Slashdot Mirror
Toronto, The Naked City
PunWork writes "In an effort to promote wireless network security, Toronto consulting firm IpEverywhere (pun intended) has published a map of downtown Toronto, showing the location of both encrypted and unencrypted ('naked') wireless networks. Is this going to help spread awareness, or is this just going to encourage people to abuse the (apparently) ignorant? The Toronto Star has a story about the map and the consulting firm here."
Like Toronto's local wardrivers don't have maps that blow that one out of the water.
Finally, math books without any of that base 6 crap in them.
both will happen.
1. the idiots will try and hack and abuse.
2. the companies will slowly gain awareness, try to figure out how to secure themsleves, secure funding, initiate sucurity protocols, fix holes, etc.
gee, i wonder who will get going first. the company or the idiots.
There's nothing Intelligent about Intelligent Design.
The map on the site doesn't cover Toronto's nude beach at Hanlan's point.
Unencrypted networks are now referred as "naked" networks? They just called it that to get more people to read it.
Maybe someone should make a new insecure Linux distro called "Naked Linux". It will be great for the desktop to compete with Windows whom has always been naked. (Maybe that's Red Hats secret Plan). In the mean time Windows is trying to get dressed. Stupid 2 legged pants!
Is this going to help spread awareness, or is this just going to encourage people to abuse the (apparently) ignorant?
I'd put my life savings on the aduse of the ignorant.
Lets see, annually, people get viruses from opening attachments in their emails. How many people, do you think, get re-infected because of ignorance?
How many people go to windowsupdate.microsoft.com for security patches?
Yeah, most IT people know what they are doing, and don't do anything foolish with their security, but you know that a lot of average users are learning to setup networks, and setting up a wireless network isn't exactly rocket science.
I anticipate a lot of abuse in the city of Toronto...
Good quote, too many chars. Seriously, the slashdot 120 char limit sucks!
I wonder how long it will take spammers to clue in on this? It is a wonderful deal for spammers; as they are untraceable via this method. There are steps that people running these networks could do to prevent spammers, but still allow legit users. But, you all know how well some admins look after security...
Michael Loves Me!
People get viruses delivered the their computers via email, the net, etc...
What is to stop viruses now becoming "airborne" and people who use an open wireless network unwittingly picking them up or (knowingly or unknowingly) transmitting them into open wireless networks?
Surely most people who wardrive would be smart enough to avoid them through various means... but most people who use computers are fairly clueless about security and virus protection.
Any known cases of wifi virus infection?
42 - So long and thanks for all the fish.
Which other sites show maps of APs? I'd like to see if my neighbor's is on there. Wide open...default password on the router...
I thought I remember seeing a site once where you could just enter a zip code to get an idea.
It might be that all these points are simply honeypots.
Did they make tcp connections to find out?
Cool, now when I go to Toronto, I have a map of all of the Starbucks downtown...
The Dopester
"Yes, I'm a Karma Whore, but I'm doing it to pay my way through school."
Well the submitter name is "PunWork". So maybe he just constantly tries to find puns that work. I'll I have to say is don't quit your day job PunWork, whatever that is!
Thats right, the scum of the network are taking advantage of open wireless networks, whether they are chalked or grabbed off online maps such as net stumbler dot com. The rise of drive-by hacking is a natural by-product of the wardriving/chalking community, and it would be naive to considering this a surprising development. Highjacking an open wireless network is only the smart thing to do for hackers whether they are after data or just a spamming platform.
This puts the pressure on network administrators to secure their wireless networks. It is far easier to drive by a NAP and jack in, and the proliferation of wireless networks could obsolete physical intrusion techniques such as connecting a Dreamcast or iPAQ to an internal network. Tools for wardriving are readily available, such as THC-warDrive. A lazy or incompetant network administrator makes it easy for a kid with the parents car, a pringles can, and a laptop.
perl -e 'print $i=pack(c5, (41*2), sqrt(7056), (unpack(c,H)-2), oct(115), 10)'
This is news? People have been
scanning wireless
networks
for a long time now...
