Here’s a little short story that perhaps illustrates why anonymous surfing is so important and some of the dangers that are ever present especially to people travelling. It occurred to me as I was sitting in a little bar in Portugal with free Wifi and computers to use.
Jason Williams was just about ready to close up, his cafe had done quite well today – business had certainly improved since he had installed the internet wireless service and offered it for free to his customers. Although the enormous boost to his income was not as a result of booming Latte sales but from a more clandestine source.
After locking up and closing the shutters there were a few more little jobs to do. First he logged into the two laptops on the counters which were provided for those customers who had no laptop or phone with them. He inserted a USB drive and copied the two files across, cards.txt and accounts.txt, these files were created from a little computer program which monitored all the keystrokes on the computer. The program was fairly simple but very clever, it simply extracted from a central log all likely card information, CCV numbers and account names. The log was created from a keylogger attached to the back of the computer.
The next job was to download the files from the laptop behind the counter, this computer monitored communication between the wireless access point and customers laptops and phones. A slightly modified program then extracted all likely account names and passwords, plus any Credit card numbers and security keys that it detected. Both programs were not perfect but after several months of tweaking from programmers he had found on the carders forums they came pretty damn close.
The last file was the paypal text file, this was his latest ‘project’ and although he rarely got more than a couple of accounts a day – it was incredibly profitable. He had read about the concept on another forum frequented by cyber criminals, again it was very simple to implement. The DNS tables on his wireless access point had been altered, so that when anybody tried to access the popular online payment site Paypal, they were redirected to a fake copy of the page. The page was stored locally and was an exact copy of the Paypal login screen, however when you tried to login it failed as the web page merely logged the username and password to a file then presented an error page.
Jason looked briefly at the files, he could estimate fairly accurately the income he received from selling the Cards and security numbers – current prices were about $20 each if you had the CCV number. Income from raiding the pay pal account was more difficult to guess as there were a lot more variables but he guess a few hundred dollars would be easily achievable………………………………………………..
Ok it’s just a story but it’s far from fiction, everything in this brief tale is easily set up and pretty simple to do. In fact the most difficult part from my point of view would be learning how to make decent Latte ! The thefts are small and frequent, carefully orchestrated to avoid detection. You don’t see these reported on the BBC News as the victims often don’t notice for weeks and will have little idea how/where it happened. My little story will hopefully just make people a little more careful about using unfamiliar wireless connections and computers, your personal information is completely vulnerable to whoever is running the systems you connect to.
The software and hardware to implement the scenario above is all readily available – here’s a picture of a key-logger for instance. This one reminds me of the little adapters you used to fit for PS2 style keyboards –
– looks fairly innocuous but the device will record every keystroke that is entered on a computer. They come in all shapes and sizes though and can even be installed inside the computer or laptop so is not visible in anyway. My advice on using such public shared computers is never, ever use them for accessing any sensitive information. The person who goes to an internet cafe to do his online banking is asking for big trouble in my opinion.
The troubles of using unfamiliar wireless connections are of course much the same, your not quite as vulnerable when using your own laptop of course but there’s still a big danger. Your personal data can still be monitored, intercepted or logged by who ever controls the connection. If you do travel a lot and use hotel, airport or other Wifi Access points regularly I definitely recommend investing in a security product like Identity Cloaker to secure your connection and allow you to surf anonymously. This encrypts all your connection so it is even protected from the people who control the network you are using to communicate (none of these products can protect against the key-loggers though so never use an unfamiliar computer!)
