Are there any extra security risks with leaving wireless enabled while ethernet is connected?

Question

Mainly I'm wondering if operating systems will always use ethernet for internet connections if it is available, falling back to wireless when it is not.

My thinking is based around the security threat of someone snooping on a wireless connection, and would prefer for that vulnerability to not be a concern. Yet, don't want to go through (minor) hassle of disabling wireless.

I'm most concerned with OS X (Mountain Lion), but am curious about other OS' behavior like Ubuntu (10/11/12), other linux distros, Windows (XP/7/8)

Aside from snooping, are there other vulnerabilities with leaving wireless enabled (even if the answer to my above is that wireless is not used while ethernet is on)

Answer 1

Operating systems generally decide to route packets based on a routing table. On a Linux (possibly even Mac?) box, you can type:

$ ip -f inet route  
default via 192.168.1.1 dev wlan0  proto static 
192.168.0.0/16 dev wlan0  proto kernel  scope link  src 192.168.1.107 
192.168.122.0/24 dev virbr0  proto kernel  scope link  src 192.168.122.1

To see the routing table. This tells you that packets addressed to 192.168.0.0/16 go down wlan0, 192.168.122.0/24 goes down virbr0 and everything else (the default route, sometimes called 0.0.0.0) also gets sent via wlan0. It is assumed by the kernel that whatever is plugged into the other end of wlan0 can answer, of course.

What this means is that depending on your routing table, the OS will do different things. If your default route is via your ethernet card, the OS will only use the wireless link when it is up for resources on its network.

There are two considerations for leaving the wireless card enabled, however. These are:

• If the OS has been configured to automatically connect to an access point, you may find that the card being enabled allows it to automatically connect, which may not be your intention. This may also re-route traffic depending on your routes, which also might not be your intention.
• If the wireless card is enabled it is likely the wireless card will be used to periodically probe for access points the OS knows about. This information can be captured by anyone within range with a wireless card in promiscuous mode and therefore might prove useful in an assessment of your network.

If I'm honest, I think the risks of leaving your network card on are quite low, provided you have correctly configured your wireless network (you're not using WEP, are you?) switching to your wireless is unlikely to pose a horrendous risk to your security. If it does, then I'd ditch the wireless network altogether.

Answer 2

Most OS prefer using ethernet if available, because it is normally faster and more reliable than WiFi. I would not rely on it, though.

For snooping, my basic stance is to consider that any network is potentially vulnerable to hostile intrusion, so if some sensitive data must leave my machine, then SSL or SSH must be used. Regardless of the presence of a cable sprouting out of the back of the computer.

Apart from snooping, a potential and amusing vulnerability induced by a machine which does both ethernet and WiFi would be if the machine acted as a router, thus granting access to the ethernet local network to an attacker who succeeded in subverting the WiFi part. Desktop operating systems do not normally act as routers (in Linux, routing must be activated explicitly, and desktop distributions do not do it by default), but I would not be overly surprised if routing abilities were activated as part of the installation of some software packages (especially virtual machine managers, and VPN software).