<?xml version="1.0"?>
<?xml-stylesheet type="text/css" href="http://wiki.cas.mcmaster.ca/skins/common/feed.css?207"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
		<id>http://wiki.cas.mcmaster.ca/index.php?feed=atom&amp;target=Chenc8&amp;title=Special%3AContributions</id>
		<title>Computing and Software Wiki - User contributions [en]</title>
		<link rel="self" type="application/atom+xml" href="http://wiki.cas.mcmaster.ca/index.php?feed=atom&amp;target=Chenc8&amp;title=Special%3AContributions"/>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/Special:Contributions/Chenc8"/>
		<updated>2026-05-23T06:11:16Z</updated>
		<subtitle>From Computing and Software Wiki</subtitle>
		<generator>MediaWiki 1.15.1</generator>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security</id>
		<title>VoIP (Voice Over IP) Security</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security"/>
				<updated>2008-04-14T03:07:13Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''VoIP''' (Voice over Internet Protocol) is a protocol used for the transmission of voice data across the Internet.  IP telephony treats voice as another form of data that is compressed and optimized for network traffic and is vulnerable to attacks traditional data would be on the network.  VoIP security is akin to network security; voice data traveling the network will look like any other normal data.&lt;br /&gt;
[[Image:oldphone.JPG|frame|right|Has VoIP evolved enough so that the benefits outweigh the costs?]]&lt;br /&gt;
Corporations generally place VoIP concerns on the voice quality, latency, and quality of service above the overall security when VoIP telephony is actually more vulnerable to certain attacks compared to the traditional phone system.[1]  The most common threats found in the VoIP environment include eavesdropping, theft of services, and denial of service attacks.[7]&lt;br /&gt;
&lt;br /&gt;
==Introduction==&lt;br /&gt;
To greater understand VoIP security, a general overview of VoIP systems is useful.  &lt;br /&gt;
&lt;br /&gt;
===Components===&lt;br /&gt;
A typical VoIP system includes four components[6]:&lt;br /&gt;
&lt;br /&gt;
{| border=&amp;quot;1&amp;quot; cellpadding=&amp;quot;2&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
|width=&amp;quot;5%&amp;quot;|'''Data Network'''&lt;br /&gt;
|width=&amp;quot;90%&amp;quot;|&lt;br /&gt;
* Must be high performance to avoid choppy communication&lt;br /&gt;
* QoS (Quality of Service) standard to prioritize voice traffic over data traffic&lt;br /&gt;
** DiffServ&lt;br /&gt;
*** Layer 3 QoS mechanism&lt;br /&gt;
** 802.1p&lt;br /&gt;
*** Layer 2 QoS mechanism&lt;br /&gt;
|-&lt;br /&gt;
|'''IP Handset'''&lt;br /&gt;
|&lt;br /&gt;
* Handset has to be IP enabled so audio stream can be digitized to be transmitted on the IP network&lt;br /&gt;
|-&lt;br /&gt;
|'''Call Server'''&lt;br /&gt;
| &lt;br /&gt;
* Application running on dedicated workstation&lt;br /&gt;
* Provides all call signaling&lt;br /&gt;
* Provides all call control functionality&lt;br /&gt;
* Core operating code of a PBX (Private Branch Exchange) transferred here&lt;br /&gt;
|-&lt;br /&gt;
|'''Gateway'''&lt;br /&gt;
|&lt;br /&gt;
* Voice connectivity between IP network and public carrier network&lt;br /&gt;
* Can be taken over by hackers to make free calls&lt;br /&gt;
|}&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
===VoIP Protocols===&lt;br /&gt;
Voice is connection oriented, hence communication between two parties must be set up first.  Two of the most common protocols used are H.323 and Session Initiation Protocol (SIP).  Here is a very brief overview of the two protocols.[6]&lt;br /&gt;
&lt;br /&gt;
====H.323====&lt;br /&gt;
H.323 is a standard to promote compatibility in video conference transmissions over IP networks.[8]&lt;br /&gt;
&lt;br /&gt;
H.323 has four main components:&lt;br /&gt;
# Terminal&lt;br /&gt;
# Gateway&lt;br /&gt;
# Multipoint Control Unit (MCU)&lt;br /&gt;
# Gatekeeper&lt;br /&gt;
&lt;br /&gt;
