Wireless Networks

[Landus]

Despite how funny this is, it brings up a point in wireless networks in schools.

I know a kid that has a laptop running WinXP. It was customized with whatever that lets you access wireless networks.

Well, for the past two weeks, he's been able to access the proxy server that doesn't filter anything and uses Kazaa to download porn.

School's really need to take some measure against wireless networks with no security.

[theprez98]

It was customized with whatever that lets you access wireless networks.

WinXP doesn't need to be customized to do this.

[Landus]

I'm not saying WinXP was customized with it.

It's the computer part that can be put in laptops so they can access wireless networks. I just can't think of what it's called.

[TheCotMan]

It's the computer part that can be put in laptops so they can access wireless networks. I just can't think of what it's called.

Wireless NIC (Network interface Card)? 802.11a,b,g card? Antenna?

Many new laptops come with wireless built-in.

[Landus]

Ah, thanks.

I'm sure it's the 802.11a,b,g card built right in.

[theprez98]

I thought you meant the capability, not the hardware.

[Landus]

Undoubtedly, but no problem.

[d3ad1ysp0rk]

School's really need to take some measure against wireless networks with no security.

You mean like blocking mac addresses of people who visit sites they don't agree with? Oh wait, that's what my school does. ;)

[TheCotMan]

You mean like blocking mac addresses of people who visit sites they don't agree with? Oh wait, that's what my school does. ;)

There are many things that schools can do to deal with enforcing policies on censoring content from students.
* Limit DNS requests and resolve all DNS for unacceptable domains to a private IP address held by a web server with one page for all requests "This site is blocked."
* Limit based on IP address of undesireable sites with outgoing or incoming filter rules.
* Limit by forcing use of a caching proxy that restricts based on domain much like anti-advertisement/banner blocking caching proxies.
* Limit based on an authentication (VLAN per port switching, ANA, VPN, caching proxy, SOCKS proxy, WEP key, kerberos, etc.)
* And a few more (including MAC Address blocking and port/service blocking which are way too weak.)

I've seen many different methods used to make school manager happy to have yet another source of power to rule over students and enforce policy, but they all amount to:
* Censorship (DoS)
* User Tracking (Big Brother Style, to know what user credentials were used to authenticate and visit which sites, and possiblt generate reports to parents on viewing habits of their child.)

[This is where my political rant would be located if it were included.]

[Landus]

There are many things that schools can do to deal with enforcing policies on censoring content from students.
* Limit DNS requests and resolve all DNS for unacceptable domains to a private IP address held by a web server with one page for all requests "This site is blocked."
* Limit based on IP address of undesireable sites with outgoing or incoming filter rules.
* Limit by forcing use of a caching proxy that restricts based on domain much like anti-advertisement/banner blocking caching proxies.
* Limit based on an authentication (VLAN per port switching, ANA, VPN, caching proxy, SOCKS proxy, WEP key, kerberos, etc.)
* And a few more (including MAC Address blocking and port/service blocking which are way too weak.)

I've seen many different methods used to make school manager happy to have yet another source of power to rule over students and enforce policy, but they all amount to:
* Censorship (DoS)
* User Tracking (Big Brother Style, to know what user credentials were used to authenticate and visit which sites, and possiblt generate reports to parents on viewing habits of their child.)

[This is where my political rant would be located if it were included.]

Some of those have already been done. To make it easier to understand, there's three proxy servers:

proxya, proxyb, and proxye.

Proxya and proxyb are filtered. Proxye is unfiltered.

Now, networking isn't one of my strong points (I'll be taking a CISCO PCT Tech and Networking class next summer), but a WEP key only lets you access other accounts on a network.

For people with laptops with a wireless card built right in running WinXP, there's something that probes wireless networks in your area, and you can use that to connect to the net.

When I get a laptop (in the next century) I'm planning to wipe it clean and install Gentoo or Debian and see if I can connect to the network, and possibly make my own modifications to prevent this.

