStockphoto
by Steve Henn NPR.org
June 13, 2014
Despite the fact that every major Internet provider has added some kind encryption to its services over the past year, tracking your online traffic is easier than you think.
And you don’t have to be the target of the hacker or the NSA for your traffic to be intercepted. There is a hole in mobile security that could make tens of millions of Americans vulnerable.
Unsecure Wi-Fi networks have been a well-known vulnerability in the tech industry for years. They can let even the most unsophisticated hacker capture your traffic and possibly steal your identity.
Opening The Door To Hackers
Earlier this spring, when I conducted , Sean Gallagher, a reporter from the , came to my house and we connected a little device called a Pwn Plug — invented by Dave Porcello, — to my network.
Seeing just how much data streamed out of my phone the second I connected was a big surprise. My phone pinged Apple, Google and Yahoo. Then apps like Twitter and Facebook connected to the Internet. This all happened in just seconds of it simply sitting on my desk. I hadn’t touched the phone.
If Porcello had been a hacker, those few seconds could have been a gold mine.
“Anything you are logged into when you reconnect it basically relogs in, so there is an opportunity for an attacker to capture the cookie or maybe even the password,” he said.
And chances are good that your beloved smartphone is constantly — relentlessly — looking for networks to connect to.
“When you have wireless turned on,” says Oliver Weis, who works with Porcello at their company, Pwnie Express, “your phone or your laptop is sending out what are called probe requests out to the world — saying, ‘Hey, where is my network? Where is my network? Is this network around? Where is this network?’ “
There is this book I read to my kids by P.D. Eastman called Are You My Mother. It’s about this tiny baby bird that goes wandering around the world asking whatever it meets, “Are you my mother?” It asks a cow, then a dog and then a cat. Weis says there are evil Wi-Fi networks out there in the world programmed to act like a hungry cat that say, “Yes, I am your mother; yes, I am your network.”
If your phone believes the cat, Weis says, the cat can intercept all traffic going through your phone.
That open Wi-Fi connection opens the door for hackers. They can get in the middle of transactions between, say, you and your bank.
Now, if you set up your phone correctly and only sign on to Wi-Fi networks you know, you can make these attacks more difficult. But some of America’s biggest companies, like AT&T and Comcast, are aggressively rolling out nationwide open public Wi-Finetworks. These networks are insecure.
They aren’t the only companies doing this but they are the biggest. Comcast is turning its customers’ cable boxes into public Wi-Fihotspots, and it has a million hotspots across the country. AT&T offers open Wi-Ficonnections at most Starbucks.
“A big problem with AT&T phones is that they all have a preferred network on their list that is open, and that is AT&T Wi-Fi,” Weis says.
There is no password, “so when your AT&T phone is near an AT&T Wi-Fi network, it will automatically connect,” he says.
You could turn off your Wi-Fi connections or shut off AT&T’s auto-connect setting. But if you don’t, your phone will connect to legitimate AT&T Wi-Fi hotspots — or hotspots called AT&T Wi-Fi set up by hackers.
The same is true for any open public Wi-Fi network. Spoofing them is as easy as changing the name on a Wi-Fi router. And Weis says if folks are just walking by one of the evil hot spots and their phone connects to it, they may never know.
“There is all this stuff going on behind the scenes — literally invisible packets in the air coming out of their pocket, saying things about who they are and where they have been and what they do,” Weis says.
Protecting Yourself
In the past year, the number of people using Xfinity Wi-Fi has almost tripled. Comcast told me that the number of out-of-home Wi-Fi sessions shot up 750 percent.
Don Bailey, a security expert at Lab Mouse, says these public Wi-Fi connections don’t have to be insecure.
“There should be a way to identify whether or not you have attached to a public Wi-Fi,” Bailey says.
That should happen automatically, he says, so when you connect to a network like this, all your traffic should be encrypted without you having to do anything. In fact, both Comcast and AT&T already offer consumers apps that will do this — but you have to buy them, install them and opt in. So most people don’t.
I asked both companies if these open Wi-Fi networks were opening up millions of their customers to potential attacks.
AT&T spokesman Mark Siegel said the company takes “extraordinary measures” to keep its customers safe. Comcast said it was planning to roll out a more secure Wi-Fi network sometime in the future, but it didn’t say when.
Comcast pointed out that for a more secure system to work, it will need the cooperation of every company that makes a device that connects with the network. That takes time.