Monday, March 10, 2014

Stanford team tries for zippier Wi-Fi in crowded buildings

Residents of a dorm can name their own networks and set policies while sharing access points

Having lots of Wi-Fi networks packed into a condominium or apartment building can hurt everyone's wireless performance, but Stanford University researchers say they've found a way to turn crowding into an advantage.

In a dorm on the Stanford campus, they're building a single, dense Wi-Fi infrastructure that each resident can use and manage like their own private network. That means the shared system, called BeHop, can be centrally managed for maximum performance and efficiency while users still assign their own SSIDs (service set identifiers), passwords and other settings, according to Yiannis Yiakoumis, a Stanford doctoral student who presented a paper at the Open Networking Summit this week.

+ Also on NetworkWorld: 10 Terrific Techie TED Talks +

There are Wi-Fi networks today, such as systems from Ruckus Wireless, that can be deployed across multi-unit buildings with some private control by individual residents. But the Stanford project is making this happen with inexpensive, consumer-grade access points and SDN (software-defined networking), on the foundation of open-source software.

In multi-unit housing, each household typically installs its own Wi-Fi network with a wired broadband link out to the Internet. Each of those networks may be powerful enough to give good performance under optimal circumstances within the owner's unit, but it may suffer from interference with all the other privately run networks next door.

Borrowing techniques from enterprise Wi-Fi, Yiakoumis and his colleagues built a shared network of APs (access points), in this case home units provided by NetGear. They modified the firmware of those APs, and using SDN, they virtualized the private aspects of the network experience.

In the Stanford researcher's model, residents can name and secure their own virtual networks as if they had bought and plugged in a router in their own rooms. They can also assign policies such as parental controls and prioritize their favorite applications for access to bandwidth. Then, wherever they go in the building, they can log into that same virtual network, Yiakoumis said.

Meanwhile, the underlying tasks of assigning client devices to particular channels and access points are centrally controlled to make the best use of the infrastructure. Where separately owned and managed APs may make poor use of the unlicensed frequencies available in the building, the centrally controlled network can use its universal view to arrange the resources most efficiently.

SDN places control of networks in overarching software rather than in the specialized network components that forward packets. BeHop uses software components including the OpenWRT Linux distribution for Wi-Fi routers and the Open VSwitch virtual switch, which is included in the Linux kernel. While most of the software used in the project is open source, the team has developed some code it hasn't had time to release as open source, Yiakoumis said. It plans to do so later.

BeHop also differs from enterprise wireless LANs, and from residential systems based on enterprise-class APs such as Ruckus', with its consumer-grade access points. The Stanford team used the approach of blanketing the dorm with inexpensive APs and skipping the typically expensive and time-consuming task of conducting a site survey for optimal placement. They don't yet have performance numbers for the network, but they expect to produce those in the coming months.

Ruckus says its enterprise-class APs, which cost anywhere from US$500 to $1,000 each, are built to use spectrum better than consumer-grade units priced at $200 and below. The Ruckus APs point their signals at a user's device rather than blasting transmissions across a wide area, which helps no matter how the network is managed, said David Callisch, vice president of corporate marketing.

Wi-Fi routers that consumers buy for their own units don't clash with each other very often, because they usually don't transmit on the same channel at the exact same time, said Farpoint Research analyst Craig Mathias. As more devices come out with radios for both the crowded 2.4GHz band and the more spacious 5GHz band, they'll have even more channels to choose from. But demands on all Wi-Fi frequencies will continue to grow, he said.

"It hasn't been as big a problem as people are making it out to be," Mathias said. "Over time, though, it will become more of a problem."

Enterprise Wi-Fi systems have sophisticated mechanisms for dividing up spectrum to provide the most possible capacity, but consumer-grade routers have very little. At most, a router that's set to automatically pick a channel will check to see which one's already busy, but it may not do that quickly or often enough, Mathias said.

"If everybody uses their own router, you don't have a prayer" of getting optimal spectrum use, Mathias said. That said, when performance lags, it's usually because the shared wired connection to the Internet is too narrow, he said. Farpoint recommends multi-unit dwellings use centrally deployed and managed Wi-Fi with enterprise-class access points.

The technology being developed at Stanford could be offered by access-point vendors, a managed service provider, a building owner, or an Internet service provider, Yiakoumis said. He and his colleagues are leaving the business model to others. It would work best if the residents shared the same broadband service, he said. Because Wi-Fi uses unlicensed spectrum, other residents might set up their own Wi-Fi routers anyway. But the more who participated, the better the network's overall performance, he said.

"We're just trying to improve things as much as we can," he said.


Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Monday, March 3, 2014

Even Apple and Google can't protect users from inherent mobile app risks

To paraphrase a phrase, there is no such thing as a free app.

Yes, there are hundreds of thousands out there that won't cost you a cent to download. But they still extract a price. The price, at a minimum, is information about you. As more than one expert has said, "You are the payment." And that payment is not risk-free.

The large majority of mobile apps, even those vetted through Apple's App Store or Google's Play Store, are (with apologies to Rogers and Hammerstein) "getting to know you, getting to know all about you," in exchange for helping you tune your instrument, see your way in the dark, find a new restaurant and any number of other services.

Except the goal of that knowledge is commercial, not romantic. The developers of those apps are selling information about you to analysts and marketers information that, knowingly or not, you are volunteering to give them.

