Queensland Police to Look For Unsecured WiFi Spots

OzPeter writes "As a part of National Consumer Fraud week, the Queensland Police are going war driving in order to identify insecure WiFi setups. From the press release: 'The War Driving Project involves police conducting proactive patrols of residential and commercial areas to identify unprotected connections. Police will follow this up with a letterbox drop in the targeted area with information on how to effectively secure your connection.' While some people may like having an open WiFi AP its interesting to see that the Police also feel that 'Having WEP encryption is like using a closed screen door as your sole means of security at home. The WPA or WPA2 security encryption is certainly what we would recommend as it offers a high degree of protection.'"

Comments

Just incase you want to jump on board.

[zippo01]

http://www.wardriving.com/code.php

Re:Just incase you want to jump on board.

[oztiks]

And the fact that maccas boast free wifi isn't a concern at all?

Re:Just incase you want to jump on board.

[crafty.munchkin]

I'm just so glad that the Queensland Police have solved all the outstanding crime and corruption within their ranks, in their fair state! Hopefully I'll be receiving a call soon about my entire worldly possessions which were stolen in 1995 during the brief 8 months I lived there. Oh yeah, fat chance.

I pity the poor guys who are on tech support for the cops.

Re:Just incase you want to jump on board.

[pbjones]

and like their burgers, it's crap!

How times have changed

[Aaron B Lingwood]

Merely 15 years ago I was doing the exact same thing and have been, on umpteen occasions, questioned, detained, given a 'move on' notice or just generally harassed.

Re:How times have changed

[davester666]

Being able to flash a badge lets you get away with murder...why would wardriving be on the do-not-do list?

Re:How times have changed

[backwardMechanic]

I expect you will receive a certain amount of harassment from the police if you try to arrest and jail somebody too.

Re:How times have changed

[Anonymous Coward]

LOL, you failed hard.

Re:How times have changed

[Aaron B Lingwood]

Yeah. Bloody zippo01 with his +5 Informative.

Re:How times have changed

[mcgrew]

I wonder why you got downmodded? It's a true statement. In fact, sometimes you don't even need a badge, just be on the neighborhood watch.

Re:How times have changed

[cpu6502]

Probably the cops will take this opportunity to arrest a few people for various "crimes" like looking at nude images ("This website may say the girl is 18, but she LOOKS like a child to me. That's a crime in Australia") or downloading movies/songs or whatever else they see you doing on your Wifi internet.

Re:How times have changed

[Grishnakh]

Bullshit.

Even in the Old West, the law was basically that you couldn't shoot an unarmed man, period. If he was unarmed and you shot him, you were hanged. There was only justification for deadly force if the other party had the capacity to also use deadly force.

According to your moronic logic, all I need to do is go find some guy walking down the street I don't like, walk up to him, shoot him in the head, and then claim that he "attacked" me. As long as there's no witnesses to deny my story, I get to walk away scot-free. How about you post your address, so that I can do this to you?

It's Basic Infrastructure

[mdm42]

I have an open Wifi setup. My attitude is that connectivity has become basic infrastructure, and all "lock it down" freaks have just bought into the agenda of ISPs who don't want us to share bandwidth to boost their own profits.

If you're a guest in my home, you're welcome to use the bandwidth, along with the lights and water. Can you imagine visitig a friend only to be told, "Look, here's the PIN code to unlock the lights, and here's the key in case you want to wash your hands." Ridiculous. I accept that there's a risk of someone lurking in their car outside the property boundary to leech off my internet connection, but there's a risk of someone stealing water from my outside, unprotected taps, too. OTOH, if bandwidth were shared freely everywhere there'd be no need to sneak around "stealing" it, would there?

It's the 21st Century, man. Get over it!

Re:It's Basic Infrastructure

[Anonymous Coward]

I'd be more worried about an identity thief stealing data than a passerby leeching bandwidth. Easier to just wall it off. FWIW, we just post the password on the fridge, so our actual guests can use it if they want.

Re:It's Basic Infrastructure

[Anonymous Coward]

I have an open Wifi setup. My attitude is that connectivity has become basic infrastructure, and all "lock it down" freaks have just bought into the agenda of ISPs who don't want us to share bandwidth to boost their own profits.

As I have previously pointed out, this approach has the additional benefit that, should you be accused of any criminal wrongdoing based on where your IP address, you can more easily raise a reasonable doubt that it was you who left the tracks. I'm not saying that leaving your WiFi open is going to get you off the hook, but the more you lock down your modem, the easier you make it for a potential prosecutor to pin the wrap on you

Re:It's Basic Infrastructure

[Anonymous Coward]

Fon router project allows this.
you share 10% of your bandwidth on the open guest SSID, which is on a separate WLAN from yours.
Good if you have couch surfers stay allot too.

I agree that everyone locking down their wifi is just get sucked into the fear mentality. If all routers shared a small amount of their bandwidth you would not need to use GSM, and could make calls from almost anywhere using Viber for example or another SIP like service.
The mobile phone companies would also be forced to provide a better service because there was another alternative available when your mobile.

It maybe also be that the opens source routers like Tomatos USB offer multiple SSID's

Ged

Re:It's Basic Infrastructure

[gl4ss]

I have an open Wifi setup. My attitude is that connectivity has become basic infrastructure, and all "lock it down" freaks have just bought into the agenda of ISPs who don't want us to share bandwidth to boost their own profits.

that's the problem when the wide area wireless isp's and local cabled isp's are the same entity.

Re:It's Basic Infrastructure

[Aaron B Lingwood]

My attitude is that connectivity has become basic infrastructure

I concur. I would like to see connections open everywhere with the option of limited surfing as Guest (should the host feel generous) or having to authenticate to my ISP (or the NBN or some central authority/network) through this random open connection, and have all usage billed to my account.

Re:It's Basic Infrastructure

[Anonymous Coward]

Unfortunately the ISP cartel in Australia charge like wounded bulls and most (all?) plans are capped, so if your neighbour decides they like your connection you can burn your plan with ease.

Guests in my home are also welcome to use my WiFi - let me type the password in for you.....In the same way I give them the spare key and travel pass.

Re:It's Basic Infrastructure

[Errtu76]

Exactly!

Mine is encrypted though with 'acomplicatedpassword' which is very easy to type so I never get the odd looks I get whenever someone asks me for the passphrase.

Re:It's Basic Infrastructure

[hawkinspeter]

What I do is use a WPA2 network that all my devices use and an open network for guests to use that is firewalled from accessing the other network. That gives me the best of both worlds.

My attitude is that if I'm out and about and want to get WIFI, I'd like other people to provide open guest networks, so it makes sense for me to provide one for other people to use.

Re:It's Basic Infrastructure

[Chrisq]

I'd be worried more about the fact everything you send over wireless may not be encrypted...

But all the important stuff is over SSL/TLS anyway

Re:It's Basic Infrastructure

[hawkinspeter]

Use HTTPS Everywhere https://www.eff.org/https-everywhere/> and make sure that any confidential data is over https and then it doesn't matter that the WIFI is un-encrypted.

Re:It's Basic Infrastructure

[Anonymous Coward]

Or someone using your connection for downloading illegal content (pirating DVDs, music etc, or worse things such as child pornography) completely anonymously because when they track you down they find you not the guy in the car outside.

Re:It's Basic Infrastructure

[mvar]

You should be more worried if someone uses your WiFi internet connection to do something illegal. Next moment the cops will be raiding your house, seizing all your hard drives for further examination, while you go through all the hell of the legal process attempting to prove that you are not an elephant. No thanks, if a guest wants to access my wifi he should ask for the password and take the extra 30 seconds needed to type it in.

Re:It's Basic Infrastructure

[im_thatoneguy]

I have an open Wifi setup. My attitude is that connectivity has become basic infrastructure, and all "lock it down" freaks have just bought into the agenda of ISPs who don't want us to share bandwidth to boost their own profits.

Screw the ISP I don't want my cheap-ass neighbors slowing my Netflix down to a crawl while they download 10 seasons of some anime shit.

If we all "had internet" and people stuck to HTTP web traffic I wouldn't care. But I've had roomates before--hell I have myself as a roomate and I know that my internet is not big enough for the both of me from time-to-time let alone neighbors.

If I had a gig-e pipe they could be free to do as they please but I don't pay for my apartment building's electric bill, I pay for mine. And based on the fact that I can't even leave my laundry detergent on my little spot of shelf in my apartment building without it being used up in a couple weeks (and 2 loads of laundry from me) I know if they could secretly plug their water into my tap they would.

If I'm playing TF2 I expect there to be 0 torrenting and streaming on my connection so that my pings stay reasonable. It's bad enough knowing if one of my computers found an 'interesting' RSS feed let alone having two moochie neighbors.

Re:It's Basic Infrastructure

[VortexCortex]

I have an open Wifi setup

I have a SSL Strip and other ARP Poisoning MITM Attacks. What's your home address?
Do you ever buy anything online? Would you like any script-kiddie to see AND MANIPULATE everything you do online?

Here's some advice for you ignorant folk who insist on leaving their WIFI insecure: Turn on WPA. This defeats ARP Poisoning via per client encryption keys. WAIT! Hold your uneducated retorts for just a second: Set the password to "Welcome" and the SSID to "Password is Welcome". You can stencil "Our WIFI password is 'Welcome'." on a sign in the yard if needed, but the SSID broadcast should be more than enough. Get the teenager down the street to configure your network if you don't know how to RTFM and configure the router.

