Slashdot Mirror
Turning Network Free-Riders' Lives Upside Down
An anonymous reader writes "You discover that your neighbours are using your unsecured wireless network without your permission. Do you secure it? Or do you do something more fun? A few minutes with squid and iptables could greatly improve your neighbours' Web experience ..." Improve is a relative term, but this is certainly gentler than certain other approaches.
I chose to leave my wireless network open so that if someone nearby needed a connection it would be available for them. If someone was to impose an unreasonable load on the network I might do something about it but so far (12 months) I've had about half a dozen people connect and download relatively small amounts of data - my guess is they were checking email. Why would I object to that? No . . . why would *you* object to that? The way I see it it's a chance to do something nice for other people, why not get yourself some good karma.
I've lived in two places where I set up my access point with no encryption. In both places, I've fired up iTunes to see someone else sharing music on my LAN. This didn't bother me until I read the name of the share: "(name)'s LimeWire Tunes."
I don't mind if people want to check their e-mail on my WAP. I do mind when they idle on file sharing services, using lots of bandwidth and exposing me to potential legal liability.
It's a shame that I have to protect my router somehow, especially because one of my devices (a Nintendo DS) doesn't support WPA at all.
For more information, click here.
Network freeloaders put themselves at risk... It would be trivial for someone to set up a "Free Internet" wireless AP and then run phishing attacks, sniff IM conversations, e-mail, etc. Considering how little the average internet user even pays attention to SSL, one could very easily imitate a bank, ebay, paypal, etc... One should certainly think twice before freeloading on someone's wireless network - and if you do, at least tunnel your connection securely (even socks5 over an SSH tunnel, etc)..
No, it's not implied. As the law stands, it's illegal unless you get something more explicit in terms of permission. Yes, illegal. Yes, people have lost in court. No, not civil court, criminal.
(And it makes sense that no implied permission is given by simply having your router be unsecured, given "unsecured" is the default configuration of most off-the-shelf routers.)
It really isn't an issue in practice. If you want to use someone else's network, all you have to do is ask them. With 802.11, you're close enough to be able to do so. There's no reason not to ask, other than knowing that "no" is likely to be the answer. And I think that's why people tell themselves the myth that somehow they have implied permission simply because the "door" was left unlocked.
You are not alone. This is not normal. None of this is normal.
Unfortunately, not everyone is as kind (or patched/anti-virus'ed/etc.) as your neighbors are.
:)
I spent three years as an abuse admin at an ISP, and spoke with a number of customers where the only likely culprit for an abuse complaint was someone "borrowing" their Wi-Fi connection (nmap is a wonderful tool for finding likely infections/file sharing clients). In almost all of these cases, securing the Wi-Fi access point made the problem go away.
It's possible that my customers were lying and that they just latched on to the Wi-Fi excuse to get me off their backs, but after three years, it (usually) wasn't too hard to tell when someone honestly had no clue and when they were covering up
So *that's* why I object to people using my Wi-Fi without permission.
MCSE? No, sir...I don't do Windows. Yes, I am an idealist. What's your point?
What you are saying is that, unles I put a tarp up around my garden, everyone has a right to use it.
No, actually we're saying that if your garden pelts us with carrots and peas as we walk past on the public street, we're at liberty to catch them and consume them. Only if you place anti-vegetable-flight netting around your garden (or stop planting vegetables that lend themselves to comparison to an unsecured WAP) does it become incumbent upon us to behave as good citizens.
Hey! Analogies are fun! Somebody compare Internet privacy law to hunting and fishing licenses!
Finally modding someone offtopic when they rant about what "Begging the Question" means: priceless.
This line gives me chills. He's passing a completely unsanitized input (the bandwidth thief's URL) to a system() function.
At least he didn't concatenate everything so that system() would run the entire string as a shell command.. then simply adding a semicolon or pair of backticks to the url would cause the system to run any command the attacker liked, including deleting all files squid has access to and running a custom backdoor. There are a lot more local root-escalation flaws than remote.
Even without the shell character vulnerability, who knows what kind of failures you can induce out of wget given the right parameters. He should sanitize the URL before passing it out.
There's also the possibility of a vulnerability in mogrify, given the right corrupted image file to work on. Mogrify should be run in a separate user account that has no access to anything other than the input file.
Never trust your input, especially from an already-admitted evildoer.
Yes, I'm paranoid - I work in information security. :)