Piggybacking - Revision history

Chenc8 at 05:23, 2 December 2007

2007-12-02T05:23:07Z

← Older revision		Revision as of 05:23, 2 December 2007
Line 29:		Line 29:

	== Views and Ethics ==		== Views and Ethics ==
-	Views on piggybacking vary widely amongst people because of the controversial nature of the practice. On one side, advocates believe the practice does not harm anyone while benefiting the piggybacker. On the other side, advocates describe the practice to "freeloading" as bandwidth costs money and the piggybacker essentially gets it for free. The table below summarizes some of these arguments with ~~anologies~~.	+	Views on piggybacking vary widely amongst people because of the controversial nature of the practice. On one side, advocates believe the practice does not harm anyone while benefiting the piggybacker. On the other side, advocates describe the practice to "freeloading" as bandwidth costs money and the piggybacker essentially gets it for free. The table below summarizes some of these arguments with analogies.

	{\| border="5" cellspacing="5" cellpadding="2" align="center"		{\| border="5" cellspacing="5" cellpadding="2" align="center"
Line 72:		Line 72:
	WPA also boasts a more secure message integrity code or MIC with the Michael algorithm.		WPA also boasts a more secure message integrity code or MIC with the Michael algorithm.
	Later, they introduced WPA2 which strengthens the security with new algorithms such as CCMP which stands for Counter Mode with Cipher Block Chaining Message Authentication Protocol.		Later, they introduced WPA2 which strengthens the security with new algorithms such as CCMP which stands for Counter Mode with Cipher Block Chaining Message Authentication Protocol.
		+	While generally strong, an exploit to WPA's flaw can crack the encryption. This method relies on obtaining the Pre-Shared Key (PSK) by monitoring network traffic packets when a valid computer logs into the network. Some tools that facilitate this are kisMAC or coWPATTY.

	== Legalities ==		== Legalities ==
	=== Canada ===		=== Canada ===
-	While there are many differences in the laws between one country and another, in Canada the law could be interpreted in such a way that makes piggybacking illegal. A Toronto lawyer Gil Zvulony commented on CBC’s Spark Radio recently and says that if the police ever showed up because you were piggybacking, the only way you can be charged was if the crown could ~~proof~~ you knew ~~that you were doing something~~ wrong.	+	While there are many differences in the laws between one country and another, in Canada the law could be interpreted in such a way that makes piggybacking illegal. A Toronto lawyer Gil Zvulony commented on CBC’s Spark Radio recently and says that if the police ever showed up because you were piggybacking, the only way you can be charged was if the crown could prove you knew it was wrong to piggyback.

	The closest thing someone being charged with piggybacking was where a Toronto man was caught literally with his pants down downloading child pornography using someone's wireless network. Ultimately, he was charged for the pornography and not the piggybacking.		The closest thing someone being charged with piggybacking was where a Toronto man was caught literally with his pants down downloading child pornography using someone's wireless network. Ultimately, he was charged for the pornography and not the piggybacking.
Line 81:		Line 82:
	=== Singapore ===		=== Singapore ===

-	~~In Singapore,~~ Garyl Tan Jia Luo became the first man to be convicted of piggybacking on January 16th, 2007 and was sentenced for 18 months probation with 80 hours of community service.	+	Garyl Tan Jia Luo became the first man to be convicted of piggybacking on January 16th, 2007 and was sentenced for 18 months probation with 80 hours of community service.
		+	Lin Zhenghuang was convicted and sentenced to 3 months jail time and a $4000 fine when he used his neighbor's internet to post a fake bombing report on forums managed by HardwareZone. The judge clarified the jail time would not be sentenced for piggybacking alone but for piggybacking "committed in order to facilitate the commission of or to avoid detection for some more serious offense" as with Mr. Zhenguang's case.

