新型黑客工具威胁Wi Fi用户安全
下面是本站小编整理的新型黑客工具威胁Wi-Fi用户安全，供广大学者参考。
You may think the only People capable of snooping on your Internet activity are government intelligence agents or possibly a talented teenage hacker holed up in his parents’ basement. But some simple software lets just about anyone sitting next to you at your local coffee shop watch you browse the Web and even assume your identity online.
也许你曾以为窥探你上网活动的事只有政府情报人员或者藏在自家地下室的青年黑客才会干的出来。但一些简单的软件使得哪怕是小咖啡馆里在你身边的任何人都可以看到你在浏览的网页甚至获得你的身份验证信息。
“Like it or not, we are now living in a cyberpunk novel,” said Darren Kitchen, a systems administrator for an aerospace company in Richmond, Calif., and the host of Hak5, a video podcast about computer hacking and security. “When people find out how trivial and easy it is to see and even modify what you do online, they are shocked.”
达伦·凯臣是美国加州里士满市的一家航空公司的系统管理员，同时他还是一家名为Hak5的计算机黑客与信息安全视频播客网站的站长。他说，“不管你喜欢与否，我们现在正生活在一个数字庞克小说之中。当人们发现他们的网上信息是多么容易被黑时，他们都会目瞪口呆。”
Until recently, only determined and knowledgeable hackers with fancy tools and lots of time on their hands could spy while you used your laptop or smartphone at Wi-Fi hot spots. But a free program called Firesheep, released in October, has made it simple to see what other users of an unsecured Wi-Fi network are doing and then log on as them at the sites they visited.
不久前若要监视你的笔记本或智能手机通过Wi-Fi热点上网的情况，这还只是有能力和有毅力的黑客，花费大量时间并利用高精尖的工具才能办到的事。但去年十月发布的一款叫做Firesheep的自由程序使得监测未加密的Wi-Fi网络变得易如反掌，利用该软件人们可以监测别人上网信息乃至登录他人访问的网站帐户。
Without issuing any warnings of the possible threat, Web site administrators have since been scrambling to provide added protections.
在没有发布任何潜在安全威胁警告的情况下，网站管理员已经争先恐后的开始提供附加安全保护措施了。
“I released Firesheep to show that a core and widespread issue in Web site security is being ignored,” said Eric Butler, a freelance software developer in Seattle who created the program. “It points out the lack of end-to-end encryption.”
Firesheep的作者是西雅图的自由软件开发者埃里克巴·特勒，他表示：“我发布Firesheep就是为了让大家知道在网站安全上一个普遍的核心问题一直以来都被大家忽略了，那就是端到端的加密。”
What he means is that while the password you initially enter on Web sites like Facebook, Twitter, Flickr, Amazon, eBay and The New York Times is encrypted, the Web browser’s cookie, a bit of code that that identifies your computer, your settings on the site or other private information, is often not encrypted. Firesheep grabs that cookie, allowing nosy or malicious users to, in essence, be you on the site and have full access to your account.
当你在Facebook、Twitter、Flickr、Amzon、eBay和纽约时报之类的网站上初次输入登录密码时，端到端信息被加密。但当使用cookie登录时，常常是不进行加密的。Cookie是对记录你的登录信息、个人访问设置及某些私人信息的一段代码的称呼。Firesheep就设法抓取这些cookie，这样就可以使任何心存好奇或别有用心的用户干脆变成你，从网站上登录你的帐号。
More than a million people have downloaded the program in the last three months (including this reporter, who is not exactly a computer genius). And it is easy to use.
在过去三个月内超过一百万人已下载了该程序(包括对计算机并不在行的笔者在内)。它真的很简单易用。
The only sites that are safe from snoopers are those that employ the cryptographic protocol Transport Layer Security or its predecessor, Secure Sockets Layer, throughout your session. PayPal and many banks do this, but a startling number of sites that people trust to safeguard their privacy do not. You know you are shielded from prying eyes if a little lock appears in the corner of your browser or the Web address starts with “https” rather than “
唯一安全的网站就是那些在整个会话过程中使用传输层加密协议或其前身SSL的网站。PayPal和许多银行做了这样的设定。但仍有一批数量惊人的网站没有这么做，而通常人们却一直相信它们能够保护其私人信息。当你的浏览器的一角出现一个小小的锁形图标或者你所访问的网址前以“https”而不是“http”开头时，你才能躲过那些窥视的眼睛。
“The usual reason Web sites give for not encrypting all communication is that it will slow down the site and would be a huge engineering expense,” said Chris Palmer, technology director at the Electronic Frontier Foundation, an electronic rights advocacy group based in San Francisco. “Yes, there are operational hurdles, but they are solvable.”
