Main

July 17, 2005

Wireless wireless everywhere

There has been so much discussion lately regarding wireless network security. The topic with the most controversy seems to be weather or not it is ethical to connect to an open access point even though it’s privately owned.

Before I start I’d like to state my personal belief. If an everyday user decides one day that he or she needs wireless networking, goes and buys an access point without doing any research, hooks it up out of the box, I feel it’s the users problem if unauthorized connections are made to that AP. To properly set up a wireless network, call on a profesional, It will pay off in the end.

Prior to purchasing wireless gear you would expect that a person would ask at least one other person what they’re up against, which is really the reason for this blog. I will be going form store-to-store posing as an average user asking questions regarding the risks of wireless networking.

I’m certainly not saying that we can expect an everyday user to become a network administrator, however we can expect them to use common sense. As you know it doesn’t take much to at lease label an access point ‘private’ or ‘keep out’. If the user is not willing to take even the smallest step in keeping out the innocent wireless mobile user then it should be assumed that the AP in question is public.

Scenario 1.
I stop at a restaurant or diner with my laptop and start to do some work when suddenly my wireless card connects to an AP called ‘linksys’ or ‘default’. I use the connection to innocently surf the Internet, check my email and be on my way. Not knowing of course the AP belonged to the person living in the house next door and I was using their cable modem to do this.

Did I do anything illegal?

According to recent arrests I did. In fact they’re calling it theft of services. What are the problems in this picture?

First the AP owner made absolutely no effort to secure this device. Now some will argue that it’s the manufacturer job to warn people. How do you figure? There’s a manual in the box that says ‘READ ME FIRST’ did you? Obviously not. Some even argue that it’s the retailer job to warn you of the risks. No it’s the retailer’s job to sell you the product assuming you know how to use it. When I buy a car the seller doesn’t give me driving lessons. It’s assumed that I know how to drive.

I don’t see anything illegal here nor do I see a prosecution happening. What I do see is an ignorant user who was too lazy to try.

Second nothing was stolen, nothing damaged, no cost endured by the AP owner. Just a little bit of unlimited bandwidth being used, I see no case at all. Same scenario with an SSID of ‘private’ would be a different story. Still not secured in any way but the laptop owner has now been told that this device is NOT for public use. I still don’t see a prosecutable case, but hey at least there’s reason for arrest.

OK so how do we overcome this? People please at least change the SSID to something that tells the innocent that your AP is not for public use. Does this make your AP secure? Absolutely not but it does tell the innocent passer by not to connect to your network.

Scenario 2 I come home from work and sit down in my living room with the company laptop, and it connects to an open AP called ‘home’. I start poking around and am able to view some shares on my neighbor’s hard drive. I read some letters and take advantage of the situation by continuing to use his Internet connection. Am I stealing? Whose fault is it that I connected, his or mine?

In my opinion, the fact that the SSID was ‘home’ should have been enough indication that it was not public, however was using the bandwidth illegal? It is unlimited so again, nothing stolen. Now was looking at his hard drive illegal? I didn’t damage anything. I would call that invasion of privacy.

Had I not looked at his hard drive and only used the Internet connection can I be arrested? Why? I think he should be arrested for providing a safe haven for hackers and spammers. He’s responsible for his ISP account why wouldn’t he protect it? Owning wireless network gear or any network gear is the responsibility of the owner or network admin, period. Not the sales guy, the manufacturer or the innocent traveler. If my computer connects to something with a non-descriptive name, and with no effort of mine, I will assume that the connection is for public use.

Please voice your opinions on this. I will post the result of my store visits as they take place.

June 16, 2005

A recent observation regarding Microsoft update.

Hotfix KB893066 causes network problems on certain Windows XP SP2 systems. Details on the patch are here http://support.microsoft.com/?kbid=893066

My exact experience with this update involved and IBM ThinkPad G41 running fully patched Windows XP Pro. After applying this update / patch networking functions were very very slow. In addition the issue that caused the research was the fact that any webpage requiring a login would fail after entering the username and password. The failure did not result in an error but rather a 'page could not be displayed' appearing to be a timeout situation.

Here is Microsoft's acknowledgment, or at least one of them.
http://support.microsoft.com/default.aspx?scid=kb;en-us;898060

I don't have any other specific information as to what systems are or aren't affected. I believe, however that this problem is isolated to XP systems only as I can not reproduce the problem on any Windows 2000 machine tested.

March 09, 2005

Discovery of the month

I have discovered a problem which can be recreated at will. Red Hat 7.3 running QMail mail server will generate errors with certain types of email clients when an attachment is present.

