computerwoche.de

Archiv

Factory settings -- insecure by default

24.04.2006
So, you just set up a shiny new wireless router at home or at your office. As convenient as it is to have no strings, or at least wires, attached, that new router may have punched a hole in your security schema and set you up for unwanted trouble. The reason you could now be vulnerable is simple: default settings. Remember, manufacturers often turn off security and certain other features by default so that their products will be easier to set up and integrate into a wide variety of networks.

Unfortunately, this default dilemma isn't limited to wireless routers. Just about every new laptop these days is powered by the Windows XP operating system and incorporates built-in wireless capability. To make these laptops easy to integrate into wireless networks, XP may be set so that when a user boots up the operating system, Windows will look for any available wireless connection.

Many so-called hot spots know this and make it as easy as possible for you to use that laptop or handheld wireless device to access the Internet. Toward that end, they may have turned off the WEP (Wired Equivalent Privacy) security feature by default. In fact, many public wireless access points, like those in hotels and airports, don't enable WEP, although that may soon change as people become more aware of the dangers of this default.

When I recently installed my Verizon-provided Westell wireless DSL router/gateway, it was factory-set at 64-bit WEP by default. Sounds nice, but that's just too weak for me, so I quickly switched that to 256, the maximum supported.

The problem is that WEP itself is flawed and weak, and, with the right tools and knowledge, it's fairly easy to circumvent, no matter what bit of encryption is used. The truth is, using WEP is better than not using anything at all for keeping the general public from spying on your data, but it's far from an ideal defense.

This is why I strongly recommend that home or small-business users consider using WPA (Wi-Fi Protected Access) in all their home computers and network devices. WPA and its more recent iteration, WPA2, are more secure than WEP. There is one caveat to using it, however: All your wireless devices must be WPA-capable in order to play together.