Stories
Slash Boxes
Comments

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Growth of Wi-Fi Opens New Path for Thieves

Posted by CowboyNeal on Sat Mar 19, 2005 12:35 PM
from the high-tech-breakins dept.
E. Harley writes "Wi-Fi connections are popping up all over the place from retails locations, schools, municipalities, and homes. Unintentionally or not, most of these wi-fi hot spots never change the system's default settings, hide the connection from others, or encrypt the data sent over it. This NY Times article [Free registration required] talks about the size and extent of the problem, and what has happened with law enforcement investigating criminals using these public connections. Also, the article updates us on an earlier Slashdot story about wardriving. That case is still pending."
+ -
unknown
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • License to steal? (Score:5, Interesting)

    by bigtallmofo (695287) on Saturday March 19 2005, @12:39PM (#11985265)
    When criminals operate online through a Wi-Fi network, law enforcement agents can track their activity to the numeric Internet Protocol address corresponding to that connection. But from there the trail may go cold, in the case of a public network, or lead to an innocent owner of a wireless home network.

    After reading the article, it gives me the impression that you have a license to do just about any illegal internet activity so long as your WiFi router uses the default SSID, broadcasts its SSID and keeps the default passwords. If anything is traced back to you, you just blame the WiFi-Boogeyman for any illegal activities originating from your IP address.
    • by Anonymous Coward on Saturday March 19 2005, @12:43PM (#11985296)
      Maybe so, maybe not. If the traffic is originating from your IP and the authorities track you down, don't you think they'll check your computer before you can blame it on the WiFi-Boogeyman. I think the WiFi-Boogeyman is more a defence you can use in court if the police didn't find anything on your computer.
    • Notice that this article goes out of its way to associate the following practices with wifi:
      --theft
      --child porn
      --terrorism

      And the article here never even questions whether associating these practices with wifi could be a subterfuge by the telcos and cable companies to demonizes wifi so as to be able to outlaw municipal wifi through legislation, which is what they are afraid of, as that will cause them to cut their broadband prices.

      This whole article is a propaganda piece, bought and paid for by the vested interests, such as telcos and cable companies.

      What a sham is the NY Times. Just another cog in the CorpGovMedia propaganda machine...

      • Re:Simple! (Score:4, Informative)

        by mattyrobinson69 (751521) <mattyrobinson&gmail,com> on Saturday March 19 2005, @01:00PM (#11985387) Homepage
        MAC addresses are not unspoofable.

        Hooray for double negatives!
      • Re:Simple! (Score:5, Informative)

        by pegr (46683) * on Saturday March 19 2005, @01:02PM (#11985399) Homepage Journal
        Everybody is forgetting each and every ethernet adapter has a unique serial number/address, called the MAC address. It would be very easy to prove/disprove you were the one or not by that address.

        Google "etherchange" and see what you get... Here [ntsecurity.nu] is the first hit... MAC addresses don't prove diddley...
      • Mister Transistor, yours is a common misconception. Your workstation's address is never transmitted outside your local network.

        To the world outside your local network, every MAC address coming from your local network appears to be the same one - the one of your router. Any such WiFi Boogeyman would appear to have the same exact MAC address as you.

        As for the "more sophisticated tracking"... There are some things that can be done but to be honest they're not very sophisticated. Suffice it to say that
  • simpsons (Score:4, Funny)

    by kerv (734279) on Saturday March 19 2005, @12:41PM (#11985283) Homepage
    Hm... maybe I should have downloaded that 35GB Simpsons torrent on a neighbors wireless internet. Ooops.
    • Hm... maybe I should have downloaded that 35GB Simpsons torrent on a neighbors wireless internet.

      Well than, since 90% of Slashdot users do not pirate intellectual property, I can only assume that you already own a legally purchased copy of the Simpson's episode in question, and thus this would be "fair use". Right?

  • coffee house voyeur (Score:5, Interesting)

    by spoonyfork (23307) <spoonyfork AT gmail DOT com> on Saturday March 19 2005, @12:43PM (#11985293) Journal
    Schlep your lappy to a Starbucks, tap into the wifi, and fire up Driftnet [ex-parrot.com] (linux) or EtherPEG [etherpeg.org] (mac). Watch what flies by... hours of entertainment.
  • by PxM (855264) on Saturday March 19 2005, @12:45PM (#11985312)
    While I understand that Joe Six Pack wants plug and play functionality without configuring, it is really that hard to add in another layer? When the AP is running on factory settings, it can just cause all Web requests to route to the configuration page along with an easy to explain set up about passwords. AP passwords aren't hard as normal passwords since many APs are in a secure building so writing the password on the AP and locking it in the closet would work half decently.