	== References ==		== References ==

Chenc8 at 04:37, 2 December 2007

2007-12-02T04:37:16Z

← Older revision		Revision as of 04:37, 2 December 2007
Line 56:		Line 56:
	It is very ineffective against people with a little computer knowledge and the will to gain access to the network since WEP is cryptographically weak and takes only a few minutes to crack. There have been attempts to enhance the security such as:		It is very ineffective against people with a little computer knowledge and the will to gain access to the network since WEP is cryptographically weak and takes only a few minutes to crack. There have been attempts to enhance the security such as:
	*WEP2		*WEP2
		+	** Enforces the minimum size of encryption to 128 bits
	*WEP+		*WEP+
-	*~~dynamic WEP~~ which ~~changes~~ the key periodically	+	** Proprietary enhancement by Agere Systems which strengthens initialization vectors
		+	*Dynamic WEP
		+	** Changes the key periodically
	None are substantially more effective.		None are substantially more effective.
	=== MAC Address Authentication ===		=== MAC Address Authentication ===
	A computer trying to connect to the network will be allowed to do so if and only if their MAC address conforms the list of allowed MAC addresses. This is cumbersome to setup for the administrator as he or she will have to add everyone’s MAC address to the list. This method does not prevent data from being stolen since there is no encryption. And even then, an attacker can observe network traffic and obtain valid MAC addresses and then spoof their MAC address to gain access.		A computer trying to connect to the network will be allowed to do so if and only if their MAC address conforms the list of allowed MAC addresses. This is cumbersome to setup for the administrator as he or she will have to add everyone’s MAC address to the list. This method does not prevent data from being stolen since there is no encryption. And even then, an attacker can observe network traffic and obtain valid MAC addresses and then spoof their MAC address to gain access.
-		+	=== Honeypot ===
		+	One can set up a fake network for would-be piggybackers to connect to and see what they do. After they connect and their MAC address is logged, one can ban their MAC address from connecting to their network.
	=== IPSec ===		=== IPSec ===
	Ip security or IPSec is used to encrypt traffic, reducing or possibly eliminating all plain text information sent across the network. It is composed of a suite of protocols such as authentication, encrypting IP packets, or cryptographic key establishment as we have read about in Chapter 9 Key Management of the textbook.		Ip security or IPSec is used to encrypt traffic, reducing or possibly eliminating all plain text information sent across the network. It is composed of a suite of protocols such as authentication, encrypting IP packets, or cryptographic key establishment as we have read about in Chapter 9 Key Management of the textbook.
Line 96:		Line 100:
	== See Also ==		== See Also ==
	[[Social engineering]]<BR>		[[Social engineering]]<BR>
		+	[[Honeypot]]<BR>

	== External Links ==		== External Links ==
	* [http://www.zvulony.com/ Zvuloney & Co]		* [http://www.zvulony.com/ Zvuloney & Co]
		+	* [http://en.wikipedia.org/wiki/Wireless_community_network Wireless Community Networks]

	--[[User:Chenc8\|Chenc8]] 13:53, 1 December 2007 (EST) Jinn Tarng Christopher Chen		--[[User:Chenc8\|Chenc8]] 13:53, 1 December 2007 (EST) Jinn Tarng Christopher Chen

