Unconfigured Wireless AP Ethics

Quote:

---

Originally posted here by JonnyFrond
I pick up 2 other networks where I live and just using simple commands in dos and seeing what info could be gleaned was quite scary. I was able to log straight into their wireless router, and I am sure with a little bit of googling, I could have found the default admin password, and caused some havok.

---

This brings up an issue I have had in the past: Is there any possible way to notify Mr Bloggs with the open wireless AP that he hasn't configured it correctly and to do so or they may be at risk? Without imposing or being deemed illegal?

The sort of thing I'm thinking of is a virtual PostIt on their system... I have thought about literally posting Pos**** on the nearby houses/apartment doors with the SSID, but I didn't want to cause a ruckous.

I have seen a number of open wireless routers with changed SSIDS... but I would say this was a little beyond what I want to do.

Anyone have any good ways?

Cheers,

aL

isnt there a program that can make a map and find the wireless users house? a friend of mine has a program that does it but i dont know the name of it, but he uses it to find people who are tapping into his wireless. but that would be the safest way, find his house and knock on the door:P

otherwise id just go in and leave a text file on his desktop named READ ME NOW.txt saying "fix your xxx xxx before some bad kid with too much time hurts your box" anonymously:)

I was talking to my flatmate last night about this, and was saying that I quite liked the idea of leaving free internet hotspots for others to link into, and I believe that there has been a trend of chalking up an "infinity symbol" that sideways 8 at places for others to identify. Then my flat mate pointed out that it is a problem if some naughty man parks outside your house and surfs for kiddie porn through your internet access, it can be traced back to you. Even if nothing comes of it the whole idea of that gives me a bad taste in my mouth

But even so, I would still maintain that it is their problem. There is enough information out there and enough media coverage to know that internet security is important these days. If you were really concerned you could always contact their ISP and let them know. Would that work, or would they tell you to mind yer own business? I think the later and they might even know how you found out even that. And quite frankly, if that is the case, then it certainly isn't worth putting your pants on over your tights.

Quote:

---

otherwise id just go in and leave a text file on his desktop named READ ME NOW.txt saying "fix your xxx xxx before some bad kid with too much time hurts your box" anonymously

---

Nice idea except how many untechy people do you know that actually read text files that say "read me" or techy peeps for that matter.

A Spade's a spade in Fronny's world

im just stating that a person that finds a new file especially one that says readme now etc...or name it "you have been hacked.txt", something eye catching. especially on the desktop, i know my desktop the best. i consider it a good deed, points for the afterlife......

I used to run an open AP, for anyone who wanted to use it. My own computers were firewalled and had all sharing disabled. I don't believe that anyone could have done any damage to my systems as even the router was password protected (by a good password).

I ceased this practice when someone started using my internet connection to download massively, and I don't really want the RIAA to come after me.

Now I use WPA and MAC filtering to limit the connections to my router and have not had anyone else connect to me in a very long time.

During the time I was running an open AP, I was very vigilant about my logs and possible connections to my systems, checking them a couple of times per day. The downloading took place less than a day before I put a stop to it, and it was more than just downloading updates would account for, so I assumed it was music or program downloads that the other person was going for.

I would have continued to supply an open AP untill someone decided to use it for downloads of that sort.

edit> there is no way you could have reached my computer to leave any kind of message, that I am aware of....without some hard cracking of my systems.

Generally... people with completely open and unsecured AP's also run the Windows Messenger service.


You can do a NET SEND to leave them a note.

Net command guide

I am sorry to appear cynical, but so many people get very upset when you point out that they are doing something the wrong way. You frequently end up by causing more trouble than it is worth.

I would be inclined to ignore it, unless they are hijacking your system.

For example, supposing some bozo has used their system for illegal purposes, you will now be the prime suspect, illogical though that might seem.