Take the time to share free WIFI the right way, or not at all.

Re:It's Basic Infrastructure

[BurningFeetMan]

You obviously don't have a bus stop outside of your house! Waiting for the bus is great when you've still got one bar of reception from your home wifi. ;)

Re:It's Basic Infrastructure

[Anonymous Coward]

As I have previously pointed out,

Bruce Schneier has pointed out, you mean....

this approach has the additional benefit that, should you be accused of any criminal wrongdoing based on where your IP address, you can more easily raise a reasonable doubt that it was you who left the tracks.

Yes, you can... as part of your legal defense at your trial.
Reasonable Doubt is what a Jury has to overcome to convict you. Reasonable Suspicion is all the cops need to get a warrant... and if your wifi is open that's a good enough reason to kick down your door without asking questions at 3AM and confiscate all your gear.

A guy like Bruce would get a polite request, maybe a phone call or an email, from the cops to send them copies of all his security logs, so that they could catch whoever used his open wifi.

Besides, Bruce also said the rest of your network should already be secured. In which case, the wifi security is weak enough to not be worth wasting time over since your existing multi-layered model takes care of everything already.

Re:It's Basic Infrastructure

[Anonymous Coward]

Bruce Schneier has pointed out, you mean...

No I meant me, right here on Slashdot a year or two ago. I doubt I was the first, nor will I be the last.

Reasonable Doubt is what a Jury has to overcome to convict you.

Thanks for that dude, but I kinda picked that up at law school. ;)

Reasonable Suspicion is all the cops need to get a warrant... and if your wifi is open that's a good enough reason to kick down your door without asking questions at 3AM and confiscate all your gear.

In your jurisdiction perhaps, but in mine (not QLD but close) a warrant won't issue merely on the basis of an open WiFi, there needs to be reasonable grounds to suspect an offence has been committed. Or did you mean, already holding the warrant, they will kick your door down because your WiFi is open? That too is unlikely. Having secured the warrant, the state of your WiFi is pretty much immaterial to how they will go about executing it. It goes without saying that if you have incriminating data on your gear, leaving your WiFi open pretty much useless.

A guy like Bruce would get a polite request, maybe a phone call or an email, from the cops to send them copies of all his security logs, so that they could catch whoever used his open wifi.

Which, of course, he would refuse.

Re:It's Basic Infrastructure

[Anonymous Coward]

Me too. And that's why I think what the Queensland police is doing is sort of OK. I don't want to use someone's Wifi if the they don't mean to leave it open. My stance is that an open network is open to everyone, practically, legally and morally, because it uses a public resource, advertises itself as open and in no way gives any indication that it is not meant to be open, even though that is trivially easy to do. People who don't want strangers on their Wifi should turn on encryption, and if that's what the police tells them, then I'm fine with it. I have a hunch that the police will do quite a bit of fearmongering on top of that, and that's not OK. But I don't want to step on people's toes when I use someone else's Wifi, so if you don't want me there, put up the virtual fence.

Re:It's Basic Infrastructure

[Stalks]

A linux box, iptables experience and a couple of WiFi cards/AP would be ideal, however there is an easier way..

Your ADSL/Cable router plugged into your ISP offers unprotected WiFi.

Buy another cable router and plug it into the above router offering protected WiFi behind its own NAT/Firewall.

Internet <--> ROUTER <--> ROUTER <--> LAN

Re:It's Basic Infrastructure

[N!k0N]

A linux box, iptables experience and a couple of WiFi cards/AP would be ideal, however there is an easier way..

Your ADSL/Cable router plugged into your ISP offers unprotected WiFi.

Buy another cable router and plug it into the above router offering protected WiFi behind its own NAT/Firewall.

Internet <--> ROUTER <--> ROUTER <--> LAN

yep, pretty much this. Just takes a little fighting to get things playing nice (i.e. tomato/ddwrt ... but you were gonna do that anyway, right?) Only thing you have to do then is make sure your devices aren't on the public one. Granted, it's also a good idea to limit the public ap, so people can't saturate your connection...

Re:It's Basic Infrastructure

[Anonymous Coward]

That doesn't help at all. A shared secret can only prevent shenanigans if it is kept secret among trusted entities. A public secret isn't a secret and can therefore not be used for authentication. An attacker could set up a relay mimicking your access point and do all the packet mangling they want.

If you wanted to do this right, you'd have to set up public key cryptography based access point authentication. There is no easy and free way of doing this though.

People who use some random stranger's network should always consider the network hostile. The attacker might not be the neighbor's kid who exploits people who use your access point. The attacker might be you, who provides the access point.

Re:It's Basic Infrastructure

[cmdr_tofu]

Not that i've rtfad or anything but i think isps in au and nz have metered charge systems. so if a neighbor uses your bw, you pay. They have every incentive to use your bw instead of their own (raising your bill).

Here in usa, i have no security on my wifi either, but it only grants access to my lan. To use the internet, openvpn is required. I usually relax that for guests as i cannot support every client.

Re:It's Basic Infrastructure

[cmdr_tofu]

"is your password a complicated password?"
"no its simple"
"what is it"
"acomplicatedpassword"
"i thought you it was simple" ...

Re:It's Basic Infrastructure

[Anonymous Coward]

By everyone locking down their wifi you provide credibility to the claim that an IP equals a perpetrator.

If I were to say, brute force your WPA2 using my graphics card, you would have a harder time making your case than if your wifi was open and it could have been anyone.

I care more about protecting the innocent than persecuting criminals I guess.

Re:It's Basic Infrastructure

[complete loony]

... and have all usage billed to my account.

I believe that the 802.11ai working group is working towards that goal.

Re:It's Basic Infrastructure

[Anonymous Coward]

My neighbor did this for about 2 weeks till they discovered that i use a lot more bandwidth then them. It took 3 months before it came up in conversation where he talked about some punk kid maxing out his internet pipe. I just smiled and agreed that those punk kids need to cut it out. :P Sure that can be easily fixed by limiting the guest network bandwidth but not every user or router allows/knows how to do this.

it was nice though to use two separate networks for torrents.

Re:It's Basic Infrastructure

[neo8750]

Some routers come with it out of box. I know netgear makes one i dont know the model sorry

Re:It's Basic Infrastructure

[neo8750]

The mobile phone companies would also be forced to provide a better service because there was another alternative available when your mobile.

I doubt this i see them just making it easier to make calls off wifi and claiming its a cool new feature.

Re:It's Basic Infrastructure

[rwhamann]

Almost all the newer Netgear N models have this - my WNDR2000 and WNDR3700 (WNDR37AV) both have it. Even if you don't, how many of us have a B or G stuck in a box in the garage that we could use to add another zone?

Re:It's Basic Infrastructure

[Anonymous Coward]

WOOSH

Re:It's Basic Infrastructure

[eyenot]

I think you're right.

The ISP model is based on net scarcity, isn't it? We're talking about the internet, something which many people today might just take for granted in that it has not always existed.

The relative scarcity of ways to get online was, at one point in time, a profitable market. You could take advantage of that scarcity and charge people to get online.

But it's a corrupted and oppressed market, much like the diamond trade. Consider the whole DSL thing. The phone companies didn't win the war against 14.4 (when they wanted subscribers to start paying more for 'data usage') and things kept going until 56kbps and the next iteration up in baud (I seriously can't remember.) Suddenly any modem that came next was part of their DSL wrapper / profit scheme.

So what we end up seeing are projects to create free wifi for the entire city get tagged by ISPs, phone companies, and cable companies (there's actually a lot of money and political power concentrated in those three) as "the enemy" and the funding or the public interest never shows up.

I think it all generates the wrong attitude about the internet. There's no reason to require that a wireless network is secure. The only people it hurts are those who have to ultimately share the bandwidth.

Cops could argue all day long about, people using it as a gateway to hacking and so on, and frankly, cops and their legislator lapdogs don't know anything about the internet. Just as there is no real security on the internet, and no real identity, the inescapable future for these various net-related laws is that they are all going to be broken increasingly until they are broken constantly, and enforcing them will become increasingly expensive until it becomes an unacceptable expense to the public.

Re:It's Basic Infrastructure

[jo_ham]

Apple's 4th and 5th gen Airport Extreme routers also have this. Pretty much all of the higher-performance dual band routers include it now.

The saucer-shaped Linksys ones also offer it.

Re:It's Basic Infrastructure

[thePowerOfGrayskull]

Indeed. People seem to think that leaving it open will be sufficient defense -- either glossing over or ignoring the fact that their equipment will be seized under warrant well before the authorities start asking questions that might reveal this defense. Ultimately the lack of offending content will be what saves them - not the fact that their APs are open.

Re:It's Basic Infrastructure

[BeardedChimp]

Then just set it up with your own encrypted wireless connection having better QoS, and that the open and free wireless connection has a leaky bucket approach to bandwidth that prevents anyone from abusing it.

Re:It's Basic Infrastructure

[synapse7]

Why do you need two routers? Segment a guest ssid.

Re:It's Basic Infrastructure

[Geeky]

BT's latest offering in the UK has this built in. You basically have two separate wi-fi access points built in to the router, one sort-of public, one private.

