flamingpeach

wardriving:

<security> (From wardialer in the "carrier scanner" sense of
that word) To drive around with a laptop with a wireless
card, and an antenna, looking for accessible wireless
networks.


I had my first wardriving experience tonight, and it was pretty neat.

My laptop has built in wifi but we stuck in a cisco card because it was more powerful. As soon as we left the house and turned on netstumbler we found a bunch of access points, and i was shocked to see just how many people don't bother to use encryption. (take into account my location ) We were out for just over 2 hours, and found 167 APs, over half which were unencrypted. 44 had the default SSID (linksys, NETGEAR, wireless, wLAN etc)

We used an app called Gfi LANguard to scan networks. Again, i was surprised at the utter lack of security most people have (passwordless shares).

Anyhow, i dropped a certain hello.jpg file into a few computers but didn't cause any harm. I browsed the web, talked on irc, and generally made use of having the web in the car, miles from home.


How many of you have gone wardriving? Do you do it on a regular basis? Any good stories?

__________________
I've eaten my veggies all my life so bring it on, I am educated and strong for the revolution.

Boner

About 2 years ago I went wardriving around the town that I live in. Wireless was just starting to take off then. I found 32 access points, and 3 were using WEP.

I now have a Compaq iPaq. A few weeks ago I threw my Orinoco card into it and drove across town on one of the major roads that goes east/west. I found over 70 APs. About 1/3 were using WEP. Lots of default SSIDs.

At this point I'd like to get a GPS and leave it hooked up to my laptop while I drive around.

I don't wardrive often, but I do occasionally walk down my street with the iPaq to survey the wireless activity going on around me.

MSD

When I put up my wireless network, I'm going to have a high-security setup, with my share directories, internet connection, and nothing else open. I believe that internet access should be free, and with a bit of bandwidth restriction, that's what I'll give to anyone in range.

The only places I know of in my town are Starbucks and a few houses.

rubicon

Shortly after getting my PowerBook I went driving down a 1/8 mile street in my 'hood. I found about 20 AP in that short time. I recently bought a GPS so I'll have to get it running and map the coordinates.

flamingpeach, I believe it's illegal to access a private network in the way that you did. We can argue that people should be smarter about computer security but invasion of someone's property is no excuse for their ignorance. Thankfully you wear a "white hat"!

__________________
How you do anything is how you do everything.

sailor

Ive been wanting to do it, but here at school dont have much of a reason to. The campus is almost all wireless, so just about anywhere on campus I get a signal through the campus network. I may give it a shot when I go home sometime, though.

__________________
"Good people do not need laws to tell them to act responsibly, while bad people will find a way around the laws."
--Plato

sailor

FP, I thought that netstumbler didnt support Cisco cards... What kind of card were you using?

__________________
"Good people do not need laws to tell them to act responsibly, while bad people will find a way around the laws."
--Plato

redravin40

It's even easier if you know the marks left by warchalkers.
Check this website for more info

http://www.warchalking.org/

charliex

i do it quite a bit, i've picked up over 2000 networks, but i live in los angeles, around 50% of them use WEP i'd say, of course just because they don't use WEP doesn't mean they are open and i don't usually check any further. The i upload the data to various websites.

Its actually not illegal to wardrive, remember you are transmitting your signal all over the place, even to my house, whats illegal would be stealing bandwidth, data or circumventing lock outs, anything beyond this is basically the lawyers and judges arguing over whos wrong to do what, and intent. My laptops OS automatically scans for highest available signal and connects to it, sometimes i don't even realise it connected to the wrong AP when i am out on site.

Its a bit like tuning into a private radio station that didnt encrypt, but they can always once you realised you werent supposed to be connected to it, why didnt you disconnect ?

sailor420: netstumbler might support cisco by NDIS support.

I'm writing my own tool thats like netstumbler, but with a lot more features for both wardriving and network admins, i was going to do a request for features post but i want to get some more ground work into, i'm still working on the core itself, when its ready i'll release it on tfp for whomever wants it

I use orinoccos and prism 2 cards, with one of those little kingston wifi detectors for quick tests (which is pretty crappy)

The best AP i found so far is a wide open 1.5MB each way in the middle of griffith park, that so far i haven't found anyone else using, so i can go out and enjoy the park and still work etc, i stopped to grab a can of coke from the machine and sat with my laptop to fiddle around for a bit, next thing yahoo IM pops into life.

I think warchalking can be a good idea so long as you don't screw anything up, it'll make people rethink their wireless security, of course i doubt 'the man' agrees most attempts to justify anything like this by any types of hackers ususally fails since you have to argue against something thats black and white to them.

flamingpeach

It's a Cisco Aironet card.

