Lycra-clad security expert James Lyne has taken to the streets of Sydney with a computer-equipped bike to reveal the risks of using public Wi-Fi in Australia's largest city.
The global head of security of Sophos went 'warbiking' across the city to track down unsecure wireless networks and spotlight user behaviours that could be exploited by rogue hackers, and he discovered some alarming results.
Lyne’s warbiking exercise revealed that of 34,476 networks surveyed, almost 28 percent were using either the known-broken Wireless Equivalent Privacy (WEP) algorithm, or no security encryption at all, a relatively lower rate of deployment when compared with other major cities.
Sydney is the latest stop on Sophos' 'World of Warbiking' tour – a global research project targeting major cities across the globe.
On his travels, Lyne found a further 28 per cent of networks were using Wi-Fi Protected Access (WPA) – a no longer recommended security algorithm.
An encouraging result however, was Sydney’s high rate of deployment of WPA2, although given that Sophos worked within the bounds of the law, Lyne was unable to test password strength.
Lyne said conventional wireless network security was still a major concern, despite the security industry assuming such issues had been resolved years ago.
"Many would assume these methods are ‘old hat’ but it is still a very viable attack vector that demonstrates basic security best practice is not being adopted,” he said.
Lyne believes that Sydney has a relatively high number of open networks.
"Whilst many were intentionally open, users may wrongly assume this means their personal information is encrypted and protected, when in reality it is available for anyone to pick up."
“It’s clear from our warbiking exercise in Sydney that there are a large number of businesses and home users employing insecure, poorly implemented, or even defunct wireless security protocols.
Lyne said the increasing desire to be online at all times was leaving millions of people, companies and their valuable data open to attack.
“Even within the security industry, there are myths and misunderstandings about what the real risks are with wireless," he said.
Read more: Mobile platforms attractive to cybercriminals: McAfee
"Many argue that the unencrypted, intentionally open networks are ‘OK’ as they use a captive portal to register users.
Unfortunately the standard user doesn’t recognise that major "brand XYZ wireless" is not encrypted and that their information can be picked up by anyone with $40 piece of equipment available on Amazon, Lyne said.
The experiment found a large number of people were willing to connect to an open wireless network, without any idea of who owned it or whether it was trustworthy.
This is compounded by the growing number of devices that are permanently identifying themselves via technology like Bluetooth.
Lyne said the willingness to connect to any wireless network that professes to offer free Wi-Fi was like shouting your personal or company information out of the nearest window and being surprised when someone abuses it.
"With a few extra command line arguments, it would have been trivial to attack nearly everyone in our Sydney hotspot study.”
The open wireless network created during the Sydney experiment also offered an insight into what people are connecting to when they are out and about in the New South Wales state capital.
Social media sites such as Facebook and Twitter were high on the list of most requested pages, along with webmail access and random web searches.
But worryingly, it appears many people are also choosing to access websites and services that could prove even more attractive to cybercriminals.
Lyne said, despite the fact that this was an open network, once connected many people seemed happy to access online banking sites.
Only a tiny minority (1.20 percent) actually took responsibility for their own security by using a Virtual Private Network (VPN) or forcing secure web standards.
“Our test was conducted strictly within the confines of the law,” he said.
“But the cybercriminals won't have the same concerns, so our experiment shows why people need to be much more aware of the potential dangers of connecting to open Wi-Fi networks when they are out and about.”