    While the user has to take some blame for technical ignorance, the AP makers also have to take some blame here since they have the tech people to implement better security.

    --
    Want a free iPod? [freeipods.com]
    Or try a free Nintendo DS, GC, PS2, Xbox. [freegamingsystems.com] (you only need 4 referrals)
    Wired article as proof [wired.com]
  • by grumling (94709) on Saturday March 19 2005, @12:53PM (#11985345) Homepage
    But I do play with home networks. Shortly after I set up my access point (with 128bit encryption) I found someone gained access. How? By looking at the darn DHCP client table. I saw a MAC I didn't recognize, and blocked it out. No problem. It would have been just as easy to only allow known MAC addresses, but the cute chick downstairs needed to get online and I didn't know her MAC. I guess I could reconfigure, but why bother? I haven't had any other attachements since then.

    Now, I realize that I'm the exception, but how hard can it be to type 192.168.1.1 in a web browser? Of course, people should check the air pressure in their tires once a week, and clean the air filter on the furnace once in a while...

    • I helped a friend of mine set up his WiFi network a month ago. The setup was to allow a Windows network for his family, and route all external traffic via one point where he could block certain IP Addresses (his daughters are 11 and 8 and he does not want to give them unlimited access).

      So far so good.

      His elder daughter was surfing away happily, but could not access the other PCs. It turned out that the strongest signal she was receiving was from an unencrypted network in a neighbouring house/flat.

      That
    • by Ledora (611009) on Saturday March 19 2005, @03:38PM (#11986356)
      You should ue the security I use on my AP to prevent people from getting on it. I changed the broadcast power to 2mw... just barely enough to get a good signal where I need it. also 128bit WEP and mac filtering AND I disabled the web admit page (must telnet to run it.) This is all on a WRT54G (linksys) if anyone cares to have a setup like it
  • by Deliveranc3 (629997) on Saturday March 19 2005, @12:56PM (#11985362) Journal
    This is the same RIAA arguement from before in a diffrent context.

    Some people like to share we should encorage that... The best possible solution is for the router to limit bandwidth to outside connections (length of use = more bandwidth? First 2 users connected get most bandwidth?)

    Even windows doesn't have sharing on by default... Allowing users to sit behind your firewall isn't a huge deal, there are tonnes of users sharing their windows dir on Kazaa or whatever if someone wanted to be malicious they should.

    There is some importance in making life better for other people, if you don't when you go on a camping trip people around you will be weighing how hungry bears are against the $ in your wallet.
  • by neonman (544) on Saturday March 19 2005, @12:57PM (#11985369)
    The banks are not using secure authentication systems and WiFi users are getting blamed?

    Tell me.. When did it become my fault that someone can download tens of thousands of customer credit cards? Perhaps if these credit cards had been ditched long before the Internet we wouldn't be having that problem. Kerberos, challenge-response, PKI, and two-factor authentication devices have all been available for quite some time.

    Someone tell the Secret Service to stop monitoring IRC connections and go after lazy banks instead, or something :]
  • by TheMeuge (645043) on Saturday March 19 2005, @12:58PM (#11985377) Homepage
    What's needed is a layer of hardware-based identification on all internet-capable computers, which would be tied to the user's fingerprint and all of the user's actions would be logged by a central database. That way, any actions are have not been approved by the government or any corporation, would be immediately logged and the subject could be immediately arrested and shipped off to Syria/Lebanon/Turkey for tort***... i mean interrogation.

    After these latter measures are in place, we can all be perfectly secure in knowing that no porn, violence, homosexual acts, books about evolution, untampered news, or any worthwhile content is being viewed by anyone in the U.S.

    P.S. Or we could just make encryption and wifi security easy to implement and show people how to use it.

    P.P.S. Nah... the former solution seems a lot more comprehensive in terms of public oppression... I mean security.
  • by raitchison (734047) on Saturday March 19 2005, @01:11PM (#11985443) Homepage Journal

    This problem could be reduced dramatically if WAPs shipped from the factory with complex random passwords WEP enabled and complex random WEP keys.

    As an example on a new HPaq server the iLO remore management interface has complex random password, printed on a label on the device.

    Imagine if Linksys, etc. did the same thing with WAPs, where no 2 WAPs with the same WEP key or password.

    Sure some users would just disable the protection but I'm betting if you made it halfway convienient that most won't. Make it more work to be insecure and the security will win most of the time. You might even be able to reduce this further by having the admin interface give you lots of warnings and make you jump through hopps to disable the security funcions.

    Of course secrity could be improved upon even further if the default security was better than WEP but I think that's too high a barrier for the average user to tolerate. WEP may suck but it's considerably better than wide open.

    • This problem could be reduced dramatically if WAPs shipped from the factory with complex random passwords WEP enabled and complex random WEP keys.

