I recently performed a security audit for a local retailer that provided wireless internet access as a convenience to its customers. This wireless access point (WAP) was set up by a relative of the proprietor who “knows a lot about computers”. Like many of these wireless hot-spots, customers didn’t need a password, or any special configuration to get on the internet. I often see wireless routers configured like this even in businesses that have no intention of providing public access. I turned on my laptop and was easily connected. I had no problems getting on the internet - very easy and convenient -great when your sitting in a coffee shop. I also had no problems getting on their internal network. In less than a minute, I was looking at the files on the company’s point of sale and inventory management computer - files which I could have deleted, or altered, or copied. I didn’t even use any special tools or secret scanning software to do it. In fact, a person with the very basic knowledge of how to read Windows network configuration information could have done the same thing. Fortunately, my intent was to find problems like these and get them fixed.
Continue reading →