If you're a BT customer, and opt-in to share your public wi-fi, you get to use anyone else's when you're out and about - the idea being that if they have a sufficient customer base you'll always be in reach of free wi-fi access.

They don't actually make clear in their documentation whether the public access point contributes to your download limit (if you have one), but I'd assume it wouldn't otherwise who in their right mind would sign up?

Re:It's Basic Infrastructure

[realityimpaired]

Or if your existing router doesn't support a guest wifi network, flash it with Tomato, DDWRT, or any of the other after-market firmwares that do....

A growing number of off-the-shelf wifi routers support guest wifi networks out of the box, though.

Re:It's Basic Infrastructure

[hawkinspeter]

But there wouldn't be any evidence of wrongdoing on your PC, so they'd have to get some more evidence. IP addresses do not correspond to people - you need more than just a log entry to convict someone.

Re:It's Basic Infrastructure

[morgauxo]

I want to agree but I don't feel like going to prison when somebody parks their car out front and downloads their daily dose of kiddie porn.

Re:It's Basic Infrastructure

[realityimpaired]

Here in usa, i have no security on my wifi either, but it only grants access to my lan. To use the internet, openvpn is required. I usually relax that for guests as i cannot support every client.

No offense, but you're nuts... You'd be safer opening up free access to the Internet, and segregating your LAN onto a separate VLAN that requires a password. Most people who "steal" wifi just want free access to the Internet, but there's a few who would quite happily make use of your LAN instead.

You could also use a captive portal, if you want to keep the wifi unencrypted. They're fairly easy to set up.

Re:It's Basic Infrastructure

[hawkinspeter]

The answer is 2 networks. One open and advertised with no access to other devices, and the other WPA2 (hidden if you like) and secured. You can throttle down the open one if you get any bandwidth problems.

Re:It's Basic Infrastructure

[Errtu76]

Glad you got it ;)

Re:It's Basic Infrastructure

[alphred]

Yes, but in order to discover that there is nothing on your PC, the police will break down your door, search your house and remove all computer-related devices that they can find. After a few months in their possession, and a thorough search of the contents, they will conclude that you must have hidden the illegal content on a thumb drive or some other device that they must have missed. In the meantime, your name and details of the search incident will have been released to the local press and the court of public opinion will have already reached a verdict of guilty that you and your family will have to live under forever. Lack of evidence in this case is not the same as innocence.

Now, this scenario may or may not be likely, but you do have to ask yourself if it's worth it to have an open connection.

Re:It's Basic Infrastructure

[halcyon1234]

I do like this idea, but I worry that it'll breed a whole new vector for phishing. Put up a wifi spot with a fake login page, and collect the accounts of "roaming wifi" users. Then use their airtime elsewhere, or worse-- make it seem like they've connected OK, but keep a MITM to sniff all their traffic.

Re:It's Basic Infrastructure

[betterunixthanunix]

You probably would not go to prison. The prosecutor would basically have no evidence (assuming you do not have child pornography on your hard drive), and you would have all the reasonable doubt in the world due to your open wifi access point. Now, the difficulty with this approach is that you need to have nothing incriminating in your home; when the police show up and see a bong sitting on your table, they'll just add that to the charges against you.

Re:It's Basic Infrastructure

[garyoa1]

Well, problem if you live in an area that has say... 1000 people on line. You end up with them all dropping their service and everyone using your wifi. (Which would obviously make it quicker for you to write a letter and send it via snail mail)

And how does the ISP stay in business with only one paying customer?

Re:It's Basic Infrastructure

[Dcnjoe60]

A guest in your home is fine. Of course, even with WPA2, as a guest you can give them the password. Then again, you take responsibility for a guest in your home. What if your neighbor's kid uses your intentionally free access to do something illegal, like child porn. Are you not then contributing to the activity? In addition, the authorities are going to come after you, because it is your IP address they will have.

Now one may argue that they were not a party to the activity, just like an ISP is not a party to it, however, unless you are registered and operate as an ISP, then you lose that argument.

It seems that your position, while laudable, is also very naive, It puts you and your family at an unnecessary risk.

Re:It's Basic Infrastructure

[Dcnjoe60]

What I do is use a WPA2 network that all my devices use and an open network for guests to use that is firewalled from accessing the other network. That gives me the best of both worlds.

My attitude is that if I'm out and about and want to get WIFI, I'd like other people to provide open guest networks, so it makes sense for me to provide one for other people to use.

Restricting your network to specific MAC addresses would be a good protection, too. As for wanting WIFI when you are out and about, there are data plans for that.

Re:It's Basic Infrastructure

[Dcnjoe60]

By everyone locking down their wifi you provide credibility to the claim that an IP equals a perpetrator.

If I were to say, brute force your WPA2 using my graphics card, you would have a harder time making your case than if your wifi was open and it could have been anyone.

I care more about protecting the innocent than persecuting criminals I guess.

That approach does not hold up in court, at least in the US. For instance, you have an open WIFI connection that someone uses to download child porn. You claim, but I didn't download the porn, somebody else did. That is true, you only distributed it, since it did flow to your device and then out again. Not a very smart strategy, if you ask me.

Re:It's Basic Infrastructure

[hawkinspeter]

On the other hand, if you're on an unlimited broadband deal, you can't bank unused bandwidth, so you might as well let other people use it (with appropriate QOS so that they don't cause a problem with your own access).

I refuse to bow down to the idea that an IP address resolves to a person. If you've got a log somewhere with an IP address and some "illegal" file, you've got to prove that it was me. It's easy to fake logs and typically ISPs don't perform security checks on their workers. If you accept that you have responsibility for anything done with an IP address that was assigned to your router, then you open yourself up to all kinds of spoofing attacks. They need proof, not just an IP address log.

Re:It's Basic Infrastructure

[ZiakII]

By everyone locking down their wifi you provide credibility to the claim that an IP equals a perpetrator.

If I were to say, brute force your WPA2 using my graphics card, you would have a harder time making your case than if your wifi was open and it could have been anyone.

I care more about protecting the innocent than persecuting criminals I guess.

That approach does not hold up in court, at least in the US. For instance, you have an open WIFI connection that someone uses to download child porn. You claim, but I didn't download the porn, somebody else did. That is true, you only distributed it, since it did flow to your device and then out again. Not a very smart strategy, if you ask me.

Have any sources at all for that or are you just theory-crafting?

Re:It's Basic Infrastructure

[hawkinspeter]

I've got a Virgin Media router (to the cable broadband) that I set up the open WIFI on, and a Buffalo WZR-HP-AG300H that I use for the WPA2 WIFI connecting to my home LAN.

To be honest, my setup is overkill as the Virgin Media router supports running a WPA2 and a guest network and the Buffalo DD-WRT router can also do the same thing. I like the extra range and throughput of the Buffalo router (it's the quickest consumer router I could find) and it also runs on 2 separate frequencies.

Re:It's Basic Infrastructure

[Anonymous Coward]

Um, wrong. WPA2 provides for CCMP (which is an AES derivitive), WPA uses RC4-TKIP and WEP uses RC4. The channel itself is encrypted as part of the authentication system. Now that being said, WEP and WPA are broken technologies and WPA2 should be used if you don't want the network cracked.

Re:It's Basic Infrastructure

[Garth Smith]

No thanks, if a guest wants to access my wifi he should ask for the password and take the extra 30 seconds needed to type it in.

How can you NOT be angry the government is forcing your guests to ask for your keys to use your datapipe by threatening you and your reputation with very serious criminal charges? This is happening all over the world and I am afraid our culture now accepts it without even thinking it's absurd!

I used to run my public WiFi with SSID "UseDontAbuse". I have since removed public access thus making the area around my home a little bit worse than it was before. I will express my anger here in the hopes that other people get angry as well and we collectively as a nation stop taking this crap!

Re:It's Basic Infrastructure

[fast turtle]

and if there's even the hint of CP being involved, you will be convicted by the newspaper and your neighbors with yours and your families lives possibly threatened. Sorry but it's a witch hunt out there and "We wont stop until sombody gets burned" (Petra - Witchhunt) and that's why you need to secure you wifi. If everyone had open wifi throughout the country, we'd all have a plausible defense but they've already won that battle because people are running scared and now that the ISP's will become Copyright cops in June of 2012, it's reached the point that what I'm paying for bandwidth is no longer worth while. In that case, I am already planning on dropping down to the absolute basic service level of 256/128. It's good enough for what I'll be able to do w/o pissing off the ISP and loosing my connection or having it throttled anyhow.

Re:It's Basic Infrastructure

[hawkinspeter]

I refuse to be scared by their implied threats. If they can get a warrant to search my house, then they can try to find whatever the warrant was issued for. Otherwise, they have no rights on my property and I won't bow down to them just to be a "good citizen".

Re:It's Basic Infrastructure

[hawkinspeter]

I'm quite happy for random strangers to use my wifi - I've never seen any significant bandwidth being used for me to be concerned about it. I'm not convinced that restricting MAC addresses is worthwhile as I'd then have to explicitly allow people/guests/devices to use the open network and it's easy enough for MAC addresses to be spoofed anyway, so it's only pretend security.

If everyone did as I do, then there'd be less need for 3G data plans. Also, not every wifi device supports mobile broadband, so sometimes it's just convenient to be able to use an open wifi.

