Internetworkers: http://www.ibiblio.org/internetworkers/

[Sil Greene <Sil_greene AT unc.edu>]

Exactly.  How do you know I haven't left it open *as* *a* *public* 
*service*?  These aren't just *my* airwaves.

Not saying I wouldn't lock down *other* parts of my network, however.

--Sil

Reported 03.09.14 18:55 from David Minton by 
internetworkers-bounces@lists....:

.:I was only suggesting that since I use a MAC white list, my network is
.:"closed" so any access is a deliberate attempt at trespass--not suggesting
.:it was secure (something else). Some leave their networks open, without any
.:form of security. If you access such a network, are you trespassing?
.:
.:David
.:
.:On 9/14/03 4:18 PM, "Shea Tisdale" <shea AT sheatisdale.com> wrote:
.:
.:> Hey David, thanks for posting.
.:> 
.:> Actually your wireless network is barely protected.  The packets your
.:> wireless card sends contain the mac address and I would only have to
.:> sniff for about 2 minutes before I could obtain your Mac address.  Then
.:> I would set my card to be your mac address and as soon as you turned off
.:> that machine, I could turn mine on and get into your wireless network.
.:> Why?  Because wireless and WEP are a joke as far a security goes.
.:> Anyone who says otherwise is full of it.  Oh, and if you have it
.:> passworded, you should know that it also transmits that password in the
.:> packets as well.
.:> 
.:> So, by nature wireless is insecure.
.:> 
.:> Under the logic espoused by some:
.:> Since it's insecure, I as a good Samaritan must prove it to whomever.
.:> So I should break into all wireless access points.
.:> 
.:> Oh, but wait.  What about wired networks?  I mean many of them are
.:> barely secure.  Hell, some systems still use the default passwords even.
.:> I should break into all those as well...I mean I have to help secure
.:> those systems.   
.:> 
.:> -----Original Message-----
.:> From: internetworkers-bounces AT lists.ibiblio.org
.:> [mailto:internetworkers-bounces AT lists.ibiblio.org] On Behalf Of David
.:> Minton
.:> Sent: Saturday, September 13, 2003 1:29 PM
.:> To: InterNetWorkers
.:> Subject: Re: [internetworkers] ethical hacking
.:> 
.:> On 9/13/03 12:34 PM, "brunkb AT ils.unc.edu" <brunkb AT ils.unc.edu> wrote:
.:> 
.:>>> i have to agree with Shea.  not only was this guy NOT under contract
.:>>> with this clinic to do security scanning (which would have made it
.:>>> okay), he went the extra mile by exposing private data.  a big NO-NO.
.:>> 
.:>> I guess this is why I don't bother with the INW meetings.  Just
.:> another
.:>> bunch of beaten down statists.  What did he steal?  Who did he harm?
.:> The
.:>> guy went to WRAL to warn everyone of the problem. I don't think he had
.:> any
.:>> criminal intent and I wouldn't rely on any of the colored media
.:> reports of
.:>> the incident.  Whether or not he was trying to make a name for
.:> himself, he
.:>> was being a good samaritan by trying to let them know that they are
.:>> radiating all kinds of confidential information in all directions.
.:> It's a
.:>> "mistake" any one of you could make, which is why I posted it.
.:>> 
.:>> The people who should be arrested (or at least definitely FIRED) are
.:> the
.:>> idiots employed as network admins at the clinic!  After all, it isn't
.:>> exactly rocket science to secure your wi-fi network.  Incompetence.
.:> 
.:> We'll let him know that next time, if he steals your medical insurance
.:> records, and turns them over to a TV reporter, he won't be harming
.:> anyone.
.:> As for me, I would rather he not steal mine.
.:> 
.:> Maybe for his next project he should check the security at UNC and see
.:> if
.:> your scholastic/employment records are getting "radiated" throughout
.:> campus
.:> (not sure if you are student, faculty or staff at SILS). I am sure we
.:> would
.:> all be interested in seeing them as proof of a flaw in security. I guess
.:> there wouldn't be any harm in it, for it is in the greater public good?
.:> 
.:> To me, an interesting question is at what point are your guilty of
.:> computer
.:> trespass? Since anyone with any sense will protect their wireless
.:> network
.:> (mine uses a MAC white list, so it is obviously "private"), if you come
.:> across an open network, what do you do if you are a real "ethical
.:> hacker?"
.:> Stealing data is obviously not the way to go. Do you look for a print
.:> queue
.:> and send a print job "Dear IT person, your network is insecure--you may
.:> want
.:> to look into this?"
.:> 
.:> In this case, I would think that running an insecure network that
.:> contains
.:> medical records would be a HIPAA violation, since the act covers
.:> "security
.:> and privacy of health data." While the HIPAA web site is pretty
.:> confusing
.:> IMHO, there is probably someone to contact at the Dept of HHS with
.:> security
.:> issues.
.:> 
.:> David
.:> 
.:> ---
.:> Come and play at the InterNetWorkers Web site!
.:> http://www.ibiblio.org/internetworkers/
.:> You are currently subscribed to InterNetWorkers mailing list
.:> To unsubscribe visit
.:> http://lists.ibiblio.org/mailman/listinfo/internetworkers
.:> 
.:> 
.:> ---
.:> Come and play at the InterNetWorkers Web site!
.:> http://www.ibiblio.org/internetworkers/
.:> You are currently subscribed to InterNetWorkers mailing list
.:> To unsubscribe visit 
http://lists.ibiblio.org/mailman/listinfo/internetworkers
.:
.:---
.:Come and play at the InterNetWorkers Web site!  
http://www.ibiblio.org/internetworkers/
.:You are currently subscribed to InterNetWorkers mailing list
.:To unsubscribe visit 
http://lists.ibiblio.org/mailman/listinfo/internetworkers
.:

-- 
"If you put your supper dish to your ears you can hear the sounds
 of a restaurant."  --Snoopy    (Charles Schultz 02-12-2000 RIP)
    *&* Sil_Greene AT unc.edu   *&*   ICQ Silauren #36430811 *&*