      The incentive for the manufacturers is for wireless access points to NOT be secure out-of-the-box.

      If it's not secure, it's plug-and-play. Plug it in, it's up. If it's more secure, it makes instalation (to the point of getting traffic through it) more difficult.

      Insecurity doesn't affect the user until they get burned - mainly by lower performance as their bandwidth gets leached (assuming their important applications, like banking, already use end-to-end encryption). Leaching might not even be noticed. If it is, they can diagnose it and tighten things up.

      Security impacts ease-of-use, and thus sales.
  • by chrisgeleven (514645) on Saturday March 19 2005, @01:19PM (#11985490) Homepage
    Part of the problem is that the manufacturers don't disable anything by default...instead, you can literally plug a wireless router in and it'll instantly work assuming your internet connection uses DHCP to get its IP address.

    Perhaps the easiest way to solve this problem is to disable the wireless part of the router until you run the setup program (or even better, make it launch the browser so it will work on any OS) and make you go through the steps of enabling encryption and everything.

    I have WPA enabled on my wireless router (a Linksys WRT54G with the latest firmware) and MAC filtering. I broadcast my SSID ("Break this"), but that is more for ease of use then anything.

    I then enabled SSL for the admin pages, so I must type https://192.168.1.1/ (the actual IP is different) to reach the router's admin page. I figure between SSL and WPA, it will be pretty hard for someone to break into my router's admin page.

    The key is, with WPA and MAC filtering that will keep out all but the most determined out. If they ever got past that and onto my wireless network, I have logs so I could manually block them.
  • by the_REAL_sam (670858) on Saturday March 19 2005, @01:22PM (#11985505) Journal

    i'll play devil's advocate, for a minute:

    the airwaves are supposed to be public.

    therefore, if there's a "thief," the thief would be the group that cordones the public airwaves off and claims them as their own private property.

  • happened to me (Score:4, Interesting)

    by mslinux (570958) on Saturday March 19 2005, @01:27PM (#11985536)
    We have a Python script on our laptops that send netstat, ipconfig, route info via email when they boot. When a laptop is stolen and the thief is dumb enough to use it online, we can subponea the ISP and walk to their door. But the last one that was stolen was in an apartment building that had 5 or 6 open WAPS. We knew that the laptop was in one of the apartments, but the cops could not get a search warrant for all the apartments within 150' radius of the open WAP that the stolen laptop was on... long story short, they got away with it.
  • Notice how this NY Times articles is careful to associate each of this poisonous trio of ID Theft-ChildPorn-Terrorism with...WiFi.

    And what a coincidence that just as this article is being published, that all over America, state governments are trying to decide whether to outlaw municipal wifi. Of course, this drive to outlaw municipal wifi is in NO WAY connected to this article that tends to associate wifi with THEFT, CHILD PORN, and TERRORISM. And in no way would the telco and cable TV lobbies that stand to lose BILLIONS (if municipal wifi takes off) try to get the NY Times to help make wifi look bad.

    No way the media would do that! They have integrity. They would never sell out to the telco-cableTV lobby like that.
    Would they?

      • OK, Anonymous Coward, let's get it on! (BTW, are you are a lobbyist for the telco/cable industry? Is that why you post anonymously?)

        you wrote:

        Prove it. You always make these unfounded claims with nothing to back it up.


        I cannot PROVE it. I do not have a complete audio-video record of every waking moment of everyone who is in control of the NY Times. But I don't HAVE to prove it. All I have to do is show that there is a LIKELIHOOD that the this article and others are biased in favor of established industry players. Really, it should be obvious to anyone who is unbiased.


        You can't even show that there is a pattern of industry favortism in the NY Times' articles, but even if I showed you numerous articles that praised wireless access, you'd try to claim (again, with no proof) its just another conspiracy to make people think that they aren't in cahoots.


        Oh, so, in order to point out that this article unquestioningly cites opinions that demonize wifi, I have to FIRST be able to go back through the archives and show a pattern? Look, the evidence is right in front of us. We ALL know that established corporate lobbies want to shut competition. We ALL know that they manipulate the media to do so. With that in mind, why, oh, WHY does this article NOT take that into account? Why doesn't the reporter acknowledge the huge industtry that stands to profit from demonizing wifi as this article does? Isn't that what fair journalism is all about?


        In short, there is nothing NY Times can do to be good in your eyes unless they say exactly what fits your own socialist agenda.


        I am not a socialist. Period. I am a Leftist. But Rush Limbaugh and the Wall St Journal did not provide you with the information to make that distinction, did they? How unfortunate for you...


        Anything that deviates from this must be some sort of Republican conspiracy to consolidate corporations and oppress the people.


        The Democrats are only marginally better then the Republicans.