GOVERNMENT NORMS LIKELY TO COMPULSORILY SECURE WIFI LINKS

Joji Thomas Philip & Harsimran Singh, New Delhi, September 15, 2008
The Economic Times | The Hindu Business Line | 

 

In the wake of the terror emails being sent from unsecured wireless fidelity (WiFi) networks, the government is examining the possibility of issuing new norms that will make it illegal to leave such Internet connections open. The new norms may also put the onus on telcos and Internet service providers (ISPs) who sell WiFi connections to educate their customers of keeping them secure.

The department of telecom will work with the home ministry and intelligence agencies to put in place steps to secure WiFi Internet connections, which are increasingly being used in homes and offices across the country. WiFi networking companies may also be asked to limit WiFi signal right down to a defined radius by installing access points around the signal.

However, Internet service providers (ISPs) say that it is customer who is to blame. “Internet service providers are taking steps on their own to secure WiFi connections. All ISPs are installing AAA servers and firewalls. But, if you look at the terror mails, they were sent from hacked or open WiFi accounts – there is nothing we can do about this.

When people take a broadband connection, then take routers and make their homes and offices WiFi enabled, and then leave it open, there is nothing ISPs can do about it,” explained the president of the Internet Service Providers Association of India’s president Rajesh Chharia.

Industry experts say that regulations will not help much since most home and corporate users use minimal security to lock their WiFi networks making them an easy target to hack into.

Security experts suggest that WiFi users should never broadcast their SSIDs (service set identifiers) and change their access passwords. “Most routers which come in the market have a password 1234 and login id – as admin. One should immediately change it after installing. Also one should block the router’s SSIDs from broadcasting the WiFI networks and allow only particular machines to access it,” says Aujas Network Founder and COO Sameer Shelke.

Generally a WiFi router is configured to advertise its SSID to all neighbouring WiFi devices. One can block the SSID from advertising so that only by typing the name, the particular WiFi network appears.
The Wireless Fidelity (WiFi) connection of a Mumbai based power company was hacked into by suspects in Chembur, who sent the e-mail to news organisations while the serial blast continued in the capital which killed about 25 people and left about 100 injured on Saturday.

Experts say that digital forensics still holds the key to catch suspects who have even challenged security agencies to catch them.
Accessing the WiFi router or the wireless access point’s log files (present in Mumbai’s Kamran Power Company in this case), one can find out the MAC (Media Access Control) address of the WiFi card which accessed the WiFi point of that company.

Each WiFi adaptor card manufactured in the world has a unique MAC address. Identifying that MAC address would mean identifying the manufacturer of that particular network card. The manufacturers are generally based in Malaysia, Taiwan and China, global hubs of electronic manufacturing.

A high level protocol with Chinese or Taiwanese government can help the investigating agencies get hold of which factory that particular card was shipped to and when. It can also identify the bar code number of that card. Each PC or laptop maker like Dell, HP, Lenovo or Acer tags the barcode numbers of the card before assembling them into the machines.

This information can be used to find out which dealer sold that particular laptop in which part of the world and to which buyer, which in this case can be the suspect. Identifying the digital footprint can thus help trace the culprits.

US-based Meru Networks’ India head Giridhar Java says: “We can also configure a network to operate only in a particular radius. All signals going outside a particular periphery can be blocked. Another way is to throw junk to an outside receiver trying to connect. We can easily jam his or her WiFi card but that’s not legally allowed in most parts of the world.”

The easiest way to secure is to provide a password for accessing WiFi but y experts say that too is penetrable. “Basically WiFi operates in the 2.5 GHz frequency and one can still access your WiFi network by special frequency scanners but that is tougher.