====Session Initiation Protocol====&lt;br /&gt;
[[Image:SIP.JPG|right|thumb|Source:http://www.cisco.com/univercd/cc/td/doc/product/voice/sipsols/biggulp/bgsipov.htm]]&lt;br /&gt;
SIP is a peer-to-peer standard protocol for multimedia conferencing over IP.  SIP exists on the application layer used to initiate, maintain, as well as terminate a call.  SIP contains 3 components: [5,8]&lt;br /&gt;
# User agent client or user agent server&lt;br /&gt;
# Proxy server&lt;br /&gt;
# Redirect server&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
==Attacks==&lt;br /&gt;
There are three main types of attacks that the VoIP environment are susceptible to including eavesdropping, theft of services, and denial of service attacks.[7]&lt;br /&gt;
&lt;br /&gt;
===Eavesdropping===&lt;br /&gt;
Eavesdropping on VoIP calls involves third parties monitoring the call signal packets in which the hacker may learn of confidential information such as name, passwords, and other personal information.  This is especially significant to businesses as corporate sensitive information may be revealed.[6]&lt;br /&gt;
&lt;br /&gt;
VoIP eavesdropping is easier accomplished that eavesdropping the traditional telephone line through physical wiretap since the hacker must physically place the wiretap.  Since VoIP calls send data across the network, the hacker can sniff for packets anywhere along the network.&lt;br /&gt;
&lt;br /&gt;
To eavesdrop a call there are 3 simple steps:&lt;br /&gt;
# Understanding how IP Telephony works.  &lt;br /&gt;
# Obtain tools.  &lt;br /&gt;
# Connect the tools into the IP network.&lt;br /&gt;
&lt;br /&gt;
A typical eavesdropper would:&lt;br /&gt;
# Perform a side channel attack based on the fact all IP Telephony implementations use Real Time Protocol(RTP) to transfer packets.&lt;br /&gt;
# Download, install, and run Fireberd DNA-323 to capture and replay voice packets.[6]&lt;br /&gt;
# Connect to the IP network the VoIP conversation is taking place on.&lt;br /&gt;
&lt;br /&gt;
====Data Encryption====&lt;br /&gt;
The most effective countermeasure to eavesdropping is data encryption.  As seen in class, there are many data encryption methods, some more effective than others.  However, all methods introduce overhead which can greatly effect the quality of the conversation by causing large packet loss and packet jitter.  Here are some common ways of implementing data encryption for VoIP: [2,3]&lt;br /&gt;
&lt;br /&gt;
* Using software such as [http://zfoneproject.com/ Zfone]&lt;br /&gt;
* Using VoIP clients with built in encryption such as Skype&lt;br /&gt;
Skype comes with its own propriety encryption method.  Some other common methods include:&lt;br /&gt;
[http://en.wikipedia.org/wiki/Data_Encryption_Standard Data Encryption Standard](DES),  &lt;br /&gt;
[http://en.wikipedia.org/wiki/Triple_DES Triple DES] (3DES), &lt;br /&gt;
[http://en.wikipedia.org/wiki/Advanced_Encryption_Standard Advanced Encryption Standard] (AES)&lt;br /&gt;
* Using a Virtual Private Network (VPN)&lt;br /&gt;
===Theft of Services===&lt;br /&gt;
One of the great things about VoIP is the fact that you can take it anywhere in the world that has internet access and use it.  Unfortunately, this also benefits the hacker so that he or she may steal access to your VoIP services and then possibly do criminal activities with them.  Also known as VoIP &amp;quot;phreaking&amp;quot;, the hacker can steal your VoIP services through two common ways:[7]&lt;br /&gt;
* '''Spoofing'''&lt;br /&gt;
** Accomplished through changing the header data in the voice packet so it looks like it comes from a different source&lt;br /&gt;
** Hacking into SIP changing SIP registrar information&lt;br /&gt;
* '''Man in the middle attack''' (MITM).&lt;br /&gt;
** Accomplished through monitoring traffic, recording it and/or changing it&lt;br /&gt;
&lt;br /&gt;
====Authentication====&lt;br /&gt;
