Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
The Internet

Worldwide WarDrive Aftermath 227

Posted by michael from the slashdot-needs-a-wireless-topic dept.
wardriver writes "The event took place on August 31st 2002, people from around the world took part in the effort to document and make known wireless access points as a group. Some people go WarDriving everyday, so this was just like an normal day for many who attended any of the world wide events as documented on the results page. Hardware ranged from laptops, to car mounted computer systems, to handhelds all equipped with GPS devices to accurately map the spots. Cars were marked with )(WarDriver stickers and people were sporting their wardriving is not a crime t-shirts. All in all the event went well and with enough pressure and requests to chris it may happen again." And in a related story, Dr_Marvin_Monroe writes "Wardrivers be warned---- A Practical Approach to Identifying and Tracking Unauthorized 802.11 Cards and Access Points includes information on locating rogue access points and intruders."
This discussion has been archived. No new comments can be posted.

Worldwide WarDrive Aftermath More

Worldwide WarDrive Aftermath

Comments Filter:

  • Yawn (Score:1, Troll)

    by shadow303 ( 446306 )
    This just goes to show that there are far too many people with too much time on there hands. Reminds me of the people in my home town who would drive around on Friday night clogging up traffic for no reason.

  • Cisco (Score:4, Informative)

    by Beatbyte ( 163694 ) on Wednesday September 04, 2002 @09:12AM (#4194600) Homepage
    It should be known that there are cards that can "just listen" without letting themselves be known.

    Cisco makes the AIR-LMC350 which would be a good choice for wardrivers.

    Or, not being an idiot administrator and leaving everything open helps too ;)

    • Most cards have Linux drivers that allow them to be put into "RF Monitor" mode, which is completely passive. This is the default mode of operation for Kismet (http://www.kismetwireless.net/)

      Supported cards include:
      Prism2 with the linux-wlan-ng drivers
      Orinoco cards with a slightly patched driver from http://airsnort.shmoo.net/
      SOME Cisco cards. While they all happily go into RF Monitor mode when asked, SOME OF THEM KEEP BROADCASTING.

      So all in all, if you *absolutely* don't want to be detected, Cisco is the least safe choice for wardriving. Orinoco is probably the best bet, even though you will have to downgrade your Orinoco firmware for compatibility (8.10 is severely broken for RFMon usage). Prism2s have the best compatibility, but are generally known for crappy receivers and most don't allow external antennas. Almost all Orinoco-based cards have much better receivers and support external antennas. The Cisco hardware is the best (100 mW transmit, not like that matters if you're trying to stay silent, some have dual MMCX jacks for diversity antennas), but you can't trust it to stay silent in RF Monitor mode.
      • Very true. I just figured if a lot of people are being told about how WarDriving is great fun, it would be better for them to stick to RFMon so half the people I know don't go to jail after someone starts calling cops. ( yes i know war driving is not illegal but people have been arrested for less )

        I like the Cisco because of the -95dBM sensitivity, dual antenna jacks, and 100mW transmit.

        • Agree. The Ciscos are VERY nice, as long as you're careful to get one that doesn't decide to peep anyway in RFMon mode.

          Dunno how Orinocos compare to the Ciscos sensitivity-wise. They're definately much better than Prisms (We have 3 Prism2-based cards in my house and one Orinoco, the Orinoco gets much better range.)

          100 mW transmit isn't much of an advantage for wardriving. Is very nice otherwise though. :)
    • It boggles the mind that so many administrators unintentionally leave their wireless networks open and available to anyone willing to make a little effort (and some cases, no effort at all). Certainly, wardrivers who spend time attempting to access secured networks need to consider their actions carefully, but what constitutes a secured network? There are plenty of foolish administrators out there who take no measures at all to secure their networks but of those who do, and have their networks authorized by 'unauthorized' persons; what truly constitutes security? Certainly there is a level of incompetence in network security where the person gaining unauthorised access can simply claim(when acused of accessing a secured network illegally) "The network was not secured". There has to be some remedial security standard below which (assumin it would otherwise be a crime to access a particular secured network) no crime would have been committed.