__________________
I've eaten my veggies all my life so bring it on, I am educated and strong for the revolution.

saltfish

I have to commend flamingpeah on her concern for others' privacy. I to, have also dropped text files into open shares letting the owner know that their system was wide open.

Remember, there are a great deal of people out there that have a hard time using a a mouse, and understanding the difference between a single click and a double click. These people do want to share printers and take advantage of wireless laptops.

As long as peoples behaviors are constructive and not destructive then they are helping out those that may not know any better.

-SF

rubicon

Hmm, using this logic, is it OK for me to walk into your house (I discovered the door was unlocked) and leave a note on your counter that says "Hi! Just letting you know your door was unlocked. You should really take more care before leaving the house. P.S. I didn't steal anything, take a dump in your toilet, or molest your underwear drawer."

I agree with your sentiments about helping others, but I'm not sure this is the way to go about it. What if such a do-gooder had a virus on their machine (unknown to them) and in their well-intentioned desire to help, it transferred itself on the other person's computer?

The ethical and legal issues are interesting and it's just a matter of time until the laws become clear on the subject. charliex is correct - wardriving of itself is not illegal but your actions using their AP might be.

I found this post about WiFi and accessing another's network via their AP. Sorry it's not from the EFF itself.

__________________
How you do anything is how you do everything.

Snakebyt

i have a wireless card for my laptop, but i havent went wardriving yet.. maybe this week ill give it a try

Mikee

Orinoco cards I have heard are the best for using NetStumbler and AirSnort. I however have not tested this.

Wardriving is fun though

Mephisto2

My job is managing the architecture & infrastructure of a global wireless network for a very large IT company you have all heard of.

Security is one of my main concerns. You'd be amazed at how many people simply setup their APs with default settings. It's kinda like people buying doors for their house, but not locking them; just assuming that once the doors are there then their home is secure.

You must remember that any unauthorized access to a company's network is illegal. Benign or not, you are breaking the law if you use their bandwidth, browse their folders, drop "friendly" TXT files onto their computers.

There is also a lot of misinformation out there about WLAN security. Following some very simple steps allows you to mitigate 99% (if not more) of all hacking attempts. Let me know if anyone wants some advice in this area.

Mr Mephisto

Mephisto2

charliex,

Would be very interested in hearing a bit more about this.

Are you familiar with APTools on SourceForge?


Mr Mephisto

Mephisto2

I couldn't agree with you more or, indeed, put it better.

I personally can't understand hackers. What's the point? Even surfing the net on someone else's AP is theft. No different from "stealing" cable TV.

And don't get me started on script kiddies or those who think it's "cool" to leave messages, drop notes or actually do damage.

Grrr...

Mr Mephisto

Pragma

Agreed, Meph. Just because getting in is so easy doesn't make it any less illegal - which is something a lot of people need to remember.

"But it's just as easy as walking into the AP's coverage area and turning on my laptop" - still illegal, don't do it without permission.

From the other perspective, you've got a lot of clueless people with computers out there. However, there's things that can be done - WEP, WPA, VPNs, (L)EAP, RADIUS, IPSec, etc.

The problem is that currently a lot of it is too complicated for your average users - there needs to be some kind of software breakthrough to get high-security methods to the home user - and turned on by default.

__________________
Eat antimatter, Posleen-boy!

Fallon

Being someone who is going thru school to be a Network Engineer, with hopefully a good background in Information Security, this intrigues me.
If though you find someone with an AP, and you're trying to be nice, what would be suggested to inform these people that they have a wide open connection for everyone else to use. Many of these people don't know enough about their equipment so that throws another kink into it. Should we just leave it there or what.
If I had a Wireless card and laptop, I'd prollay go around trying to help people. The only problem is while I'm helping them fix their problem, they'd be calling the cops and their lawyers to get me arrested.

joofoo

I had a neighbor who's WLAN was open.. I walked over to his door, knocked on it and informed him. He was very happy when I showed him how to secure it.

__________________
-
joofoo

saltfish

I'm confused...

Let us suppose that I find an open access point with default settings and happen to drop a text file alerting the owner of their "open" system.

They will then take care of the problem, set up encryption an make sure that their AP is secure. Thus preventing someone else from doing damage.

If by doing so, I may have helped them prevent a destructive attack...

So, that means that I'm just as bad as the guy who would have attacked them?

------

Following that logic:

I walk by my neighbor's door and notice that his keys were left in the door.. ..I knock on the door and let the neighbor know that they left their keys in the door.

