[Boondoggle]

I have my wireless network clamped down pretty well with WPA, but I was wondering, if I didn't, and someone gained internet access through my router and then downloaded 1000's of copywritten songs, would I be liable?

Wouldn't the burden of proof be on the plaintiff to show beyond a resonable doubt that I personally downloaded the songs? And if so wouldn't this be a good way of getting around the lawsuits? Do they actually seize your hardware? I don't think they can do that unless it a criminal investigation.

In a civil case you'd have time to just wipe your drives delete your router logs and claim sombody stole your bandwidth.

Or am I missing something?

[iPoder]

You are paranoid. The intruder has to be within your wireless LAN range to do that. Get a dog or something to protect your property.

Besides, you can always use MAC address to prove that you are not the one originating the traffic.

[tooki]

No, you couldn't.

MAC addresses are only used within a subnet. Outside the router, all they see is the IP address.

Right now, I don't think liability has ever been tested. I wouldn't want to be the test case. In theory, yes, the burden of proof should lie on the accuser. But we're way past "innocent until proven guilty", thanks to the DMCA.

I'd sure keep WEP/WPA on!

tooki

[iPoder]

MAC address is embedded in every IP packet along with the public IP address. This is how the NAT (Network Address Translation) identified each TCP/IP traffic.

Unless someone spoofs your MAC address (replace the MAC address of their originated traffics with your MAC address, hard-to-do btw), every traffic sent from your computer is uniquely identified with the MAC address of your network card.

[mitchell_pgh]

spoofing a MAC isn't as difficult as it sounds.

[BobK]

MAC address spoofing is VERY easy on an unsecure wireless network. All you need is a packet sniffer. It is a simple Regkey in winblows.

[macroy]

Originally posted by iPoder:
MAC address is embedded in every IP packet along with the public IP address. This is how the NAT (Network Address Translation) identified each TCP/IP traffic.

Unless someone spoofs your MAC address (replace the MAC address of their originated traffics with your MAC address, hard-to-do btw), every traffic sent from your computer is uniquely identified with the MAC address of your network card.

Actually, your MAC is stripped off at the gateway/router/hop and replaced with that routers MAC. This has nothing to do with NAT (layer 3), but plain networking.

[ghporter]

In point of fact, you WOULD be liable in the eyes of the RIAA. Like providing the gasoline and matches, you would be responsible for ALLOWING the event to occur. Right or wrong, that's how it is seen legally.

Now start pondering what would happen if your hypothetical downloader instead downloaded about 4GB of kiddie porn... In the US, you would be in SERIOUS trouble, and while you would eventually be able to show that you were simply the unknowing conduit, your life would be hell for a long time.

It's not paranoia to have insurance, nor to lock your front door. Keep your network locked down. Let somebody else meet all those lawyers.

[tooki]

Originally posted by iPoder:
MAC address is embedded in every IP packet along with the public IP address. This is how the NAT (Network Address Translation) identified each TCP/IP traffic.

Unless someone spoofs your MAC address (replace the MAC address of their originated traffics with your MAC address, hard-to-do btw), every traffic sent from your computer is uniquely identified with the MAC address of your network card.

No.

Packet addressing works in layers, kind of like sticking a message in an envelope, and then that in another envelope. In the case of TCP/IP networking, it's 4 envelopes.

The MAC address is on the outermost "envelope" and is only used on the subnet. Once the packet reaches a router, the MAC layer is stripped off -- it's gone. Poof.

Besides, MAC is the link-local addressing used by Ethernet and Wi-Fi. Other network types use different kinds of hardware addresses. The MAC address is of no use there, and in fact would not work.

tooki

[Leonard]

Originally posted by iPoder:
You are paranoid. The intruder has to be within your wireless LAN range to do that. Get a dog or something to protect your property.

This would be true if property sizes were big, but in a city where you have apartment buildings and houses just feet apart (if that) it's not paranoia. You can literally have a hundred people within distance of your router. In my new house I can see my neighbor's wireless router, at my old condo I found 2 or 3.

Lock your router down with at least a WEP password.