电子前哨基金会是一家总部位于旧金山的数字版权维权组织，它的技术总监克利斯·帕尔默说：“网站不提供全程通信加密的理由通常是，这会拖慢站点访问速度并造成巨大的工程开销。要提供全程通信机密的确有一些操作上的障碍，但这些困难都是可以解决的。”
Indeed, Gmail made end-to-end encryption its default mode in January 2010. Facebook began to offer the same protection as an opt-in security feature last month, though it is so far available only to a small percentage of users and has limitations. For example, it doesn’t work with many third-party applications.
实际上，Gmail已于2010年一月起在其默认模式中采用了端到端加密技术。上个月，Facebook也开始将同样的保护措施作为一项可选择的安全功能提供给用户，但目前仍只限于一小部分用户应用。例如，它并不适用于许多第三方应用。
“It’s worth noting that Facebook took this step, but it’s too early to congratulate them,” said Mr. Butler, who is frustrated that “https” is not the site’s default setting. “Most people aren’t going to know about it or won’t think it’s important or won’t want to use it when they find out that it disables major applications.”
“Facebook这么做并不值得，现在就为他们的成功祝贺也为时尚早。大多数人并不会了解这项保护措施，或者并不会认为这有多重要，或者由于这对于大多数第三方应用无效而不会使用它。”巴特勒先生如是说，他仍觉得“https”访问并不是网站的默认访问设置乃是一件憾事。
Joe Sullivan, chief security officer at Facebook, said the company was engaged in a “deliberative rollout process,” to access and address any unforeseen difficulties. “We hope to have it available for all users in the next several weeks,” he said, adding that the company was also working to address problems with third-party applications and to make “https” the default setting.
Facebook的信息安全总监乔·沙利文表示，他们正着手准备一个“慎重的发布过程”，以发现并克服所有潜在的困难。他说，“我们希望在几周后这项安全措施能适用于所有用户。”此外他还补充说，公司正在努力解决第三方应用方面的安全问题并力促“https”访问方式成为默认设置。
Many Web sites offer some support for encryption via “https,” but they make it difficult to use. To address these problems, the Electronic Frontier Foundation in collaboration with the Tor Project, another group concerned with Internet privacy, released in June an add-on to the browser Firefox, called Https Everywhere. The extension, which can be downloaded at , makes “https” the stubbornly unchangeable default on all sites that support it.
许多网站通过“https”提供加密服务，但这用起来并不方便。为解决这个问题，电子前哨基金会联合Tor项目组(另一个互联网隐私相关组织)于去年六月发布了一款名为Https Everywhere(Https无处不在)的火狐浏览器插件。该插件(可由下载)强制通过https方式访问所有支持该访问服务的网站。
Since not all Web sites have “https” capability, Bill Pennington, chief strategy officer with the Web site risk management firm WhiteHat Security in Santa Clara, Calif., said: “I tell people that if you’re doing things with sensitive data, don’t do it at a Wi-Fi hot spot. Do it at home.”
由于并非所有网站都能提供“https”访问支持，白帽安全公司(美国加州圣克拉拉的网络风险管理公司)的首席策略官比尔·潘宁顿告戒大众：“如果你要进行涉及敏感信息的操作，不要通过Wi-Fi来做，还是回家再弄吧。”
But home wireless networks may not be all that safe either, because of free and widely available Wi-Fi cracking programs like Gerix WiFi Cracker, Aircrack-ng and Wifite. The programs work by faking legitimate user activity to collect a series of so-called weak keys or clues to the password. The process is wholly automated, said Mr. Kitchen at Hak5, allowing even techno-ignoramuses to recover a wireless router’s password in a matter of seconds. “I’ve yet to find a WEP-protected network not susceptible to this kind of attack,” Mr. Kitchen said.
