A wardrive..... :eek:

Out of interest I decided to drive the four miles between my home and my watering hole with Netstumbler fired up. The drive is through mixed suburban areas, some commercial some residential. I was surprised at what I found.

1. Excluding my own WAP's at either end of the trip there were a total of 68 WAP's broadcasting their SSID.

2. Fourty of those WAPs were unencrypted.

3. Thirty eight were broadcasting the default SSID

4. 31 were Wireless-G indicating more recent purchase.

5. 18 of the Wireless-G were unencrypted.

6. One Government office, (porbably the Police station I passed :eek: ), was running a Linksys in default configuration.... I will resist the temptation.....

7. 3 people used their house number as the SSID

8. 3 People used their first name as the SSID

9. One person used their initial and last name as the SSID

10. 3 companies used the company name as the SSID

11. One company had three WAP's all broadcasting the same SSID, (MAC's were different, Fake network?)

12. The local Cemetery has wireless access... I find this funny for two reasons.... it's encrypted.... and it's where I want to be buried.... :D

Hope you find that little wardrive as interesting as I did. It seems that wireless is making quite big inroads into normal people's lives but that they have no clue about even the most basic personal security issues.

I had an experience similar to it when one of my friend purchased a new laptop with wireless access card included, when i asked him about his safety measures his reply was " Hey this is branded laptop and preloaded with windows XP and you know microsoft has just released SP2 which is much secure and also dealer told me that this system is state of art, So why do I have to worry". Well if this is how these terms are interpreted , then it is no wonder that you experienced this in your wardrive. :-)

rider: On the client side with XPSP2 I would suspect that this isn't quite such as big deal as the WAP's themselves but I do get your point.

Seems to me that I can go anywhere and do anything completely anonymously because the unprotected WAP's give me almost unlimited opportunity.

Lets say I'm a terrorist and whether I am or not I think there is a high possibility that I am being watched. The scanario goes something like this......

1. OBL has a mail server in Jakarta listening on port 1234
2. I wardrive while going to work and save the log.
3. I get home and pick my three target WAP's that make it look like I will get straight on.
4. I configure my laptop to connect to them automatically.
5. I write a script that begins to ping yahoo constantly until I get a reply.
6. When Yahoo replies the script then runs a .reg file to alter my MAC address then deletes the .reg, disconnects and reconnects to the WAP.
7. The script sends a message to OBL's mail server with my encrypted attachment.
8. When the message is sent the script checks for mail and d/l's the encrypted IP address and port of the next mail drop, (they rotate on OBL's end for security's sake).
9. When the send/receive are done the script runs a .reg file that changes my MAC back to normal and deletes the .reg file and terminates.
10. I fire it up and drive to work.

Even if I am being followed and listened in on it will appear that the transmission came from somewhere else and that all I was doing was driving to work.

and that isn't all that difficult to do..........

.One of my roommates has a tablet pc and I put a input into the stereo and a ac/dc power adapeter in the car too. We'd ride around and just run stumbler. It's amazing how many open APs there are around here. I'll see if the numbers are still saved on his computer tomorrow after he wakes up.

Thats what my whole point was tiger shark, users are there who think all thses security related (even simple ) things too much work to do. there assumption of accessing something without dwidling with wires, shows that they like to be pampered so that they have to do less work, but when it comes to simple safety precautions it s boring, geeky and so on.
Now even a single user ina big company(anyone with sesitive data) with attitude can a potential hazard to company's data, as was case in your drive along 'police station'.
My point with SP2 was also that when it was released there is much huphullah in magazines(general pc users) that it is making them beleive that now everything is being taken care of and there is nothing to worry about. So much for technologically advanced society.

Tiger, you'd love my neighborhood. There's a wireless ISP broadcasting from atop the local water tower not 2 blocks from my house...

Love the cemetary encryption - Perhaps they're downloading PR0N from Beyond?

Quote:

---

Perhaps they're downloading PR0N from Beyond?

---

Yeah, but I like my ladies with a little "meat" not the boney old things they'd be watching..... ROFLMAO

My point with SP2 was also that when it was released there is much huphullah in magazines(general pc users) that it is making them beleive that now everything is being taken care of and there is nothing to worry about. So much for technologically advanced society.

A great point Rider! Education must be put out there that even though SP2 has some advances in security; it is quite a long way from being secure.