Direct from Toronto: Naked News!!!
"I have never let my schooling interfere with my education." - Mark Twain
What about properly secured public/community wireless portals that use nocatnet for user authentication? they dont use WEP as it's useless for this kind of community access point. while nocatauth does quite well at making open portals available for members.
Do not look at laser with remaining good eye.
There's a pair red pins (unsecured WAPs) on the west side of University Avenue between Dundas and Queen, right about where the US Consulate is.
-Tom Duff
It looks like two of the pins are almost in the right spot for the US Consulate (although it might be the next building up the road). Honeypot or clueless government officials?
And after you've secured your network on a higher level than OSI 1, you can be less paranoid about WEP. So much less, that some claim that DISabling WEP is not a bad thing at all. Think about it, you already have encryption taken care of, so why not make your network more stable, robust and fast by disabling WEP?
Those 'wardriving' pictures should make a distinction between "secured with WEP", "no WEP, but I cannot use the network because of IPsec/VPN/whatever" and "no WEP, and I can surf freely through it".
-Leto2
<grub> Reading
...in my head was of naked warwalkers. but, isnt it cold in toronto? just think of the shrinkage.
As the map shows, about anywhere you go in Toronto, there's open access. Since there is no crime in Canada, this is not a problem, it's a feature.
"with their freedom lost all virtue lose" - Milton
Queens Park (look on north portion of the map) is the seat of the Ontario Provincial Legislature, not an open, green space. This means that there are (or were) 2 open, non WEP (like that mattered) access points within the government offices. I really, really hope these are isolated from the internal network via firewalls - I don't want all of the info that the Ontario Government has on it's citizens (like me and my family) being broadcast for anyone to see/save/use.
Soko
"Depression is merely anger without enthusiasm." - Anonymous
With IT people in the Toronto area... here is how serious they took this map.... Several of them wanted to know if we could find the blinking red dot over their house. :(
This is a problem in just about every city. I live on a tree lined residential street in Santa Monica, CA. There's no real offices or businesses within about a half mile because I live between two public parks. I was planning on putting in a wireless network in my house so I bought a card and put it in my laptop. I was AMAZED to find that it locked right up to someone else's network immediately! I was able to browse the web, and even look at their shared files. This was true on channel after channel on the card. I can only imagine how it must be even worse in an industrial area. Now I know why my 2 Ghz spread spectrum phone has such poor range.
With all this on war driving and hacking into networks for fun or foul, we better start being careful of what we say and how we act. (be nice)
We should realize that right now we have a great oppertunity to use wireless.
If admins continue to leave networks that need to be secure open to the public they are going to get hacked -in one form or another, maybe just harmlessly syphoning bandwidth, maybe stealing private information - but something is going to happen regardless.
What I fear hear is government regulation. Right now it is the resposibility of the admin who sets up this network to make sure it is reasonably secure. If wireless hacking becomes enough of a problem, governments will be compelled to regulate wireless networks. Sure some regulation may even be good, but from my perspective what is more likely to happen is it will be regulated to death.
Whenever we are forced to regulate we get these types of results: People who want to use wireless won't be able to comply with impossible for the little guy to comply with standards - experimentation dies, soon so does innovation.
Why should admins secure their network when they can rely on a government wireless police force to go around picking up the kiddies breaking into their network? Sounds stupid? that's right it sure is, but crap like this could very well happen. -We're allowed to remail lazy.
I have a wireless lan and it's reasonably secure... It isn't hack proof - nothing is. but it is encrypted and secured and stuff and also it is on it's own network, not directly tied into my wired lan... plus there isn't information on the wireless that could be considered "secret" or personal. I want the thing to work around the house for getting that there interweb. The access point is in the basement -- a simple thing, limits the coverage of the unit a lot - just the house and parts of the yard.
I'm still looking at other ways to secure it. I found a good one the other day SHUT IT OFF WHEN NOT IN USE. (who'd a thunk it?) Why can't businesses figure this one out?? put the power cord to the thing on a timer!! not business hours? no wireless!
