Wireless Networks

[Xodia]

All this talk of computer security in schools is hilarious to me. I go to a private Christian school, to them computer security is Cyber Sitter. The whole school abuses the network, and the system admin can't do anything about it.

I would say something about it, but I got banned from the lab the last time I did. :)

[Landus]

....

You've gotta be kidding.

[Thorn]

but the macs do this as well. For example...when I'm sitting in my English class, which is closest to the public street outside, a nice little "linksys" connection shows up. The signal isn't 100% but it's pretty darn close. I asked the head tech guy and he said it was some guy across the street running an open, unprotected network, and that he needed to go over their soon and talk to him about it. So I guess it's fortunate for me, not being smart, to have these things just present themselves to me. So now when I'm in class going on sites that everyone else can't get to, they all ask me how I do it and I feel really important and cool and uber 1337.

:)

This is also considered "Theft of Service" in some jurisdictions. Unless you have the permission to access his network and resources, you could be committing a crime by doing this. The definition of allowing access by not properly securing has not been tested in a precedent lawsuit yet (AFAIK), so you are in a hazy area doing this. Just a heads up in case that guy across the street gets pissed off because someone happens to be leaching his bandwidth every day while you are in class.

Precedence has been set. The State of Illinois has reportedly prosecuted multiple Theft of Services offenses of exactly this type, apparently quite successfully.

In most jurisdictions, Theft of Services is typically a low level misdemeanor and usually has a low fine and a minimal (if any) associated jail sentence. It is probably the least criminal offense that someone could or would be charged under these circumstances. TOS charges are usually associated with crimes such as stealing Cable TV or telephone service.

Depending on the actions taken by the abuser, their intent and the wording of the particular State's laws, Computer Crime laws may be also applied or even take priority. Potentially, the charges could be much more serious. For example, here in Vermont, merely communicating with the network is a misdemeanor carrying a fine of up to $500 and 6 months in jail. Using a network or computer service (e.g. checking email or surfing the web) or causing interference to the rightful network owner may elevate this to a felony with a maximum of 10 years jail and $10,000. On top of all that, the network owner gets to sue you civilly.

In comparison, a Theft of Service charge here for stealing Cable TV typically carries a fine of $25 - $100 and no jail time.

[AlxRogan]

Precedence has been set. The State of Illinois has reportedly prosecuted multiple Theft of Services offenses of exactly this type, apparently quite successfully.

In most jurisdictions, Theft of Services is typically a low level misdemeanor and usually has a low fine and a minimal (if any) associated jail sentence. It is probably the least criminal offense that someone could or would be charged under these circumstances. TOS charges are usually associated with crimes such as stealing Cable TV or telephone service.

Depending on the actions taken by the abuser, their intent and the wording of the particular State's laws, Computer Crime laws may be also applied or even take priority. Potentially, the charges could be much more serious. For example, here in Vermont, merely communicating with the network is a misdemeanor carrying a fine of up to $500 and 6 months in jail. Using a network or computer service (e.g. checking email or surfing the web) or causing interference to the rightful network owner may elevate this to a felony with a maximum of 10 years jail and $10,000. On top of all that, the network owner gets to sue you civilly.

In comparison, a Theft of Service charge here for stealing Cable TV typically carries a fine of $25 - $100 and no jail time.

I stand corrected. :) Thanks for the info.

[Second]

I go to a private Christian school

haha so did I...then I said something I shouldn't have, and now I go to my local public high school :)

Anyways, thanks for the information Thorn, guess I'll cut the linksys business and stick with my school connection, albeit filtered by the great 8e6 R3000 filter.

But hey, at least it's there for our own good.

:)

[Thorn]

I stand corrected. :) Thanks for the info.

haha so did I...then I said something I shouldn't have, and now I go to my local public high school :)

Anyways, thanks for the information Thorn, guess I'll cut the linksys business and stick with my school connection, albeit filtered by the great 8e6 R3000 filter.

But hey, at least it's there for our own good.

:)

You're both welcome. I should point out that as far as I know, no one has been charged with a felony for doing something relatively minor like checking email. It is just possible under the laws.

Most of the cases that I'm aware of where a felony was charged for using a wireless connection also involved some other computer crime such as altering medical records (So. Carolina), dumping raw sewage* (Australia), downloading kiddie porn (Ontario), and attempted theft of credit card information (Michigan).

*While this doesn't sound like a typical computer crime, the perpetrator did it through a WiFi/SCADA control system. The offense was repeated several times until the sewer plant operators figured out how and why it was done. It reportedly cost in excess of $15 million USD to clean up the resulting environmental damage.

