Wireless network card security vulnerabilities

Question

Is it possible for a hacker to access a standalone laptop that has an enabled wireless network card but is not connected to a wireless access point? I.e. I'm using my laptop on the bus and someone else creates an ah-hoc network / blue-tooth network and access my computer without my consent?

What are the vulnerabilities for PC vs Mac?

How do I prevent this (if it's possible)?

Answer 1

I would say to anyone, if you are not using your wireless connection - Disable it. (Forget security for a second - you can save battery life!)

I have not personally seen any attacks on one that is not connected to a network, but that doesn't mean it is not possible...

I think that it is very far fetched, but, if you are using a driver where a vulnerability exists, it could be possible to remotely cause it damage without connecting - for example, a special character/command in a SSID, or possibly some sort of command targeting the device by MAC address (not 100% sure on this point as it is not actually connected).

If the above is true and there is a vulnerability at driver level, it would most likely be irrelevant whether you use Windows, Mac, Linux or other - arbitrary code could be executed, it would just need to be recompiled/changed slightly for the target.

These are all possibilities however, I doubt they exist/anyone is actively using them. Also worth mentioning (If you are a foil hat type person!) it is possible that a driver making company actually put remote execution code inside a driver for this sort of thing... Again, possible, but unlikely.

What is much more likely is you get people starting fake access points with the same SSID as public hotspots (e.g. BT Openzone, Cloud, T-Mobile etc.) and hope that your device has remembered the setting then automatically connects.

As for security concerns on the above, it would be the same as anything on a home network - any unpatched security hole could be used as an attack vector - with the addition that anything you do on these could be logged, redirected or other.

It is important in Vista/7 to choose Public as the location so it locks down the connection as much as possible including some of the main Windows attack vectors (e.g. stops SMB file sharing), I am not sure/cannot comment on similar location based security on MAC or Linux.

Answer 2

There are some known wireless driver exploits ... you can consult for example http://www.networkworld.com/columnists/2006/1127-wireless-security.html

As Wil mentioned, when you don't need your wireless connection, simply disable it !

Answer 3

If you are running Windows, it has this annoying habit of trying to automatically connect to wireless networks. An attacker can very easily create a malicious access point (say with the SSID Free Wifi) and your machine will connect to it unless configured well.

At that point, he can run a vulnerability scanner to identify weaknesses and then attack.

Quite easy to do on long distance transport (you get a lot of time) or at bus depots, airports, hotels etc