May 5, 2007
Wireless epithets.
I'm in a café, using the café's WiFi, but I can see a list of all the signals within range, many of which are private and password protected. You can name your wireless network whatever you want. A lot of people put no effort into the name. They leave it "linksys" or they just put their first name. Some people do something more expressive, maybe promoting an artist or a cause they care about. But the list I'm seeing on my computer right now includes an offensive epithet! Somebody is imposing his ugliness on my space -- a new variation on graffiti.
Subscribe to:
Post Comments (Atom)
Posts
24 comments:
As a network administrator, and one who works with security tools often, I regularly scan wireless, and you'd be surprised at what I find. It all boils down to education. The later versions of the Linksys routers have done a BETTER job of encouraging users to secure their home WiFi routers, but there are still hundreds if not thousands of legacy routers out there mis-configured and WIDE open. One thing that still doesn't get done is the configuration wizard STILL doesn't turn of SSID broadcast, at least not in the router wizards I've encountered...perhaps this has changed recently, but this should be one of the FIRST things done during a router configuration...
I should do a 20 minute free config your home router step by step tour....
My computer shows a list of all the signals including the ones that have the security turned on.
There's a difference between having WEP (or other type of security), and SSID broadcast. If your router has SSID broadcast enabled, your laptop WILL see that router/access point. If the router/access point is PROPERLY configured/secured, it should have SSID broadcast turned off, and the network staff/provider of wireless access should provide you with a sheet TELLING you what the SSID is so you can manually enter it to configure your laptop...because your laptop won't see it.....that's security.
Actually, I'm not really sure why I should care if other people use the access I create, as long as there aren't too many people around to use it. What is the problem?
I pick up many networks from my densely populated Chicago neighborhood.
There is one called "Eggs, Feet and Vagina"
I feel this way about offensive T-shirts...and bumper stickers.
There's a BIG problem if you've got that Linksys router connected to the same network as your regular Windows desktop machine on your home network, which most home users DO....and if it's a UNPATCHED windows machine...it's a HAVEN for hackers, especially of that Windows box, especially if you've got NETBIOS enabled and open windows shares....
http://www.mycert.org.my/homepcsecurity.html
An open Linksys router on the same home network as your desktop PC, with, let's say, your financial Quicken info or other personal documents.....yeah....asking for trouble....
That's funny! Last year, I lived across the street from a starbucks in an apartment building. I liked to hang out at the starbucks but was aggravated by their T-mobile wireless extortion business. So I set up an access point in my apartment window (on it's own VLAN, of course) and set it to open so that I or anybody in that starbucks could use it. The SSID was "FUTmobile"
Pete: I use a Macintosh and an Apple AirPort.
Professor A: You might want to consider getting a copy of shareware iStumbler for your MacBook. It clearly shows wireless networks and their status. I find it's somewhat better than the network drop-down menu for clear information about nearby WiFi networks, and is handy for travel.
I won't say anything about KisMAC, the WiFi discovery and password cracking tool. It's too geeky and dangerous for ordinary Mac users. And cracking passwords would be wrong, not to mention illegal.
Actually, I'm not really sure why I should care if other people use the access I create, as long as there aren't too many people around to use it. What is the problem?
The biggest potential problem, aside from hackers gaining access to your own computer, is that people can use your WiFi network for illegal activities. I hesitate to even name them for reasons that the cyber-paranoid would understand.
But it isn't being paranoid to secure your WiFi access with WEP personal security, which you can easily do with the AirPort Setup Assistant. Use a long, random string of characters for a password. Someone with KisMac could easily crack a natural-language password in a few minutes. I know, because I've done it on my own networks to test security.
What Theo said: I believe I just read that having an open WAP is not a defense against child porn charges.
In other words, saying "I didn't do it, it was someone using my wireless" won't get you off the hook. I suppose the same is true if you set up your machine to be an anonymous proxy.
But, hey, you're the lawyer here....
Legal question: What if you have an open router and someone uses your network connection to download child pornography or pass nuclear bomb plans to a terrorist cell? Are you implicated in the criminal activity?
Well, obviously, just saying it wasn't me isn't enough to get you off the hook. But that's a different question from whether that evidence alone proves guilt beyond a reasonable doubt.