:)

Interesting topic. As I speak, there are 8 wifi networks that I can see that are close to my apartment (I live in a complex). Only 2 of them are secured, including mine. This just goes to show that people refuse to take computer security seriously until they are subject to some nasty virus and/or trojan. Hell, even when I find viruses/trojans on other people's computers and point them out...I get a blank stare and they go back to business as usual.
I see 3 ways of handling open, unsecured wifi networks:
1) The good samaritan way - Let them know they have an unsecured network and hope they don't freak out on you.
2) The wrong way - Log on to their router (most likely using the default admin password) and block them out of their own router, then change the password.
3) The realistic way - do nothing.
Yes, I said do nothing. Why? You'd be lucky if even 1/4 of the people you notified did anything about it. People just don't care enough to educate themselves. In most cases, it takes something drastic to convince people to secure their computer(s)/network(s). We (meaning people who pay attention to computer security) all know what proper ethics are regarding unsecure wifi networks. Whether we practice them or not is another story.
In any event, I'm reminded of an old saying:
"If all people were angels, we wouldn't need a government"

I noticed that one of the wireless computers at work was connected to the router of the bowling alley next door... not encrypted... I found a laser printer and printed out instructions on how to set up encryption, and change the password of the router (which I am guessing was still the default). Not sure how ethical it was, but the next day, WEP was enabled, and the SSID was changed (although it was still being broadcasted). I figure that some good came out of the incident.

I love it when everyone has an opinion, it makes me realise two things;

1. I was right and
2. It's all about me, me me me me me.

Good, now I've got that off my chest....

I have a very dear friend who knows really only what I tell him about security, and he really sits and listens and thinks, and then once a year when I go to visit him, I spend 6 hours doing his acumulated patches and updates for virus and stuff over a 56k modem.

You can't tell anyone anything, they will only listen if they have asked for advice, and even then...How many times have you given directions to a stranger only for them to walk off in a totally different direction?

Quote:

---

I figure that some good came out of the incident.

---

Well if it works and you didn't get caught, you can have some feel good points. I find it is better to leave criminal activity to the criminals, they know how to get away with it, and they don't have a conscience that way people beef up their security others make money which if users are savvy the banks will pay, and we can all go to hell in a little row boat for cutting down the trees.


And before you ask, it is all about me


ME ME ME ME ME ME ME JF ME ME ME

The best thing to do is situations like this... where you have clueless people with open AP's... is to remember the location...

You never know when you need anonymous internet access.

Quote:

---

You must spread your AntiPoints around before giving it to d0pp again.

---

At last someone who speaks sense!

Quote:

---

Originally posted here by karmine
otherwise id just go in and leave a text file on his desktop named READ ME NOW.txt saying "fix your xxx xxx before some bad kid with too much time hurts your box" anonymously:)

---

Go on then, tell us all how you would do this.

I have an open wi-fi AP that has no internet connection just two very old boxs connected to it (1 hardwired the other wi-fi) It can be very interesting looking at what people do, or try to do to be more exact, when they find an open AP.

My other AP with internet access is totaly locked down.

My outlook on it, is if someone has a open AP and in this day and age has not even had the common sense to look into securing it - what do they expect.

Unless I know them of course then I will let them know. You would be suprised how many people change the ssid to their own name!!

I would like to add that it's not per se illegal to connect to an unsecured wireless network. The (legal) reasoning is as follows:

- Since Windows (by default, I think?) connects to "any available network", there is no easy way to tell (for the ignorant user, that is) what wireless network you're connected to (it takes skill to not see it, but anyways...). In other words: Windows could connect to your neighbor's network if he's got a stronger signal than yours, and you can't punish people for that.

- You have to be ignorant: the following only goes for unintentionally connecting to an unsecured wireless network:

The Electronic Communications Privacy Act states that it is not illegal to "intercept or access an electronic communication made through an electronic communication system that is configured so that such electronic communication is readily accessible to the general public" - the electronic communication with unsecured wi-fi is readily accessible to the general public and wi-fi uses unlicensed radio bands, so there's nothing illegal about connecting to them...

Quote:

---

originally by negative:

Since Windows (by default, I think?) connects to "any available network", there is no easy way to tell (for the ignorant user, that is) what wireless network you're connected to (it takes skill to not see it, but anyways...). In other words: Windows could connect to your neighbor's network if he's got a stronger signal than yours, and you can't punish people for that.