但家里的无线网络也并不一定能确保安全，因为Gerix WiFi Cracker、Aircrack-ng 和Wifite之类的自由Wi-Fi黑客程序正被广泛使用着。此类软件仿冒合法用户的活动以窃取一系列所谓弱密匙或者可能透露户密码的蛛丝马迹。这个过程完全是自动的，凯臣在Hak5上说，这使得哪怕是一个技术白痴都能在几秒钟内获得一个无线路由器的密码。他还说：“我还没有发现哪个采用WEP保护的网络能够对这种攻击免疫。”
A WEP-encrypted password (for wired equivalent privacy) is not as strong as a WPA (or Wi-Fi protected access) password, so it’s best to use a WPA password instead. Even so, hackers can use the same free software programs to get on WPA password-protected networks as well. It just takes much longer (think weeks) and more computer expertise.
WEP(有线等效保密)密码并不如WPA(Wi-Fi接入保护)密码强大，所以使用WPA密码方为上策。但即便如此，黑客们也还是可以用同样的软件得到采用WPA密码保护的网络的密码信息。这只是需要花上更长的时间(大概是几周)，当然也需要更多的计算机专业知识。
Using such programs along with high-powered Wi-Fi antennas that cost less than $90, hackers can pull in signals from home networks two to three miles away. There are also some computerized cracking devices with built-in antennas on the market, like WifiRobin ($156). But experts said they were not as fast or effective as the latest free cracking programs, because the devices worked only on WEP-protected networks.
使用这些程序和大功率的Wi-Fi天线的成本不到90美元，这样黑客们就能监听到两三英里内的家庭无线网络信号了。市场上还有一些带有内置天线的黑客设备，例如售价156美元的WifiRobin之类。但专家们称这些设备并不如最新的自由黑客程序来的便捷有效，这些设备只能针对采用WEP保护的网络使用。
To protect yourself, changing the Service Set Identifier or SSID of your wireless network from the default name of your router (like Linksys or Netgear) to something less predictable helps, as does choosing a lengthy and complicated alphanumeric password.
要保护你自己，最好将你的服务集标识符或无线网络服务组标识符(SSID)由路由器的默认名(Linksys或Netgear之类)改成一个比较不易预测的名字，就像选择够长够复杂的字母数字混合的密码那样。
Setting up a virtual private network, or V.P.N., which encrypts all communications you transmit wirelessly whether on your home network or at a hot spot, is even more secure. The data looks like gibberish to a snooper as it travels from your computer to a secure server before it is blasted onto the Internet.
建立一个虚拟专用网络将对你收发的所有信息进行加密，无论你使用的是家用无线网络或是Wi-Fi热点。这会更安全些。你的计算机发出的数据会先经过一个网络安全服务器再在互联网上传播，这样加密后的数据在嗅探软件看来就像是一堆乱码一样。
Popular V.P.N. providers include Vyper, HotSpot and LogMeIn Hamachi. Some are free; others are as much as $18 a month, depending on how much data is encrypted. Free versions tend to encrypt only Web activity and not e-mail exchanges.
流行的提供商包括Vyper, HotSpot 和LogMeIn Hamachi。其中一些是免费的，另一些则依加密的数据量的多少来计费(如每月18美金)。免费版本的通常只加密Web访问信息而不加密电邮。
However, Mr. Palmer at the Electronic Frontier Foundation blames poorly designed Web sites, not vulnerable Wi-Fi connections, for security lapses. “Many popular sites were not designed for security from the beginning, and now we are suffering the consequences,” he said. “People need to demand ‘https’ so Web sites will do the painful integration work that needs to be done.”
但电子前哨基金会的帕尔默先生却认为网络安全的疏失更多的要归咎于糟糕的网站设计，而非Wi-Fi连接本身的脆弱性。他说：“许多热门网站在其设计之初就对安全问题考虑不足，现在不得不自食其果，大众要求使用‘https’，因此网站不得不艰难的履行其义务。”