Humm, I let them know that they left the keys in the door, and that someone could have opened their door, or even worse taken their car... ...and this is wrong?

Thoughts?

-SF

sailor

No, it would be more akin to your noticing they left the keys in the door, so you just walk in their house and find them to tell them. Knocking on the door is one thing, actually entering their house without permission is another.

__________________
"Good people do not need laws to tell them to act responsibly, while bad people will find a way around the laws."
--Plato

Mephisto2

Well said sailor.

ANY unauthorized access to a company's private network, via a wide open security hole or not, is illegal.

It's not that complicated.

Mr Mephisto

Vanquish

I would like to know how the study by Orinoco was able to be published if all of this is considered illegal. Is the law different in England? If anyone doesn't know of this, it was a study performed in London (I believe) that involved driving down 3 main streets and finding as many APs as they could and then commenting on each. Anyway this was back in the Pre WPA days, but still.
I am in the middle of a course much the same as fallon I believe, just in the early stages of it. (taking CCNA 1 currently LOL) and this is a big concern for me. I have never delt with Wireless before so I was wondering also how hard it was to set up WPA or a IPsec. VLANs speak for themselves, but WPA and IPsec are unkown to me at this time. If I can get any information from any of you on these two topics it would be appriciated. Thanks

Mephisto2

Hi Vanquish,

Setting up WPA is very easy.

WPA is effectively a security overlay, in that it still uses WEP as its encryption standard.

WPA comes in two "modes"; one for enterprise style deployments where an EAP mechanism is used to manage authentication and a SOHO version that manages the use of a "shared key" between the client and the AP; WPA-PSK mode.

I'll write up another WLAN Security post that goes into more detail if you want.

Mr Mephisto

rubicon

Whether it's the WLAN or the house keys, if you are "friendly" with your neighbor you go over there in person and inform them of the problem. If they're not home you leave a note or call.

If it's someone in your neighborhood that you don't know personally, I wouldn't invade their home network or house. You're a total stranger to them and they have no idea about your real intentions.

As for "helping" someone by leaving them a text file... First, they need to actually read the file. This might be questionable based on people's haphazard way of managing their files. If you took the time to browse into their actual Desktop folder then you're a snoop and eavesdropper - not a help. Secondly, if they're computer novices they won't have a clue what you're talking about. Maybe they'll ask a family member for help or they simply get disgusted with their computer and turn it off, return it, or god knows what else. Keep in mind the mental trauma you might give them, just knowing that a stranger had been in their system.

My point: no one knows anything about you, and therefore, by default cannot trust you or your intentions. Think about it - you'd feel the exact same way if it happened to you.

__________________
How you do anything is how you do everything.

Vanquish

Thanks Mephisto, we havn't gotten into this yet and it sparked my interest Anyway on an unrelated topic, I cant say much more because I have to get back to my god damn 3 month old hard drive that might of had a head crash and I might have lost around 50-80gb of personal Info LOL

charliex

Mr Mephisto : Yeah i've sen APTools, i use netstumbler, kismet, aeropeek, etc but i'm not happy with any of them, i want something that basically allows me to have a mappoint database etc updated in realtime with signal strengths so it maps out the area covered by the device, as well as all the other stuff included with stumbler etc, (and also not have it crash when WEP is enabled)

i'd like to do something like have a tool that generates what you'd expect to see from the base station, and have that overlaid with what you actually get.

I figure that'll also help pinpoint rogue AP's are you'll be able to see that the area covered has changed significantly ( more so that weather conditions or such would allow )

As well as that i want it to be able to pull in data from other machines in realtime, so a distributed stumbler (whcih would require the device to either have two network connections or one card and have it scan, switch, send, switch, scan etc

yeah i think the difference is your relationship with the company or people and how much of a hardass they would be about it, lets face it, even if you are doing some people a favour the righteous indignation can kick in even when you are secure, as for the finder having a virus, well if their network is wide open, they are volatile to getting that from anyone, and not even knowing.

I know i'd rather have some tell me my network was wide open than leave it and wait til someone malicous came along, i wouldn't get all uppity about it, ego doesn't come into it for me. if i screwed up i want to be told.

unfortunately theres no simple way of making sure its wide open.

i guess its a lot like spam lists that block ip ranges or test for open relays by sending a test message ? that is tecnically the same thing as connection to an AP, just because you have a SMTP server, doesn't mean you have given permission to use it, i had my indy on a private network for a while, then it got out on internet, i hadnt worried since i hadn't set anything up to listen, however out of the box, it had SMTP on , but it was misconfigured, so the message that was sent by an open relay checker, ended up being stuck in a loop the indy kept sending it to itself , as fast as it could, which brought the machine down, i'd been running a 3 week long simulation on that machine and had gone away for a few days, when i got back it was down, i could have gotten mad about the open relay checker just scanning me and finding that smtp port, but i think the reasons they have are valid, open relays are really bad things IMHO and although i lost three weeks of time for that , and had to run it again, i had locked down the machine safely before some spammer had used it, which would have gotten me blacklisted and possibly cut off by my provider.

to be honest, i'd be happy to allow people to use my AP for checking emaill etc, so long as i could control the bandwidth, and they couldn't access my internal network.