[ghporter]

To add to what Leonard said, I live in a residential, single family neighborhood, and I can connect to three other wireless networks from inside the front of my house. Range is longer than you might think; even if you don't get all 54Mbps, you can get a good connection quite a ways out.

[Boondoggle]

Anyone parked on the street outside my house could get a signal on a laptop, which is why I use WPA and a 63 character PSK...

Since the MAC is stripped out at the router/gateway and MAC spoofing is pathetically easy on uprotected networks, anyway, I don't see how the RIAA could win a case against an individual who demonstrated that he used an unprotected network, unless they managed to subpoena his hardware and found the contraband files in question. Or possibly the router logs....

Of course laymen and probably most lawyers are not 100% up to speed on the details of networks, and getting sued can be very intimidating, so plaintiffs might still win cases like that anyway if defendants were not aware of the inherent uncertanty.

[ghporter]

ISP's logs are one source of information, but so are the records kept by the various file sharing applications, which is how they got what they needed to subpoena ISPs' records early this year. You can obtain a whole lot of information from simple network housekeeping applications, too.

I should also point out that it is often employees using corporate assets to host materials they want to share that are the source of the orignial "clues" to where shared files went. This is because corporate networks usually have lots of available capacity (for those employees that know which server to play with). Most corporate networks also use enough management software that they can track which local IP does what whenever, 24/7. If the corporation is on its toes, the IT folks clamp down on the practice right away. Not all corporations are on their toes...so employees get away with stealing storage space and bandwidth. Until someone like RIAA complains that it looks like illegally shared files originated on a specific network. Then the stuff hits the fan and companies start firing such employees. Or prosecuting them.

There is little if any true annonymity in the online world; it just depends on how hard you want to work at identifying a source or destination.

[kcmac]

I have jumped onto many open wireless networks, connections in offices, in buildings, etc. I have never understood what the security issue is although I know there is one.

I don't see their network or any hard drives or anything that I could mistakingly get into. It is just a connection that lets me get on the net. I'm just being a leech with no intentions of harm. (Places like the Pittsburgh airport however are honest areas.)

Is it that I can't see them but they can instead see me and my hard drive?

Sorry for my ignorance.

[macroy]

Originally posted by kcmac:
I have jumped onto many open wireless networks, connections in offices, in buildings, etc. I have never understood what the security issue is although I know there is one.

I don't see their network or any hard drives or anything that I could mistakingly get into. It is just a connection that lets me get on the net. I'm just being a leech with no intentions of harm. (Places like the Pittsburgh airport however are honest areas.)

Is it that I can't see them but they can instead see me and my hard drive?

Sorry for my ignorance.

The issue is that you are a potential threat to the network you just 'hijacked'. While you may not have malicious intent, others might.

Boondoggle's question is mainly from the other side, as the network owner. And what his liablilty would be should someone used his network to commit a crime.

[ghporter]

I agree with Macroy; you are an intruder when you enter someone else's network uninvited. And you are probably violating state and federal laws if you do that in the US. Not that accidentally finding that your notebook has connected to your neighbor's network will land you in jail, necessarily, but if you connect to a corporate network and they find out, you might be prosecuted.

When I note a network that I can connect to without being invited, I try to find the owner-usually a neighbor-and explain the situation. I try to educate them on the whys and wherefores of security. It usually works.

[kcmac]

I don't disagree with anything you have all said. I am just trying to understand how this is insecure.

At places like the Pittsburgh airport, you are allowed to jump on the wireless network with no strings or fees attached. Am I vulnerable to someone attacking my machine? Is there any harm that I could unwillingly do to others by just simply using this access and jumping on the internet or getting email?

At places that you come across that you have access but not invited to use, how am I making them vulnerable to others?

Again. I am just trying to understand why this is an issue. Not stirring up trouble. I think 95% or more of us out there using wireless access points, sometimes anywhere we find one just want to get email or find something on the net real fast and go on. We aren't looking for anything more. It's hard to imagine how that is breaking the law but I don't doubt that it could be if someone pushed hard enough.

Of course, if people took a few minutes to set up there network the chances of getting access would be eliminated. Most every one of them is named "Default".

