Slashdot Mirror
Turning Network Free-Riders' Lives Upside Down
An anonymous reader writes "You discover that your neighbours are using your unsecured wireless network without your permission. Do you secure it? Or do you do something more fun? A few minutes with squid and iptables could greatly improve your neighbours' Web experience ..." Improve is a relative term, but this is certainly gentler than certain other approaches.
It's as much stealing as sending the signal into their home is trespassing.
I think you just shake your head at your failure to secure it in the first place, decide if you care, and if you do, lock it down.
Funny way to deal with it, though.
Improve is a relative term, but this is certainly gentler than certain other approaches.
I don't really see the point. It's funny as a practical joke. In terms of protecting your network... why not just secure it instead?
It's impossible to steal unprotected wifi. If you leave your connection unprotected, that means you are purposely sharing it. Although flipping the pictures upsidedown is pure genious.
If, on the other hand, you simply mangle the images that (s)he's looking for, then you could say that you're protecting the kid from nasty content.
It's not like you have a contractual responsibility to deliver something that (s)he never asked or paid you for.
Sometimes boldness is in fashion. Sometimes only the brave will be bold.
I chose to leave my wireless network open so that if someone nearby needed a connection it would be available for them. If someone was to impose an unreasonable load on the network I might do something about it but so far (12 months) I've had about half a dozen people connect and download relatively small amounts of data - my guess is they were checking email. Why would I object to that? No . . . why would *you* object to that? The way I see it it's a chance to do something nice for other people, why not get yourself some good karma.
I've lived in two places where I set up my access point with no encryption. In both places, I've fired up iTunes to see someone else sharing music on my LAN. This didn't bother me until I read the name of the share: "(name)'s LimeWire Tunes."
I don't mind if people want to check their e-mail on my WAP. I do mind when they idle on file sharing services, using lots of bandwidth and exposing me to potential legal liability.
It's a shame that I have to protect my router somehow, especially because one of my devices (a Nintendo DS) doesn't support WPA at all.
For more information, click here.
by leaving it open he is inviting other people to connect.
Some computer says to the router "Hey, can I come in?" and the router says "Sure". Now, the moment you put something up, like needing a password, then you are no longer inviting people in.
Computer says "Hey, can I come in" router says "Sure, if you know the password."
Or you can encrypt it
Computer says "Hey, can I come in?" the router says "KE*jd7638JDEJE*834899(&^&#nd&#&bd*e#"
The Kruger Dunning explains most post on
Network freeloaders put themselves at risk... It would be trivial for someone to set up a "Free Internet" wireless AP and then run phishing attacks, sniff IM conversations, e-mail, etc. Considering how little the average internet user even pays attention to SSL, one could very easily imitate a bank, ebay, paypal, etc... One should certainly think twice before freeloading on someone's wireless network - and if you do, at least tunnel your connection securely (even socks5 over an SSH tunnel, etc)..
Conversely, if you find someone else's unsecured wireless network, why would you complain if they decided to flip all the images?
No, it's not implied. As the law stands, it's illegal unless you get something more explicit in terms of permission. Yes, illegal. Yes, people have lost in court. No, not civil court, criminal.
(And it makes sense that no implied permission is given by simply having your router be unsecured, given "unsecured" is the default configuration of most off-the-shelf routers.)
It really isn't an issue in practice. If you want to use someone else's network, all you have to do is ask them. With 802.11, you're close enough to be able to do so. There's no reason not to ask, other than knowing that "no" is likely to be the answer. And I think that's why people tell themselves the myth that somehow they have implied permission simply because the "door" was left unlocked.
You are not alone. This is not normal. None of this is normal.
The analogy is not flawed. So the router is "visible", with an option to make it invisible. Big deal. My garden is visible from the street, but I can put a tarp around it to obscure its existence. What you are saying is that, unles I put a tarp up around my garden, everyone has a right to use it.