Re:It's Basic Infrastructure

[hawkinspeter]

I doubt that could ever happen as ISPs would fall foul of that law every time. An IP address does not identify a person - you'd need more evidence to convict than that. Have you got an example of someone being convicted without any evidence being found on their computer?

Re:It's Basic Infrastructure

[Belial6]

Why would someone go way out of their way to find your house just so they could make themselves conspicuous while they get their kiddie porn when they could park outside of a Starbucks or McDonald's and be less conspicuous? Sounds about as likely that they would splice into the phone lines on your house to make their drug deals while they are at it.

Fear that you are going to get arrested because of an open WiFi is pure paranoia.

Re:It's Basic Infrastructure

[Belial6]

That must be why every McDonald's, Starbucks, and all of the other businesses in town have been locked up after huge police raids.

Re:It's Basic Infrastructure

[hawkinspeter]

Just my curiosity, but why did you remove public access?

Re:It's Basic Infrastructure

[hawkinspeter]

Here in the UK AFAIK, they'd have to have a warrant to search for CP, so if they found a bong, they wouldn't be able to use it as evidence.

Re:It's Basic Infrastructure

[hawkinspeter]

Just apply some QOS so you're guaranteed to get as much bandwidth as you want and other people can use whatever's spare. You can't bank the unused bandwidth on unlimited connections, so you might as well let someone else use it if they want.

If people are happy to share the remaining bandwidth then I'm quite happy for them to drop their service. I've already paid for my agreed bandwidth, so I'm not cheating the ISP out of anything. If their business model relies on re-selling the bandwidth that I've already paid for, then that's their problem.

Re:It's Basic Infrastructure

[hawkinspeter]

Could you please provide an actual example where this has happened? I quite happily run an open WIFI and I think people are just fear-mongering when they say things like this.

Re:It's Basic Infrastructure

[toygeek]

This has actually happened multiple times. Neighbor looks at CP using your open wifi, FBI raids YOUR house and ousts YOUR family from your home.

http://arstechnica.com/tech-policy/news/2011/04/fbi-child-porn-raid-a-strong-argument-for-locking-down-wifi-networks.ars

http://www.thebostonchannel.com/news/28039374/detail.html

Re:It's Basic Infrastructure

[gknoy]

Would keeping logs of the MACs that connect to your open wifi help? (" ____ is not my laptop, nor my pc, nor my refrigerator, nor any of our phones.")

Re:It's Basic Infrastructure

[hypergreatthing]

There are things called load balances, QoS, bandwidth limits you can set.
Besides, you talk about comparing laundry detergent which is a measured resource compared to bandwidth. If you use 50% of your bandwidth, where does the other 50% go? To waste.

Re:It's Basic Infrastructure

[LazyBoot]

I would think it has more to do with the fact that for ages now space has not been something you could have in a password.

Re:It's Basic Infrastructure

[StikyPad]

I just wall off the open AP from the rest of my network and probe anyone who connects. My assumption is that if they're connecting to my network, they must want to share any and all of their accessible data with me.

Re:It's Basic Infrastructure

[borkie]

Most consumer wireless APs/routers have WPS (Wi-Fi protected setup) enabled, with no way of turning it off. The WPS mechanism has a weakness that makes wpa2-psk protection utterly useless. Google for "reaver wps", proceed to download, and crack all networks in your area within 24h, even the ones with 30+ char passphrases. The entire "security" of wpa2-psk is bypassed.

One solution is to run an open network, with IPsec combined with an authenticating gateway.

Re:It's Basic Infrastructure

[ae1294]

Restricting your network to specific MAC addresses would be a good protection, too. As for wanting WIFI when you are out and about, there are data plans for that.

MAC address filtering DOES NOTHING! Stop spreading this lie.

Re:It's Basic Infrastructure

[Richy_T]

I am happy for you that you have the legal budget of those companies.

Re:It's Basic Infrastructure

[Em Adespoton]

There's already software available to do this... you can often see such "hotspots" show up in coffee shops, etc.

Re:It's Basic Infrastructure

[webnut77]

"What's the password?"
"idontknow"
"Well then, how do you login?"
"I use the password."
"Alrighty, what's the password?"
"idontknow"
"Arrg, you just said you use the password to login."

Re:It's Basic Infrastructure

[PReDiToR]

First hit on DDG
http://www.techrepublic.com/blog/security/how-to-spoof-a-mac-address/39

Right clicking the network connection and calling up Properties, or even the Device Manager will let you change the MAC on Windows.

Easy as Pi.[sic]

Re:It's Basic Infrastructure

[hawkinspeter]

To be honest, I hadn't really considered DNS poisoning. With any luck, the SSL certificate will throw up a problem when the hostname doesn't match the certificate, so an attacker would have to compromise the certificate as well.

Re:It's Basic Infrastructure

[Dcnjoe60]

I doubt that could ever happen as ISPs would fall foul of that law every time. An IP address does not identify a person - you'd need more evidence to convict than that. Have you got an example of someone being convicted without any evidence being found on their computer?

An ISP is a company in the business of providing internet access. An individual opening up their router is not. An IP address does not identify a person, but it will identify your specific router. If illegal content has been detected going through your router's IP (say child porn), it will/can trigger an investigation, it happens all the time, but is dependent on your state's laws. It is never a good idea to rely on a defense that is based on ignorance as in not knowing what people were doing with the service you were providing them. Just ask MegaUpload.

Re:It's Basic Infrastructure

[Dcnjoe60]

As I have stated previously, there is a difference between a business providing this service and an individual doing the same. Just as there is a difference between a a casino running a black jack table and you doing so in your basement.

Re:It's Basic Infrastructure

[Dcnjoe60]

Chicago IL
Memphis TN
Columbia MO
and most major Universities

For one, most ISP contracts prohibited the practice on a consumer contract. Second, the courts in those locations have held that since the individuals are not business, but illegally sharing their connection (since the ISP contract explicitly disallows it), they are held as part of a) a conspiracy to defraud the ISP and b) liable in enabling protected content from being distributed.

In most states, it is also illegal to use somebody's WIFI without permission.

Re:It's Basic Infrastructure

[Dcnjoe60]

While it is easy to spoof a MAC address, if the router only accepts connections from specific ones means somebody has to sit there with a sniffer to intercept the traffic to determine acceptable addresses. That is a crime in most states and is enough to protect you, assuming you also have WPA2 enabled, to show the authorities that you didn't willfully do something illegal. It doesn't keep somebody else from using it, it just helps cover your own butt.

Re:It's Basic Infrastructure

[Grishnakh]

Not only that, but they have to find an acceptable address that isn't in use at the moment. So if they use a sniffer, they'll find out which MAC addresses are connected right now, but if they clone one of those, it won't work because the system with that MAC address is still connected. They'd have to monitor your AP for some time to find a list of MAC addresses that are acceptable and then figure out which ones aren't always connected.

Re:It's Basic Infrastructure

[Grishnakh]

Then be prepared to put your life on hold for 6-12 months while they do their investigation, and you're not allowed to have a computer while they keep all your equipment. If you're like me and you telecommute, you can kiss your job goodbye.

Re:It's Basic Infrastructure

[Belial6]

No, it isn't. The casino can run a blackjack table because they are licensed to run blackjack tables. There are no retail businesses other than ISPs licensed to run WiFi.

Re:It's Basic Infrastructure

[themusicgod1]

To be fair, some of us probably use 99%+ of our bandwidth. wooo 5000ms ping time!

Re:It's Basic Infrastructure

[themusicgod1]

Thanks for the reminder to restart my tor exit node.

Know what's *also* not free? Monopoly rent & wireless data coverage within cities via centralized, heavily controlled & policed networks. 4G networks cost a shit ton, and local to me we're putting them up because, as a continent, we're more or less a bunch of greedy assholes who can't seem to learn to share our very good coverage of 802.11 networks within most cities properly.

Re:It's Basic Infrastructure

[gnapster]

He discontinued public access because the risk (of losing all his gear while waiting for a trial) finally outweighed the benefit of providing a public service, in his estimation.

We have a right to a speedy trial, but it would still be a mess to deal with and it seems like most people don't take advantage of it. I myself don't understand all the nuances of that right and when it would be to one's advantage to claim it.

Re:It's Basic Infrastructure

[uninformedLuddite]

The number of people driving around your neighbourhood capable of doing this are very few. At least in Adelaide.

Re:It's Basic Infrastructure

[uninformedLuddite]

Spoken like someone who has never really experienced the joys of dealing with the police

Re:It's Basic Infrastructure

[uninformedLuddite]

so if they found a bong

That's an African musical instrument isn't it?

Re:It's Basic Infrastructure

[uninformedLuddite]

I tried the WiFi at a McDonalds here in AU a while ago. It took several minutes just to load the google home page fully. I can't see someone getting images or videos that way.

Re:It's Basic Infrastructure

[randyleepublic]

I think all these strategies are easily defeated: Wardriving child porn downloader ignores your low bandwidth open ap, acquires your secure ap signal, cracks your encryption, ids one of your mac addresses, and then, at a random later date, spoofs it for his bad stuff activities.

Re:It's Basic Infrastructure

[randyleepublic]

For values of "saves" that include ruined lives.

Accountability

[rwa2]

Plus, it's easier for them to book you for thought crimes they catch you committing via their IP taps. They'll have none of that "but my wifi is open -- it could have been anyone" defense. That won't work for you, sir, you'll be held accountable for whatever flows through your pipes!

