Two Wheeled Wi-Fi Sniffing Robot

paulnuyu writes "ZDNet/MSN has an article about a robot that detects Wi-Fi vulnerabilities and intrusions. The two wheeled robot made by the Shmoo Group cruised around the DefCon convention in Vegas last Sunday, picking up telnet and POP passwords. Though still a prototype, the shipping version is projected to have autonomous steering capabilities."

Comments

Use?

[Radon Knight]

Could someone explain just why this is useful? Sounds like a terrible waste of robotics to me.

Re:Telnet and POP?

[jc42]

If anyone is still using plaintext to send passwords over their lan they are insane.

Well, a lot of people don't have any choice. Our cable ISP here, for example, provided the usual email accounts, and for a lot of customers, that is their only email. If you use it, you have no choice other than POP, and I haven't seen anything in several mailers that talks about encrypting the passwords. Our ISP doesn't actually block port 25, so you could run your own mailer. This isn't feasible for most customers, though, for several reasons. One is the dynamic IP addresses and insane hostnames. I've fixed that by using one of the many independent registration services, but to most customers, that would be utterly baffling and unusable. Another problem is that running your own email server is in fact in violation of the TOS in the ISP's contract, and they can legally block your port(s) or kick you off entirely at any time, without warning or recourse.

So for most non-geek customers, unencrypted POP passwords are the only option. There's probably no way they could even learn from the ISP that there's a problem; they certainly wouldn't get (or understand) any advice on how to fix it.

(Myself, I use an account at a school. It has been stable and usable for over 15 years now, unlike commercial email accounts that force you to change your address every 6 months whenever there's a merger, buyout, or corporate renaming. And I can use a plain-text mail reader, eliminating all problems with virii, worms and the like. But I'm not sure I'd recommend this to the typical non-geek.)

Make it a standard

[segment]

With all these insecurities over protocols not using any form of SSL you would think companies after so much time would have made it a default issue to run these protocols securely. How hard would it be for the developers of BSD/Linux/*Nix to change the settings on this. Well actually someone should create a sort of "Trust" repository for sites that don't know how to set up SSL and the likes. (e.g. the millions of mom and pop shops on the net) and perhaps charge them for securing their data.

I know Verisign and others offer services like this often at a high rate but perhaps the initiative can be funded by governments participating in some W3 standard to secure transactions.