See the Pictures of the Flood of '08
Apparently my college (George Brown) has a naked network. I never thought in a million years I would be reading something like that on Slashdot.
I love it. Time to h4x0r my grades.
I notice one of the big red "abuse me" circles right in the middle of the U of Toronto engineering buildings, where they should know better.
I'd make snarky comments about the prof who I suspect might be running the open network, but in this case I have no strong reason to suspect it's him.
I say abuse the ignorant and we can bring back darwinism in a technological point of view. Survival of the fittest.
Outdoor digital photography, mostly in New Engl
Remember, WEP is not the be all and end all of wireless security. Just because those networks don't have WEP doesn't mean they aren't secured in another, quite possibly better, way.
Of course, they could also be totally open. No way to know without taking your laptop on a walk I suppose... let us know what you find out if you do.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
Spamming from unsecured wireless networks will be a fun form of shameless profit until people start setting up "sting" nodes that will be specially rigged so that upon detecting that they are being used by a spammer, they will photograph their license plates, call the cops, and maybe spray some hot tar and feathers for good measure.
pi = 3.141592653589793helpimtrappedinauniversefactory7
I setup a WIFI net at home recently and have found that the coverage I get inside the house is amazing. Outside it's a different story. I'm pretty sure that the aluminum siding is blocking the signal from leaving the building because I do get limited reception if I'm lined up with a window.
Basically this stops any war drivers from seeing my network unless they get really lucky and creep up to the bushes outside one of the few windows that faces the street. If they do that I'm more at risk that they see ME naked than my network!
Anybody else notice specific physical obstacles that clobber reception?
I just spoke with the COO of the IPEverywhere about this study, and confirmed that the methodology only established whether a node was running WEP (a "security measure" of dubious value).
That means that many of the "unsecured" nodes in this report may have had other means of securing themselves, from switch- or AP-based MAC filtering to captive portals such as NoCat. Moreover, the protocol for this study did not establish whether the open APs in question were handing out DHCP leases (or, indeed, whether they were connected to the Internet at all).
Finally, this study did not investigate in any depth whether the open APs were deliberately or accidentally left open. Many of us run open "community" networks around the world (I operate one in Toronto at King and Niagara, and three in San Francisco, two at 19th and Shotwell, and one on Sycamore near 17th and Mission). These networks are deliberately "unsecured" and are provided out of public-spiritedness, or even out of a political commitment to providing tools for anonymous speech on the Internet -- anonymous speech being fundamental to democratic discourse.
Since WEP is such a poor "security" measure, the best practice for wireless users is to use SSH and/or SSL tunnels to secure sensitive traffic to a proxy (either remote or on your own network). In fact, if you're a promiscuous user of any network -- conference centers, airport lounges, hotel rooms, schools, etc -- you should assume that unless your messages are encrypted, they will be sniffed on the wire.
The primary "security" concern about open wireless seems to be that a "rogue" AP will be installed behind a firewall. The firewall, of course, is hardly sufficient in and of itself for securing a network. It's based on the presumption that everyone on one side of the firewall is trustworthy, and everyone on the other side is untrustworthy. We know, though, that this is a fallacy. Getting inside the firewall -- either through physical intrusion (think of visitors to your office plugging into the the network to check mail) or virtually, by 0wning a box on the network with a trojan -- is not difficult for a determined intruder. Meanwhile, the legitimate users of your network resources are often outside your firewall (mobile execs at a client site, for example) and thus not only walled off from the rest of the network, but also vulnerable to attack, since their machines' first line of defense is the firewall, which they are suddenly out of.
Security is hard. The proper place to draw your network perimiter isn't around your office, but around each machine. Personal firewalls, regular applications of security patches, good passwords and user education provide genuine security. Firewalls (and FUD about open APs) doesn't.
The actual URL is http://www.nakedwireless.ca/winudcol.htm
;D
I work for a computer company at the corner of Bay and Dundas on the map, which has tons of red push pins. Luckily there are no nudist colonies here
-Shieldwolf
just = (My)Opinion.toCents();
Did Ashcroft help design thier logo?
