Skip to Content.
Sympa Menu

internetworkers - Re: [internetworkers] ethical hacking

internetworkers AT lists.ibiblio.org

Subject: Internetworkers: http://www.ibiblio.org/internetworkers/

List archive

Chronological Thread  
  • From: David Minton <dminton AT mindspring.com>
  • To: InterNetWorkers <internetworkers AT lists.ibiblio.org>
  • Subject: Re: [internetworkers] ethical hacking
  • Date: Sat, 13 Sep 2003 13:29:28 -0400

On 9/13/03 12:34 PM, "brunkb AT ils.unc.edu" <brunkb AT ils.unc.edu> wrote:

>> i have to agree with Shea. not only was this guy NOT under contract
>> with this clinic to do security scanning (which would have made it
>> okay), he went the extra mile by exposing private data. a big NO-NO.
>
> I guess this is why I don't bother with the INW meetings. Just another
> bunch of beaten down statists. What did he steal? Who did he harm? The
> guy went to WRAL to warn everyone of the problem. I don't think he had any
> criminal intent and I wouldn't rely on any of the colored media reports of
> the incident. Whether or not he was trying to make a name for himself, he
> was being a good samaritan by trying to let them know that they are
> radiating all kinds of confidential information in all directions. It's a
> "mistake" any one of you could make, which is why I posted it.
>
> The people who should be arrested (or at least definitely FIRED) are the
> idiots employed as network admins at the clinic! After all, it isn't
> exactly rocket science to secure your wi-fi network. Incompetence.

We'll let him know that next time, if he steals your medical insurance
records, and turns them over to a TV reporter, he won't be harming anyone.
As for me, I would rather he not steal mine.

Maybe for his next project he should check the security at UNC and see if
your scholastic/employment records are getting "radiated" throughout campus
(not sure if you are student, faculty or staff at SILS). I am sure we would
all be interested in seeing them as proof of a flaw in security. I guess
there wouldn't be any harm in it, for it is in the greater public good?

To me, an interesting question is at what point are your guilty of computer
trespass? Since anyone with any sense will protect their wireless network
(mine uses a MAC white list, so it is obviously "private"), if you come
across an open network, what do you do if you are a real "ethical hacker?"
Stealing data is obviously not the way to go. Do you look for a print queue
and send a print job "Dear IT person, your network is insecure--you may want
to look into this?"

In this case, I would think that running an insecure network that contains
medical records would be a HIPAA violation, since the act covers "security
and privacy of health data." While the HIPAA web site is pretty confusing
IMHO, there is probably someone to contact at the Dept of HHS with security
issues.

David





Archive powered by MHonArc 2.6.24.

Top of Page