Stealing Wireless network access

[MrBert]

First off i am just shoot out some other points of view. I personaly love grey areas. for example i foud out that my health insc. is free if i do everything out of the emrgency room no copay or anything. muahahaha emergency room for a headache. There is the part of liablity in having a public WAP. you are essencaily becoming an isp then yourself. make sure to cover your ass. and do not be an ass if you are the one getting on to a public WAP. if thoes rules were followed life would be nice but then agian reality hits...

[Tiger Shark]

Zombie: If you read my posts _carefully_ you will see that I go to great pains to make clear not to detrimentally affect the "provider" of the WAP. This would include using the WAP for nefarious purposes such as cracking since the activity would point back to the "provider".

The FBI is hardly likely to come honking on down to the "provider's" house because I checked my work systems with his WAP..... The complainant would be me and I would have nothing to complain about since I was also the perpetrator of the activity.

So, in short, NO - Nobody gets hurt.

Is there a huge potential for misuse? No more than there already is on the Internet itself.

As for the number of computers you can have the providers do not charge per computer. They charge per IP address. You are no better off buying the extra addresses than buying a router that pays for itself in a few months because the $5 doesn't buy you 1 bit, (literally), more bandwidth. You can have 254 computers behind the router but the total bandwidth provided still stays the same, the access time just slows like it does on any busy network. The cable providers don't give a rats about how many computers you have behind the router. They are keen to keep thier IP addresses for new customers until IPv6 is up, tried and tested and so the $5/month is potentially a waste for them when they could be making $40/month of the same product.

The only time they don't like the router is when you call to bitch about their crappy service. They want to blame it on your system before they start looking at their own and will not troubleshoot a connection with a router in the way.

MrBert: Yep.... that's about what I have been saying. If you find a nice little public WAP treat it and it's owner with the same respect you'd like to be shown if they found yours and everyone will be much happier....

[sickyourIT]

as far as the cool, tasty beer comment goes, did anyone think about backwash?

now, there's a good chance that nothing you do will affect the person's network. but let's assume they have a NAT firewall set up, so their broadcast IP is the one everyone sees you as. You piss off someone online, while on their IP (intentionally, or unintentionally) now their static broadcast IP has a bullseye on it...

Also, if said customer x with his accidental public WAP happens to be a gamer. Gamers get pissed if you mess with their bandwidth. Now checking email is in itself usualy harmless, but what if you do download a big attachment while he's playing unreal, and the lag causes him to lose the five bucks and bragging rights he bet someone on the game?

I'm not trying to piss anyone off, just trying to bring up valid points.

[Networker]

IchNiSan wrote:
There are several ways to make wireless more secure. If you use a radius server for authentication you have several options for increased security. EAP/TLS(client and server have X.509 certificaate, allows secure authentication) EAP/TTLS(only server has X.509 certificate, a bit easier to setup and maintain, also allows secure authentication), PEAP(cisco, server certificates.).

Yes IchNiSAN, the TLS extension gives a encrypted authentication you're right but:
1- 802.1X standard introduce a periodical re-authentication (but that's an option not systematically implemented in access points)
2- Between, 2 re-authentication or if there no re-auth, an attacker can DoS the authenticated PC and then spoof its 802.11b MAC address. In that case the authenticator (the Access Point) won't see a difference & will forward frames.

One paper of great interest on the subject that all WiFi users should read once:
An Initial Security Analysis of the IEEE 802.1X Standard - Mishra


Tiger:
just one thing about ssid:

Full article here
SSIDs are useless
The 802.11 standard specifies the SSID (service set identifier) as a form of password for a user's radio NIC to join a particular wireless LAN. 802.11 requires that the user's radio NIC have the same SSID as the access point have to enable association and communications with other devices. In fact, the SSID is the only "security" mechanism that the access point requires to enable association in the absence of activating optional security features.

The use of SSIDs is a fairly weak form of security, however, because most access points broadcast the SSID multiple times per second within the body of each beacon frame. A hacker can easily use an 802.11 analysis tool (e.g., AirMagnet, Netstumbler, or AiroPeek) to identify the SSID. In addition, Windows XP does a great job of "sniffing" the SSID in use by the network and automatically configuring the radio NIC within the end user device.