I'm still a believer in the difference between a wireless ap and passive things, i don't actively broadcast my door is open, or there is stuff inside, i do with my AP, its my responsibility to make sure the signal covers my house, and thats its locked down. The buck stops with me, its my fault if someone gets in. malicous or otherwise.

Of course just because WEP isn't enabled, doesnt mean the network is unprotected.

i fi get a virus coz of an open network, its my fault.
if someone walks into my house and steals sutff coz the doors open, its my fault.
if my car is pinched because i nip in for something and leave the keys in it, its my fault.

Mr.Deflok

Sitting outside a testing centre for Microsoft Certifications we gained access to a backend sytem of theirs, about 2 minutes we lost the connection and ran.

skinbag

How would someone with a cable modem and a wireless AP go about leaving some bandwidth or files open and keeping the rest of the network secure? ( I'd love to share my access as long as I could seal off my private space. )

sailor

I dont quite understand the question... Are you trying to open up the AP for others to use? Do you just want friends to use it, or do you want anyone to be able to use it?

__________________
"Good people do not need laws to tell them to act responsibly, while bad people will find a way around the laws."
--Plato

skinbag

Anyone else, so long as I can "firewall" my home network. I would like to supply internet access, not .local access.

Chingal0

Fuck, I had a great arguement but some ass sent me a link and i lost it. Basically, Jaywalking is illegal but noone gives a shit. Any sane person would appreciate a persons help if they pointed out that their comp/network/dog dish were succeptable to malicious hacker attack. I commend anyone who helps noobs out with this crap, and for you who think its loco, I understand your side as well, but I dont give a shit. I would help out said random person. Even tho it is illegal, its worth it. To me anyways.

And whats so bad about 'stealing' cable?!

__________________
"Eventually I became too sexy for my gym membership fee."

aarchaon

How do you stop people from accessing your network without blocking yourself out?

__________________
Green. Yellow. Blue.

steveincolumbus

aarchaon

you would need to enable WEP encryption on your wireless router as well as on you computer that you use wireless on....

skinbag

I do that, so I'm secure (Loooong, mixed character password on WEP);
Now that I am secure, I can't let anyone else 'share' my public files or my internet connection without giving them access to my personal files and helping them hack my system..(As I understand it anyway.)
I have OSX and a wireless AP -BTW. So if I turn off WEP people can log onto my network, but they would still have to log in as a User or Administrator to check out my desktop/system. As I'm running multi-user, my system should be as safe as the User's password, right? I've heard passwords can be broken, but I really have a hard time believing anyone would invest that much trouble with my little network.
-Sorry it's so long.-^- I guess I'm asking: "How much of a security risk is a 'Wardriver' with access to the Network if said 'Wardriver' has no login priveleges? And if they have no login priveleges, can they share the connection?" (Assuming I enabled the proper prefences.) As you can tell, I have no fucking idea...
BTW-As it is, my laptop shares the connection via the AP, and a login is still required to access my desktop machine via the network.

skinbag

That's what I'm talking about..MrSelfDestruct, where are you now?

shakran

]

ji don't think there's anything morally wrong with letting them know. Of course, if they're really clueless, how likely is it that they will notice that txt file?

Legally is another issue. Lemme give you an example. Several years ago a robber stole from a jewelry store. He was chased by the owner. A cab driver saw the whole thing and pinned the robber against a wall with his cab until cops could arrest him. The robber then sued the cab driver for injuring him, and won.

Another example (anyone who recognizes this guy gets 3 points.) A scientist at Los Alamos who was working on developing the nuclear bomb was walking into the base one day when he noticed a big hole in the security fence that the groundscrew were using to get in and out without having to deal with the gate guard. He began walking in the gate, then out through the hole, then back in the gate again. After a few times, the guard noticed that he kept going in, but never went out. The guard tried to arrest him - for pointing out a flaw in security, the guy almost got jailed.

In other words, our society is set up to punish those who warn us of problems with our stuff, even if they didn't themselves do any harm.