      --CTH
      • Certainly there is a level of incompetence in network security where the person gaining unauthorised access can simply claim(when acused of accessing a secured network illegally) "The network was not secured". There has to be some remedial security standard below which (assumin it would otherwise be a crime to access a particular secured network) no crime would have been committed.

        Crimes are determined on intent though. By your logic if I don't leave my doors locked 24 hours a day with an guard dog at my door then I deserve to be robbed? Unauthorised access of any network is akin to walking into someone's house. At the very least you are trespassing, at the very most I am going to shoot you. This is the kind of logic many pirates use to steal music. Just because you can do something doesn't give you the right to and certainly doesn't make it any less illegal.

      • Re:Idiot Administrators (Score:5, Insightful)

        by Melantha_Bacchae ( 232402 ) on Wednesday September 04, 2002 @11:32AM (#4195275)
        hillct wrote:

        > It boggles the mind that so many administrators
        > unintentionally leave their wireless networks open
        > and available

        It doesn't boggle anything when you get off you geeky high horse and realize that most people buying and installing wireless network equipment are not "administrators" of any sort. They are ordinary people who don't know a thing about network security, but just need a net to work. The only thing that boggles the mind is that you would rationalize preying upon their ignorance.

        The manufacturers hold one key to solving this. If they would make the configuration of these networks secure by default, and give people easy to understand instructions for enabling security: "Yes, I want to make my network safe from invading hordes of young hoodlums.", it would help.

        "Godzilla and Jaguar: Punch! Punch! Punch! Hit! Hit! Hit!
        We die if they stop fighting for us."
        Jet Jaguar Song, "Godzilla vs. Megalon"
      • I take offense at this. I am one of those "idiot administrators" of whom you speak--I run an unsecured wireless access point (two, actually). I do so by choice--my home network is for my use, and that of my guests; setting up individual permissions for every guest is a pain. Additionally, I'm happy to share the bandwidth with my neighbors. I keep an eye on my logs, and so far (1.5 years), I've not seen anything that concerns me. My other network is also open to the public. I follow the same security procedures as the wired network to which it connects: if you can plug in, you can get access. With the abundance of public ports, and unsupervised ports, my wireless hub does not affect security in any way. It does, however, add convenience. If you're ever in the pilot lounge at Westheimer Airport (Norman, OK), and notice you have 802.11b connectivity, stop by my office and say hi--that's my hub you're using, and I hope you enjoy it. Idiot sysadmin? No, try generous--there are no security concerns for me, so I share, try to do everybody a favor. I'll shut down the open access when it becomes a problem; until then, enjoy the bandwidth.

  • low tech variant of this event... (Score:4, Funny)

    by Ubergrendle ( 531719 ) on Wednesday September 04, 2002 @09:16AM (#4194613) Journal
    I went for a low-tech version of this event.
    Knock knock
    "Anybody home?"
    Try door.
    "This one's locked, next house!"

    Nicky nicky nine doors is fun...except for the old codger sitting on his front porch on a rocker with a shotgun full of rock salt...
    • Bleah...

      You aren't sending any packets out to knock. You are simply driving down the street looking for ssids, or house numbers. Looking for packets is like seeing if houses exist in the city.

      Sending ping packets would be knocking on the doors. But you are just passively driving down the street looking at the countryside for life.
  • World Series (2 teams from Canada, rest from States).

    WarDriving... Cities from only the western part of North America...

    Don't call it "World" if its just North America, and especially don't if its just a region of North America.

    • With the World Series it's different, because when Major League Baseball first introduced the World Series, nobody outside of the US had professional baseball teams, so the winner of the game between the American League and the National League was the legitimate world champion.

      Now that baseball is played all over Central America and Japan, calling it the World Series sounds a little arrogant, perhaps, but it remains called that because of tradition.

      It's still not entirely incorrect, because most of the very best Latino and Japanese baseball players come to America or Canada to make the big money and play against the best competition, so the winner of the "World Series" on any given year probably is, in fact, the world's best baseball team.

    • World Series (2 teams from Canada, rest from States).

      I'd imagine that non-Americans probably don't have this attitude towards the "world champions" in sports that they dominate, like cricket or something that's not played here.

      I think when it comes to baseball it'd be hard to see that the team that wins the World Series isn't the best team in the world.