Chenc8 at 04:23, 2 December 2007

2007-12-02T04:23:32Z

← Older revision		Revision as of 04:23, 2 December 2007
Line 27:		Line 27:
	Of all the student’s surveyed, only about 20% expressed concerned about security issues when using somebody’s wireless network and said they would not send passwords or do any other information sensitive actions.		Of all the student’s surveyed, only about 20% expressed concerned about security issues when using somebody’s wireless network and said they would not send passwords or do any other information sensitive actions.
	<br style="clear:both;"/>		<br style="clear:both;"/>
		+
	== Views and Ethics ==		== Views and Ethics ==
-	~~Advocates for~~ piggybacking ~~state that~~ the practice ~~is harmless~~ and ~~compare~~ it to ~~drinking~~ from a public water fountain ~~or sharing~~ a cup of sugar. One writes, “Leaving a network open is just being a good neighbor”.	+	Views on piggybacking vary widely amongst people because of the controversial nature of the practice. On one side, advocates believe the practice does not harm anyone while benefiting the piggybacker. On the other side, advocates describe the practice to "freeloading" as bandwidth costs money and the piggybacker essentially gets it for free. The table below summarizes some of these arguments with anologies.
-	~~Advocates against piggybacking compare the practice to entering a home just because it is unlocked or stealing cable from your neighbor with a splitter~~.	+
		+	{\| border="5" cellspacing="5" cellpadding="2" align="center"
		+	\|+ '''Analogies to Piggybacking Wireless Internet'''
		+	! Advocates For !! Advocates Against
		+	\|-
		+	\|
		+	* Drinking from a public water fountain
		+	* Reading over someone's shoulder
		+	* Eating leftovers a restaurant has thrown away
		+	* Borrowing a cup of sugar
		+	* Enjoying music playing from a neighbor's backyard
		+	\|
		+	* Entering a home just because the door is unlocked
		+	* Stealing cable from a neighbor with a splitter
		+	* Hanging on the outside of a bus to get a free ride
		+	\|}
		+
		+	About 30% of the students surveyed in the McMaster University survey who said they have piggybacked in the past or present believe it is the network owner's responsibility to enable security. Responses such as "It is their fault for not enabling security in the first place" and "It's fair game" are some of the more cynical reasons students said in favor for piggybacking. One writes, “Leaving a network open is just being a good neighbor”.

-	~~Besides the bandwidth loss, a~~ person can commit some serious crimes with the Internet services he or she gains through piggybacking, such as hacking into sensitive information, downloading child pornography, etc.	+	A person can commit some serious crimes with the Internet services he or she gains through piggybacking, such as hacking into sensitive information, downloading child pornography, etc while remaining pretty much anonymous without a trail leading back them. Especially if many people piggyback on a single network, bandwidth can become an issue. Users on the network may experience major slow down if many people are using the network simultaneously or if there are a lot of downloads.

	== Prevention ==		== Prevention ==

Chenc8 at 21:45, 1 December 2007

2007-12-01T21:45:15Z

← Older revision		Revision as of 21:45, 1 December 2007
Line 7:		Line 7:
	The recent explosive growth of wireless technology found in the market can be attributed to the many benefits wireless telecommunications provide. From the casual Internet surfer to the technological inclined power user, wireless networks provide the convenience of mobility, keeping up with today’s trends in increasing portability and decreasing size of our devices. Unfortunately, wireless networks also suffer from more attacks and abuse because of how easy it is to locate and connect to wireless networks in comparison to traditional wired ones. In combination with the lack of strong default security counter measures, the controversial practice of piggybacking has increasingly become more common.		The recent explosive growth of wireless technology found in the market can be attributed to the many benefits wireless telecommunications provide. From the casual Internet surfer to the technological inclined power user, wireless networks provide the convenience of mobility, keeping up with today’s trends in increasing portability and decreasing size of our devices. Unfortunately, wireless networks also suffer from more attacks and abuse because of how easy it is to locate and connect to wireless networks in comparison to traditional wired ones. In combination with the lack of strong default security counter measures, the controversial practice of piggybacking has increasingly become more common.

-	Piggybacking should not be confused with wardriving which involves only the mapping of the insecure access points. In addition, people connecting to a hotspot service provided by businesses is generally not considered as piggybacking.	+	Piggybacking should not be confused with [http://en.wikipedia.org/wiki/Wardriving wardriving] which involves only the mapping of the insecure access points. In addition, people connecting to a hotspot service provided by businesses is generally not considered as piggybacking.

	== Statistics ==		== Statistics ==
Line 77:		Line 77:

	== See Also ==		== See Also ==
		+	[[Social engineering]]<BR>

	== External Links ==		== External Links ==
-	--[[User:Chenc8\|Chenc8]] 13:53, 1 December 2007 (EST) Christopher Chen	+	* [http://www.zvulony.com/ Zvuloney & Co]
		+
		+	--[[User:Chenc8\|Chenc8]] 13:53, 1 December 2007 (EST) Jinn Tarng Christopher Chen