Re:Accountability

[Aaron B Lingwood]

Including Simpsons porn

Re:Accountability

[houghi]

And good for them. They will also warn if you have left your car door unlocked and motor running. At that moment you should not claim that your car was stolen and used in a robbery. Well, you could, but would have a LOT of explaining to do.

OTOH the majority of people will have absolutely no clue that their Wifi is open and will be grateful that they were warned.

Re:Accountability

[Anonymous Coward]

In Queensland, your more likely to get a fine that a warning for leaving your car do unlocked and motor running, as that is a crime.

Re:Accountability

[georgeaperkins]

Gosh is that Simpsons thing a joke? Had to check the calender that its not 1st April yet. How ridiculous

Re:Accountability

[Aaron B Lingwood]

Gosh is that Simpsons thing a joke?

No joke. Photos of small-breasted woman, regardless of age, is also considered child-porn.

Re:Accountability

[dbIII]

That was another Conroy (Australian Communications Minister) brainfart that luckily never made it into law. Business as usual from the man that said there was a Lesbian Cabal plotting to halt the national broadband network. If it had made it into law as proposed a "jailbait" photo could have been of a merely topless woman over 40. Such a thing has no place in a nation where breastfeeding in public is still accepted and not a crime and would even be insane in a place still upset over an exposed nipple at the Superbowl.

Re:Accountability

[Aaron B Lingwood]

That was another Conroy (Australian Communications Minister) brainfart that luckily never made it into law.

/me breathes a sigh of relief

Re:Accountability

[NoMaster]

No joke. Photos of small-breasted woman, regardless of age, is also considered child-porn.

Bullshit.

As to the actual story, the police already wander around public car parks checking to see if you've secured your car, and leave a flyer under the wiper. If the car is secure they tick the "Congratulations!" box; if not, they tick a box describing why your car is insecure. A quick Google tells me that this is also fairly common in the Good Ol' US of A.

Don't see anybody complaining about that, though. Apparently, the police knowing that somebody within a street or two has an open WiFi AP is worse than them physically touching your property and potentially building a database of who habitually doesn't lock their cars...

Re:Accountability

[Dodgy G33za]

I bloody well would. I often leave my car unlocked. I don't pay my bloody taxes to have them give me a score out of ten for how paranoid I am.

If they did their bloody jobs properly no-one would need to lock their cars.

Re:Accountability

[Anonymous Coward]

Uh no, it doesn't work that way. If your government does its job properly then no-one needs to lock their cars, and you hardly need cops.

Only if you're deluded.

Crime is part of the human condition, even in a mythical perfect communist state there would still be outliers who steal shit. That is just a foolish line of thought because it is foisting responsibility of protecting your property from casual small scale crime on to society just because you're too god damn lazy to lock your doors. The GP's offered social environment is basically a monoculture and, like crop monocultures, it is highly vulnerable to disease wiping out the lot — if you trust everyone by making no effort to protect your stuff then the first crook who comes along will make an absolute killing robbing everyone blind.

Government and society are nice in that they provide herd safety but it is still the responsibility of each individual within the herd to manage their personal interests themselves, you don't get to externalise (Remember that thing we really hate corporations for doing?) all your personal responsibilities onto everyone else. At least, not unless you're rich enough to afford to pay people to run around cleaning up your mistakes after you.

Re:Accountability

[cbope]

Wow, if this is indeed true that cops walk around checking for locked cars; what a spectacular way to waste police resources.

If you are stupid enough to leave your car unlocked in this day and age, you deserve to have your stuff stolen.

Re:Accountability

[Capt.DrumkenBum]

Locking the doors of your car is a foolish waste of time.
If you lock the doors they break a window, and steal your stuff. If you don't lock the doors you tend to not leave anything in your car for them to steal, and your window doesn't get broken.
My car doesn't even have door locks. I would say 3 or 4 times a year I get back to me car after work and I can tell someone has gone through my car. (I park in a very high vehicle crime area.)
I do put the club on the steering wheel though, and have a hidden kill switch.
The funny thing is I get the same notice on my care about once a year and it never notes that my doors are unlocked. :)

Re:Accountability

[gnapster]

I have heard that in some jurisdictions, traffic tickets due to speed cameras are only binding if the registered owner was the one driving. If a camera catches me running a red light while driving my wife's car, the ticket is mailed to her, not me. She wasn't the one who committed the crime.

Google

[Aaron B Lingwood]

Doesn't google already have this data?

This looks like a money grab from this years' budget

The QPS is always complaining that they do not have enough funding to pay their staff. Now they are wasting precious manhours to mine data that they could easily purchase (or even receive for free) from Google.

Finaly!

[V!NCENT]

Finaly an actual initiative to protect and serve the people! A little faith in government restored.

Ignoring the FUD about Identity theft

[Anonymous Coward]

It's too easy finding a strong (as in signal), open, public WIFI signal these days for there really be any incentive to run around "hacking" WEP or even dealing with weak and unreliable signal issues that one faces using an open connection inside a building.

Shit, if you want to commit fraud, take a clean machine to any McDonalds in the country and you can fraud away to your heart's content.

I wonder what they will say

[Anonymous Coward]

NSW police may be interested in my wifi ssid "Police_Surveillance_Van_71A"

Re:I wonder what they will say

[lexsird]

I name mine "Warning: Virus Detected!"

Re:wifi security

[Anonymous Coward]

Insecure WiFi != Insecure network.

At home I have two WiFi network over the same AP, one is open an the other use WPA2, they are in independent networks and with a firewall between both, plus the open is capped to use at max 2mbps.

Broken security

[NoobixCube]

Wifi security, including WPA and WPA2, is already broken. It's the equivalent of locking your house up with a six pin tumbler lock. It keeps the honest and the curious out, but it's nothing to someone who really wants in.

Re:Broken security

[gl4ss]

it's still illegal to break it.

unless, of course, it seems if you're a cop.

Re:Broken security

[SilentChasm]

As far as I know WPA/WPA2 isn't broken, only WPS's PIN mode (enter an easy 8 digit number instead of a complicated alphanumeric passphrase). Granted you can still bruteforce the PSK itself instead of the PIN but then you've just got the same problem of weak passwords that many other things do.

Re:Broken security

[thegarbz]

WPA and WPA2 isn't broken. There's only a configuration problem in WPS (a system designed to bypass having to enter a WPA key, who thought that was a good idea anyway?). Even that isn't broken as such. The effect is that the brute force attack has been simplified to the point where it is achievable to actually perform rather than having to brute force the entire array of usable keys. A simple configuration change that either fixes the problem or better yet limits the number of tries or the rate of tries for connecting using WPS would instantly make it secure again.

The irony? Older access points which support WPA and WPA2 but don't support WPS are quite secure.
The double irony? I have never had WPS actually work on my access point even when the PIN is known, so I'm amazed that this is a suitable attack vector in the first place.

Re:Broken security

[FireFury03]

it's still illegal to break it.

unless, of course, it seems if you're a cop.

The police aren't breaking anything, AFAICT they are just listening to the beacon from the access points and seeing if it is flagged as encrypted.

Re:Broken security

[virb67]

And no matter what kind of lock you place on your house's door a sledgehammer will probably knock it down pretty easily. So what's your point exactly?

Re:Broken security

[jamesh]

WPA and WPA2 isn't broken.

WPA w/TKIP isn't 'broken' in the strictest sense of the word, but is considered insecure enough that there is no good reason to use it if all your hardware supports WPA2.

http://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#Security

Re:Broken security

[allo]

google got a lot of trouble for doing so. because its inevitable they capture some actual content of connections on insecure wlans.

Re:Broken security

[MtViewGuy]

If you use a password that is not breakable easily using a dictionary-based guessing system, it would take a LONG, LONG time to break the password for something like the 16 alphanumeric character long password I used on my Wi-Fi router.

Re:Broken security

[FireFury03]

google got a lot of trouble for doing so. because its inevitable they capture some actual content of connections on insecure wlans.

Google got into trouble for _storing_ that data, not capturing it.

(IMHO they shouldn't have got into trouble for any of it anyway, if you broadcast something into a public space you should have no expectation of it not being captured, stored, analysed, etc.)

Incidentally, why did the law enforcement authorities complain about Google storing data (which could have been analysed later, even though Google said they weren't going to do this), whilst shopping centres are starting to get away with capturing cellphone beacons and analysing them to build a picture of shopper movements? I'm much happier about Google capturing some random data that people have _chosen_ to transmit in the clear than someone capturing data that is mandated by international protocol standards to be transmitted in the clear.

Re:Broken security

[thegarbz]

Security is not an arbitrary line, security depends entirely on what threat you are trying to protect from. The attack you are talking about works against packets where the structure is mostly known. The link you posted presents one possible attack vector which causes packet redirection. This basically means that the attack is useless against any meaningful data (logins and passwords etc), and that if a packet redirection attack happens it essentially either causes your connection to drop unless the equipment used is very sophisticated.

Essentially WPA w/TKIP may let the CIA snoop on any password you're stupid enough to transmit in plaintext over IP. However in terms of "security" most normal people are not all that concerned about the CIA. Most normal people are concerned about people using metered WiFi for free, people stealing personally identifiable information, and jumping on your network and downloading all the stuff you put in the public folder without realising that any idiot with a laptop could take it over WiFi.