I conducted a wardrive from Staten island to 59th St (i was doing some work for a client and just let netstumbler run on the drive home) picked up hundreds of open APs, Manhattan seems littered with them.

Although, the client I was working on was using the new TKIP supported implementations (well, it was new then), now that was an entirely different beast.

Quote:

---

(porbably the Police station I passed )

---

Resist.... resist... resist.....

Actually that "chaps my ass" I fought and fought at a local level to keep wireless out of the local police headquarters and they did it anyway. ALL it takes is One tech to leave a link open and bam, you know damn well local government agencies do not have the audit and tech talent necessary to fight back and protect their "toyz". Do me a favor Tiger, go out tonight and war chalk their office. Watch them come in tomorrow and go WTF!!!! Chalk them right at the front entrance. :p

My local grocery chain has the ability to order croceries on the net and then have them either delivered or ready for pickup. I set here everyday staring at their open WAP link. I even checked out the antennas and routers to see exactly which they are and the model number as well as lights that are one indicating configuration etc. They are on a shelf in 4 locations across the main building. Sigh.... I am a white hat, I am a white hat.... big juicy truck full of steaks.... white hat white hat...

:D

Ronin:

I'd expect that in Manhatten or any other major city center. What you have there is lots of people renting buildings and apartments who aren't allowed to go digging holes in walls etc. So wireless is the obvious answer. I can always get a connection from my hotel room in Toronto and I haven't used netstumbler there yet.... no need really.... ;)

What interested me is that the commercial areas I had to drive through were relatively sparsely populated with businesses mainly because of the cemetary being large. The majority of the hits came from Joe Public's houses in the residential area which is about 50% of the drive. I didn't expect that big of a market penetration in the home user market to be honest. but the number of Wireless-G WAPs indicates that they are relatively recent purchases.

Quote:

---

Chalk them right at the front entrance

---

[Edit]

You are joking.... right.... That's where they park the police cars... I have $10 says they have a camera out there.... I'll just finish my pretty graffiti and I'll turn around to a Glock in the face and a burly cop asking "Got yer license Buddy"!!!!!! :eek:

Now the cartful of steaks.... hmmm... You are a white hat, you are a white hat... :D

[/Edit]

Did I mention they have stickers on the routers with the name and contact group......

day dreaming....

"Hello this is Bob from *****. We are having problems and we need you to reboot router number 4, it's over by the milk. It says GateRtr*** on it. Yeah that's it, you know what I mean. Yeah just turn it off and I'll call you back in a few minutes. Yeah I know, it would take about and hour for techs to get down their from ***** and the boss is pretty hot about it, you know how they have been getting on to us about customer service! How dare they get onto us when they are the ones holding all the money shitting on the little man. It will only take a bit and you will be a hero bringing the net back up. OK? Now your inventory system will be down for a few minutes but the Point of Sale stuff goes into a local safe mode so everthing is cool. NEW transactions to the system will get uploaded as soon as that box comes back online. Talk to you in a bit dude. thanks man, your a life saver."

Quote:

---

Glock in the face

---

Hire some kid at the coffee shop with a laptop to war chalk it. Buy him a cup of espresso.

//EDIT

This may seem a bit off topic but puting your gatways on shelves in public view and having the contact info on it is just as bad as leaving the gate open. Let's change the scenario.... I don't have an open link.....

"Hey man this is bob again... I couldn't reset the router and man is the boss pissed off! Can you believe that crap they pull on us? Here do me a favor and I swear the next time I am down from ***** I'll buy you a beer over at Chili's. Go back to the same router and pull out the power cord and hold down the black key wile you plug the cord back in. Cool is it blinking red now.... sweet dude I'll get right back to you l8tr."

:eek:

Quote:

---

Hire some kid at the coffee shop with a laptop to war chalk it. Buy him a cup of espresso.

---

It would be a bit more of an interesting exercise doing something along the lines of my terrorist example above.... Except have it run an NMap scan against the subnet while I'm in there asking about the procedure for my CCW..... :D Then email them the results from someone elses WAP...... Through their own mail server.... ;)

Tigershark, yes for some areas in the city lots of folks have no choice but to run wireless. My drive encompassed many of the areas which are primarily commercial (financial district, park Ave from 42-59) so I fear that there are many rogue access points in use at companies. They must be rogues because every company is using WEP and other security measures right....?

Quote:

---

Then email them the results from someone elses WAP...... Through their own mail server....