      The same is true in basketball as has been amply demonstrated in the Olympics since the inclusion of professional players -- the US easily trounces the competition, despite the presence of a handfull of professional players on other national teams.

      I'd like to see more international play in baseball, maybe a world-cup style competition where US World Series champions took on Japanese, Philipine and Central/South American and Carribean teams. I think the results would be pretty dominated by the Americans.
      • Unlike the baseball "World" Series, Cricket's World Cup can actually claim more than two competeing countries. There are the top teams, England, Australia, India, Pakistan, Sri Lanka, South Africa, New Zealand and also some newer, not quite so good teams, Kenya, Bandladesh (sp?) Zimbabwe (actual New Zealand probably should be put in the second list :)

        A better example would be Aussie Rules Football except that there has never been a "World" anything and it's called "Aussie" rules.

        And for the poster above, neither Ireland or Scotland have world class cricket teams. Not sure what they play in Scotland but Ireland play a game called Curling I believe. It's sort of an unusual cross between field hockey, soccer, rugby and war.

    • WarDriving... Cities from only the western part of North America...

      Don't call it "World" if its just North America, and especially don't if its just a region of North America.

      So get off your butt and go do some wardriving. Nothing is stopping you, or anyone else in the world, from participating. Indeed, I suspect the organizers would be happier if more countries participated.

      Perhaps it will become an annual event, with gradually more countries taking part.

      BTW - Where do you draw the line for 'world?' 1 country per continent, x countries per hemisphere? Most 'world' events in Europe and Asia are similarly limited ... only a tiny fraction of the world community takes part (e.g. "world" art exhibitions, with all of 4 countries on 4 continents represented out of hundreds is arguably as small a slice of the world as it would be if those 4 countries were on one continent, to cite an example I witnessed more than once while living in Germany).

      If 10 people take part in a 'world' event and they happen to be scattered all over the globe, does that somehow add legitimacy over 10,000 people taking part, who happen to be scatterd over just one corner of it? I agree the term is often abused, but your kneejerk reaction is more than a little silly itself.
    • Um, wasn't this announced on the Internet? Isn't the Internet world-wide?

      So how is it the fault of the organizers (to use the term somewhat loosely) if people in other parts of the world ignored the event or decided not to take part?

      Of course, in parts of the world, people don't have pickup trucks loaded with electronics. But where were the folks in Europe, Japan and Australia?

      Maybe next time, it just needs a bit more publicity, and we can get an idea of how wireless is coming along in the rest of the world.

    • If you bothered to check, its called the World Series, because it was started by the World newspaper, hence the World series. If it was started by the times, it would be called the Times series.

      Normally I'd say someone was ignorant but since you know about google, clearly you made no effort to confirm your assumption, so your stupid.

      BTW it(wardriving) was a world event, the fact that you didn't participate is hardly the fault on North America.

  • NPR story (Score:3, Funny)

    by micromoog ( 206608 ) on Wednesday September 04, 2002 @09:18AM (#4194624)
    NPR had a story on wardriving this morning. While they didn't use the term, they covered the topic pretty accurately (as usual).

    They interviewed a couple of guys that regularly drive around in a "pickup truck full of gear" and document access points. Apparently one of them has documented more than 400.

    The best part was when they said they do it at night, so people in "affluent neighborhoods" won't mistake the cylidrical antenna for a shotgun.

    • thanks dude. i live on the west coast. just turned on the radio to hear that they're about to do the story.
    • When the story goes live on the website, here's the link [npr.org]
    • Note that the 400 access points we discovered were just during THAT evening's war-drive.

      I war-drive for one reason--to guage the growth of wi-fi in the Northern Virginia area. It's been fascinating. Driving last year I'd pick up 20-40 access point within a few miles of my home. Now, I pick up several hundred on an hour long cruise around my town. That phenomenon keeps me going out on a monthly basis.

      We visited Old Town Alexandria for this NPR event. We combined it with a "war-walk" and it's a shame they edited out that portion of the adventure. The inebriated queries regarding our yagis were an amusing portion of the un-edited mini-discs.

      If you would like to see the setup that was used, visit:

      http://ruff.cs.jmu.edu/~beetle/wardrive/index.html [jmu.edu]

      We used this same setup for a similar war-driving demo for the Baltimore Sun a few months back.

