"An attack might be a terrorist who wants to disconnect emergency crews from each other and make his physical attack more effective, or a criminal who wishes to disconnect members of police in their efforts to chase him," said researcher Markus Jakobsson at Indiana University in Bloomington. Such an attack also "could hijack normal traffic for corporate espionage or identity theft."

Jakobsson and colleagues are developing the digital equivalents of magic envelopes and invisible ink that promise to protect cell phones and laptops against these attacks.

"We hope to have a version in a few months," Jakobsson told United Press International.

Jakobsson discussed wireless-network vulnerability at the American Association for the Advancement of Science annual meeting.

The networks are surprisingly easy to attack, he said. "A wired network is like talking in a room with a group of colleagues. You know who they are. In a wireless network, it's more like a phone call from a stranger. You have no idea who they are, where they are (and you) don't know whether to trust them or not."

He described one type of attack, called "man in the middle," where an enemy impersonates a friend.

"If you go to a wireless access point at Starbucks and do some online banking," Jakobsson explained, "when you come in, my computer can broadcast that it's the Starbucks' wireless access point. You think you're sending securely to the bank, but you're (actually) sending to me. There's a great threat (of) identity theft in wireless networks. We haven't seen it yet, but it's the next thing. In this hijacking attack, you don't know it's taking place."

The problem could be worse in the so-called ad-hoc wireless networks expected to become popular in the near future. In such a network, each laptop or cell phone takes on the added responsibility of serving as a relay that forwards data to others.

"They're easy to deploy and less dependent on infrastructure such as base stations, which can be pretty expensive," said Susanne Wetzel of the Stevens Institute of Technology in Hoboken, N.J.

For example, Wetzel said, "you don't want to send soldiers on a battlefield blind, you want to see what's going on. If we could deploy a ton of sensors, have the sensors report back to base on what the surroundings are (such as) the chemicals in the area, you have the possibility of exploring territory without the risk of sending soldiers in directly."

The networks also would prove valuable in search-an d-rescue operations.

"You could make use of ad-hoc networks where regular cell-phone networks are not available," said researcher Adrian Perrig of Carnegie Mellon University in Pittsburgh.

"You could have an ad-hoc network when you would like to get to a wireless access point too far away, and leverage other intermediate nodes to reach an access point."

Perrig told UPI an analogy would be trying to access a cell-phone signal in a tunnel. "You can relay a signal from car to car until you can get a signal outside the tunnel," he said.

The biggest problem, he continued, is ad-hoc networks have not yet resolved security issues.

"It's a challenge to create an ad-hoc network even without considering security, so they've only considered trustworthy environments where no one cheats - so it becomes trivial to attack," Perrig said.

"We have a great opportunity today to deploy secure protocols before ad-hoc net works are widely deployed."

System designers worry about how easy ad-hoc networks are to attack.

"There are quite serious attacks that are simple to execute that cannot be detected. That's what makes them stealth attacks," Perrig said.

In one strategy, called a wormhole attack, an enemy pretends to provide the shortest route between all nodes in the network, thus attracting all data traffic and then suddenly killing communication.

The answer is to authenticate as trustworthy the computers or cell-phones with whom one communicates, Jakobsson said. When sending a password, that password should be encased in the digital equivalent of a magic envelope, in which the message it carries can be read only by its intended receiver and any attempt to access it would be revealed.

In the computer-network equivalent, Jakobsson explained, if the receiver already knows the password, the receiver can modify the incoming message in an agreed-upon manner via a kind of invisible ink.

If the sender is legitimate, the sender will recognize the invisible-ink response as legitimate. If the sender is a hacker, the receiver will not divulge the proper password.

The solution must prove compatible with existing systems and look and feel the same to all users, Jakobsson said, adding that his team is working on data packets that resemble software patches, or updates.

"People download software patches all the time. A simple patch would make this possible," he explained.

Charles Choi covers research and technology for UPI Science News.

Community
Email This Article
Comment On This Article

Related Links
SpaceDaily
Search SpaceDaily
Subscribe To SpaceDaily Express
Cyberwar - Internet Security News - Systems and Policy Issues

Memory Foam Mattress Review

SPACE MEDIA NETWORK PROMOTIONS Solar Energy Solutions Tempur-Pedic Mattress Comparison ... Newsletters :: SpaceDaily :: SpaceWar :: TerraDaily :: Energy Daily XML Feeds :: Space News :: Earth News :: War News :: Solar Energy News