Maybe this is a stupid question, but does the website that you go to tell which router you're using?
I was in a coffee shop once and had the same experience of seeing many other networks. I had a little chuckle when I saw one of them was named "Hurray for Boobies."
The website you go to knows the IP address of the computer you are using to connect to the internet. All the computers using the same router will show the same IP address to whatever websites are visited (omitting a few technical complexities here, but that's the basics).
Here's what would happen if a bad guy uses your open wireless router to go surfing for contraband. The cops bust the contraband site and pull all the logs of all the IP addresses which accessed the site. When they get to your IP address, they'll see that it's registered to RoadRunner (or whoever is your ISP). Then they go to Roadrunner and check their logs to see which of their customers was assigned that IP address at the time of the access. Roadrunner checks their logs and gives them your name and address.
All Roadrunner can see is your router; that's the device it assigned the IP address to. From their standpoint, they don't know whether you've got one computer connected to the router or 3. So it's up to you to establish that it wasn't your computer which accessed the contraband site when the police show up at your door.
Well, yeah, exactly. What I've read indicates that you're responsible whether you did it or not. But that seems vaguely hysterical. Question is, is it true, and hysteria based on the whole child porn thing, or is it false, and I read it on, say, Slashdot, where everything not supremely technical is tinged with hysteria?
As to the router, yes, the web site can trace it. I'm not sure (generally) why you would, though. You could burn a lot of disk space keeping track of all that info.
Anyway, you would be implicated. And I'm not sure how you'd prove "I wasn't looking at [whatever]"
Okay, I turned on the security and added a password.
There are tons of places with open WiFi networks though.
Sorry to drag this out, and for the several mistakes that I've had to delete, but I'd like to say a few more words to wireless security and Macs.
It may be that there are tons of places with open WiFi networks where Althouse is. But they are getting scarce here in the Boston area. I have no doubt that just being nasty and suspicious compared to the nice, Midwestern types plays a part in this, but we've all gotten a little more fearful in recent years, haven't we?
But back to security: It's important not to use just any passwords. Long, random passwords are much more secure than natural-language passwords. This is true for any computer system. As I said in my previous comment, I was able to crack an 8-character natural language password in a few minutes with KisMAC. I could crack the longest "normal" password I've used in 20 minutes. I could not crack 31-character random passwords, however, and I didn't even bother with longer ones.
The best way to generate a random password is with one of the freeware password generators, either a dashboard widget or a stand-alone app. My favorite stand-alone is RPG. It's simple and self-explanatory. Apple has a dashboard widget on their site that is even simpler and works quite well.
There are two passwords you will need to protect your AirPort network with WPA-2 security. The first is the AirPort Network password. This should be a random 63-character string.
The other password is the AirPort base station configuration password. This should also be random, but can only be 31 characters long. It's important to protect the base station's configuration, as a hacker may be able to reconfigure your base station to gain access.
You can assign passwords using the AirPort Setup Assistant when the network is first set up, or after you've done a hard reset of the base station. Otherwise, use the AirPort Admin Utility. This is a bit complicated, but AirPort Help will see you through it.
Make sure the passwords are on your Keychain, and that your Keychain will allow AirPort to use them every time. You will see a dialog box to this effect when you first try to join the AirPort network with the new password. Be sure to click on "always allow" when it asks if AirPort can use the item "password" on the Keychain.
=====
I've been subject to several attempts that I know of to break into my two password-protected wireless networks. Intruders have gained access on several occasions. This has convinced me that the threat is real. Some of it may be relatively harmless "Wardriving," but I'm convinced that on at least two occasions people have used my Internet connection. For what, God only knows, but given the potential liability, I have no interest in allowing it to continue.
There are tons of places with open WiFi networks though.
There are tons of people who don't keep their AV software up to date or regularly install OS patches. And even more that use words out of the dictionary for passwords (or don't use any password whatsoever); doesn't make it a good idea.
