II. Background
- Security is always balanced with, and often at risk due to other requirements
- Ease of use (or convenience)
- Functionality (or mobility)
III. Approach: Practice least privelege
- See computer firewall
- Disable Web-based remote management
- Disable WiFi Protected Setup (WPS)
- Modify all router default settings
- Assign an SSID (unique discoverable name) to router that does not give away its owner (e.g. avoid "Smith Router")
- Change the DHCP private IP Range to another private IP range (e.g. 10.1.1.1 - 10.1.1.254)
- Use strong passwords (Router, WLAN)
- Disable services that are not needed
- UPnP - see Firewall above
- Integrated Webcam and microphone (may be turned on by malicious users via network connection)
- Resources
IV. Approach: Hardware tricks
- Network Hub (Hubbing Out)
- Network Hub inefficiencies are exploited for network troubleshooting
- All traffic on the hub is distributed to each computer on the hub (one collision path)
- Allows a monitoring computer to monitor all traffic to and from another computer
- Contrast with switch which divides out its traffic
- Step 1: Attach a network hub to the switch or network
- Step 2: Attach a monitoring or troubleshooting computer to the network hub
- Step 3: Attach target computer in question to the network hub
- Network Hub inefficiencies are exploited for network troubleshooting
V. Approach: Utilities
- Protocol Analyzer
- Wire Shark
- https://www.wireshark.org/
- Visualize network traffic frame-by-frame (data layer 2, switch level)
- Use with a network hub (see above) to monitor traffic to another computer on the network
- Wire Shark
- Testing Firewall
- Shields Up
- https://www.grc.com/shieldsup
- Tests ports as well as UPnP settings
- Shields Up
VI. Pearls: Travel
- Wireless: Wifi
- Use WPA2 connections (with a strong password)
- Do not use WEP or WPA (encryption broken in seconds to minutes)
- Hotel or conference wifi logins are no more secure than open wifi connections
- Ensure that open, free public connections (e.g. coffee shops) are not imposters
- Use WPA2 connections (with a strong password)
- Wired: Ethernet
- Hotels and conference wired connects have no significant security advantage over wireless
- Man-in-the-middle attacks (e.g. altered wall socket connections) and corrupted host are still risks
- USB Connections
- USB power stations are subject to "juice jacking"
- User plugs in their device to a power station (or friendly associates laptop) to charge
- Altered station or laptop can access data on the device
- Consider using a "USB Condom" (e.g. CyberStop) or set the device USB configuration to charge only
- USB power stations are subject to "juice jacking"
VII. References
- Scott (2016) Cyber Security While Traveling, Pluralsight.com