User manual

WhirlWind

The proliferation of wireless networks and mobile devices has untapped

enormous new productivity potential for organizations that rely on corporate

communications and rapid decision making. However, an increased level of

security risks has been created as well. The widespread use and continuing

expansion of wireless and mobile technologies is forcing government and

commercial organizations and their IT security departments to seek tools to

help them assess the risks of wireless networks and monitor them for potential

attacks. Attacks of the wireless environment and employee misuse threaten to

erase the gains in productivity realized through wireless and mobile devices.

Organizations need to protect proprietary data and assets, not only within their

corporate boundaries, but across the physical walls of their facilities into the

outside wireless environment as well. Rarely are any such security policies in

place to provide guidance on the use of wireless technologies or enumerate

responsibilities.

Part of the problem of securing wireless technology is the low cost and ease

with which these devices can be purchased. Wireless access points bought

through the local computer/electronics stores generally are cheap and easy to

install. Users take these products out of the box and deploy them without

thought of configuration or security. The relative ease with which these

products can be deployed is evidenced by the large number of wireless

networks left with their factory default names, such as “linksys” and “dlink,”

which remain unchanged by the user. Activation and implementation of the

associated encryption modules more-often-than-not, are not utilized. Or if

used, the minimal protection of Wired Equivalent Privacy (WEP), which can be

easily cracked by hacker tools, is employed. Another threat is present when

mobile users connect to public wireless networks with common names such as

“tmobile” or “attwifi.” Mobile users connecting to these public networks offer

unscrupulous individuals an opportunity to steal personal information or

sensitive corporate information if they have not taken prior security

precautions to protect their information from interception. Thus, the wireless

and mobile environment is “prime” for a variety of standard hacker attacks

such as sniffing, spoofing, man-in-the-middle, and wardriving.

It is this final item, wardriving, with which WhirlWind is concerned. Wardriving

is the undertaking of surveying the wireless networks in a given area (usually by

driving) and cataloguing the wireless access points detected based on their

network name, security features, and other relevant characteristics. Hackers

perform wardriving to find vulnerable networks to attack. Security

professionals can perform wardriving against their own wireless networks using

WhirlWind to find their own vulnerable networks before the hackers do and to

correct the security problems before costly data breaches occur. WhirlWind

organizes and displays the collected information about wireless networks in the

easy-to-use Google Earth™ mapping application.