That, in the view of many mobile users, is not necessarily risky if all it means is getting some targeted ads for things that already interest them. And there are apps available that are even designed to protect your privacy among them Telegram, Wickr and Confide for text messages and Snapchat for photos that delete what you sent in seconds or minutes.

But users may not be aware of how much more interested purveyors of malware are in them than they were even a couple of years ago.

The Mobile Security Threat Report from Sophos, released at this week's Mobile World Congress, reports that while the first mobile malware appeared 10 years ago, it has exploded in the past two years, responding to mobile subscriptions now totaling about 7 billion and app downloads of about 110 billion just from Apple's App Store and Google's Play Store.

The company, which has tracked Android malware samples since 2004, reported that they remained relatively negligible until 2012, and since then have grown to more than 650,000.

And even with apps free of malware, users may not know how deep the collection goes, and how their information (about friends and business associates, their identity and their financial transactions) can fall into the wrong hands.

Domingo Guerra, cofounder and president of mobile app risk management vendor Appthority, contends that this is a greater risk than malware right now. While he agrees that malware is "growing exponentially," he said it remains, "a sliver of the app ecosystem. Having analyzed over 2.3 million apps for our customers, we have found that less than 0.4% of apps have malware, while 79% had other kinds of enterprise risk.

In its Winter 2014 App Reputation Report, Appthority analyzed 400 apps the top 100 free and top 100 paid for each of the two most most popular mobile platforms, iOS and Android ndash; and reported multiple "risky" behaviors, most involving the privacy of users.

Of the free apps analyzed from both platforms, 70% allow location tracking, 56% identify the user's ID (UDID), 31% access users' contact list or address book, 69% use single sign-on, 53% share data with ad networks and analytics and 51% offer in-app purchasing.

That last item in-app purchasing can be especially risky, and expensive. Guerra said a growing trend is for apps to, "leverage in-app purchasing to monetize. For example, Candy Crush Saga, one of the most popular free apps, is also one of the top-grossing apps."

Guerra said Apple recently settled a case with the Federal Trade Commission about in-app purchases specifically for children's apps. "Parents thought they were authorizing one in-app-purchase transaction, but instead authorized any transaction during a 30-minute window," he said.

"This resulted in many 'unauthorized' charges, as kids used in-app-purchases to buy additional content, features, virtual goods etc. And in-app-purchases can be as high as $99 per transaction."

That does not mean paid apps are not invasive. "While 95% of free apps exhibited at least one risky behavior, so did 80% of the top paid apps," Appthority reported. "Developers of paid and free apps are seeking new methods of generating revenue and unfortunately, it comes at the cost of the user's privacy."

Security vendor McAfee reported similar findings recently. In a recent post on the McAfee Blog, Lianne Caetano wrote that company researchers, "found that privacy-invading apps are more common than ever before, and beyond violating your digital space, some even contain malware and other suspicious characteristics."

According to the report, 82% of the apps read the UDID; 64% know the wireless carrier; 59% track the last known location; 55% continuously track location; 26% read the apps used; 26% know the SIM card number; and 36% know the user's account information.

While some tracking is inevitable, given that users expect certain apps to guide them to specific locations, "the real question is: What are these apps doing with all of the information that they collect? ... some of these apps may be oversharing that information with third parties or using it to inform more nefarious groups," Caetano wrote.

And some of the promises made about privacy may not be rigorously enforced. Among Apple's latest rules for developers is that they should not request a UDID as a method of user tracking.

"However, 26% of top iOS apps still make requests for UDID, and on any device that is running an older OS than iOS7, the apps are still able to get the UDID directly from the device," said Guerra.

Beyond the privacy risks, Guerra said many apps, "are communicating without encryption, so intercepting this data in motion is also easy." A hacker doesn't need to hack a device to get this data; they could simply sniff the network.

In spite of such multiple warnings about both privacy invasion and malware from mobile apps, there is so far no perceptible consumer backlash about the risks of mobile apps. That may be in large measure because, as Scott Matsumoto, principal consultant at Cigital, puts it, "there is no backlash because people don't know it's happening."

But Matsumoto also said data collection on users is not a black-and-white issue. Some free apps, like those from a bank, collect information so they know users' typical habits and can tell more easily if someone is trying to impersonate them.

Dan Dearing, vice president of marketing at MobileSpaces, agreed. "The problem is complicated," he said. "You might want apps to see your contacts, to make your life easier, but not upload them to their server. But then the policy choices that a user needs to make get too complicated."

There are things consumers and enterprises do to improve their privacy. Among the most basic are to buy apps only from reliable sources that have been vetted by companies like Google and Apple, and to take the time to limit the amount of tracking an app can do, through privacy and/or preference settings.

"Apps are generally collecting more information than they need," Guerra said. "Why does a flashlight app need my location, calendar, and address book? The issue this creates is that these databases are not always built securely and can become targets for criminals or governments recall NSA's comments about using Angry Birds data to track user data."

Strong passwords and strong encryption also help, especially with handheld devices that can be lost or stolen.

Bogdan "Bob" Botezatu, senior e-threat analyst at Bitdefender, said encryption is crucial, since, "mobile phones and tablets spend the bulk of their time on unsecure, untrusted networks."

Botezatu also said users should, "limit themselves to installing the applications they need, most of which come from trustworthy publishers. The smaller the number of applications installed, the smaller the attack surface."



Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com