The errors include;

Microsoft Outlook 2000 SP1
Mail could not be sent Error 354 Server said Go Ahead

Microsoft Outlook 97 and Microsoft Outlook Express 6.0
Your server has unexpectedly terminated the connection. Possible causes for this include server problems, network problems, or a long period of inactivity. Subject '', Account: 'mail.server.com', Server: 'mail.server.com', Protocol: SMTP, Port: 25, Secure(SSL): No, Error Number: 0x800CCC0F

Thunderbird 1.0
The message could not be sent because the connection to the SMTP server failed.
The server may be unavailable or may be refusing SMTP connections.

The Facts

· This occurs on Windows 2000 and Windows XP fully patched
· This can be recreated at will and has been tested on 5 different networks using 4 different upstream providers
· This does NOT occur when using Outlook 2000 which is patched up to date
· With Thunderbird, it only occurs when the sender and recipient are on the same server
· This has been tested with AUTO MTU on and off


At the time of this writing the actual cause is unknown and is under investigation.

January 11, 2005

Choosing the right PC

Too often I hear people telling me what a great deal they got on they’re new computer. You know, the $400 deal that came with a printer and a real nice flat panel monitor. Yeah ok. Let’s clarify a few things here. First of all, if there is any industry where the “You get what you pay for” adage holds true, it’s technology. A decent flat panel will cost you $300 - $400 alone. Anything less isn’t worth buying.

There’s a reason why a PC is $400, actually there are several reasons. Don’t get me wrong, I don’t think everyone needs the latest and greatest but you should know what you’re getting and what to expect. Here’s a breakdown

CPU: The CPU or processor is the ‘brain’ of your computer. It handles all tasks and controls all I/O functions. A low cost computer will usually incorporate an Intel Celeron or AMD processor. Which are both less costly than a Pentium 4 or XEON. Although the frequency appears to be what you what, all CPU’s are NOT created equal. 3.0Ghz is not equal to 3.0Ghz, well sort of. Actually a cycle IS equal to a cycle but the architecture of the CPU is very different.

With the Celeron, the lack of on chip cache is probably the biggest difference and is also very important to system performance.

With the AMD processors, you will hear people talk about them benchmarking better than the Pentium 4. From what I’ve seen, that’s only true for the floating point, (math) functions. Good for gamers but doesn’t help anyone else.

If you plan on doing anything more than sending e-mail or reading a book, spend the extra money and by a genuine Pentium 4 or XEON.

Motherboard: This is surely the component, which affects system performance the most. The motherboard or mainboard is the connection of all other components to the CPU. A well-designed motherboard is worth its weight in gold. If you care about performance DO NOT buy a motherboard with on board video or sound. If the video chip or sound chip are on integrated into the motherboard that means they don’t have a unique controller chip. This is to say they are using precious clock cycles from your CPU to function. You don’t want that.

A motherboard with on-board video will perform 30% slower than the same board without. I recommend Supermicro, Intel or ASUS

RAM: Memory isn’t always about quantity. As a matter of fact, blue screens, freezes and random crashes are almost, always caused by inferior RAM. Not lack of RAM, inferior quality RAM. Don’t skimp. Buy less, higher quality RAM if you want to save a few bucks. You can always add later.

If your motherboard supports it, for a truly stable system, buy Registered ECC memory from a well-known memory source like Crucial or Kingston.

Hard Drive: Again, Quality over quantity. Hard drives come in many sizes and use many different technologies. The new buzzword is SATA or Serial ATA. SATA drives are slowly phasing out the more costly SCSI drives and slower performing IDE drives.

Many SATA drives have a spindle speed of 10,000 rpm’s as do SCSI disks. This is the speed at which the platters in the drive rotate, obviously the faster the better. A low budget PC will usually have a 5400-rpm disk. Higher quality IDE drives, although fine for most applications, still only have a spindle speed of 7200 rpm’s.

This speed also has a huge impact on overall system performance. Know what you’re buying. I recommend the SATA Western Digital Raptor 74Gb.

Video: Your choice of video cards should depend on the PC’s intended use. Just in case you missed it, do NOT get a motherboard with on-board video. You’ll regret it. Most on-board video devices also use shared memory. Which means, guess what, you can only use part of the RAM that you paid for because the video chip set needs the rest.

If you’re a gamer then you probably don’t need to read this. For gaming purposes the amount of video ram is important 128 Megs should be enough in most cases. For the serious gamer go to 256Megs. I personally like the nVidia GeForce chips.

If you’re not a gamer I still recommend 128 Megs of video RAM just in case. Although you can spend a lot of money in this department, you don’t need to. A decent, all purpose video card should cost you under $150, depending on the amount of video RAM you decide you need.

Having said all that, my claim is always that you can build a new up to date computer for under $1000 plus monitor and peripherals. Or if you don't want to build you can have a custom PC built for you, or purchase an Acer or IBM from an authorized reseller.