[chabig]

Nobody has yet mentioned the fact that just because somebody gets onto your network, they can't do anything (like copy those 1000 songs you mentioned) unless you have security turned off on your computers. If you don't have file sharing turned on, they can't do anything even if they get onto your network (except maybe print to your printer). And if you do have file sharing turned on, they still need your username and password to get anywhere. The worst thing anyone could reasonable do would be to use your internet bandwidth. So I wouldn't worry about it.

Chris

[ghporter]

kcmac, in publicly provided networks, the network should be built to prevent anyone from "reaching out into" your computer-it should be built to absolutely prevent any sort of sharing, and thus protect all the users. This is a service provider responsibility, and the user has every expectation to believe that he or she is safe in using such networks.

In a home network, you'll probably want to share some resources, such as printers and storage. This is a problem for you because an intruder can hijack your print server (there are a number of exploits that take over printer services and do nasty things to the rest of the network) or read/overwrite/destroy whatever is on your storage.

Worse, you are responsible for what goes through your network, so if an intruder simply uses your Internet connection to do something illegal, you could be held responsible and lose a lot of time, money, and sleep getting yourself out of such a mess. THAT, if nothing else, is reason enough to at least take a few steps to secure a home wireless network.

[macroy]

Originally posted by kcmac:
I don't disagree with anything you have all said. I am just trying to understand how this is insecure.

At places like the Pittsburgh airport, you are allowed to jump on the wireless network with no strings or fees attached. Am I vulnerable to someone attacking my machine? Is there any harm that I could unwillingly do to others by just simply using this access and jumping on the internet or getting email?

At places that you come across that you have access but not invited to use, how am I making them vulnerable to others?

Again. I am just trying to understand why this is an issue. Not stirring up trouble. I think 95% or more of us out there using wireless access points, sometimes anywhere we find one just want to get email or find something on the net real fast and go on. We aren't looking for anything more. It's hard to imagine how that is breaking the law but I don't doubt that it could be if someone pushed hard enough.

Of course, if people took a few minutes to set up there network the chances of getting access would be eliminated. Most every one of them is named "Default".

You're comparing a public access point to a private network that someone have neglected to secure. Take your office coffee pot, everyone is welcome to it.. but that doens't mean you can walk into someone's house for a cup of jo 'cause they forgot to lock the door.

Just because someone lack of tech savy does not give someone the right to take advantage of that. I know you most likely mean no harm... but again, others may not. As for accessing a public access point, I don't believe they are required to ensure your security (some even have you read and agree to a disclosure) - my suggestion would be to always assume its not protected.

[kcmac]

This is all fairly interesting.

We are all wireless at our house. Use Airport express to share our internet connection with 3 macs. We don't share any services. (ie file sharing, printer sharing, etc.) So I would guess it sounds like we are safe at home. (We share the printer directly from Airport Express.)

It sounds like however that when I "borrow" bandwidth out in public, that someone with enough knowledge could go through me and potentially get onto the "bandwidth providers" network. Seems to me however that this knowledgeable person could do this all on their own. How am I really helping them?

I agree with chabig here that they would still need the person's username and password. Something that they would have to crack. Me being on the bandwidth with them certainly would not be providing that.

[Chinasaur]

1. Change the admin logon password at LEAST
2. Set WEP encryption at 128bit with alpha numeric key
3. Set your SSID to something odd - I use Disabled
4. Turn off DHCP and use Static local IP's
5. Enable MAC address filtering.
6. Disable SSID Broadcasting
7. Be paranoid and use a local firewall on ALL computers behind the firewall/router

This is the most you can do on most consumer routers and is enough for all but the best crackers who in all probability WON'T be driving through your neighborhood soon.

[ghporter]

Originally posted by kcmac:
This is all fairly interesting.

We are all wireless at our house. Use Airport express to share our internet connection with 3 macs. We don't share any services. (ie file sharing, printer sharing, etc.) So I would guess it sounds like we are safe at home. (We share the printer directly from Airport Express.)

It sounds like however that when I "borrow" bandwidth out in public, that someone with enough knowledge could go through me and potentially get onto the "bandwidth providers" network. Seems to me however that this knowledgeable person could do this all on their own. How am I really helping them?