Wireless networks may make themselves conspicuous, but that does not confer an invitation to use them. The connection between "visible" and "inviting" is not legally or morally valid. (I am excepting the concept of "attractive nuisance", but I don't think open routers will come under that area of liability)
"As God is my witness, I thought turkeys could fly." A. Carlson
Yeah, that's what I do too. My neighbors also have open access points mostly. I check the logs every so often, but I've never seen anyone but me having connected. Still, if someone wants to check their email, it's there. I don't have a problem using open points to check mail while I'm travelling, might as well return the favor. I'd lock it down if someone were leeching 24/7, but I don't see any of my neighbors doing that.
Unfortunately, not everyone is as kind (or patched/anti-virus'ed/etc.) as your neighbors are.
:)
I spent three years as an abuse admin at an ISP, and spoke with a number of customers where the only likely culprit for an abuse complaint was someone "borrowing" their Wi-Fi connection (nmap is a wonderful tool for finding likely infections/file sharing clients). In almost all of these cases, securing the Wi-Fi access point made the problem go away.
It's possible that my customers were lying and that they just latched on to the Wi-Fi excuse to get me off their backs, but after three years, it (usually) wasn't too hard to tell when someone honestly had no clue and when they were covering up
So *that's* why I object to people using my Wi-Fi without permission.
MCSE? No, sir...I don't do Windows. Yes, I am an idealist. What's your point?
Even something as amorphous as bandwidth is a limited resource. To paraphrse the head of the commerce committee, an open wireless connection is not a dump truck you can just load up with as much as you like; it's a tube!
Sure, if you want to make sure nobody uses your tube, you should protect it. But just because you don't doesn't mean you're giving explicit permission. If I leave my bike on my front lawn without a lock and someone steals it--even if they give it back before I notice it was gone--it's still theft.
The CB App. What's your 20?
Your router is giving them permission to associate, is providing them with an IP address, and is allowing them to pass traffic. Heck, I'm guessing your AP is even broadcasting its SSID and telling people its available for them to connect to. When the client associates it acts just like a web page request, it says "Hey, can I connect here?" and if your router replies with a "Sure thing!", then as far as I'm concerned you've given them permission to use your network. If you don't want strangers using your Internet, you've got TONS of options, turn off DHCP, use WEP, use WPA, limit access only to those MAC addresses you approve, turf off SSID broadcast. Obviously some of these offer better security than others, but ANY of these will prevent a casual user from using your network.
You've got two problems you've overlooked. If someone uses your connection for illegal activity (downloading Meet the Fockers, kiddie porn) it will be your IP address that the RIAA/MPAA/FBI will trace. Good luck convincing them it wasn't you. You might be able to do it, but it will take up time and money (lawyers) to clear your name. And in the case of kiddie porn or other criminal act, expect every computer, PDA, and cell phone in your home to be confiscated to be analyized for incriminating data. The second problem is you are allowing strangers access to not only your Internet connection, but also your LAN. I have multiple computers and put files in shared folders so I can access them from different machines. I don't want some strange to have access to those files, or worse, have their computer be infected with a worm/virus that propogates across the network.
What you are saying is that, unles I put a tarp up around my garden, everyone has a right to use it.
No, actually we're saying that if your garden pelts us with carrots and peas as we walk past on the public street, we're at liberty to catch them and consume them. Only if you place anti-vegetable-flight netting around your garden (or stop planting vegetables that lend themselves to comparison to an unsecured WAP) does it become incumbent upon us to behave as good citizens.
Hey! Analogies are fun! Somebody compare Internet privacy law to hunting and fishing licenses!
Finally modding someone offtopic when they rant about what "Begging the Question" means: priceless.
This line gives me chills. He's passing a completely unsanitized input (the bandwidth thief's URL) to a system() function.
At least he didn't concatenate everything so that system() would run the entire string as a shell command.. then simply adding a semicolon or pair of backticks to the url would cause the system to run any command the attacker liked, including deleting all files squid has access to and running a custom backdoor. There are a lot more local root-escalation flaws than remote.
Even without the shell character vulnerability, who knows what kind of failures you can induce out of wget given the right parameters. He should sanitize the URL before passing it out.
There's also the possibility of a vulnerability in mogrify, given the right corrupted image file to work on. Mogrify should be run in a separate user account that has no access to anything other than the input file.
Never trust your input, especially from an already-admitted evildoer.
Yes, I'm paranoid - I work in information security. :)