If criminals were to target unsecured wireless routers, they could create an
attack that could piggyback across thousands of Wi-Fi networks in urban areas
like Chicago or New York City, according to researchers at Indiana University.

The researchers estimate that a Wi-Fi attack could take over 20,000 wireless
routers in New York City within a two-week period, with most of the infections
occurring within the first day.

"The issue is that most of these routers are installed out of the box
very insecurely," said Steven Myers, an assistant professor at Indiana
University, who published the paper in November, along with researchers from
the Institute for Scientific Interchange in Torino, Italy,

The researchers theorize that attack would work by guessing administrative
passwords and then instructing the routers to install new worm-like firmware
which would in turn cause the infected router to attack other devices in its
range.

Because there are so many closely connected Wi-Fi networks in most urban areas,
the attack could hop from router to router for many miles in some cities.

The team used what is known as the Susceptible Infected Removed (SIR) model
to track the growth of this attack. This methodology is typically used to estimate
things like influenza outbreaks, but it has also been used to predict things
like computer virus infections, Myers said.

Although the researchers did not develop any attack code that would be used
to carry out this infection, they believe it would be possible to write code
that guessed default passwords by first entering the default administrative
passwords that shipped with the router, and then by trying a list of one million
commonly used passwords, one after the other. They believe that 36 percent of
passwords can be guessed using this technique.

Even some routers that use encryption could be cracked, if they use the popular
WEP (Wired Equivalent Privacy) algorithm, which security experts have been able
to crack for years now. Routers that were encrypted using the more-secure WPA
(Wi-Fi Protected Access) standard were considered impossible to infect, Myers
said.

Myers' model is based on data compiled from the Wireless
Geographic Logging Engine (WiGLE), a volunteer-run effort to map Wi-Fi networks
around the world, which has over 10 million networks in its database.

Using this data, they were able to map out large networks of made out of Wi-Fi
routers that were each no more than 45 meters (49 yards) from the network --
in other words, close enough for an infection to spread. The largest such network
in New York included 36,807 systems; in Boston it was 15,899; and in Chicago:
50,084.

Because New York is such a dense city with a relatively low percentage (25.8
percent, according to the researchers) of encrypted routers, it was particularly
susceptible to this type of attack. San Francisco, on the other hand, where
40.1 percent of routers are encrypted and which had a lower density of routers
was less susceptible.

Myers says that because the attack would be technically complex, he doubts
that criminals will attempt it any time soon. There are simply too many other,
easier ways to take over computers, he said.

Still, he thinks hardware makers should take note. "The bigger point for
developers and people making wireless information technology is to realize that
there are serious security issues."

IDG News Service

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine