wireless insecurity... report?

EDIT: Sorry about the multiple posts... my connection kept timing out... I didn't think it ever posted. I've been having trouble posting lately... my bad. They should all be deleted by now.

I was in lab the other night at school and I working with this guy who has a hosting comany and also a small wireless ISP (802.11g) going on. He had his laptop with him and he was looking to see if he could get to his WAPs from our school. We could not.

But.... here is what we discovered...

Turns out that our school has 3 WAPs all broadcasting their SSID and are wide open. We didn't breach any security... we just discovered them. We have better things to do than mess with the schools network. It is a state run college and we could get in a sh17 load of trouble for messing around. I'm trying to get my education... not get kicked out/jail time.

I want to tell the admins... but want to be sure that they won't turn it around on us... like we were trying to break in... which we were not. Mabye we'll send an "annonymous" e-mail alerting them without giving our contact info. Mabye we'll just say that we live in the area (which there are plenty of dorms/apartments near by) and that we discovered their unprotected WAPs and they should look into securing it better. For now... I'm taking ALL of my stuff off their network...

Pretty scary with all of those kids at school getting in trouble for trying to help out the admins and the school alike. I'm tempted to just forget it... but what would that make me? No better than their admin(s). I have read the horror stories of others trying to help too.

Like most people know... I'm not a malicious person and neither is he. We both want to be in the security field at some point in our carreers and we are well on our ways. We feel we have a responsablility to both the school and the students to report it. We just don't want to get in trouble...

What do you all think we should do? Just forget it and let them worry about it?

I've been in network security for five years and its been my experience that some admins are territorial lil' *****s. Despite this, something must be done to inform these "individuals" of the flaws in their network. Just forgetting such a matter makes you just as irresponsible and unprofessional as your substandard admins. If you foresee an issue in elightening them, then just do it anonymously if need be. But ultimately do the right thing and report the issue to the best of your means available.

Why not call them from some phoneboot in town?

Yes I totally agree with DJay. I've tried going to the admins of my high school about problems, only to have them laugh in my face. But I laughed whenever they got in trouble for all the security flaws ;D Though letting them know at least lets you know that you did the right thing, it is up to them to take measures.

I would think though that if you might know any staff members of your college, maybe you should let them know so they can actually talk to the admins or place "help desk tickets" like we have here at Penn State. That way the problem can be logged and dealt with, and you don't really have to have your name mentioned, so you can't be acused of doing any "hacking".

I have had mixed reaction from informing Administrators that their wireless network needs to be better secured.

The "I don't give a crap admin"
One instance noticed that at this particular intersection I was picking up a lot of public IP traffic on my wireless software (kismet). I later analyzed the ethereal log that I had obtained and noticed a lot of POP passwords, IRC traffic (w/passwords), etc... I did a nslookup on the IP's that I found. I called the tech support at the ISP that registered those IP's. They said that it was " A new network and they weren't finished with it". Kind of odd that a network with customer traffic on it was "new and not finished". Well anyways, months went by and they still never fixed. Never heard from them again.

The "Thank God you told me this Admin."
Other instance, involving a major Oil Company. On my day of driving around I noticed a new AP. So I went to check it out and gather some more info. It also had publicly registered IP's. As well as a lot of http traffic, again my friend ethereal helped me out. I decided to call the Admin at this oil company, and when I say big, think Chevron, Connoco, Shell, etc... I called thier main number and asked to speak to a network administrator. Can you believe this, they patched me directly to one of their network security admins. Thought that was un-bellievable. Anyways, the admin was very pissed at the person that had done this. He asked for the ethereal log, which I was happy to send him, and he said it would be taken care of immediatly.

Those are the two instances so far that I have dealt with personally. Of course there are those admin's that would take you to court and sue you. But those are the chances you take by divulging information that you learned. Personally, I am one of those Administrators that would appreciate someone sharing with me information about insecurities in my network that I manage. Just be careful in how you approach the administrator and or management.

Good Luck

Quote:

---

I would think though that if you might know any staff members of your college, maybe you should let them know so they can actually talk to the admins or place "help desk tickets" like we have here at Penn State.

---

I have thought about this, but most of the ones I know... know that I am learning network security, and might think I tried to find a vulnerablility. I am really cool with some of them.. but policies are policies. I don't want my name in the picture. I don't have too long to go with my first degree and would hate to jepordize it over something like this. Especially since I'm going to be returning for a second degree and some certs.

Quote:

---

I've tried going to the admins of my high school about problems, only to have them laugh in my face.

---

I've had this happen to me too. Makes you feel like crap that someone thinks that you can't know anything because of your age and education. Try living with my Dad... he is always "right"... lol

Quote:

---

Just forgetting such a matter makes you just as irresponsible and unprofessional as your substandard admins.

---

That is exactly what I'm thinking. I guess I will report it annonymously.

Thank you for your suggestions.
I can always count on the AO community to point me in the right direction!

Its a good thing that we follow a good set of ethics...

/off to yahoo to create a "Joe User" account... ;)

Actually,
hter is the third type of admin who think they are teh **** and everyone lese just stink...
I just recently re-became a student. after notr being able to check my email (school) for 3 days i went to ask some ???? got as an aswer a shitty it'll get better in2 months... sorry not good enough for me.
I know i'm not the best but 2 month is not acceptable in this kind of environment. so i wne and told him the truth about his netowrk (or at least my version) and he went like you know crap.... ok but the network is still down and right now we are 4 weeks later ...
this is the worst attitude i've ever ran into.

I say you should just chalk right in front of the sysadmins office. You can't get it turned around on you as attempting to break in, you get to have a clear concience, and hopefully the guy will take it for what it's worth and fix the network before someone does exploit it. ;)

--edit: edited to add the winking smiley.

That's a very intersting site, thread_killer....especially how they address the legalities of warchalking. Pretty cool / funny. :)

phish: I have been dealing with this around my town for quite some time. I have infiltrated quite a few networks ( some without even trying) and finally it got one my nerves so badly that I contacted one companies ISP, and the local paper with some information.
I've reported incidents to a handful of businesses, institutions etc about their flaws, and yes some admins are indeed *****s. Some aren't. What hasn't failed me yet is to go above the admin, directly to the person whose network is supposed to be being secured by the admin..
(You usually get a prompt and serious response.) namely the director, CIO, CEO, COO etc etc. My suggestion would be the following. kindly send a letter of concern to the admin. Make sure you word it so as not to implicate a hacking. After all Wireless signals are broadcasted...its not your fault you picked it up..much like a radio signal in your car. If the admin does not respond or responds negatively, go over his head and contact his boss.

from what i know of you. your upstanding and honest. im sure the staff at your school has that impression as well BUT you can never be certain of someones reaction or if there are any facts unknown to you that might cause them to hit the ceiling, maybe they became aware of someone actually breaking in...whatever. its just not worth what an accusation can do to your life. dont take any foolish chances. do the right thing but do it anonymously. if that dosnt bring change...chalk'em :-) to do the right thing without the motivation of reward (appreciation not money) is a much greater act.

how anonymous is really anonymous guys.....**** that..you have nothing to hide, man up and tell them. don't hide from it, that only implicates you.

go do the unknown sender email thing. just make sure you're not sending the email from a computer there inside the school grounds. they might see the IP and identify it to come from the school. then they'll check the logs of students who used the PC's. then they'll see it was you. :P

just use a PC outside school grounds

(long explanation just to say something so short...weird ain't it?)

Two things that may be a factor.

1) The SysAdmins may not even know the WAP's are there and may be extremely grateful that you point it out to them. Though it sounds improbible, I assure you it isn't. Users will do some crazy stuff without clearing it with the technology overlords. Where I work, a small department with their own budget decided to go out and buy 12 machines and build their own network without telling anyone! I found out about it when the lady called complaining that she couldn't get to the internet. Strange but true.

2) The SSID's might be broadcast deliberately. According to a vendor I met with the other day, Henrico County Public Schools in Richmond, VA, deliberately broadcasts their SSID. They figure that they are being funded publicly, so they have some wierd responsibility to provide public access. I'm told (mind you, this is heresay) that people park there after hours and on the weekends with their 802.11 compliant laptops and surf away.


Just food for thought.

Thank you all for your input.

I have sent an annonymous e mail and wil give them about a week until I take further action.
Which may or may not involve "chalking". ;)

I'm just happy that I can post on AO again. I was having some major problems on my home network and it seems to be mostly resolved... now I have a whole new set of problems...

but... istn't that the way it always works? :D

Thanks again!

thread_killer: to backup what you are saying. NYC has a ton of freeaccess Wireless networks. www.nycwireless.net . Other cities/areas may have them as well.

That's cool phishphreek, it's a good way to start. Keep us updated on what's going on!

Djay is right buddy .
as u can see that i am a newbie but common sence says do it anonymously may be mail from
a new account that u will never again use or anything but certainly not tell them directly or from a telephone booth.