[TheCotMan]

Most of the cases that I'm aware of where a felony was charged for using a wireless connection also involved some other computer crime such as altering medical records (So. Carolina), dumping raw sewage* (Australia), downloading kiddie porn (Ontario), and attempted theft of credit card information (Michigan).

Ahh yes! Other than damages in ${large_amount_of_money}, other crimes committed while stealing services can help push simple theft of service from "sorry, too small of a crime to investigate" to an "open investigation" due to selective enforcement and available resources.
Size of department can also play a role in enforcement... Smaller departments don't seem to have much in the way of computer crime specialists, but YMMV.

If theft of service becomes publicized with public backing, politics can push enforcement of these laws. If a high profile crime is committed in an area, Police may allocate more resources to enforcement in order to create the appearance of active enforcement, but the next major thing that happens will pull resources away from this too. (Much like what is found after murders in affluent parts of town... immediate increase in police presence that is not sustained over the long term.)

[Police departments seem to be like the corporate world, where purchases (new investigations) have to be justified-- especially when they use new, or expensive resources. Even police departments have "managers" who must balance their budgets.]

Thorn, you kick ass, man. Good info!

[Thorn]

Ahh yes! Other than damages in ${large_amount_of_money}, other crimes committed while stealing services can help push simple theft of service from "sorry, too small of a crime to investigate" to an "open investigation" due to selective enforcement and available resources.
Size of department can also play a role in enforcement... Smaller departments don't seem to have much in the way of computer crime specialists, but YMMV.

If theft of service becomes publicized with public backing, politics can push enforcement of these laws. If a high profile crime is committed in an area, Police may allocate more resources to enforcement in order to create the appearance of active enforcement, but the next major thing that happens will pull resources away from this too. (Much like what is found after murders in affluent parts of town... immediate increase in police presence that is not sustained over the long term.)

I can tell you from many years in that line of work, that two things influence every investigation (although it is not always stated so overly):
1) Economics. Is it worth the investigators time/other police resources for the expected return?
2) What is the public perception over this activity/inactivity?

Two quick (and extreme) examples:
A) An extremely high percentage of burglarlies could cleared if a full crime scene workup was done and a seperated investigative team was assigned to each one, but the costs would be outrageous. Instead, for the most part, little more is done than a report taken for insurance purposes. The economic return is so little against the required costs for solving it, that it would be foolish to spend the resources.

B) A full investigative effort is expended on a parent who murders a child. Economically, there is little reason for this, and realistically the general public is usually in very little danger from such a person. However, the revulsion and public outrage to such a crime is so high (probably due to long ingrained species survival traits) that it is fully justified in the taxpayer's minds.

So you're correct. When and if wireless attacks become fully integrated in the public perception as part and parcel (or even just a precursor) to other computer related crimes such as identity theft, then there will be more vigorous enforcement.

Thorn, you kick ass, man. Good info!

Thanks. As a great man once said "I'm all about the service."

[highwizard]

Thanks. As a great man once said "I'm all about the service."

It's a sad day when you quote Chris.

[lil_freak]

So you're correct. When and if wireless attacks become fully integrated in the public perception as part and parcel (or even just a precursor) to other computer related crimes such as identity theft, then there will be more vigorous enforcement.

The when and if has happened here where I live and it amounts to a lot of empty bottles of Tylenol. Not to forget the in-depth investigations which can lead a person to madness.


With new computer federal grant awards going out every year I think more law enforcement agencies will try to push for an expansion to their forensic computer laboratory capabilities, much like what we did here in Colorado.

[alklloyd]

I should point out that as far as I know, no one has been charged with a felony for doing something relatively minor like checking email. It is just possible under the laws.

Coming from you that's good news...since XP connects to unsecured networks by default.

Al K. Lloyd

[Oddz]

proxy sites

what are the proxy sites available?

[Oddz]

All this talk of computer security in schools is hilarious to me. I go to a private Christian school, to them computer security is Cyber Sitter. The whole school abuses the network, and the system admin can't do anything about it.

I would say something about it, but I got banned from the lab the last time I did. :)

Schools are just afraid of having their reputation tarnished. If students visit undesired sites in school, action would be taken against the school and not the students.

[TheCotMan]

what are the proxy sites available?

This question has come up many times before now, and if you use the forum search, you can find threads where proxy servers are discussed (as well as how to find more.)

[Nimby]

Also ... as doubtful as this might be, the person with teh "linksys" AP could be packet capturing anyone connecting to his AP.

so, when you check your email, your bank account, sign into forums (like this one! ;) ) you could have your info snagged by another person.

(I'm assuming the AP is unprotected by WEP or WAP, since you're able to affilate with it and you didn't mention needing a key)