      Beetle

  • worldwide wardrive (Score:4, Funny)

    by Golias ( 176380 ) on Wednesday September 04, 2002 @09:20AM (#4194629)
    If by "worldwide" they mean "a few counties in California, Canada, and bits of the midwest," then the project was an amazing success. :)
    • I think the idea was to promote a world-wide response, maybe not this time but the next time.
      • Well, obviously. My point (actually, it was more of a smart-assed joke than a point) was that they utterly failed to reach the objective of world-wide participation, at least this time.

        Who knows, though... maybe it will build up steam. Personally, I don't really see why one would need an "event" like this. It seems that WarDriving would be a pastime that would be better supported by an ongoing blog or slashcode site, where people could submit time-stamped maps of wireless nodes.

      • If they were smart, they would get their site posted to slashdot after first making sure their 56k modem was up to withstanding a slashdot effect.

        Oh, wait. Nevermind.

        The many war{driving|storming|floating|biking|hiking} groups here in Europe would likely participate next time.

        I just got a new laptop and I'll be getting netstumbler up and running RSN. Part two of my driving around Europe vacation is about to begin. That should provide a nice map of a few dozen cities by the end of the month.

        the AC

  • Not just for bored amateurs... (Score:3, Interesting)

    by EvilAlien ( 133134 ) on Wednesday September 04, 2002 @09:21AM (#4194636) Journal
    ... wardriving is a fun hobby for real security professionals with big name consulting firms. Its a great way to demonstrate the importance of good practices and how pervasive bad security is. Its a pretty quick way to justify the expense for security, otherwise it can be pretty hard to quantify the benefits of vigilance to the penny counters.

    An ounce of prevention shows up in the ledgers, but they never see the cost of the avoided pound of cure.

  • "wardriving is not a crime" hmmm (Score:4, Insightful)

    by fantomas ( 94850 ) on Wednesday September 04, 2002 @09:22AM (#4194641)

    "wardriving is not a crime t-shirts...


    You got to admit that people aren't doing themselves any favours by choosing a real positive expression like "wardriving"....


    I can see this must win real friends when you are explaining to companies what you are doing outside their offices. Especially in countries where vigilante groups /gangsters like cruising round in their autos. Great PR, guys :-)


    (Yeah yeah I know the origin of the term but I still think it sucks.. maybe try cruising round New York on 11th September and explain to a cop that you're war driving...)

    • Maybe they should call it 'theft of service'.

      Or the T-shirt could be more clear: "Wardriving is not a crime. Or a war."

  • Somebody please clear this up for me... (Score:4, Insightful)

    by psxndc ( 105904 ) on Wednesday September 04, 2002 @09:25AM (#4194653) Journal
    While white hat hacking can be argued to be ethical (like Adrian Lamo type people), I don't see how wardriving does _not_ lead to unethical practices. It may be interesting how many people have open networks, but really what "good" does war driving accomplish? Do war drivers stop at the house and tell the people "Hey, you're network is open, and this is how you fix it"? What "good" comes out of knowing where wireless service is available?

    I understand that some people invite others onto their network. This is very generous (but in my opinion insane because YOU are responsible for what comes out of YOUR router), but shouldn't these people advertise that their network is open instead of people driving around trying to discover these access points? I think the concept of wardriving is interesting, but the practical ethical results of wardriving efforts seem very very few. Maybe there is some application I am missing. Feel free to enlighten me

    psxndc

    • Why is birdwatching interesting?

      • birdwatching is about understanding what is out there and to a degree the world around you.

        Wardriving is snooping and peeking into someone's electronic window. And they might not know you can see in.

        Be ashamed for not knowing the difference!
        • Wardriving as peeking in someone's window is only if you are running a program to capture packets at the same time. You can run ethereal and airsnort at the same time to view the webpages people see. That would be snooping.

          Looking at ssid's like like looking at housenumbers as you drive down the street. Wardriving is like seeing if there are houses in the city. Its like looking at the development of the neighborhoods. Do these people plan properly?
        • birdwatching is about understanding what is out there and to a degree the world around you.

