Open Networking

New10k writes "Here is a feature article on guys in Seattle, San Francisco and elsewhere who are bringing the Open Source ethic to the idea of an available to all wireless Internet. Includes a short explanation of telco vs. free methods of providing access." I know folks who do this already, just not with permission (roam around cities with sniffers and find networks that aren't locked down ;)

Comments

900Mhz / 2.4Ghz IP networks and security.

[PureFiction]

These types of RF networks have been in use by companies for quite a few years (i.e. manufacturing data collection)

Like the TacoMan said, many of these networks aren't secured very well.

Half a dozen manufacturing plants that I integrated RF data collection devices for did not use any type of authentication of encryption and relied solely on frequency channels to identify remote RF terminals.

For a few hundred bucks, Intermec and others can provide you with ISA cards to tap into RF networks and even PCMCIA cards that you can plug right into your laptop.

These devices setup an IP connection that ties a psuedo terminal on a unix server to the ANSI/VT100/etc emulation terminal running on the data collection devices themselves.

Some of the newer models provide a light weight web browser configured for various ports on a unix server to handle the data collection interface.

Almost all (95%+) of the data collection applications that are attached to the other end of these RF terminals are running on critical enterprise servers so that they can be close to the databases they feed.

It always baffled me that the IS tech's would be so lax on security simply because it was 'RF'.

As a side note, eavesdropping on an RF network is orders of magnitude easier than typical networks (ethernet / ATM) and effectively impossible to identify. For a few hundred bucks anyone can make a RF 'tcpdump' with a laptop and RF PCMCIA card that will trap every single IP packet flying over the RF networks.

So, the moral of this story is:
RF entails much more security risk than typical networking. Beware when you implement an RF network, and keep security at the top of your to-do list.

Re:Tragedy of the common?

[Seenhere]

By the way, I'd like to hear more about cruising the streets with a sniffer looking for open networks. How's that done, and what does one do to 'lock down' the network?

It depends on what wireless technology you're using, but here in my own private geek compound I run Orinoco (Lucent) Wavelan Gold wireless cards in 128-bit RC4 encryption mode.

This is quite easy to set up under Linux using the wireless extensions to the standard pcmcia services . You will have a switch branch in your wireless.opts file that looks something like

# Default Lucent Wavelan IEEE
# Note : wvlan_cs driver only,
# and version 1.0.4+ for encryption support
*,*,*,00:60:1D:*)
INFO="Wavelan IEEE ad-hoc"
ESSID="Secure Network"
MODE="Ad-hoc"
CHANNEL="3" #2.422GHz
RATE="auto"
KEY="1234-5648-9abc-def1-2345-6789-ab"
;;
(No, that's not my actual key :). And note it's not the full 128 bits... the version of the drivers I have won't permit that, for some reason that I don't understand. But 104 bits is pretty good.)

Anyway, you definitely want to "lock down" your network, unless you are into to providing a public access point. Without encryption, it would be like having a hub on my DSL modem that anybody driving by could plug in to...

--Seen