[Second]

Yeah..in our great school district, funding has provided IBooks for schools which teachers can "check out" for their class. We have a dedicated wireless network which is the default connection. And I don't really know what you mean by

For people with laptops with a wireless card built right in running WinXP, there's something that probes wireless networks in your area, and you can use that to connect to the net.

but the macs do this as well. For example...when I'm sitting in my English class, which is closest to the public street outside, a nice little "linksys" connection shows up. The signal isn't 100% but it's pretty darn close. I asked the head tech guy and he said it was some guy across the street running an open, unprotected network, and that he needed to go over their soon and talk to him about it. So I guess it's fortunate for me, not being smart, to have these things just present themselves to me. So now when I'm in class going on sites that everyone else can't get to, they all ask me how I do it and I feel really important and cool and uber 1337.

:)

[AlxRogan]

For example...when I'm sitting in my English class, which is closest to the public street outside, a nice little "linksys" connection shows up. The signal isn't 100% but it's pretty darn close. I asked the head tech guy and he said it was some guy across the street running an open, unprotected network, and that he needed to go over their soon and talk to him about it. So I guess it's fortunate for me, not being smart, to have these things just present themselves to me.

This is also considered "Theft of Service" in some jurisdictions. Unless you have the permission to access his network and resources, you could be committing a crime by doing this. The definition of allowing access by not properly securing has not been tested in a precedent lawsuit yet (AFAIK), so you are in a hazy area doing this. Just a heads up in case that guy across the street gets pissed off because someone happens to be leaching his bandwidth every day while you are in class.

[Second]

This is also considered "Theft of Service" in some jurisdictions. Unless you have the permission to access his network and resources, you could be committing a crime by doing this. The definition of allowing access by not properly securing has not been tested in a precedent lawsuit yet (AFAIK), so you are in a hazy area doing this. Just a heads up in case that guy across the street gets pissed off because someone happens to be leaching his bandwidth every day while you are in class.

Thanks for the heads up. But just for argument's sake, and I'm not trying to be a jerk about it or anything...

If he did find out that someone else was using his bandwidth, could it even be traced back to the exact user? The same set of laptops is used for the teacher (he checks it out for the day/week and every one of his classes uses them) They do not have specific log on requirements (every student uses the same "Student" account) so it doesn't go by ID number for example. So anyways, if he found out about it, wouldn't it just be traced back to the school or the actual computer?

[TheCotMan]

If he did find out that someone else was using his bandwidth, could it even be traced back to the exact user?

In this case, it is possible to track this to a specific user at the time of the event-- it is all a matter of effort and skill.
Prisons are filled with people who assumed they could not get caught.
(Consider DefCon... People try to bring down the wireless networks, and when the right people are on the task, these abusers can be found too.)

The same set of laptops is used for the teacher (he checks it out for the day/week and every one of his classes uses them) They do not have specific log on requirements (every student uses the same "Student" account) so it doesn't go by ID number for example. So anyways, if he found out about it, wouldn't it just be traced back to the school or the actual computer?

Depends on what kinds of obfuscation are involved, but MAC address is a potential data point. So is the fact that your NIC continues to broadcast to stay associated with the Access Point, and with that, directional information can be used (triangulation for example.)
Once there is a problem, an investigation could be launched and then things could be documented without your knowledge and then eventually traced to the (ab)user.

Would there be an investigation? Probably not unless the guy could show damages in excess of ${lots_of_money}.
It is more likely that policy would change to disallow students to use wireless laptops, or more restrictions would be imposed, or the guy would just add more security to his home LAN.

[Second]

Depends on what kinds of obfuscation are involved, but MAC address is a potential data point. So is the fact that your NIC continues to broadcast to stay associated with the Access Point, and with that, directional information can be used (triangulation for example.)

You know that hand motion people do where they pass it over their heads to signal not understanding? Yeah...that's what I just did :) guess I have some learning to do.

or more restrictions would be imposed, or the guy would just add more security to his home LAN.

That would seem like the most likely result..if any. Thanks for the response.

:)