Yes WPA w/TKIP in my opinion is perfectly secure enough for the needs of most people. WEP for instance isn't because there's a single click attack vector which gets full access to the network, but unless there's some way to get full access to the network with WPA (i.e. WPS brute force bug on poorly implemented devices) it still provides security.

Re:Broken security

[jamesh]

I'm not sure if you are agreeing with me or disagreeing with me... there is still no good reason to use WPA+TKIP if all your devices support WPA2.

Re:Broken security

[allo]

the point is protecting people who do not know any better.

Of course, your worst-case analysis should consider: everything sent will be captured and stored forever and when its possible to decrypt it, then it will be analysed and used against you. When you assume this, no bad surprise will happen.

But another thing is, what the laws should look like. They should not assume the worst-case to be normal anyway, but forbid the bad parts. So the worst case CAN still happen, but it WON'T happen that often, because only people not caring about the legality of their actions will do it.

From the security point of view, you need still to consider the worst-case. But for people who do not know anything about security, their average case will be much better.

Re:Broken security

[thegarbz]

Both. On the one hand I agree WPA+TKIP is not secure, as in I wouldn't use it if I was protecting my network from government spies type secure.
On the other hand it's secure enough for most common uses, as in keeping script kiddies and general drive by thieves out.

Think of it as a bicycle lock. It's security for rest of us; won't do a thing to stop someone with a bolt cutter, but it'll stop the casual person grabbing the bicycle and making a run (ride) for it.

Or to put it in plain English, I wouldn't recommend someone going out and buying a router simply for WPA2 support if they had WPA+TKIP already. I on the other hand would tell someone it's time to upgrade if they are relying on ailing WEP for their encryption.

Re:Broken security

[FireFury03]

the point is protecting people who do not know any better.

The problem here is you basically achieve nothing, and at worst give people a false sense of security. Giving Google a hard time over storing data they realistically couldn't do a lot with* prevents no abuse (because they couldn't really have done much with that data anyway), meanwhile it does nothing to prevent people with bad motivation from logging and analysing the traffic.

So at best, nothing changed. At worst, some people decide they don't need to worry about encrypting their networks because the police will catch anyone naughty.

(*) Google captured wifi traffic from a vehicle moving at speed. As they drove past someone's network, they will have captured a few isolated fragments from the middle of a stream of data (assuming the network was actually being used at the time). It isn't like they were sitting outside someone's house for hours watching all their email traffic go by or something.

Re:Broken security

[allo]

i do not think you got the point.

the worst case stays the same: somebody who wants to do evil things captures as much as possible and does evil things with it. This is possible now and then.
But the average case differs. When its forbidden to capture anything, the people, who are not plain criminals, but just dataminers acting in the legal range, will be stopped.

So of course, the worst case isn't any different, and you should still be afraid and encrypt your wlan as good as possible. But the sum of all datamining will be less, because the legal acting people will behave differently. Which is at least a small advantage to the status quo.

Possible Abuse

[Aaron B Lingwood]

I find it odd that QPS Media has failed to supply the public with any technical information on what tools they are using and the scope of the exercise
Are they simply searching for wireless networks? Or going as far as trying default passwords?
Are they geocaching MAC Addresses and SSIDs that will be used in other investigations?
Are they sniffing traffic? Are they collecting any personally identifiable information?

While this is a nice service, I do think this does not fall under the purview of the state police
If this is simply a SIGINT operation in disguise, it is better left to the DSD or ASIO
If this is simply a community service, the state governement should use grants to coerce the industry to extend their voluntary code of practice so that ISP's are responsible for making their customers aware of the risks as part of the signup process.

Re:Possible Abuse

[AHuxley]

DSD/ASIO would be getting every packet in and out of Australia by default over any telco link.
If your chatting with Africa, Asia or the Middle East- your on a list shared with the UK, NSA ect..
As for sniffing traffic, they would do that as a drift net - all flagged p2p files, forums, chatrooms - going after the person and ip.
MAC Addresses and SSIDs that will be used in other investigations would really be long term with unmarked vans/cars.
It sounds like a simple tool that shows a pad lock or no padlock - just like any consumer device, but it cost Australian taxpayers a lot.
Some telco contractor did good with this deal :)

Re:Possible Abuse

[FireFury03]

While this is a nice service, I do think this does not fall under the purview of the state police

Why not? The police are in the business of crime prevention as well as catching criminals.

Breaking into someone's house and stealing their stuff is a crime. If you do it, the police will (hopefully) come after you and lock you up. The police also have programmes whereby they will tour the neighbourhoods and if they spot some bit of bad security they will knock on the door and tell you about it so you can fix it *before* someone takes advantage of it.

Breaking into someone's network is a crime*. If you do it, the police will (hopefully) come after you and lock you up. In this case, the police are also running a programme whereby they will tour the neighbourhoods and if they spot some bit of bad security they will knock on the door and tell you about it so you can fix it *before* someone takes advantage of it.

What's the difference?

(* cracking someone's security, even if it's lowly WEP, is a crime and should be punished - if someone is running any kind of encryption then it is clear that they don't want to let you into the network. On the other hand, I very much believe that it should _not_ be a crime to use an open network, because there is no reasonable way to know that it wasn't intended to be an open hotspot. I would, however, expect these police to tell you "did you know your network is open, here's how to lock it down" to help people who may have left it open by accident. Getting helpful information from the police does *not* mean you can't ignore it if you actually want to run an open network though).

If this is simply a community service, the state governement should use grants to coerce the industry to extend their voluntary code of practice so that ISP's are responsible for making their customers aware of the risks as part of the signup process.

What kind of "voluntary code of practice" are you talking about? Its true in the past that access points shipped with encryption turned off, but that hasn't been the case for years. So these days the people with open APs are generally either still running old hardware, or are intentionally running them open. I can't see what "code of practice" is going to help with either of these situations.

Re:Possible Abuse

[Aaron B Lingwood]

While this is a nice service, I do think this does not fall under the purview of the state police

Why not?

The Commonwealth Criminal Code completely covers all aspects of unauthorised access. Computer crime has always been a federal crime. The federal police have the experience and resources to deal with this. In the past, I had reported (read: attempted to report but was refused) several minor computer crimes that involved my network or my workplaces. Usually theft of services/data. The state police had ZERO understanding. I realise that QPS have, for almost a decade, really focused on strengthening their tech ability and understanding. I just remain sceptical or perhaps it is just scorn.

What kind of "voluntary code of practice" are you talking about?

I am of the opinion that the majority of ISP subscribers buy their hardware from the ISP and sometimes this is the only option. Many ISP's also charge a setup fee which often also covers support and configuration. Such a code of practice could ensure that this configuration/support covers such things as education and assistance with securing WiFi.

these days the people with open APs are generally either still running old hardware, or are intentionally running them open.

With the role out of the NBN, most Queenslanders will be up for new hardware well before every street in the state has been audited. Implementing this code in time would mean that EVERY NBN subscriber would be at least aware of the security issues and I can see this approach possibly saving ISP's money.

Re:Possible Abuse

[drsmithy]

On the other hand, I very much believe that it should _not_ be a crime to use an open network, because there is no reasonable way to know that it wasn't intended to be an open hotspot.

By your logic, it's reasonable to assume anyone without a fence and locked door is inviting me in for dinner.

Re:Possible Abuse

[FireFury03]

On the other hand, I very much believe that it should _not_ be a crime to use an open network, because there is no reasonable way to know that it wasn't intended to be an open hotspot.

By your logic, it's reasonable to assume anyone without a fence and locked door is inviting me in for dinner.

No. Public areas (parks, etc) are usually clearly marked as such - it is pretty easy to tell the deifference between a park and someone's unfenced garden.

On the other hand, wifi has a flag in the protocol explicitly to tell you if it is public or private and there is no other sensible way to tell this. Unfortunately, access points that are accidentally left open will also be broadcasting an "I am a public hotspot" flag, even though the owner didn't intend to do this.

As an example, if you go for a coffee in "Bob's café" and you find an open access point called "bobs_wifi", are you to assume that this is intended to be used by the customers of the café, or should you assume that Bob lives above the café and this is his personal wifi that has been set up incorrectly? (And yes, it's pretty common for cafés to provide free wifi in the form of an open access point and not even bother to advertise the fact).

Another example: I have accidentally used someone's personal wifi in the past - it was an open access point that was broadcasting a pretty generic SSID (something like "BTOpenSpace"). BT provide internet connections to homes and businesses (with associated wifi kit), but they also provide public hotspots under a variety of names (BTOpenZone, BTFon and a few others). Without a good knowledge of all the hotspot providers and ISPs, it is impossible to know which ones are private and which are public without trusting that the ones that advertise themselves as public really are (as it turns out, the BTOpenSpace one was someone's home ADSL, but I didn't realise this until afterwards).

Also, anything that automatically looks for public wifi hotspots can *only* trust what the access point is advertising itself to be - since no human is reviewing its decisions, there are no judgement calls. My SIP handset will auto-associate with any public network if it can't find my private one - it isn't going to ask me every time it needs to change network, so even if your network has the SSID of "private_keep_out", it'll still happilly use that network if your AP is advertising itself as a public hotspot.

So sorry, since legitimate public hotspots are very common and there is no way to tell them apart from incorrectly configured private access points, I can't see how it can be considered a crime for someone to use a private hotspot that is advertising itself as being public. This isn't like an obvious private garden not having fences, it's more like an unfenced garden with a bloody great sign outside it saying "please come in".