          When I scan for networks, I am doing just that. I can see in real time how my neighborhoods are evolving - where the technical people are, where businesses are popping up, even cafes. There's a cafe near my office whose access point is named 'Good Day Cafe'. They apparently leave it open on purpose. I first saw it from a taxi in Omotesando. For them, it's a form of cheap advertising I guess.

          Lots of people (myself included) leave their access open for web browsing.

          Often times, my iBook will automatically log me on to the strongest network I am near. I've noticed that I sometimes get a low IP like 192.168.0.2, which would seem to indicate that it's just me and the router - no servers to 'snoop'. Most home users seem to just use these things to get online.

          Be ashamed for not knowing the difference!

          Don't be such a pill.

          There's a big difference between logging networks and breaking into them. At least awareness is being raised and more people that want to are securing their nets.

          Cheers,
          Jim
    • Wi-Fi piggy-backing is kind of analogous to riding freight trains.

      A rail line needs to protect themselves against being held responsible for the hobo population, so they hire screws to kick the bums off the trains. Likewise, most people are advised to encrypt their Wi-Fi signal for the same reason. However, beyond that, most people don't view either type of trespass as a particularly serious crime. Odds are, the user of this WarDrive data is just some warez kid who is using your broadband to swap DivX files or something. Someday they will turn 18, and the fear of a permanent criminal record will disuade them from continuing. (At least that's what happened with all the hacker kids I grew up with.)

    • In many cases, these people go wardriving just out of curiosity.

      I find it very interesting that in a short drive around my area I found 45 networks (I was NOT expecting that many, esp. since I wasn't using an external antenna), and over a third of them were factory default. (Not just unencrypted, but completely unchanged factory default units.)

      I haven't actually DONE anything with those APs though.
      • what might less ethical people than yourself do with those APs?

        that's the problem i have with wardriving - i don't mind that someone goes around snooping, because it's genuinely part of what makes us human - our propensity for curiosity. however, most wardrivers tend to mark with chalk the direction of insecure wireless networks. really, what's the purpose of that? in my mind, that's the equivalent of people going around with a basket of eggs looking for folks with their fly open.
    • Funny, since I "wardrove" for about a month picking up experimental data for a report I presented in a grad school class about the lack of WiFi security.

      I followed basic precautions:
      Never entered private property
      Configured the notebook to not route any packets
      Placed the contraption in the back seat so it wasn't a driving distraction
      Performed no "follow-up" actions such as attempting to connect to unsecured networks

      I came up with interesting data too, the overall percentage of encrypted AP's was 28%, that is a mix of residential, schools and businesses.

      For grins, I chose a more localized area with just Fortune 500 companies, high-rises and strictly commercial areas and got a rate of... 28%. Scary. It makes me curious to see how many of these are behind the company firewalls, but I actually know better than to try and find that out.

  • That's funny (Score:2, Insightful)

    by Night Goat ( 18437 )
    "Wardriving is not a crime..."


    Unless you think of THEFT OF SERVICE!

    Sometimes I have to wonder about the real-world intelligence of these people. Sure, they probably are really bright when it comes to technology, but evolution should have taken care of the guys wearing these t-shirts long ago.

    • How is it theft of service to listen to the chatter of an access point? That would be like saying figuring out where the phones are by listening to the ringing sounds was theft of service.
      • As I mentioned in a previous post - Many people just do it out of curiosity to see what's out there. They never DO anything with the information except for plot it, and in mant cases, laugh at the morons who leave their APs wide-open factory-default.
        • I've been reading all these replies to my post, and felt that I should clarify. (Maybe it's not a good idea right now, I've been up all night from insomnia) I sort of assumed that people would be eventually using these unsecured access points to get a free internet connection. I imagine there are people out there who just record where the open WAPs are. However, from what I've read in the newspapers, magazines, web, etc., I have noticed that people have been marking these spots like hoboes used to do or maybe still do. Or maybe there's a web site out there that catalogs them all. Now there's no point in doing that besides letting others know where the free access is. That results in eventual theft of service. So while just cataloging the open wireless transmissions isn't theft of service, making these spots widely known seems to me to be a bit unscrupulous, like a locksmith publishing his book of lock backdoors to the Internet. Hopefully you understand what I was getting at.
    • pollution/

      Why think of you feet when you can think in your head.

