Wireless wireless everywhere
There has been so much discussion lately regarding wireless network security. The topic with the most controversy seems to be weather or not it is ethical to connect to an open access point even though it’s privately owned.
Before I start I’d like to state my personal belief. If an everyday user decides one day that he or she needs wireless networking, goes and buys an access point without doing any research, hooks it up out of the box, I feel it’s the users problem if unauthorized connections are made to that AP. To properly set up a wireless network, call on a profesional, It will pay off in the end.
Prior to purchasing wireless gear you would expect that a person would ask at least one other person what they’re up against, which is really the reason for this blog. I will be going form store-to-store posing as an average user asking questions regarding the risks of wireless networking.
I’m certainly not saying that we can expect an everyday user to become a network administrator, however we can expect them to use common sense. As you know it doesn’t take much to at lease label an access point ‘private’ or ‘keep out’. If the user is not willing to take even the smallest step in keeping out the innocent wireless mobile user then it should be assumed that the AP in question is public.
Scenario 1.
I stop at a restaurant or diner with my laptop and start to do some work when suddenly my wireless card connects to an AP called ‘linksys’ or ‘default’. I use the connection to innocently surf the Internet, check my email and be on my way. Not knowing of course the AP belonged to the person living in the house next door and I was using their cable modem to do this.
Did I do anything illegal?
According to recent arrests I did. In fact they’re calling it theft of services. What are the problems in this picture?
First the AP owner made absolutely no effort to secure this device. Now some will argue that it’s the manufacturer job to warn people. How do you figure? There’s a manual in the box that says ‘READ ME FIRST’ did you? Obviously not. Some even argue that it’s the retailer job to warn you of the risks. No it’s the retailer’s job to sell you the product assuming you know how to use it. When I buy a car the seller doesn’t give me driving lessons. It’s assumed that I know how to drive.
I don’t see anything illegal here nor do I see a prosecution happening. What I do see is an ignorant user who was too lazy to try.
Second nothing was stolen, nothing damaged, no cost endured by the AP owner. Just a little bit of unlimited bandwidth being used, I see no case at all. Same scenario with an SSID of ‘private’ would be a different story. Still not secured in any way but the laptop owner has now been told that this device is NOT for public use. I still don’t see a prosecutable case, but hey at least there’s reason for arrest.
OK so how do we overcome this? People please at least change the SSID to something that tells the innocent that your AP is not for public use. Does this make your AP secure? Absolutely not but it does tell the innocent passer by not to connect to your network.
Scenario 2 I come home from work and sit down in my living room with the company laptop, and it connects to an open AP called ‘home’. I start poking around and am able to view some shares on my neighbor’s hard drive. I read some letters and take advantage of the situation by continuing to use his Internet connection. Am I stealing? Whose fault is it that I connected, his or mine?
In my opinion, the fact that the SSID was ‘home’ should have been enough indication that it was not public, however was using the bandwidth illegal? It is unlimited so again, nothing stolen. Now was looking at his hard drive illegal? I didn’t damage anything. I would call that invasion of privacy.
Had I not looked at his hard drive and only used the Internet connection can I be arrested? Why? I think he should be arrested for providing a safe haven for hackers and spammers. He’s responsible for his ISP account why wouldn’t he protect it? Owning wireless network gear or any network gear is the responsibility of the owner or network admin, period. Not the sales guy, the manufacturer or the innocent traveler. If my computer connects to something with a non-descriptive name, and with no effort of mine, I will assume that the connection is for public use.
Please voice your opinions on this. I will post the result of my store visits as they take place.