---

This is exactly what happened when the computer at my workplace connected to the bowling alley's network... for some reason it was picking up a stronger signal from the other router...

So...it's is not illegal to "intercept or access an electronic communication made through an electronic communication system that is configured so that such electronic communication is readily accessible to the general public"?

Following that logic, I can just run my old Uniden scanner and eavesdrop on cell phone calls? And it's legal if I sit in a Starbuck's transmitting t-mobile wireless and run Ethereal without logging onto the network?

I dunno...seems like a gray area at best. I'd hate to be a test case.

Quote:

---

I can just run my old Uniden scanner and eavesdrop on cell phone calls? And it's legal if I sit in a Starbuck's transmitting t-mobile wireless and run Ethereal without logging onto the network?

---

No... I don't think I mentioned cell phone calls. They're not in the public band afaik...

Quote:

---

You would be suprised how many people change the ssid to their own name!!

---

You gotta wonder how many people enter their SSN when they read SSID too... I bet _someone_ has... *shaking head*

Quote:

---

Starbuck's transmitting t-mobile wireless and run Ethereal without logging onto the network?

---

AFAIK, that is legal. Anything transmitted in the clear on a public frequency...

Quote:

---

The Electronic Communications Privacy Act states that it is not illegal to "intercept or access an electronic communication made through an electronic communication system that is configured so that such electronic communication is readily accessible to the general public" - the electronic communication with unsecured wi-fi is readily accessible to the general public and wi-fi uses unlicensed radio bands, so there's nothing illegal about connecting to them...

---

There has to be more to this. Nowhere does it state that you have to be ignorant or do it unintentionally.

Quote:

---

- You have to be ignorant: the following only goes for unintentionally connecting to an unsecured wireless network:

---

Well duh... of course there's more to it, namely the rest of the ECPA.

Section 2511 is where the intentional/unintentional disctintion comes from - in all articles, "intentional" interception is specified:

Quote:

---

Interception and disclosure of wire, oral, or
electronic communications prohibited

(1) Except as otherwise specifically provided in this chapter
any person who -

(a) intentionally intercepts, endeavors to intercept, or
procures any other person to intercept or endeavor to intercept,
any wire, oral, or electronic communication;
[...]

---

I had this situation and it turned out fine. It was my neighbor whom I know fairly well. I just told him that I was setting up my network and when the laptop was looking for my network I noticed an open one besides my own and determined it was his.

I don't know if this is applicable outside the States but just have then go to Wigle.net and they will likely be able to see their open network displayed on the Internet. That might get their attention.

Quote:

---

Originally posted here by card_richelieu
I had this situation and it turned out fine. It was my neighbor whom I know fairly well. I just told him that I was setting up my network and when the laptop was looking for my network I noticed an open one besides my own and determined it was his.

I don't know if this is applicable outside the States but just have then go to Wigle.net and they will likely be able to see their open network displayed on the Internet. That might get their attention.

---

That's great for you, but it is almost entirely due to your previous relationship with your neighbor and how you went about explaining it to him.

The best-case-scenario legal implications of using someones wifi AP (if you aren't doing anything hinkey, just using their AP to connect to the Internet via their ISP) is Unauthorized Use of Services/Resources. Do anything else, and your bound to cross all sorts of lines.

<WARNING> The following section describes activities that may have been considered illegal at the time, if detected and successfully prosecuted. They are presented here as a learning tool, NOT AS AN ADVOCATION OF ACCEPTABLE BEHAVIOR!</WARNING>

Nihil said it in his post, most folks aren't too keen to have their deficiencies pointed out to them. Years ago (I mean, upwards of 10), I was playing with the original BackOrifice from Dildog and the cDc. I was finding TONS of infected systems. I was still kind of young, dumb, and full of nevermind...before I had really considered the implications of "moral and ethical" behavior and whatnot. But one system I found had a REALLY low latency to me, so I started poking around, being young and dumb and not realizing or THINKING how inappropriate it was...I was just filling the vouyeristic urge each of us has to some degree.