---

That my friend would be worth the risk. My risk analysis says, hell yes.
:)

Wifi is just a marketing pilocks dream, all those home users you came across fell for the sales pitch. How many people do you no need to be able to use there laptop in the garden.

Recently i had to get a Notary to draw me up some papers, there office was smaller than my flat. No more than 4 pc's and a printer, and yet they had a wifi network. Now i am not likely to sit in the pub over the road with my laptop, and use there unprotected network for one reason. The dodgy bastards in the pub would probably mug me for it.

I'm in the pub right now..... I'm bigger than the dodgey bastards.... Well... Ok, they ain't that dodgey.... ;)

I just put my WAP in at home, (I cracked finally), so I can watch football on the big screen upstairs without having to run a wire across the floor that would give my sweetie a heart attack, (which would then cause me horrible problems), while keeping track of my fantasy team in real time.... :D. I used to sit downstairs in my hovel while she sat upstairs.... I expect a less hassle filled season this year.... ;)

Lol i no exactly what you mean., But you aint no run of the mill home user are you. Believe me if you were to sit in my local with a laptop or a ppc, you would stick out like a sore pr......k at a prostitutes wedding.

\\WAY off topic.

I wish I was at the damn pub. I am here trying to determine why a single pc keeps calling me because the security log fills up and locks them out. Normally I would be quite excited but I want a beer. lol.

Quote:

---

I am a white hat, I am a white hat.... big juicy truck full of steaks.... white hat white hat...

---

With little black dots on .................. :D

WAP is just the new toy on the block, and unfortunately it has arrived before the [L]users have been educated in WIRED security.

I have no need for a home WAP, I live in a bungalow [single storey house] wiring goes up wall across attic down into ANY room, no prob ........
And I follow the 'SweetSpot' regime, as espoused by Undie's

Quote:

---

now seriously.. I generaly recommend a Sweetspot machine ..that is where the Specs are 80% of the bleeding edge.. but cost a min of half of the wallet drain.. you may need to spend a bit more on the video card and ram

---

But that is not the case for the 'must have the latest / greatest toyz NOW' brigade.
And THESE people are not always the most technically competant ...............

Still, if it wasn't for them, where would we get our work from ? ..................

What gets me is the fact that most admins just dont seem to know that if there is a WAP in the network. Most large networks that have 100+++ users never seem to keep up with their netowrk. even with admin, jr admins crawling all over the place they never notice Bob with his WiFi card in his laptop so he can use his PDA with a wire... Bob thinks its nifty, but it is a logistical nightmare.

In my network, I got hopping mad at the person who thought that they would use their 802.11b to bridge DSL from the company to thier offices in the next building ... none the less, unencrypted and streaming data that isnt public. Another source of many wifi problems are hospitals, they like the new wireless data that they can run to PDAs for their Docs. But forget that thier weak encryption is beaming patient info. a very very very big no no. the thing is thier admins are to overconfident in their systems and dont get an outside security consultant to check it out. ADMINS WAKE UP AND GET OUTSIDE CONSULTING!!!!!!!!

Home users are just plain stupid, they have no clue what anything does... makes me feel sorry for their ignorance, but than again, that is thier fault!

^^Shugart^^

Quote:

---

Home users are just plain stupid, they have no clue what anything does... makes me feel sorry for their ignorance, but than again, that is thier fault!

---

You have to watch what you say here biATCH, of i will slap you with my home wired network :D

I live in a townhome community, in my neighborhood alone there are about 10 wide open wireless networks, all broadcasting their SSID, and most are the default (linksys, belkin54g, etc.). Using a stumbler, I can pretty much nail down whose townhome has the open connection. I have often been tempted to knock on their door and offer my services as a wireless network security consultant. I would configure the access point and clients to use encryption, MAC address filtering, and set the SSID to nonbroadcast. How much should I charge? It would take about an hour to set up. Say around $200?

Suddenly i feel safe and secure in old ways like mine of network by wires, atleast you have to be physically here to access it.(ok you can copy my mac but at any given time ether you can login or me) .
and as one of post yesterday said that it took 50 years to break a lock using simple trick, well i think old ways have there days being praised here. but what else can we say about this wireless access that we can all easily tap on and best of all , we don't have to even more our butt for that(except for driving , of course)
Thank god , when my account expires this time atleast i ave backup plan to access internet till i clear my dues. :-)