Open networks exposing firms to hackers

MORE THAN half of Dublin city-centre businesses with their own wireless Wi-Fi networks have left them open to hackers.

A "war walk" conducted by security consultants with Deloitte found that there has been a 25 per cent increase in wireless networks in Dublin's business districts since it last conducted the exercise in 2006. That study found that 56 per cent of networks were not secured. This year Deloitte found 594 open networks, or 54 per cent of the total.

"This is a ticking time bomb waiting to go off," said Colm McDonnell, partner in Deloitte's enterprise risk services division.

"Unlike the laptop issue, which is in the news at the moment, organisations may not even realise their wireless has been impacted."

Wireless networks come with the capability to be secured with the WEP standard, but this had not been turned on by owners of the open networks. Of those secured, 73 per cent use WEP, which can be cracked easily.

Networks may be left open if they are wireless "hotspots" provided free in cafes or other public settings. But Deloitte estimates that the number of wireless hotspots discovered in the study fell from 72 in 2006 to 60 in 2008.

The risk of open wireless networks is that criminals or hackers could use them to access the organisation's corporate network.

"Once a connection is insecure, potentially all of a company's information is available to outside parties," said Mr McDonnell.

"The fact that the growth rate of new wireless connections is so far above the growth rate of secure wireless connections means that there are more and more opportunities for hackers to attack."

Mr McDonnell said that, in some firms, untrained staff may be using laptops to create wireless networks in order to access websites that are blocked by the corporate firewall. In one recent instance, Deloitte found an unauthorised wireless network that was providing a link to the main corporate network.

The practice of naming a wireless network after the company plays into hackers' hands, as they can then search for the name of employees and try to guess passwords. The number of network IDs that matched the name of the organisation increased to 12 per cent this year.

The so-called war walk, which involves walking the streets with a Wi-Fi antenna and laptop scanning for open networks, was conducted in March on Grafton Street, Harcourt Street, the IFSC, Merrion Square, St Stephen's Green and O'Connell Street.

"The worry is that the results point to a big problem around security in Ireland," said Mr McDonnell. "It's the only way you can understand the attitude to security without going into an organisation and doing an audit."