Internetworkers: http://www.ibiblio.org/internetworkers/

["Shea Tisdale" <shea AT sheatisdale.com>]

The official answer is yes.  Connecting to a wide open network, wireless
or wired, is trespassing if you do not have permission to be on it.

-----Original Message-----
From: internetworkers-bounces AT lists.ibiblio.org
[mailto:internetworkers-bounces AT lists.ibiblio.org] On Behalf Of David
Minton
Sent: Sunday, September 14, 2003 6:56 PM
To: InterNetWorkers
Subject: Re: [internetworkers] ethical hacking

I was only suggesting that since I use a MAC white list, my network is
"closed" so any access is a deliberate attempt at trespass--not
suggesting
it was secure (something else). Some leave their networks open, without
any
form of security. If you access such a network, are you trespassing?

David

On 9/14/03 4:18 PM, "Shea Tisdale" <shea AT sheatisdale.com> wrote:

> Hey David, thanks for posting.
> 
> Actually your wireless network is barely protected.  The packets your
> wireless card sends contain the mac address and I would only have to
> sniff for about 2 minutes before I could obtain your Mac address.
Then
> I would set my card to be your mac address and as soon as you turned
off
> that machine, I could turn mine on and get into your wireless network.
> Why?  Because wireless and WEP are a joke as far a security goes.
> Anyone who says otherwise is full of it.  Oh, and if you have it
> passworded, you should know that it also transmits that password in
the
> packets as well.
> 
> So, by nature wireless is insecure.
> 
> Under the logic espoused by some:
> Since it's insecure, I as a good Samaritan must prove it to whomever.
> So I should break into all wireless access points.
> 
> Oh, but wait.  What about wired networks?  I mean many of them are
> barely secure.  Hell, some systems still use the default passwords
even.
> I should break into all those as well...I mean I have to help secure
> those systems.   
> 
> -----Original Message-----
> From: internetworkers-bounces AT lists.ibiblio.org
> [mailto:internetworkers-bounces AT lists.ibiblio.org] On Behalf Of David
> Minton
> Sent: Saturday, September 13, 2003 1:29 PM
> To: InterNetWorkers
> Subject: Re: [internetworkers] ethical hacking
> 
> On 9/13/03 12:34 PM, "brunkb AT ils.unc.edu" <brunkb AT ils.unc.edu> wrote:
> 
>>> i have to agree with Shea.  not only was this guy NOT under contract
>>> with this clinic to do security scanning (which would have made it
>>> okay), he went the extra mile by exposing private data.  a big
NO-NO.
>> 
>> I guess this is why I don't bother with the INW meetings.  Just
> another
>> bunch of beaten down statists.  What did he steal?  Who did he harm?
> The
>> guy went to WRAL to warn everyone of the problem. I don't think he
had
> any
>> criminal intent and I wouldn't rely on any of the colored media
> reports of
>> the incident.  Whether or not he was trying to make a name for
> himself, he
>> was being a good samaritan by trying to let them know that they are
>> radiating all kinds of confidential information in all directions.
> It's a
>> "mistake" any one of you could make, which is why I posted it.
>> 
>> The people who should be arrested (or at least definitely FIRED) are
> the
>> idiots employed as network admins at the clinic!  After all, it isn't
>> exactly rocket science to secure your wi-fi network.  Incompetence.
> 
> We'll let him know that next time, if he steals your medical insurance
> records, and turns them over to a TV reporter, he won't be harming
> anyone.
> As for me, I would rather he not steal mine.
> 
> Maybe for his next project he should check the security at UNC and see
> if
> your scholastic/employment records are getting "radiated" throughout
> campus
> (not sure if you are student, faculty or staff at SILS). I am sure we
> would
> all be interested in seeing them as proof of a flaw in security. I
guess
> there wouldn't be any harm in it, for it is in the greater public
good?
> 
> To me, an interesting question is at what point are your guilty of
> computer
> trespass? Since anyone with any sense will protect their wireless
> network
> (mine uses a MAC white list, so it is obviously "private"), if you
come
> across an open network, what do you do if you are a real "ethical
> hacker?"
> Stealing data is obviously not the way to go. Do you look for a print
> queue
> and send a print job "Dear IT person, your network is insecure--you
may
> want
> to look into this?"
> 
> In this case, I would think that running an insecure network that
> contains
> medical records would be a HIPAA violation, since the act covers
> "security
> and privacy of health data." While the HIPAA web site is pretty
> confusing
> IMHO, there is probably someone to contact at the Dept of HHS with
> security
> issues.
> 
> David
> 
> ---
> Come and play at the InterNetWorkers Web site!
> http://www.ibiblio.org/internetworkers/
> You are currently subscribed to InterNetWorkers mailing list
> To unsubscribe visit
> http://lists.ibiblio.org/mailman/listinfo/internetworkers
> 
> 
> ---
> Come and play at the InterNetWorkers Web site!
> http://www.ibiblio.org/internetworkers/
> You are currently subscribed to InterNetWorkers mailing list
> To unsubscribe visit
http://lists.ibiblio.org/mailman/listinfo/internetworkers

---
Come and play at the InterNetWorkers Web site!
http://www.ibiblio.org/internetworkers/
You are currently subscribed to InterNetWorkers mailing list
To unsubscribe visit
http://lists.ibiblio.org/mailman/listinfo/internetworkers