Some network administrators turn off SSID broadcasting (which deletes the SSID from the beacon frames), but a hacker can still sniff the SSID from frames that stations use when associating with an access point. They just have to wait until someone associates or re-assoicates (e.g., when roaming) with the network.

Aside from sniffing the SSID, many wireless LAN administrators make it even easier by using the vendor's default SSIDs, which are pretty well known. For example Cisco uses tsunami and most other vendors use the name of their company as the default SSID. Just do some war driving, and you'll see that this is true.

[black_knight]

I agree with the latest post, you shouldnt steal other people's networks. It is against the law and if you get caught, you might have an enemy for life. And 'cos he's/she's ur neighbour, it won't be very nice

[d0ppelg@nger]

Originally posted here by bballad
Instead of stealing the bandwidth you can do what I have done with my neighbors. We have a Very hi speed DSL line (it peaks at close t o1 mps, averages around 750 kbs) that we split between 5 families. The house with the lines has a WAP that we slapped a powered antenna on to (old CB antenna) and we all have wireless bridges or overlapping WAPS for our houses. Then we all split the cost of the DSL line, we all get broadband for less then we would each spend individually.

I might be wrong on this but isn't that stealing? if you read the fine print on your DSL agreement I do think it might say that sharing between houses is a no no....could be wrong though....

After all would the cable company allow you to split cable TV between five houses? But if your motto is , "it ain't stealing unless you get caught" then have fun....

[UpperCell]

I think the focus would be on getting payed for letting other households use it. though splitting the cost could be seen as such, I would think your fine.

[Tiger Shark]

Networker: The point about SSID's is understood and well taken. My point in this whole discussion has been that if I enter your cloud and you provide the default SSID, an IP address to my wireless card etc. etc. etc. and all I have to do is click on your cloud in my connection app. to access the resources your cloud provides then I am not, technically, doing anything wrong. OTOH, If I have to alter some setting or other on my end be it IP address or something in order to make the connection then I am probably doing something wrong because you changed something to prevent me from having automatic access and because I do something that "circumvent" that change I am "cracking" your system.

IMO, that attitude is fair..... I'm not asking Joe Public to become a security guru but I don't think it is unreasonable to expect anyone using any kind of technology to think about the implications of using it.

Let's think about a WAP for a second...... A WAP allows me to walk around my house, go out in my garage or yard and still remain connected to my network. Hmmmm.... It's all done without a wire, ergo, it acts like my car radio. Anyone can listen to the same radio station I am when I am in my car, ergo, anyone can listen to my network if they have a similar receiver. OK, that means that if I can connect to my network anyone else can and I don't want that. Ok, then I need to find out if there is a way to stop that... Lets visit the manufacturer of my WAP's website and see what they have to say..... ohhh look, it tells me how to restrict access by just anyone..... Cool, I make the changes and I'm done. How hard is that to work out for the average Joe..... Yes, I know..... It assumes the average Joe thinks about things which, we both know ain't happening......<sigh>

Now, because Joe made that change, let's say he did something simple like turn off DHCP and set fixed IP's on his 2 machines. In order for me to access his system I have to guess subnets until I find his or use airsnort to see what subnet he is using. I'm a cracker at that point because I am taking deliberate acts to bypass his "security" no matter how insipid that security may be. But if Joe made no changes the implication is that Joe is providing a service. I can never tell if Joe is providing a service through a deliberate act or by his sheer ignorance, either way, as long as I do nothing to deliberately harm Joe or his system I haven't done anything wrong.

[wreckwar]

I got a bit to say about the whole wireless thing. I love warwalking with my laptop in my book bag with headphones on listening for the beloved tone of netstubler to sound. I can not lie I like LANjacking but best of all i like to help people fix the probs they got all in all I don't do to munch LANjacking any more because I have authorizied acsess to more then nine diffrent wi-fi networks in my city. the moral is if you hack it it will come. LOL

[bballad]

Originally posted here by d0ppelg@nger


I might be wrong on this but isn't that stealing? if you read the fine print on your DSL agreement I do think it might say that sharing between houses is a no no....could be wrong though....

After all would the cable company allow you to split cable TV between five houses? But if your motto is , "it ain't stealing unless you get caught" then have fun....

Some of the cable companies may have an Issue with it..but we talked to the ISP first, cleared ti with them and got a business class DSL line from them...its still significantly cheaper for each family then getting individual DSL lines each