NST - Wireless Vulnerabilities (Lesson)

Wireless Vulnerabilities

Introduction

In this lesson, you will learn about the types of attacks that can be executed on Wireless and Mobile networks. We will also explore the security characteristics of Virtual Private Networks (VPNs).

Up to now, we have dealt with networks that are wired together with central devices such as hubs or switches. However, there are multiple technologies that deliver data without running wires between network devices. The three primary technologies in use are Bluetooth, cellular, and wireless.

 

Examples:

• Bluetooth – wireless headphones, keyboard, mouse, speakers, phone, laptop, iPad…
• Cellular – phone, iPad, automobile, medical alert device…
• Wireless – laptop, phone, iPad, watch, home assistants like Alexa or Echo, Roomba vacuum…

They all deliver data without the use of wiring on the end user device. However, they each use different technologies and protocols to deliver the data so there are different security considerations.

Bluetooth Threats

1. Bluejacking: Pushing unsolicited messages onto a device. Similar to spam, messages can include links to malware. A threat actor sends unsolicited messages to your Bluetooth-enabled mobile devices. For example, on phones it uses the Bluetooth connection instead of having your phone number. If you respond to the message or add the contact to your address book, you give the threat actor an opportunity to connect to your devices because you are establishing them as a known contact. Threat actors can then control your device remotely! Threat scale – annoying!
2. Bluesnarfing: Pulling email, contacts, passwords, images, or other data off the device. A threat actor connects to the phone and then steals passwords, images, contacts, or other data from your device. Bluesnarfing attacks can be hard to detect as you may not notice that someone is stealing your data over Bluetooth. Threat scale – bad!
3. Bluebugging: A bug or spy is installed on your device by gaining access and then installing a backdoor for future access. It can also be used to remotely control the device. A threat actor poses as a device you’re looking to connect to (e.g., headphones). You may not even realize that you are connecting to a spoofed device. Once connected, your device and your data are accessible as long as the spoofed device is on your list of paired devices. Once connected the hacker installs software for continued access. At this point, the hacker can spy on your activity, access your sensitive information, and even use your device to impersonate you on any apps on your device, including the apps you use for online banking. Threat scale – very bad!

Securing Bluetooth Presentation

Cellular and Wireless Threats Presentation

Public Wi-Fi Threats

Remember -- public Wi-Fi is like a public bathroom! I know, I know – gross… but true!

1. Turn on your firewall.
2. Make sure the anti-virus is up to date and running.
3. Confirm the name of the network
4. Do NOT use a credit card or do any online shopping.
5. Use Virtual Private Network (VPN) software.

VPN vs. No VPN Presentation

How a VPN Works

A VPN is very much like a tunnel for your Internet traffic, preventing outsiders from monitoring or changing your traffic. VPNs establish secure connections by encrypting data and using virtual IP addresses so that the user’s digital footprint and browsing activity cannot be viewed by ISPs or malicious actors. These virtual IP addresses hide a device’s true location.

• The VPN replaces your IP address – browser activity can’t be traced back to you and the website can’t determine your location.
• Any data you send or download is encrypted so it cannot be read by anyone except the destination website – even on an insecure network.

Pros and Cons of VPNs

Using a VPN essentially shifts your trust from your ISP to the VPN, so it’s important to make sure that you trust your VPN provider to protect your privacy. Consider a provider with a zero-logging policy, which ensures that no user data is stored by the service. This would include records of personal information, traffic, and downloads in order to provide strong data and privacy protections. Many security policies block network traffic from countries that have a reputation as a source for cybercrime BUT threat actors from these countries can use a VPN to bypass location-based restrictions as well as hide their tracks.

Reflection and Wrap-up

In this lesson, you have learned about the various vulnerabilities and threats associated with wireless devices, including Bluetooth, cellular, and wireless network technologies. We explored Bluetooth threats like Bluejacking, Bluesnarfing, and Bluebugging, and discussed ways to secure your devices against such threats, including disabling Bluetooth when not in use and keeping your device's software up to date. You also learned about cellular and wireless threats like Radio Frequency Jamming, Rogue Access Points, and Evil Twin Attacks, highlighting the importance of being cautious when connecting to public Wi-Fi networks. The lesson further covered the concept and benefits of using Virtual Private Networks (VPNs) to protect your internet traffic by encrypting it and masking your IP address, thus enhancing your privacy and security online. This comprehensive overview equips you with the knowledge to identify and mitigate the common threats faced by wireless and mobile devices, ensuring safer usage of these technologies.

[CC BY-NC-SA 4.0 Links to an external site.] UNLESS OTHERWISE NOTED | IMAGES: LICENSED AND USED ACCORDING TO TERMS OF SUBSCRIPTION - INTENDED ONLY FOR USE WITHIN LESSON.