I agree with chabig here that they would still need the person's username and password. Something that they would have to crack. Me being on the bandwidth with them certainly would not be providing that.

THIS IS NOT A FLAME.


I don't think you've gotten the point I was making about your home network. If your home network is like 99.99% of other wireless home networks, mine included, you don't actually authenticate home users-you just let them connect and surf away. THAT is the #1 security problem with such a network. That's why I use WPA-PSK and MAC address filtering. Your assessment of someone "going through" your computer while you're on a public network is almost completely incorrect. The public arena is not where you need to worry, especially if your computer is not set up to share any of its resources. Your HOME network is what requires your attention.

If Bad Guy drives up in front of your house, whips out his laptop and connects to YOUR wireless network, YOU can be held legally responsible for some or all of the illegal activities Bad Guy conducts while he's using YOUR wireless network. Sure, he may not be able to corrupt your hard drive, but the kiddie porn he downloads through your connection will get YOU into serious trouble.

Use WPA, change passwords periodically, and notice when your connection seems to be slow and you're the only user (that you know of) on your home network. It's like locking the front door EVERY TIME, and noticing when you hear somebody rattle the knob.

I'm not paranoid, but I am aware, so I do what I can to protect myself. I recommend you do the same.

[kcmac]

Not taking it as a flame. All I have been asking is what is the big risk? No one has told me anything that sounded risky until your last post which is pretty radical. The risk seems to be that they can use my bandwidth. Doesn't seem they can get into my computer which to me and most users is what we are concerned about.

All of us "average" users tire pretty easily of the IT guy at work that just keeps saying "just do what I say because I know best." I am just trying to find out if I am at risk of someone getting into our computers and damaging or removing information.

As for your example, for me to get busted for someone else downloading kiddie porn or other illegal activity from my bandwidth, wouldn't they have to find evidence of it somewhere on my machine or the others in my network, in my bank account, lifestyle, something? Can my cable modem connection really slow down noticeably if someone else is on it considering that the whole cable connection theory is that it is shared by neighbors living around you already and that it can dynamically expand?

Again, I am not trying to stir up trouble. The posts above are interesting but what are the realistic risks? Especially considering that we do not share services in our network, only the online connection.

I do get the point that we should use a password to access our network. Seems only logical. But all the steps that Chinasaur suggests, come on.

[Forte]

All of us "average" users tire pretty easily of the IT guy at work that just keeps saying "just do what I say because I know best." I am just trying to find out if I am at risk of someone getting into our computers and damaging or removing information.

That's all well and good, but you've been given good advice on how to secure things, and are then saying "but come on..." to it.

As for your example, for me to get busted for someone else downloading kiddie porn or other illegal activity from my bandwidth, wouldn't they have to find evidence of it somewhere on my machine or the others in my network, in my bank account, lifestyle, something?

Think of it this way - Someone is using your bandwidth to do it, but at the ISP's end, and to the authorities, it does not appear to be someone else using your bandwidth: It is you. The fact that it would appear you are engaging in the activity alone is enough to warrant them investigating you. Not the bandwidth theif.
Sorry to put it in a radical way, as such, but that's very likely how they would see it.

Again, I am not trying to stir up trouble. The posts above are interesting but what are the realistic risks? Especially considering that we do not share services in our network, only the online connection.

Those are realistic risks. The problem is that ISPs and wireless kit providers advertise it all as "safe" and suchlike, and therefore some users unfortunately do not seem to believe the risks, even when they are laid out for them. It is to their detriment.

I do get the point that we should use a password to access our network. Seems only logical. But all the steps that Chinasaur suggests, come on.

All the steps that Chinasaur suggested, I personally would consider to be the very least that should be done. It's for that reason I choose not to use wireless at all - there are too many risks for me to justify using it.

[macroy]

Originally posted by kcmac:
Not taking it as a flame. All I have been asking is what is the big risk? No one has told me anything that sounded risky until your last post which is pretty radical. The risk seems to be that they can use my bandwidth. Doesn't seem they can get into my computer which to me and most users is what we are concerned about.