The most effective countermeasure to theft of VoIP services involves implementing authentication.  Fortunately, VoIP protocols include some form of authentication.  Specifically, the H.235 component of H.323 facilitates 3 types of authentication: [4]&lt;br /&gt;
# Symmetric encryption&lt;br /&gt;
# Subscription based&lt;br /&gt;
# IPSEC&lt;br /&gt;
Subscription based is much more CPU intensive than symmetric encryption and requires the sharing of a secret key before communication can begin.  Alternatively, H.235 may allow IPSEC to handle the authentication.&lt;br /&gt;
SIP also provides 3 different types of authentication:[8]&lt;br /&gt;
# Basic authentication&lt;br /&gt;
# Digest authentication&lt;br /&gt;
# PGP authentication&lt;br /&gt;
However, all three are challenge-response based.&lt;br /&gt;
&lt;br /&gt;
Other authentication methods include but not limited to:&lt;br /&gt;
* Public key authentication with certification&lt;br /&gt;
* Diffie-Hellman key exchange&lt;br /&gt;
* [http://www.cisco.ws/en/US/docs/ios/12_1t/12_1t2/feature/guide/uni_osp.html UNI-OSP] from Cisco&lt;br /&gt;
&lt;br /&gt;
===Denial of Services===&lt;br /&gt;
    &lt;br /&gt;
{|align=&amp;quot;right&amp;quot;&lt;br /&gt;
    |[[image:DoS.JPG|right|thumb|600px|Source:http://www.hillside.net/plop/2007/papers/PLoP2007_PelaezEtAl.pdf]]&lt;br /&gt;
    |}&lt;br /&gt;
&lt;br /&gt;
There are two main types of denial of services attacks in the VoIP environment including:&lt;br /&gt;
# Exploiting software bugs to bring down servers&lt;br /&gt;
# Distributed bandwidth attack&lt;br /&gt;
Before a DoS attack can take place, the hacker must first use a sniffing program to look for vulnerable hosts.  As discussed in class, a port scanner is useful to identify those hosts.  In a distributed DoS (DDoS) attack, once the vulnerable host is found, a program sometimes called a bot is installed on the computer and awaits for instructions.  The infected computers, sometimes called zombies as in the image to the right, can then be coordinated to  bombard a target with traffic effectively disabling it.[7,10]&lt;br /&gt;
&lt;br /&gt;
====Packet Filtering====&lt;br /&gt;
Denial of service attacks are hard to defend against because of the nature of the attack; The attack is hard to distinguish from normal traffic.  The method to defend against DoS attacks used today is mainly packet filtering and/or firewalls.  The packet filter must look for suspicious packets and block them before reaching the target.  There is still a great amount of work that can be done in this area.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
===Summary===&lt;br /&gt;
{| border=&amp;quot;1&amp;quot; align=&amp;quot;right&amp;quot;&lt;br /&gt;
|&lt;br /&gt;
{| border=&amp;quot;5&amp;quot; cellspacing=&amp;quot;5&amp;quot; cellpadding=&amp;quot;2&amp;quot; align=&amp;quot;right&amp;quot;&lt;br /&gt;
|+ '''VoIP Security Vulnerabilities'''&lt;br /&gt;
! Threat!! Countermeasures&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Eavesdropping'''&lt;br /&gt;
| &lt;br /&gt;
Data Encryption&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Theft of services'''&lt;br /&gt;
|&lt;br /&gt;
Authentication&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Denial of Services''' &lt;br /&gt;
|&lt;br /&gt;
Packet Filtering&lt;br /&gt;
|}&lt;br /&gt;
|-&lt;br /&gt;
| align=&amp;quot;center&amp;quot;|A short summary&lt;br /&gt;
|}&lt;br /&gt;
Although there is more than way one to defend against a certain kind of attack, the most common countermeasures to the attacks listed in this wiki are summarized in the table to the right.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==Recommendations==&lt;br /&gt;
&lt;br /&gt;
Although a network cannot be completely immune to attack, here are some recommendations to secure your VoIP network. [8]&lt;br /&gt;
&lt;br /&gt;
