Skip to Content.
Sympa Menu

internetworkers - Re: [internetworkers] ethical hacking

internetworkers AT lists.ibiblio.org

Subject: Internetworkers: http://www.ibiblio.org/internetworkers/

List archive

Chronological Thread  
  • From: Sil Greene <Sil_greene AT unc.edu>
  • To: "Internetworkers: http://www.ibiblio.org/internetworkers/" <internetworkers AT lists.ibiblio.org>
  • Subject: Re: [internetworkers] ethical hacking
  • Date: Sun, 14 Sep 2003 23:24:58 -0400 (EDT)


Exactly. How do you know I haven't left it open *as* *a* *public*
*service*? These aren't just *my* airwaves.

Not saying I wouldn't lock down *other* parts of my network, however.

--Sil

Reported 03.09.14 18:55 from David Minton by
internetworkers-bounces@lists....:

.:I was only suggesting that since I use a MAC white list, my network is
.:"closed" so any access is a deliberate attempt at trespass--not suggesting
.:it was secure (something else). Some leave their networks open, without any
.:form of security. If you access such a network, are you trespassing?
.:
.:David
.:
.:On 9/14/03 4:18 PM, "Shea Tisdale" <shea AT sheatisdale.com> wrote:
.:
.:> Hey David, thanks for posting.
.:>
.:> Actually your wireless network is barely protected. The packets your
.:> wireless card sends contain the mac address and I would only have to
.:> sniff for about 2 minutes before I could obtain your Mac address. Then
.:> I would set my card to be your mac address and as soon as you turned off
.:> that machine, I could turn mine on and get into your wireless network.
.:> Why? Because wireless and WEP are a joke as far a security goes.
.:> Anyone who says otherwise is full of it. Oh, and if you have it
.:> passworded, you should know that it also transmits that password in the
.:> packets as well.
.:>
.:> So, by nature wireless is insecure.
.:>
.:> Under the logic espoused by some:
.:> Since it's insecure, I as a good Samaritan must prove it to whomever.
.:> So I should break into all wireless access points.
.:>
.:> Oh, but wait. What about wired networks? I mean many of them are
.:> barely secure. Hell, some systems still use the default passwords even.
.:> I should break into all those as well...I mean I have to help secure
.:> those systems.
.:>
.:> -----Original Message-----
.:> From: internetworkers-bounces AT lists.ibiblio.org
.:> [mailto:internetworkers-bounces AT lists.ibiblio.org] On Behalf Of David
.:> Minton
.:> Sent: Saturday, September 13, 2003 1:29 PM
.:> To: InterNetWorkers
.:> Subject: Re: [internetworkers] ethical hacking
.:>
.:> On 9/13/03 12:34 PM, "brunkb AT ils.unc.edu" <brunkb AT ils.unc.edu> wrote:
.:>
.:>>> i have to agree with Shea. not only was this guy NOT under contract
.:>>> with this clinic to do security scanning (which would have made it
.:>>> okay), he went the extra mile by exposing private data. a big NO-NO.
.:>>
.:>> I guess this is why I don't bother with the INW meetings. Just
.:> another
.:>> bunch of beaten down statists. What did he steal? Who did he harm?
.:> The
.:>> guy went to WRAL to warn everyone of the problem. I don't think he had
.:> any
.:>> criminal intent and I wouldn't rely on any of the colored media
.:> reports of
.:>> the incident. Whether or not he was trying to make a name for
.:> himself, he
.:>> was being a good samaritan by trying to let them know that they are
.:>> radiating all kinds of confidential information in all directions.
.:> It's a
.:>> "mistake" any one of you could make, which is why I posted it.
.:>>
.:>> The people who should be arrested (or at least definitely FIRED) are
.:> the
.:>> idiots employed as network admins at the clinic! After all, it isn't
.:>> exactly rocket science to secure your wi-fi network. Incompetence.
.:>
.:> We'll let him know that next time, if he steals your medical insurance
.:> records, and turns them over to a TV reporter, he won't be harming
.:> anyone.
.:> As for me, I would rather he not steal mine.
.:>
.:> Maybe for his next project he should check the security at UNC and see
.:> if
.:> your scholastic/employment records are getting "radiated" throughout
.:> campus
.:> (not sure if you are student, faculty or staff at SILS). I am sure we
.:> would
.:> all be interested in seeing them as proof of a flaw in security. I guess
.:> there wouldn't be any harm in it, for it is in the greater public good?
.:>
.:> To me, an interesting question is at what point are your guilty of
.:> computer
.:> trespass? Since anyone with any sense will protect their wireless
.:> network
.:> (mine uses a MAC white list, so it is obviously "private"), if you come
.:> across an open network, what do you do if you are a real "ethical
.:> hacker?"
.:> Stealing data is obviously not the way to go. Do you look for a print
.:> queue
.:> and send a print job "Dear IT person, your network is insecure--you may
.:> want
.:> to look into this?"
.:>
.:> In this case, I would think that running an insecure network that
.:> contains
.:> medical records would be a HIPAA violation, since the act covers
.:> "security
.:> and privacy of health data." While the HIPAA web site is pretty
.:> confusing
.:> IMHO, there is probably someone to contact at the Dept of HHS with
.:> security
.:> issues.
.:>
.:> David
.:>
.:> ---
.:> Come and play at the InterNetWorkers Web site!
.:> http://www.ibiblio.org/internetworkers/
.:> You are currently subscribed to InterNetWorkers mailing list
.:> To unsubscribe visit
.:> http://lists.ibiblio.org/mailman/listinfo/internetworkers
.:>
.:>
.:> ---
.:> Come and play at the InterNetWorkers Web site!
.:> http://www.ibiblio.org/internetworkers/
.:> You are currently subscribed to InterNetWorkers mailing list
.:> To unsubscribe visit
http://lists.ibiblio.org/mailman/listinfo/internetworkers
.:
.:---
.:Come and play at the InterNetWorkers Web site!
http://www.ibiblio.org/internetworkers/
.:You are currently subscribed to InterNetWorkers mailing list
.:To unsubscribe visit
http://lists.ibiblio.org/mailman/listinfo/internetworkers
.:

--
"If you put your supper dish to your ears you can hear the sounds
of a restaurant." --Snoopy (Charles Schultz 02-12-2000 RIP)
*&* Sil_Greene AT unc.edu *&* ICQ Silauren #36430811 *&*





Archive powered by MHonArc 2.6.24.

Top of Page