Skip to Content.
Sympa Menu

internetworkers - Re: [internetworkers] ethical hacking

internetworkers AT lists.ibiblio.org

Subject: Internetworkers: http://www.ibiblio.org/internetworkers/

List archive

Chronological Thread  
  • From: David Minton <dminton AT mindspring.com>
  • To: InterNetWorkers <internetworkers AT lists.ibiblio.org>
  • Subject: Re: [internetworkers] ethical hacking
  • Date: Sun, 14 Sep 2003 18:55:49 -0400

I was only suggesting that since I use a MAC white list, my network is
"closed" so any access is a deliberate attempt at trespass--not suggesting
it was secure (something else). Some leave their networks open, without any
form of security. If you access such a network, are you trespassing?

David

On 9/14/03 4:18 PM, "Shea Tisdale" <shea AT sheatisdale.com> wrote:

> Hey David, thanks for posting.
>
> Actually your wireless network is barely protected. The packets your
> wireless card sends contain the mac address and I would only have to
> sniff for about 2 minutes before I could obtain your Mac address. Then
> I would set my card to be your mac address and as soon as you turned off
> that machine, I could turn mine on and get into your wireless network.
> Why? Because wireless and WEP are a joke as far a security goes.
> Anyone who says otherwise is full of it. Oh, and if you have it
> passworded, you should know that it also transmits that password in the
> packets as well.
>
> So, by nature wireless is insecure.
>
> Under the logic espoused by some:
> Since it's insecure, I as a good Samaritan must prove it to whomever.
> So I should break into all wireless access points.
>
> Oh, but wait. What about wired networks? I mean many of them are
> barely secure. Hell, some systems still use the default passwords even.
> I should break into all those as well...I mean I have to help secure
> those systems.
>
> -----Original Message-----
> From: internetworkers-bounces AT lists.ibiblio.org
> [mailto:internetworkers-bounces AT lists.ibiblio.org] On Behalf Of David
> Minton
> Sent: Saturday, September 13, 2003 1:29 PM
> To: InterNetWorkers
> Subject: Re: [internetworkers] ethical hacking
>
> On 9/13/03 12:34 PM, "brunkb AT ils.unc.edu" <brunkb AT ils.unc.edu> wrote:
>
>>> i have to agree with Shea. not only was this guy NOT under contract
>>> with this clinic to do security scanning (which would have made it
>>> okay), he went the extra mile by exposing private data. a big NO-NO.
>>
>> I guess this is why I don't bother with the INW meetings. Just
> another
>> bunch of beaten down statists. What did he steal? Who did he harm?
> The
>> guy went to WRAL to warn everyone of the problem. I don't think he had
> any
>> criminal intent and I wouldn't rely on any of the colored media
> reports of
>> the incident. Whether or not he was trying to make a name for
> himself, he
>> was being a good samaritan by trying to let them know that they are
>> radiating all kinds of confidential information in all directions.
> It's a
>> "mistake" any one of you could make, which is why I posted it.
>>
>> The people who should be arrested (or at least definitely FIRED) are
> the
>> idiots employed as network admins at the clinic! After all, it isn't
>> exactly rocket science to secure your wi-fi network. Incompetence.
>
> We'll let him know that next time, if he steals your medical insurance
> records, and turns them over to a TV reporter, he won't be harming
> anyone.
> As for me, I would rather he not steal mine.
>
> Maybe for his next project he should check the security at UNC and see
> if
> your scholastic/employment records are getting "radiated" throughout
> campus
> (not sure if you are student, faculty or staff at SILS). I am sure we
> would
> all be interested in seeing them as proof of a flaw in security. I guess
> there wouldn't be any harm in it, for it is in the greater public good?
>
> To me, an interesting question is at what point are your guilty of
> computer
> trespass? Since anyone with any sense will protect their wireless
> network
> (mine uses a MAC white list, so it is obviously "private"), if you come
> across an open network, what do you do if you are a real "ethical
> hacker?"
> Stealing data is obviously not the way to go. Do you look for a print
> queue
> and send a print job "Dear IT person, your network is insecure--you may
> want
> to look into this?"
>
> In this case, I would think that running an insecure network that
> contains
> medical records would be a HIPAA violation, since the act covers
> "security
> and privacy of health data." While the HIPAA web site is pretty
> confusing
> IMHO, there is probably someone to contact at the Dept of HHS with
> security
> issues.
>
> David
>
> ---
> Come and play at the InterNetWorkers Web site!
> http://www.ibiblio.org/internetworkers/
> You are currently subscribed to InterNetWorkers mailing list
> To unsubscribe visit
> http://lists.ibiblio.org/mailman/listinfo/internetworkers
>
>
> ---
> Come and play at the InterNetWorkers Web site!
> http://www.ibiblio.org/internetworkers/
> You are currently subscribed to InterNetWorkers mailing list
> To unsubscribe visit
> http://lists.ibiblio.org/mailman/listinfo/internetworkers





Archive powered by MHonArc 2.6.24.

Top of Page