All of us "average" users tire pretty easily of the IT guy at work that just keeps saying "just do what I say because I know best." I am just trying to find out if I am at risk of someone getting into our computers and damaging or removing information.

As for your example, for me to get busted for someone else downloading kiddie porn or other illegal activity from my bandwidth, wouldn't they have to find evidence of it somewhere on my machine or the others in my network, in my bank account, lifestyle, something? Can my cable modem connection really slow down noticeably if someone else is on it considering that the whole cable connection theory is that it is shared by neighbors living around you already and that it can dynamically expand?

Again, I am not trying to stir up trouble. The posts above are interesting but what are the realistic risks? Especially considering that we do not share services in our network, only the online connection.

I do get the point that we should use a password to access our network. Seems only logical. But all the steps that Chinasaur suggests, come on.

You are taking more of a selfish approach to this matter - and I don't mean it as an insult. But if I'm understanding you correctly, you're simply saying, as long as my systems are safe, why should I care if others are on my network.

From a security perspective - 100% security is never going to happen. So unless you unplug your systems from the network, there is going to be some risk. Chinasaur's suggestions are ways to add an additional layer to protect yourself. And honestly, its not that big of a deal, most of what he suggests are "do it and leave it" steps (although I would suggest you change the variables on a rolling basis, like passwords). You say you are not running services, and should be safe. But there are always exploits and vulnerabilities that others can take advantage of.

The question with security controls are if they are worth the effort given the asset. And your bandwidth is viewed as an asset. So unless you secure it, its vulnerable.

As far as you getting in trouble if others are using your bandwidth - you may not have anything to show... But, on the other hand, the ISP's logs will show that the illegal activity is coming from your computer.. so you may be caught up in the investigation. Thus... is it worth the hassle of having a search warrant conducted on your property to save a few simple steps to secure your network?

[kcmac]

Points taken.

It's not that I care if others are on the network as much as I wonder what can happen.

We always are being told that wireless is so insecure. Our IT guys won't let us use it. End of discussion. No explanation. And because security is such an issue, people just seem to shrug their shoulders and say okay.

After using wireless at home and on the road now for the last several years, I can't imagine not using it. Not once have I had an issue. I realize this doesn't mean that I couldn't.

I guess my ignorance in this matter also includes how I perceive bandwidth. To me, it is not my asset. It is something I buy from the asset pool of the provider. So maybe that is why I look at this differently (and maybe incorrectly).

The security breach seems to be that someone is getting free use of the bandwidth. Not that they can or will do any harm to the user. If that is correct, then this is a security concern harbored more by the provider than the user.

Thank you for being civil in this discussion.

[ghporter]

Originally posted by kcmac:
Points taken.

It's not that I care if others are on the network as much as I wonder what can happen.

We always are being told that wireless is so insecure. Our IT guys won't let us use it. End of discussion. No explanation. And because security is such an issue, people just seem to shrug their shoulders and say okay.

After using wireless at home and on the road now for the last several years, I can't imagine not using it. Not once have I had an issue. I realize this doesn't mean that I couldn't.

I guess my ignorance in this matter also includes how I perceive bandwidth. To me, it is not my asset. It is something I buy from the asset pool of the provider. So maybe that is why I look at this differently (and maybe incorrectly).

The security breach seems to be that someone is getting free use of the bandwidth. Not that they can or will do any harm to the user. If that is correct, then this is a security concern harbored more by the provider than the user.

Thank you for being civil in this discussion.

Civility is my middle name. No, that's not right... let me look at my driver's license....

Anyway, your IT people are either under instructions not to spend more money on the hardware, software, and manpower time needed to secure your firm's wireless network (an authentication server, everything capable of WPA, a system to produce and distribute initial passwords, and their brains and time), or they and the company are completely clueless about how to get this done. Either way, it's about the same thing that the on-line world went through about ten years ago with everyone wanting access to the Internet. Give 'em time... but they're still wrong.