I figured out that this guy was playing Ultima Online, and that he was logged in to ICQ. So, I decide to try and be the good samaritan and let him know he's hosed. I had found the whole BO package contents, and determined he had downloaded it and had infected himself (as was easy to do...the executable was in the archive, and many people would double click it thinking it would run a utility to setup the package to infect others or something...why RTFM when we can point and click, right?)

So I sent a system message using BO, explaining (anonymously) who I was and what was going on, and I told him I'd ICQ him from a certain ICQ number...one of my many anonymous ones. He messages me, we exchange email addresses (again, one of my anonymous ones) and I send him some links to help him clean it up, and then he acts kinda of put out and says "Don't contact me anymore". So I respect his wishes and leave him alone...but for the life of me, that system was reporting "Orifice Open" for several weeks after that...until I got tired of the whole thing and stopped scanning subnets.

And what do you know? The next day, my anonymous account is signed up for half a dozen listservs and spam. *****er had added my account to them to mess with me. Not that it mattered, it was an anonymous throw-away account, but the point is...

No good deed goes unpunished. IMHO, if you REALLY feel the urge to "do something good", instead of telling these folks anything, go serve food at the soup kitchen. They'll appreciate your help a lot more than your neighbors would.

I personally love the fact I can go anywhere in my Vibe with my laptop and pringle can and find Internet access! I'm at the park with my kid and can check my email, I go on vacation and we can check our email on the drive! LOL... Hey, if you're going to be in my neighborhood I'll give you my ESSID and key and you can surf away (all major credit cards accepted by my proxy :D )

I had a neighbour three houses away that was the second person on our street to get an AP (I was the first and watched with Network Stumbler all the time to see who else was bleeding-edge). His AP was wide open, SSID was SMC and him and his wife were developers so they shared their PCs and printers on the LAN.

I just about died when I saw how vulnerable this guy was and went and knocked on his door with the SMC WiFi security guide in my hand. I told him in my passionate, paranoid, security professional way that he is opening the universe to potential aliens from another galaxy and the odd war-driver who could really mess him up good. He looked at me with a half interested poker face and said thanks, he'd deal with it.

I checked this guys progress daily for a month and then decided he needed a reminder. So I connected to his printer (over the shared LAN) and printed out in 36 pt. Arial Bold "Thanks for sharing the Internet, I was just driving by and got an address". After I had done this I waited for him to knock on my door and I was ready to defend my reasoning and give him some fire and brimstone. He never showed up. I was curious. So I fired up Net Stumbler and I'll be damned! He was gone from the radar! I scanned again after that a few times and he never showed up again. So either he read the documentation and did things properly, or his wife was home when the printer started spitting the anonymous message and she freaked and started bashing all of the computer equipment at home with a ball-bat blessed in holy water.

DISCLAIMER: don't try this at home kiddies because it's not an ethical thing to do and when having a showdown with a corporate entity they can drag your ass through the courts and have you pay out punitive damages to their reputation (even if all you did was scan them and showed up suggesting they're a bunch of Noobs).

sorry to drudge up an old post, but i have to ask a question....maybe i'm naive, but are people really THAT PISSED when you tell them they are bleeding wifi access to whoever drives by??? I find that so irrational....i run my network wide open right now and i don't think i would be righteously offended if someone told me so. I cannot fathon why someone would get so upset over something like that....it's like being mad at the "guy" across the street cause he knocked on my door to tell me it's raining and my car windows are down. Well, hell hit him in the face and say *** off???? no, do the right thing and fix your security hole!!!!! Wow, i honestly can't believe someone would be that upset!?!?.....eric

It's not that people are pissed off at you for doing the right thing It's that they often don't understand about computers and networks to the same depth as you might. They are scared when somebody comes along and says something to the effect of "I can access your network". To them network may be an extension of computer. So instead of being cool about it and asking what they can do to fix it, they get defensive. They may even become a little scared that you were able to track down the network to them (even if you did knock on every door in the street to do so. They won't know that).
It all comes down to a fear of the unknown. They don't know much about the problem. They don't know what the problem means. They don't know how much more you know than them. They don't know your motives. It all adds up to them getting defensive and being angry at you. Of course there are sometimes other reasons, but this would be my top reason.

Fear of the unknown often leads us to think the worst of others, too.