Re:Possible Abuse

[stephanruby]

I find it odd that QPS Media has failed to supply the public with any technical information on what tools they are using and the scope of the exercise

Also, why are they limiting themselves to wifi only? Unsecured trash cans, unsecured cable boxes, and cheap mailboxes can be another way for people to steal your data. And in bad neighborhoods, unsecured backyards, unsecured windows, and easy to break doors, are a boon for criminals. If they're going to have someone driving around inspecting security issues, they might has well give that person multiple things to look for -- to save on gas.

Re:Possible Abuse

[Lumpy]

You have a fine here for having breakable glass windows. This encourages crime.

Re:Possible Abuse

[Aaron B Lingwood]

Also, why are they limiting themselves to wifi only? Unsecured trash cans, unsecured cable boxes, and cheap mailboxes can be another way for people to steal your data.

This is one of the reasons I suspect this may be a SIGINT operation by the state police so they don't have to keep giving up jurisdiction or credit to the feds.

Re:Possible Abuse

[drsmithy]

Public areas (parks, etc) are usually clearly marked as such - it is pretty easy to tell the deifference between a park and someone's unfenced garden.

It's pretty east to tell which wifi hotspots are setup for "public use" as well - assuming you're being honest with yourself.

As an example, if you go for a coffee in "Bob's café" and you find an open access point called "bobs_wifi", are you to assume that this is intended to be used by the customers of the café, or should you assume that Bob lives above the café and this is his personal wifi that has been set up incorrectly? (And yes, it's pretty common for cafés to provide free wifi in the form of an open access point and not even bother to advertise the fact).

It would be _reasonable_ to assume it's only meant for customers. Just like it's _reasonable_ to assume those newspapers and magazines lying around are for customers and not random passers-by.

Another example: I have accidentally used someone's personal wifi in the past - it was an open access point that was broadcasting a pretty generic SSID (something like "BTOpenSpace"). BT provide internet connections to homes and businesses (with associated wifi kit), but they also provide public hotspots under a variety of names (BTOpenZone, BTFon and a few others). Without a good knowledge of all the hotspot providers and ISPs, it is impossible to know which ones are private and which are public without trusting that the ones that advertise themselves as public really are (as it turns out, the BTOpenSpace one was someone's home ADSL, but I didn't realise this until afterwards).

I've never seen an ISP-provided wifi kit that didn't uniquely identify itself somehow. Usually with a MAC address, or something other random-but-unique number in the SSID.

*Real* public hotspots, on the other hand nearly always have a completely generic name, often with "free" or "open" in it.

Like I said, it's rarely hard to tell the difference if you're being honest with yourself.

So sorry, since legitimate public hotspots are very common and there is no way to tell them apart from incorrectly configured private access points, I can't see how it can be considered a crime for someone to use a private hotspot that is advertising itself as being public.

Whoa there, champ. I didn't say it should be a crime, I applied your logic to the physical world.

This isn't like an obvious private garden not having fences, it's more like an unfenced garden with a bloody great sign outside it saying "please come in".

No, it's not. The lack of a "please stay out" sign is not the same as a "please come in" sign. Refer back to my original post.

Re:Possible Abuse

[drsmithy]

The internet is quite different. The internet is made to be used by people all over the world.

The internet ? I thought we were talking about wifi access points ?

How are you supposed to know whose wifi is deliberately open and whose isn't?

You make a reasonable assumption. If you're being honest with yourself, it's rarely difficult to tell whether or not someone has setup their wifi point for open access.

Re:Possible Abuse

[FireFury03]

As an example, if you go for a coffee in "Bob's café" and you find an open access point called "bobs_wifi", are you to assume that this is intended to be used by the customers of the café, or should you assume that Bob lives above the café and this is his personal wifi that has been set up incorrectly? (And yes, it's pretty common for cafés to provide free wifi in the form of an open access point and not even bother to advertise the fact).

It would be _reasonable_ to assume it's only meant for customers. Just like it's _reasonable_ to assume those newspapers and magazines lying around are for customers and not random passers-by.

Did you read what I wrote or did you just read the first few words and make the rest up? I never said anything about non-customers, the choices I offered were:
1. it is intended to be used by customers of Bob's Caf'e
2. it is Bob's personal wifi network that has been accidentally left open and no one except Bob himself should be using it

I've never seen an ISP-provided wifi kit that didn't uniquely identify itself somehow. Usually with a MAC address, or something other random-but-unique number in the SSID.

And yet I have. It is less common now, but it certainly used to happen a lot. Also, access points with the manufacturer's name and no uniqueness are still pretty common (Linksys, Netgear, etc.) It may be obvious to someone familiar with all the different manufacturers of kit that these are the default names, but the law should not require people to be that knowledgable about the market. Wifi broadcasts a flag *specifically* to tell you if it is public or private, if people set that flag to public when they mean private I don't think the general public should be expected to have a vast amount of knowledge of a changing market place in order to judge whether the owner set it up wrong or not.

Also, if you are one of the people who leaves their home router's SSID set to "Linksys", your computer _will_ automatically associate with any other open network called "Linksys" and there's no sensible technological way to stop this from happening.

Remember: we're not necessarilly talking about techies with a good indepth knowledge of the technologies and marketplace. If a laptop has a "public wifi" icon next to a wifi network with a fairly generic name then it is reasonable for the _general public_ to believe this to be a public wifi hotspot. A law to protect unknowledgable people who can't configure their routers correctly automatically criminalises unknowledgable people who can't make a judgement based on fairly extensive knowledge of an ever-changing market.

Re:Possible Abuse

[gnapster]

Wifi broadcasts a flag *specifically* to tell you if it is public or private, if people set that flag to public when they mean private I don't think the general public should be expected to have a vast amount of knowledge of a changing market place in order to judge whether the owner set it up wrong or not.

What is this flag, and how is it configured? I have often wondered if such a thing exists, but I can't see how to change it on my current router (DD-WRT, as it happens) and I wouldn't know how to tell my WiFi client to respect such a flag (or not).

Re:Possible Abuse

[FireFury03]

Wifi broadcasts a flag *specifically* to tell you if it is public or private, if people set that flag to public when they mean private I don't think the general public should be expected to have a vast amount of knowledge of a changing market place in order to judge whether the owner set it up wrong or not.

What is this flag, and how is it configured? I have often wondered if such a thing exists, but I can't see how to change it on my current router (DD-WRT, as it happens) and I wouldn't know how to tell my WiFi client to respect such a flag (or not).

The wifi AP broadcasts a flag to say whether the network is encrypted (and hence private) or open (therefore public).

australian Accountability

[johnjones]

thats exactly it !

realistically hacking a wpa setup by a person with no experience is pretty unsecured
(do you really want to know how many people have password1 or changeme...)

have a look at this:

http://open.youyuxi.com/

australia is censored beyond what I certainly expected...

regards

John Jones

Safe wi-fi spot

[hcs_$reboot]

If anyone has a secure wi-fi spot, will the "I did not download that file, someone did by accessing my wi-fi" excuse remain valid?

Re:Safe wi-fi spot

[gnasher719]

If anyone has a secure wi-fi spot, will the "I did not download that file, someone did by accessing my wi-fi" excuse remain valid?

If your WiFi is secured, then you don't need the defense because nobody will use your WiFi to download files.

Re:Safe wi-fi spot

[Aryden]

If your WiFi is secured, then you don't need the defense because only those who really want to will use your WiFi to download files.

FTFY

Re:Safe wi-fi spot

[Aaron B Lingwood]

If anyone has a secure wi-fi spot, will the "I did not download that file, someone did by accessing my wi-fi" excuse remain valid?

If your WiFi is secured, then you don't need the defense because nobody will use your WiFi to download files.

If your WiFi is secured and someone, through luck or through skill, manages to identify with your AP and use your connection for nefarious deeds, you no longer have that defence. I always keep an open but isolated, bandwidth-limited channel. I use a secure channel for myself and my guests.

Re:Safe wi-fi spot

[hawkinspeter]

Not if they find evidence on your computer that you downloaded it.

Re:wifi security

[johnjones]

yes thats a very decent way to do things however in australia we have cap's so I would not want to give away my allowance...

living in other places I was unlimited and had no problem doing exactly what you do and giving away a portion of my bandwidth to those in need

maybe someone would help me out one day...

regards

John Jones

Re:what's next

[Aaron B Lingwood]

police going around to everyone's door trying to open it?

Some police beats in shopping centres check parked cars and leave a nice little letter with a nice big fine if they find one unlocked.

Re:what's next

[Aryden]

Then you're littering.

Re:what's next

[Anonymous Coward]

hahaha They NEVER leave a Fine on a car for being unlocked. Stop stirring shit dude. They just leave a notice saying its unsecure etc etc.

Re:what's next

[Aaron B Lingwood]

and why is it illegal to leave your car unlocked ?

It is illegal as it encourages opportunistic crime resulting in more paperwork for the old bill.
It is quite difficult to type up reports when your fingers are all sticky from doughnut icing.

Money must grow on trees in Queensland

[anarkhos]

to pay for this crap

Re:what's next

[Aaron B Lingwood]

They NEVER leave a Fine on a car for being unlocked.

Never Say Never

Why bother?