#	Do not user shared media devices (ie hubs) on networks&lt;br /&gt;
#	All VoIP traffic should be encrypted&lt;br /&gt;
#	VoIP servers with confidential information should be treated as a confidential database&lt;br /&gt;
#	Build redundancy into VoIP network.&lt;br /&gt;
#	Make sure firewall is VoIP aware&lt;br /&gt;
&lt;br /&gt;
==References==&lt;br /&gt;
# Jaikumar Vijayan. &amp;quot;VOIP: Don't overlook security&amp;quot;.  Retrieved on 2008-04-08. [http://www.computerworld.com/securitytopics/security/story/0,10801,74840,00.html]&lt;br /&gt;
# Bruce Schneier.  &amp;quot;VOIP Encryption&amp;quot;.  Retrieved on 2008-04-12. [http://www.schneier.com/blog/archives/2006/04/voip_encryption.html]&lt;br /&gt;
# &amp;quot;How to: Encrypt Your VoIP&amp;quot;. Retrieved on 2008-04-11. [http://www.voipnow.org/2007/04/how_to_encrypt_.html]&lt;br /&gt;
# &amp;quot;VoIP Authentication (UNI-OSP) Feature&amp;quot;. Retrieved on 2008-04-12. [http://www.cisco.ws/en/US/docs/ios/12_1t/12_1t2/feature/guide/uni_osp.html]&lt;br /&gt;
# &amp;quot;Overview of the Session Initiation Protocol&amp;quot;. Retrieved on 2008-04-12. [http://www.cisco.com/univercd/cc/td/doc/product/voice/sipsols/biggulp/bgsipov.htm]&lt;br /&gt;
# Tom Long. &amp;quot;Eavesdropping an IP Telephony Call&amp;quot;. Retrieved on 2008-04-09. [http://www.sans.org/reading_room/whitepapers/telephone/318.php]&lt;br /&gt;
# Philip Bednarz. &amp;quot;How VoIP is changing the network security equation&amp;quot;. Retrieved on 2008-04-09. [http://www.eetimes.com/showArticle.jhtml;jsessionid=ERU1FKTFCHUJUQSNDLPCKH0CJUNN2JVN?articleID=16505939]&lt;br /&gt;
# Eric Weiss. &amp;quot;Security Concerns with VOIP&amp;quot;. Retrieved on 2008-04-09. [http://www.sans.org/reading_room/whitepapers/voip/323.php]&lt;br /&gt;
# Peter Thermos. &amp;quot;Two attacks against VoIP&amp;quot;. Rerieved on 2008-04-09. [http://www.securityfocus.com/infocus/1862]&lt;br /&gt;
# Juan C. Pelaez, Eduardo B. Fernandez, Maria M. Larrondo-Petrie, Christian Wieser. &amp;quot;Attack Patterns in VoIP&amp;quot;. Retrieved on 2008-04-12. [http://www.hillside.net/plop/2007/papers/PLoP2007_PelaezEtAl.pdf]&lt;br /&gt;
==See Also==&lt;br /&gt;
[[Two-factor Authentication]]&amp;lt;BR&amp;gt;&lt;br /&gt;
[[Public Key Encryption Algorithms]]&amp;lt;BR&amp;gt;&lt;br /&gt;
[[Peer to Peer Network Security]]&amp;lt;BR&amp;gt;&lt;br /&gt;
[[Streaming Media Technology]]&amp;lt;BR&amp;gt;&lt;br /&gt;
[[Secure Electronic Transaction (SET) Protocol]]&amp;lt;BR&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==External Links==&lt;br /&gt;
* [http://en.wikipedia.org/wiki/Session_Initiation_Protocol Session Initiation Protocol]&lt;br /&gt;
* [http://en.wikipedia.org/wiki/H.323 H.323]&lt;br /&gt;
* [http://en.wikipedia.org/wiki/VoIP VoIP]&lt;br /&gt;
&lt;br /&gt;
--[[User:Chenc8|Chenc8]] 23:07, 13 April 2008 (EDT)&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security</id>
		<title>VoIP (Voice Over IP) Security</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security"/>
				<updated>2008-04-14T02:44:18Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''VoIP''' (Voice over Internet Protocol) is a protocol used for the transmission of voice data across the Internet.  IP telephony treats voice as another form of data that is compressed and optimized for network traffic and is vulnerable to attacks traditional data would be on the network.  VoIP security is akin to network security; voice data traveling the network will look like any other normal data.&lt;br /&gt;
[[Image:oldphone.JPG|frame|right|Has VoIP evolved enough so that the benefits outweigh the costs?]]&lt;br /&gt;
Corporations generally place VoIP concerns on the voice quality, latency, and quality of service above the overall security when VoIP telephony is actually more vulnerable to certain attacks compared to the traditional phone system.[1]  The most common threats found in the VoIP environment include eavesdropping, theft of services, and denial of service attacks. &lt;br /&gt;
