9.3 Searching Publicly Available Resources

Today, it is possible to find out information on almost any conceivable topic simply by searching the Internet. This new information tool can be used to find out about almost anything, including personal information about individuals, proprietary information about corporations, and even network security information that is not intended to be made public. If public information exists, it can most likely be found on the Internet with little effort. Nefarious individuals can find out who you are, the names of your family members , where you live and work, if your residence or workplace has a WLAN, and what wireless security solutions are used by your employer. As an example, many people now post their resumes on the Internet. From an individual's resume, you may be able to determine if someone has WLAN proficiency. It is logical to therefore assume that this individual may have a WLAN set up at his or her home. This individual is also more likely than not to be connected to his or her employer's corporate network. It is also likely that sensitive corporate data is exposed on the user 's laptop or desktop computer. Because this individual connects to a laptop using the WLAN at home, he or she is susceptible to hacking attacks. All of this is probable because a small amount of personal information found on the Internet exposed critical data that led to a security breach on a corporate network. What is even worse is the fact that this data could be pilfered and the victim is likely never going to know it happened !

Many Web sites provide maps of public wireless Internet access. If someone is easily able to use a corporation's WLAN as a public access point, that WLAN may even be one of the sites listed on these maps. For instance, http://www.NetStumbler.com offers a unique mapping [2] of all reported WLANs NetStumbler has found.