Web sites have to know your IP address in order to respond to Web clients' requests for info. By info I mean everything that gets returned when you click on an URL. The explanation of how authorities can trace requests for info from a Web site (or any other network traffic for that matter) back to a particular user is correct, start with Web servers logs and work back through any intervening ISPs. However, I would like to stress that bad guys generally know they can be traced and try to hide their origins. In the old days before ubiquitous WIFI this generally involved stolen credit cards, disposable ISP accounts, and using a chains of ISPs, some of which would be located in third world countries unlikely or unable to cooperate with U.S. authorities when attempting to trace the IP back to a user. And while the serious criminals still engage in this kind of behavior, open WIFI access has seriously lowered the bar for anonymous mischief making.
Some examples:
There's a dark side to the convenience, though.
The technology has made life easier for high-tech criminals because it provides near anonymity. Each online connection generates an Internet Protocol Address, a unique set of numbers that can be traced back to a house or business.
That's still the case with Wi-Fi but if a criminal taps into a network, his actions would lead to the owner of that network. By the time authorities show up to investigate, the hacker would be gone.
"Anything they do traces back to your house and chances are we're going to knock on your door," Breeden said.
Breeden recalled a case a few years ago in which e-mail containing death threats was sent to a school principal in Tallahassee. The e-mail was traced back to a home, and when investigators arrived, they found a dumbfounded family. The culprit: a neighborhood boy who had set up the family's Wi-Fi network and then tapped into it.
In another Florida case, a man in an apartment complex used a neighbor's Wi-Fi to access bank information and pay for pornography sites.
But he slipped up. The man had sex products sent to his address. "The morning we did a search warrant, we found an antenna hanging out his window so he could get a better signal from his neighbor's network," Breeden said.
http://www.sptimes.com/2005/07/04/State/Wi_Fi_cloaks_a_new_br.shtml
Most places I've been in Monterey, CA (where I have been doing some research), have some kind of free-wireless Internet access available. While some of it is through a service that runs my Internet traffic through a proxy server and shows me advertisements, most of it is through open access points run by small businesses, restaurants, and home owners.
This is the future that Nicholas Negroponte predicted, of course. Years ago he said that there would be lots of free wireless around cities. When people asked him who would fund it, he said that it would be funded through the same mechanism that funds flower boxes: people would do it out of the goodness of their hearts because it doesn't cost much and it makes the world a better place.
I believed Nick back then, and I opened up the wireless access point at my house in Massachusetts. I learned my lesson later, when a neighbor's daughter came home for Christmas break, and her infested laptop associated with my access point and started trying to infect the Internet with the Code Red virus. My ISP told me to shut down the machine or get disconnected, with a $200 reconnection fee. So I put a password on the access point--and that was that.
http://www.technologyreview.com/blog/tags/wireless+internet+access/
So, those of you who haven't done so, please secure your WAP.
I had a pretty funny incident like this in a cafe in San Diego. The cafe provided a free wireless network, but there was also someone nearby, probably in the adjacent apartment building who was also hosting a personal wireless network. This person apparently did not know how to set up encryption for his network, but was clearly frustrated with cafe users accidently logging in to it. In order to stop the abuse he had named the network "FUCKTHEHELLOFF" which I thought was pretty funny, considering everyone who used the cafe's network inevitably saw this at least once when they were trying to connect.
Turning off SSID broadcast won't stop anyone who's a real threat anyway, especially on a busy network where people are connecting or roaming.
(If you're not using encryption, you're hosed in any case, unless you intend to just have your network wide open to any passing computer.
If you're using WEP, you're still hosed because WEP only prevents honest, decent people from using your network ... and anyone capable of running the script-kiddie tools to crack WEP can also run the script-kiddie tools to wait for an SSID frame to come up and snarf the SSID - or even force one.
The real security solution is to use WPA.
[Paranoid people can firewall the WAP so that the LAN is protected from any contact from the wireless network what isn't using a VPN. But that's pretty damn paranoid.])
Remember, Pete, that most of Linksys' customers are not network security people, and aren't going to write down their SSID and are going to complain to Linksys that "my computer doesn't see the internets" if they don't see the SSID.
That, combined with the lack of real security gained, well, is a good reason for them not to turn it off by default.
Hiding the SSID is almost the weakest form of security-via-obscurity I can imagine.
Post a Comment