[Datamonstar]

I mean, it's a fine and commendable effort & all, but it's just bound to go WOOOOSH!!! to most citizens anyway. In fact, that goes for many of the cops too, I'd bet. Just leaving a letter talking about a screen door isn't really going to cut it for people who just expect to plug in a device and have it work perfectly automagically.

Re:I understand WEP is bad but ...

[jamesh]

I had a WEP SSID for my daughters Nintendo DS, but had it locked down to the point that a hacker without a DS wouldn't be able to do much with it.

Re:what's next

[blackest_k]

That law is ridiculous, i've had several locked cars broken into and the damage due to breaking in has always cost more than anything stolen. Generally the only thing of value is a couple of euro and the radio which although it has bluetooth, mp3 cd cost 56 euro a new door or window costs a lot more to fix than replacing the radio.

The engine immobiliser still works you need a proper coded key for the ignition to work, you might still steal the car but the door locks are not going to be much of a barrier honestly.

Sure sometimes i might be carrying something of value when it makes the cost of repairing the car less than the cost of the stolen goods but then i would lock it.

however in practical terms the cost of a break in is my insurance excess (500 euro) + the loss of noclaims discount which is around 75% a loss of (750 euro).

A friend of mine had his lorry fuel tank syphoned in a locked patrolled yard no less, the police said he should have a locking cap on the tank. well that is all well and good until you realise the tank would still have been broke into and the tank damaged in the process and his lorry would have been off the road making him unable to meet his contracts. While annoying and expensive to lose fuel that way the alternative could cost him a lot more maybe even his business.

  Security is a trade off and it makes no sense to ensure the cost of flimsy security measures costs more than the things stolen in the first place.

Re:what's next

[Aaron B Lingwood]

I once purchased a new Jeep Wrangler softtop.

Being a new car, I was being very careful ensuring that the car was always locked and parked under a streetlight at night.
Didn't help. Had the window panels slashed on 2 occasions in the first month of ownership. Once for some pocket change, and another for a work uniform.
Replacement panels are $1,200 a pop. I resorted to ALWAYS leaving the car unlocked to prevent this kind of vandalism. Never had a problem again.
Over the next 2 years, I only received a single $40 fine for leaving the vehicle unlocked. Argued the ticket and it was retracted.

I broadcast about 120 open AP's

[Lumpy]

All of them named Linksys, Dlink, Wireless, etc... and all to a single router that is connected to nothing at all.

It significantly reduces the volume of idiot neighbors that do not configure their new wireless as many times they will connect to me instead.

Works great, when I shut it off, I see no more default router names.

It also screws with the wardrivers, I look at some of the maps every few months and see my location with a giant pile of AP names around my building.

Re:I broadcast about 120 open AP's

[Anonymous Coward]

While you're at it, why don't you broadcast at max power on every single channel except 3. Then simply use channel three for your own router. Sure it's an asshole thing to do.. but while you're being an asshole, you might as well go all the way.

Re:I broadcast about 120 open AP's

[Richy_T]

That's a terrible idea. The channels overlap somewhat.

Re:WEP and WPA are both worthless

[Anonymous Coward]

WPA hasn't been broken (except for trivial password-guessing attacks that apply to every encryption scheme which uses pre-shared keys). WPA2 requires AES support, so a lot of older devices which have been upgraded from WEP can't use WPA2 because they lack AES support. If you expect to have devices like that on your network, WPA+TKIP is fine.

Re: broken is apparently a matter of opinion?

[jamesh]

So in conclusion: attacker gets all your outbound traffic in 20 minutes (and gets all your inbound traffic too if you use QoS). But somehow that's not "broken?"
Either you've just got your head in the sand, or you're a black hat trying to convince potential marks to keep using WPA-TPIK.

I did say use WPA2 if you have it available, but the threat isn't as significant as you make out. Anything serious (eg passwords) would be secured by SSL or TLS, so what are you going to sniff? You certainly can't get hold of anything that you couldn't just as easily get hold of via intercepting the cable/dsl/fibre. A guy with a high visibility vest and a clipboard fiddling around in your comms pit is much less noticeable than someone parked in your street with a laptop for 20 minutes.

And the threat TFA is talking about closing requires that your wireless security would be broken enough to allow an outsider to use it. No currently known WPA exploits allow this.

So it's broken, but not completely broken, and certainly not broken in the context of TFA.

Re:what's next

[Ash-Fox]

I think you shouldn't spread that information while logged in. I was able to acquire your home address with relative ease.

Do what I did

[fast turtle]

and buy a router with the a guest network capability. One device that offers dual AP - protected full speed for the home - un/protected guest ap that's restricted to 1/10 network bandwidth and isolated from the lan. Cost was $45 at Walmart

More dangerous than you think!

[Sentrion]

You Slashdotters just don't get it. If these wifi connections are left unprotected it will be the end of the world as we know it. Communists will start abusing these connections to access the internet WITHOUT PAYING FOR IT! Consider the long term ramifications! The dismantling of the international banking system! Dogs and cats, living together! Mass hysteria!

Aaron B Lingwood, explain yourself, PLEASE.

[Anonymous Coward]

Merely 15 years ago I was doing the exact same thing and have been, on umpteen occasions, questioned, detained, given a 'move on' notice or just generally harassed.

Wi-Fi did not exist in 1997. It existed about ten years ago. Wardriving didn't become particularly popular until around 2002-2003. I went out all the time and was never questioned.
 
Maybe that guilty look on your face got you second looks? Cops WILL hassle you if you appear to be doing something wrong and are looking around all the time.
 
--Martin Espinoza

Re:Aaron B Lingwood, explain yourself, PLEASE.

[Aaron B Lingwood]

Wi-Fi did not exist in 1997. It existed about ten years ago.

I probably shouldn't have rounded up. It was actually in 1999 the first time I went 'wardriving'.
WiFi was also not called WiFi yet and WiFi was not available for laptops (but were being advertised).
I was a radio enthusiast and had often searched for other wireless networks.
I did work experience for a tech mag who had just reviewed a lot of 802.11 devices, I was allowed to keep them
My wardriving consisted of a few old nix desktop PC's on an inverter in the back of my mates van
No home users had wireless networks yet. But many businesses did - especially those in the Auto industry

Wardriving didn't become particularly popular until around 2002-2003.

I agree. By the time I first read about wardriving, I had gotten bored and stopped.
In 2004, another mate of mine caught the bug. We went out, this time with a laptop on an inverter with NetStumbler on Windows
WEP had become fairly standard and I had decided against alerting people of their unsecured networks because of the type of negative attention it brought me in the past

I went out all the time and was never questioned. Maybe that guilty look on your face got you second looks? Cops WILL hassle you if you appear to be doing something wrong and are looking around all the time.

I think part of the reason why I got a lot of attention is because I was usually parked (with van running) in front of Auto dealers, Marine dealers and Computer shops in the wee hours of the morning, and back before WiFi and Wardriving were words. I didn't mind the police asking questions, I just wished they had listened to the answers.

The *proper* solution...

[IGnatius T Foobar]

The *proper* solution is to *accept* that some folks have open wifi, are ok with sharing their bandwidth, and therefore a consumer IP address is *not* to be admitted as evidence of a "crime" that has been committed using the public Internet.

Pure Paranoia

[Belial6]

Clearly that is not how it works. If it was, every McDonald's, Starbucks, and half the other retail stores out there would not be offering free unencrypted WiFi. Fear that some criminal is going to drive around town looking for your open WiFi so that they can commit a crime is complete paranoia. There are open WiFi hotspots everywhere that wouldn't draw attention if a stranger was sitting in their car using it. They are even put on maps, and advertised by the businesses offering the open WiFi.

Re:Pure Paranoia

[Dcnjoe60]

Clearly that is not how it works. If it was, every McDonald's, Starbucks, and half the other retail stores out there would not be offering free unencrypted WiFi. Fear that some criminal is going to drive around town looking for your open WiFi so that they can commit a crime is complete paranoia. There are open WiFi hotspots everywhere that wouldn't draw attention if a stranger was sitting in their car using it. They are even put on maps, and advertised by the businesses offering the open WiFi.

There is a difference between a business or municipality doing this and an individual. Since there have been individuals who have tried that defense and have lost (at least in the US), it does indeed work that way. Of course, each state has different laws. In some, merely being in possession of child porn can get you arrested in others you have to distribute it. Do you really want to chance it in your location? If so, go for it.

Re:Pure Paranoia

[Belial6]

If you are unwilling to chance it, you better build that dome completely encapsulating your home, because someone might throw an envelope stuffed with kiddie porn over your fence. You haven't done that? Do you really want to chance it in your location? If so, go for it.

Re:I understand WEP is bad but ...

[Richy_T]

Yep. I'm upset with Nintendo about this. Even though the 3DS can do WPA, some of the games still only do WEP so we have an old access point that only gets plugged in when required. Really need to lock it all down sometime.

think of the upside

[ozduo]

More police driving around looking for naughty free Wi-Fi means less police driving around looking for drunk drivers. Tip buy shares in auto repairers and funeral homes.

Protection from whom?

[minstrelmike]

Protection from whom? What is the risk to my personal data or my personal laptop if my WiFi _connection_ is open (assuming I've changed the default admin pwd on the router itself). Seems to me the cops have identified a solution before they actually defined a problem. same old same old