Open Wifi. Free game?

 An Illinois Judge recently ruled that accessing and sniffing traffic over an open wifi network is not illegal. (Lee, 2012) While this was a preliminary judgment, and in direct contradiction with one made in 2011 against Google, who was accused of sniffing traffic from open networks around its Street View vehicles, this could open the door to abuse of open wireless networks in places such as restaurants, cafés, and public areas around the nation.

Sniffing is a term used by security professionals to describe the process of copying or analyzing data that is being transmitted over a network. Traditionally, an intruder would require physical access to network equipment to be able to sniff data, but with the advent of 802.11 wireless networking equipment, it is a trivial matter to crack the encryption code and gain access to a wireless network. Open Wifi networks do not even have encryption enabled, making it extremely easy to take advantage of other clients on the network.

But wait! Don’t most website use their own SSL encryption now? Unfortunately, several attacks can be used against local clients on the network such as ARP cache poisoning, sslstrip, and other man-in-the-middle attacks (MITM) enabling an intruder to intercept your data, decrypt it, and gain access to whatever you are sending over the internet (including passwords).

By now it should be obvious that this ruling is a mistake. Not every wireless implementation can use encryption to protect accessibility, as the goal is to make the network accessible to everyone. While users should practice good security while they are on insecure wireless networks, the law shouldn’t give  a green light to malicious users looking to spy on others.

 

Lee, T. B. (2012, September 7 2012). Sniffing open Wifi networks is not wiretapping, judge says. Retrieved from Ars Technica: http://arstechnica.com/tech-policy/2012/09/sniffing-open-wifi-networks-is-not-wiretapping-judge-says/

[ams]