I'd like to feel the same way about the 'bandwidth pool' as you, but I've been involved in computer security for too long. I am quite aware of what could happen if a home network is breached, which is why I'm trying to warn you to protect yourself. Your purchase of bandwidth is more like buying electricity, and you probably wouldn't want someone plugging a big cord into your house and using the electricity that you paid for, would you? To press the analogy a bit, if they plugged into your house, then maliciously electricuted someone, you would at least be in line for a civil suit; "This wouldn't have happened if Mr. Smith had just secured his utility outlets!" It sounds funny, but it could easily happen here and now.

[kcmac]

Thanks GH.

[Chinasaur]

kcmac,

One reason IT won't let you use Wireless is that once logged into a wirless connection..any intruder is BEHIND the firewall. Think about that for a minute. And as the PC's at most companies are not running local firewalls (because they assume the main routers/firewalls are protecting them)..this would let an intruder hammer away at the OS without detection. This gives them time to exploit any of the known vulnerabilities of the OS's a company might be running. So they then have time and access to crack servers, both mail and file, user workstations..etc. Like having a tunnel into Ft Knox.

Additionally, once inside said servers, they can use them to store whatever they want...warez, pron, you name it.

And the same applies to a home user. Someone gets thru their router and they have no local firewall running, they can crack at the computer till they get in.

Now do you see why IT is not really excited at having AP's all over the map?

[insha]

On my home network I have disabled SSID brodcasting and enabled MAC filtering (Access Control -- for the Airport Exptreme/Express crowd). Plus I have my Firewall (in the System Preference panel) turned on all Macs in my home.

I have not turned on WEP, nor have I disabled DHCP. Does this make my home network less prone to being hijacked by those living around me, if they are within range of my wireless network?

Also is there a good place to go to learn about Wirless network security for Mac users, like myself?

Thanks.

EDIT: How can I get to the logs from my Airport Express base station?

[amazing]

Originally posted by Chinasaur:
Additionally, once inside said servers, they can use them to store whatever they want...warez, pron, you name it.

And the same applies to a home user. Someone gets thru their router and they have no local firewall running, they can crack at the computer till they get in.

Now do you see why IT is not really excited at having AP's all over the map?

It seems to me that there are 2 separate questions here:
1. security at work. This usually involves a majority of window clients and servers, all of which are vulnerable to a vast variety of bad stuff. The IT people know that these Windows disasters need to be protected because they're "infirm and disease-prone." IT people may not have the most prominent people skills, but even a real communicator would get mightily sick of talking to recalcitrant users.

2. security at home. If you've got all Macs, you personally are probably not going to get hacked. However, the real issues of stealing bandwidth revolve around someone downloading kiddie porn or perhaps sending vast amounts of spam. It has happened already--I seem to recall a case in Canada (?) where police arrested a man acting suspiciously (caught with his pants off) in a darkened car watching porn while stealing bandwidth from an unsuspecting home wireless network. There's also the somewhat unrelated case where a grandma was sued under the DCMA for stuff that her granddaughter did while there on vacation? That's but a short jump from someone using your WAP for nefarious stuff that draws the unwelcome attention of deep-pocket lawyers.

Face it: not securing your WAP is irresponsible and dangerous.

[steveo21]

This may be a little off topic but I've never tried to hack a computer before so I don't know what steps are usually taken to do so. What I have done is gone war driving with my laptop or pocket pc to see how many open wireless networks there are in my area. I've never had any malicious intensions, I was just curious to see how many unprotected networks existed in my area.

As an amature war driver, all i do is drive around the back roads in my area and wait for my laptop or pocket pc to tell me there is a wireless network detected. Assuming this is how most people find vulnerable networks, the easist way to avoid an intrusion is to simply disable SSID broadcasting in your router.

If the war driver never gets a notification on his handheld, theres a much slimmer chance he'll stop and scan the area. I live in an apartment building so my paranoid wireless setup is as follows:

128bit WEP encryption
mac address filtering
no SSID broadcasting
dhcp disabled
renamed the ssid name
update router password weekly
all except 4 ips are filtered from internet use through my router
all shared folders on my computers have tight user settings

I hope no one above has already mentioned any of this. I got tired of reading through the posts and just wanted to throw in my cents