  • Don't they have anything better to do? (Score:3, Funny)

    by JimPooley ( 150814 ) on Wednesday September 04, 2002 @09:31AM (#4194685) Homepage
    Some people go WarDriving everyday...

    ...and really need to get a life.
    • Or a job?

      See for many of us it isn't that easy. Look at the unemployment numbers for this month and you'll see why.

  • Wardriving Results (Score:3, Informative)

    by drewzhrodague ( 606182 ) <drew@nOsPaM.zhrodague.net> on Wednesday September 04, 2002 @09:31AM (#4194686) Homepage Journal
    Also, people have been uploading their scans to http://mapserver.zhrodague.net -- a web-based mapping package for the entire planet, and http://www.wigle.net - a java-based mapping client. Check 'em out when you get a chance.
  • Does anyone know the origin of the term WarDriving? I mean, on the one hand you have the Slashdot group that's trying to end the myth that all "hackers" are malicious sociopaths with laptops, but then they go around reffering to something like documenting wireless access points as "WarDriving". Not exactly good marketing.

    This isn't intended as a flame or a troll or whatever, I'm just curious as to why it's called that.

  • How about... (Score:2, Funny)

    by setzman ( 541053 )
    /.'ing a server so quickly should be a crime.

  • Useless ? (Score:2, Insightful)

    by CresentCityRon ( 2570 )
    It would seem to me that if someone wanted you on their system they would register on one of the various websites for free wireless access.

    If they didn't want you then you're becoming a bother. I guess you could tell them that they were open and be helpful. I don't see anything of that angle though.

    So its just "Lets see who screwed up their technology. Tee Hee." Nothing useful here.
  • Seriously the analogy of if your front door is unlocked doesn't apply. It's more like comparing the kid next door getting a free peep show by looking in your living room window from his house because you're too stupid to close the blinds (I've told my wife 1000x). So is it really that kids job to come over, knock on the door and say ma'am could you close the door because I sure hate seeing your tits? Not really.
    • Seeing their access point wide open is like looking through the windows. You browse the network then you just walked through the open door. It's tresspassing locked, unlocked, open or no door at all.
      • Not really because if they are brodcasting it and it conflicts with my 2.4GHz phone or my 802.11 network, then why shouldn't I be able to get on it? I didn't ask my neighbor to brodcast an internet connection to my house, so they are intruding on my usage of 2.4GHz.
        • Sorry, you can't justify your crime because they did something wrong. If you use someone's wireless network, whether they secured it or not, without their permission, it is illegal. Whether their signal is interfering with your phone or not. If their wireless equipment is FCC certified and they have it set to factory defaults they aren't doing anything wrong. If that causes interference on your wireless phone, you need to complain to the FCC and the manufacturer, not try to justify illegally using your neighbor's network.
      • No one said anything about browsing the network. They're just looking for networks ... that's all. :-)

  • Not a crime (Score:2, Insightful)

    by Strog ( 129969 )
    Port scanning also is not a crime(for now at least) but a lot of crimes are started with it. I don't blame people for getting a little paranoid.

    It's like a guy swinging a baseball bat all over the place. Sure it's not illegal but he could start clobbering people whether on purpose or not. I'd probably tell him to stop swinging too.

    My brother-in-law lives in California and has had all kinds of trouble since this event. Conicidence?? You start stealing service and disrupting other people's service and you just crossed the line.

    The people that are just scanning and mapping could be considered accesories to the crime when other people use their info to "steal bandwidth".
    • Yes it is, well under UK law.
      It's spelled out in fact :

      Gaining or attempting to gain anauthorised access to a computer.

      Like all good laws no methodology is mentioned or proscribed. In this way the burden of proof is on the prosecution and the interpretation of the law is for the courts.

      Incidentally I had a friend who was a phreaker. He was arrested for it before the Computer Misuse Act was put on the statute. The cops had a print out of phone company logs for all the phone calls he'd made through them. He had to sit there while they asked him if he'd made *every* individual call. It took them 10 hours.

      In the end all he was prosecuted for was "theft of electricity" and walked with a £70 fine.

