Skip to Content.
Sympa Menu

internetworkers - RE: [internetworkers] ethical hacking

internetworkers AT lists.ibiblio.org

Subject: Internetworkers: http://www.ibiblio.org/internetworkers/

List archive

Chronological Thread  
  • From: "Shea Tisdale" <shea AT sheatisdale.com>
  • To: "'Internetworkers: http://www.ibiblio.org/internetworkers/'" <internetworkers AT lists.ibiblio.org>
  • Subject: RE: [internetworkers] ethical hacking
  • Date: Sun, 14 Sep 2003 16:18:08 -0400

Hey David, thanks for posting.

Actually your wireless network is barely protected. The packets your
wireless card sends contain the mac address and I would only have to
sniff for about 2 minutes before I could obtain your Mac address. Then
I would set my card to be your mac address and as soon as you turned off
that machine, I could turn mine on and get into your wireless network.
Why? Because wireless and WEP are a joke as far a security goes.
Anyone who says otherwise is full of it. Oh, and if you have it
passworded, you should know that it also transmits that password in the
packets as well.

So, by nature wireless is insecure.

Under the logic espoused by some:
Since it's insecure, I as a good Samaritan must prove it to whomever.
So I should break into all wireless access points.

Oh, but wait. What about wired networks? I mean many of them are
barely secure. Hell, some systems still use the default passwords even.
I should break into all those as well...I mean I have to help secure
those systems.

-----Original Message-----
From: internetworkers-bounces AT lists.ibiblio.org
[mailto:internetworkers-bounces AT lists.ibiblio.org] On Behalf Of David
Minton
Sent: Saturday, September 13, 2003 1:29 PM
To: InterNetWorkers
Subject: Re: [internetworkers] ethical hacking

On 9/13/03 12:34 PM, "brunkb AT ils.unc.edu" <brunkb AT ils.unc.edu> wrote:

>> i have to agree with Shea. not only was this guy NOT under contract
>> with this clinic to do security scanning (which would have made it
>> okay), he went the extra mile by exposing private data. a big NO-NO.
>
> I guess this is why I don't bother with the INW meetings. Just
another
> bunch of beaten down statists. What did he steal? Who did he harm?
The
> guy went to WRAL to warn everyone of the problem. I don't think he had
any
> criminal intent and I wouldn't rely on any of the colored media
reports of
> the incident. Whether or not he was trying to make a name for
himself, he
> was being a good samaritan by trying to let them know that they are
> radiating all kinds of confidential information in all directions.
It's a
> "mistake" any one of you could make, which is why I posted it.
>
> The people who should be arrested (or at least definitely FIRED) are
the
> idiots employed as network admins at the clinic! After all, it isn't
> exactly rocket science to secure your wi-fi network. Incompetence.

We'll let him know that next time, if he steals your medical insurance
records, and turns them over to a TV reporter, he won't be harming
anyone.
As for me, I would rather he not steal mine.

Maybe for his next project he should check the security at UNC and see
if
your scholastic/employment records are getting "radiated" throughout
campus
(not sure if you are student, faculty or staff at SILS). I am sure we
would
all be interested in seeing them as proof of a flaw in security. I guess
there wouldn't be any harm in it, for it is in the greater public good?

To me, an interesting question is at what point are your guilty of
computer
trespass? Since anyone with any sense will protect their wireless
network
(mine uses a MAC white list, so it is obviously "private"), if you come
across an open network, what do you do if you are a real "ethical
hacker?"
Stealing data is obviously not the way to go. Do you look for a print
queue
and send a print job "Dear IT person, your network is insecure--you may
want
to look into this?"

In this case, I would think that running an insecure network that
contains
medical records would be a HIPAA violation, since the act covers
"security
and privacy of health data." While the HIPAA web site is pretty
confusing
IMHO, there is probably someone to contact at the Dept of HHS with
security
issues.

David

---
Come and play at the InterNetWorkers Web site!
http://www.ibiblio.org/internetworkers/
You are currently subscribed to InterNetWorkers mailing list
To unsubscribe visit
http://lists.ibiblio.org/mailman/listinfo/internetworkers






Archive powered by MHonArc 2.6.24.

Top of Page