"If you are on fire you can just stop, drop, and roll. If you fall into Lava you are just dead." - my 5yr old daughter
I think you would find most Torontians and Ontarians, feel differently. As for the rest of Canada's opinion about Toronto, I wouldn't know, and wonder why you would presume to. Do you always put your foot into other peoples mouths?
My friend has a Linksys wireless base station and laptop; I gave him some minimal help in setting it up in "infrastructure" (unrestricted?) mode.
Unless there is some sort of "wireless sniffer" which can detect in-use MAC addresses, and also unless the wireless NIC can modify its own MAC, restricting the Linksys base station to a specific set of MACs should be sufficient for small-system security, correct?
It would be even better if I could take a MAC from an old NE2000 10Base2 ethernet card and use that MAC, since anyone trying to guess a MAC would probably use the ranges that have been assigned to the WAN manufacturers. It would be best if this could be done under Windows (in spite of my distaste for MS).
I'm just looking for a "hosts.deny" sort of security; I don't really need encryption (and I understand that wireless encryption has been broken anyway).
Pardon me for any technical errors; I'm clueless about wireless.
I don't see any map. All I get is a couple of pictures and two plug-in boxes. Either the site is slashdotted, or it requires you to run "Naked Flash". I refuse to leave Flash enabled because of all the annoying web ads that now (ab)use it.
--
"Open source is good." - Steve Jobs
"Open source is evil." - Microsoft
Appearantly the ignorant one is you considering that the encryption is faulty anyway, why bother fooling yourself...
What really bothers me, is that I drive to work and even though the "drive clean" program has been in effect for years, I'm still seeing black exhaust comming out of trucks and cars. Or about Canadian companies like Eco Logic that have working systems to clean up hazardeous waste, yet receive no support from the government, that still incinerates garbage and pcbs. (kirkland lake area residents what out!).
Not to mention the pollutants from the coal burning electrical plants in Ontario. Let's invest a couple of million and put scrubbers on the stacks so that tons of carbon isn't spewed into the air. And oh, yes, Ohio thanks for your contributions to our haze. You're one of the dirtest states there is, but you don't notice because it blows over here.
I've considered moving just for my health's sake, at a great financial loss. Thanks to the government for giving me this option. (Die of lung cancer, or other respertory disease, or move).
I think this is a childish approach and very dangerous because of the legality of doing this, however I do understand their need to highlight this serious issue, this is clearly the wrong way.
In fact I would go so far as to say this is an unauthorised pen-test, in that part of a pen-test is in finding hosts/networks in the same way the physical location has been found, but not only found, also published.
I dont know where liability and juristiction come into play here, i'm surprised these guys/gals are prepared to go this extreme and risk finding out.
Surely a CNN interview would do their careers good and promote the issue far wider than a website could?
Sorry, I can't find the link, but with the right equipment (all consumer available) you can easy link up to any wireless network up to 40 km away.
With your sheilding they might have to be just 1 or 2 km away, which still leaves them completely hidden, and your network totally open.
If you could be told what you can see or read, then it follows that you could be told what to say or think - BoC
That would tell you there are lots of nodes, but not where they are located at street level. Your "map" would show hundreds of nodes *AT* the CN Tower since that's where you were standing when you connected to them.
1) WEP all by itself is simply not secure.
2) If you are using another form of encryption (such as IPSEC) then WEP would slow down your network without any security benefits because the data stream would be encrypted twice.
By way of example, I run a Linux server and Linux laptop. The server has a second ethernet interface that is dedicated to the wireless device. Both the laptop and the server are configured to drop all packets arriving or departing via the wireless device except for IPSEC (esp protocol and udp port 500). Forwarding in the server is only permitted from the ipsec (post-decode) interface. If someone wants to use my broadband connection then they have to break IPSEC.
And yet these guys would flag me on their map as an insecure station because I don't use WEP. Maybe they should re-make the map based on whether or not their roaming node can do more than just handshake. Like, try connecting to Slashdot or something....