    • It's like a guy swinging a baseball bat all over the place.

      Any UK officer could pick one of (but not limited to) :
      • Threatening behaviour.
      • Posession of an offensive weapon.
      • Breach of the Peace.
      • Behaviour likely to occasion a breach of the peace.
      • Behaviour contrary to section 5 of the public order act (1986 i think).


      I found a url for the other comment

      Which, I think (IANAL) lays out in pretty straight terms that wardriving and portscanning is illegal in the UK.

      Computer Misuse Act 1990 [hmso.gov.uk]

      1. (1) A person is guilty of an offence if--

      (a) he causes a computer to perform any function with intent to secure access to any program or data held in any computer;

      (b) the access he intends to secure is unauthorised; and

      (c) he knows at the time when he causes the computer to perform the function that that is the case.

      (2) The intent a person has to have to commit an offence under this section need not be directed at--

      (a) any particular program or data;

      (b) a program or data of any particular kind; or

      (c) a program or data held in any particular computer.

      (3) A person guilty of an offence under this section shall be liable on summary conviction to imprisonment for a term not exceeding six months or to a fine not exceeding level 5 on the standard scale or to both.

  • Personally, I don't see it as a crime to simply find open networks. While that point is likely debatable, I've got a couple access points set up, and quite frankly it doesn't matter to me if anyone were to jump on and use the connection. Granted, if someone is constantly sucking up all my bandwidth, that's a different story. But, while I don't publicly flaunt these access points, it doesn't bother me if they're used. It's sort of a "you scratch my back, I'll scratch yours" mentality. MY ISP is quite open when it comes to the types of traffic, so that's not a concern to me. Yeah, some idiot could download kiddie porn or something and it's probably muddy waters legally, but I treat people in general with trust, I don't look at everyone as a criminal because they're not.
  • Ok, Slashdotters. Time to fess up and be honest Wardriving, though harmless in and of itself, is shady business. It's the electronic equivalent of casing a store or residence in order to rob it later. I realize the vast majority of wardrivers do nothing with the info they find, and right now it's more of a fad than anything (especially for kids that fantasize about being Mad Haxorz with Big Skillz, or whatever they hell they're calling it this week), but deep down, face it. You KNOW you're up to no good. The very essence of Wardriving is LOOKING FOR VULNERABILITIES. Only two kinds of people really give a damn about this kind of information. Serious security researchers, and net scum looking to break into networks. Now, like everyone else, I'm getting damn tired of seeing my liberties slip away in new laws and regulations. But if there was half an ounce of honesty here, we'd all admit to each other that by doing stupid shit like Wardriving, we're begging the government and public to be alarmed and put further restrictions on what we do. So to you people that deface webpages, spread virii, and wardrive looking networks to break into, why don't you do us a favor and go fuck yourselves. You are why the word "hacker" evokes fear and loathing.
  • Some folks are talking about 'stupid network administrators' while many of the articles and quotations talk about driving about affluent neighborhoods.

    So, in large part, quite possibly the majority, we are not talking about careless security professionals but people who bought a wireless access point at their local computer store because it seemed to be an easy way to get the computers in their house to be able to share the internet connection and play games or share the printer. These are not security professionals or network administrators in any reasonable definition.

    The people that should really have the mud thrown at them are the companies selling these home wireless access points to unsuspecting customers with security set to wide open by default and next to no instructions about how to turn it on (since that would confuse the customer and result in more calls to customer support and/or returns). They are the ones being truly negligent. If they were being honest the boxes would have "Share your internet connection and all the data on your computers with all of your neighbors!" in big bold letters.

  • If I can see you having sex as I ride by in a car is that my fault or yours?
    If I can see you having sex as I ride by in a car provided I'm using glasses is that my fault or yours?
    How about if I use a pair of binoculars?
    How about a telescope?

    Why wardriving are listening to telephones with a ham radio are probably both socially repugnant the flip side is that one group of people are BROADCASTING on public airwaves. If they don't want people listening to those broadcasts, maybe they shouldn't be broadcasting on a public frequency.

    If you want privacy, pull the digital shades.
  • I'm hoping to write some scripts of my own to scan the various MAC addresses that show up on the network I manage for 802.11 access points.

