War Walking … A student experiment

1. War Walking …A student experiment

2. Agenda • Project Goal • WiFi Basics • War Walk • Conclusion & Lessons Learned

3. Our Goal • Walk around downtown Seattle • Locate private wireless networks on a PDA • Record network names and addresses • Attempt to gain access to these networks • Determine wireless network security levels • Stay only in public areas to ensure no trespassing laws were violated

4. Wireless Network Basics • Wireless networks operate on two different frequency bands (2.4 & 5.4 GHz) • Wi-Fi, also known as 802.11b, is the most popular broadband wireless networking. • There is also 802.11a and 802.11g • Wi-Fi shares the same broadcast spectrum as some cordless phones, microwave ovens, and Bluetooth short-range wireless • Network density is becoming an issue and will force private Wi-Fi networks to be secure

5. The World of Wi-Fi • Wi-Fi is relatively easy to install • Provides broadband Internet access to specially outfitted wireless devices within a few hundred feet of a Wi-Fi base station • Avoids the time and cost of hard-wiring • Found in homes, hotels, airports, restaurants, coffee shops, corporations, and shopping malls • North American business users account for 90% of Wi-Fi users worldwide • By 2005 95% of new laptops will come WiFi enabled

6. War Walk - Location • Downtown Seattle business district • Between 6th and 4th Avenues • Between Union and Madison Streets • Hotels, retail stores, and business offices • 9:15 to 10:15 pm

7. War Walk - Equipment • Compaq iPAQ Pocket PC 2003 • Cisco 802.11b Wi-Fi Card • HudsonMobile IPDashboard • Our feet

8. War Walk - Results

9. ENET CNXT-FRLAN01 CD-WIRELESS ENET DEFAULT TAAIRPORT WMAOFFICE NETWORK WIRELESS LYNKSYS MKA 32SW CD-WIRELESS MKA 33SW NOSID MKA 33SE MKA 32SE LYNKSYS PANAMBIC DEFAULT WIRELESS JDDS War Walk - Results

10. MYNEWWIRELESS-NETWORK SEATAL MC VPK ALX DADCO DSOFFICE WLANNAI LYNKSYS CNET WIRELESS.COM RNI RAINIER DEFAULT ACCESSTOGO BARTLETT MKA 33SE ELECTRICARROW MUSACORPHIN ROUTER NAKAMURA War Walk - Results (continued)

11. War Walk – Results (continued) • In addition to 41 network names • We were issued IP addresses and were able to get IP addresses of the infrastructure of several companies • Gateway, DHCP server, WINS server, DNS naming, etc • We were able to access and “surf” on several networks • The majority of the networks were secure and required authentication • We did not record all of the Starbucks T-Mobile Hot Spots that we encountered

12. Conclusions • Downtown Seattle has high density of wireless networks • There was high concentration of networks near large high rises • The wireless networks located downtown may be secured to reduce “tripping into” other neighbor networks • We did not attempt to enter any networks that required authentication. Passwords could potentially still be set at default

13. Lessons Learned • WAP in highly congested areas more likely to be secured • Commercial networks in rural areas less likely to be secured • Home networks are less likely to be secured • WAP signals bleed a great distance from high-rise buildings • Companies should turnoff SSID broadcasts to make their networks more stealthy • There are websites like www.seattlewireless.net/index.cgi/ WarDrivingResults that have a lot of the networks already sniffed out • Companies need to be concerned about unauthorized WiFi Networks in their buildings • Employee built • Industrial espionage • Privacy Invasion (802.11 cameras)

14. Questions?