    So far I haven't been able to find a list of the prefixes used by various manufacturers for their access points. I asked about this on usenet but the only replies I got were the IEEE lists of ALL MAC address prefixes, with no distinction between NICs, APs, switches, etc.

    I'm sure various vendors must have compiled such a thing for their auditing tools... but it doesn't seem like there's anything available through Google just yet.

    Thanks for any help you can give!

    -carl

  • I have read a lot of snickering about idiotic network managers and know-nothing, affluent homeowners. I guess I fall into the latter category. It would be really nice if one--just one--person posting criticism might also offer a link or word of advice on how to actually secure my spiffy new wireless access point.

    My router offers WEP, but a quick Google search makes me wonder if even that's enough. What can the know-nothing, affluent homeowner do that does not take six weeks of intensive reading on network security?

    • Most routers (including my Netgear wireless) allow you to restrict wireless acess by the MAC address of the connecting wireless card. Just restrict your router to the MAC addresses of the wirelss cards in your laptop(s) and/or wireless desktop(s) and you should be all set.
    • From a practical perspective, as a non-sysadmin about the best you can easily do is WEP. Though weak, it is better than nothing and is certainly sufficient to keep all but the most determined attackers at bay.

      When having to settle for WEP, you should regularly change keys. Since this is a home situation, manually changing it every couple of days or so should suffice. In a corporate enviornment, some sort of automatic rekeying should be implemented to complement WEP. If you do not rekey, and you have a persistant attacker sniffing your packets constantly, your traffic could be compromised in less than a week (I've managed overnight in my tests when constantly saturating the wireless bandwidth with data). Some equipment is better about the weak points of WEP than others, but assume you have the weakest and change every day or two. Chances are slim that a house would have a person trying hard to crack when so many open APs can be found.

      Personally, I back up my wireless configuration with IPSec in addition to WEP. With WEP alone, all they can do is get a dhcp response, talk to other wireless systems, and hit the router on udp port 500 and esp (for ipsec). Once in IPSec, they get access to the wired network and the outside world. Still not the perfect solution (plan to force traffic through routing table when I get around it), but still serves to protect some of the more important stuff pretty reliably.
  • I am seeing a lot of confused comments in this thread, so I will throw in my $0.02.

    Disclosure: I wardrive on occasion. I keep a list of access points [cubicmetercrystal.com] that I find while driving. Currently in excess of 1,000 for the Portland, OR area.

    1. Why wardriving? Everyone has their reasons. Mine are security related. Myself and a small group of other local wifi enthusiasts enjoy passive monitoring to identify security weaknesses. We also inform insecure node operators of the fact that their networks are wide open.

    We have found a number of extremely sensitive, wide open access points operated by city and state governments, corporations, and home users. By this I mean networks that are obviously not intended to be public.

    If your government has weak security on sensitive information, this can affect you directly (which means Us, the wardrivers too). So we like to notify them of the vulnerabilities and give them information on fixing the holes. Sometimes we get paid to do this.

    [You will notice the results page is missing GPS coordinates. This is intentional, as there are those out there who would take advantage of unsecured networks]

    This is also usefull for identifying trends and generating usefull statistics.

    2. How do you really secure a wireless network? You have a few options: Basic security and high security.

    Basic Security: Enable MAC ID restrictions, allowing only those cards with a specific MAC id to connect to the network. Also turn on 128bit WEP encryption. You can switch to a lesser used channel, like 1 or 11 if you wish.

    Please note that this is still easily circumvented with the right tools, like AirSnort and MAC ID spoofing. Despite this, most people will find a network in this state and move on. It significantly raises the barrier to entry.

    High Security: Install a VPN with very good passwords or preferably something like SecureID cryptographic tokens. This is the only way to be truly secure, where truly secure is as good as the firewall VPN combo you use at work.
  • I've just discovered this new hobby, using Linux, kismet and gpsdrive. So I put together a t-shirt for War Drivers - www.cafepress.com/wardriver [cafepress.com]. All profits (every check from cafepress) goes to the eff [eff.org].


    Brian

Slashdot Top Deals

Lots of folks confuse bad management with destiny. -- Frank Hubbard

Close