&lt;br /&gt;
==Introduction==&lt;br /&gt;
To greater understand VoIP security, a general overview of VoIP systems is useful.  &lt;br /&gt;
&lt;br /&gt;
===Components===&lt;br /&gt;
A typical VoIP system includes four components[6]:&lt;br /&gt;
&lt;br /&gt;
{| border=&amp;quot;1&amp;quot; cellpadding=&amp;quot;2&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
|width=&amp;quot;5%&amp;quot;|'''Data Network'''&lt;br /&gt;
|width=&amp;quot;90%&amp;quot;|&lt;br /&gt;
* Must be high performance to avoid choppy communication&lt;br /&gt;
* QoS (Quality of Service) standard to prioritize voice traffic over data traffic&lt;br /&gt;
** DiffServ&lt;br /&gt;
*** Layer 3 QoS mechanism&lt;br /&gt;
** 802.1p&lt;br /&gt;
*** Layer 2 QoS mechanism&lt;br /&gt;
|-&lt;br /&gt;
|'''IP Handset'''&lt;br /&gt;
|&lt;br /&gt;
* Handset has to be IP enabled so audio stream can be digitized to be transmitted on the IP network&lt;br /&gt;
|-&lt;br /&gt;
|'''Call Server'''&lt;br /&gt;
| &lt;br /&gt;
* Application running on dedicated workstation&lt;br /&gt;
* Provides all call signaling&lt;br /&gt;
* Provides all call control functionality&lt;br /&gt;
* Core operating code of a PBX (Private Branch Exchange) transferred here&lt;br /&gt;
|-&lt;br /&gt;
|'''Gateway'''&lt;br /&gt;
|&lt;br /&gt;
* Voice connectivity between IP network and public carrier network&lt;br /&gt;
* Can be taken over by hackers to make free calls&lt;br /&gt;
|}&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
===VoIP Protocols===&lt;br /&gt;
Voice is connection oriented, hence communication between two parties must be set up first.  Two of the most common protocols used are H.323 and Session Initiation Protocol (SIP).  Here is a very brief overview of the two protocols.[6]&lt;br /&gt;
&lt;br /&gt;
====H.323====&lt;br /&gt;
H.323 is a standard to promote compatibility in video conference transmissions over IP networks.[8]&lt;br /&gt;
&lt;br /&gt;
H.323 has four main components:&lt;br /&gt;
# Terminal&lt;br /&gt;
# Gateway&lt;br /&gt;
# Multipoint Control Unit (MCU)&lt;br /&gt;
# Gatekeeper&lt;br /&gt;
&lt;br /&gt;
====Session Initiation Protocol====&lt;br /&gt;
[[Image:SIP.JPG|right|thumb|Source:http://www.cisco.com/univercd/cc/td/doc/product/voice/sipsols/biggulp/bgsipov.htm]]&lt;br /&gt;
SIP is a peer-to-peer standard protocol for multimedia conferencing over IP.  SIP exists on the application layer used to initiate, maintain, as well as terminate a call.  SIP contains 3 components: [8]&lt;br /&gt;
# User agent client or user agent server&lt;br /&gt;
# Proxy server&lt;br /&gt;
# Redirect server&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
==Attacks==&lt;br /&gt;
There are three main types of attacks that the VoIP environment are susceptible to including eavesdropping, theft of services, and denial of service attacks.[7]&lt;br /&gt;
&lt;br /&gt;
===Eavesdropping===&lt;br /&gt;
Eavesdropping on VoIP calls involves third parties monitoring the call signal packets in which the hacker may learn of confidential information such as name, passwords, and other personal information.  This is especially significant to businesses as corporate sensitive information may be revealed.&lt;br /&gt;
&lt;br /&gt;
VoIP eavesdropping is easier accomplished that eavesdropping the traditional telephone line through physical wiretap since the hacker must physically place the wiretap.  Since VoIP calls send data across the network, the hacker can sniff for packets anywhere along the network.&lt;br /&gt;
&lt;br /&gt;
To eavesdrop a call there are 3 simple steps:&lt;br /&gt;
# Understanding how IP Telephony works.  &lt;br /&gt;
# Obtain tools.  &lt;br /&gt;
# Connect the tools into the IP network.&lt;br /&gt;
&lt;br /&gt;
A typical eavesdropper would:&lt;br /&gt;
# Perform a side channel attack based on the fact all IP Telephony implementations use Real Time Protocol(RTP) to transfer packets.&lt;br /&gt;
# Download, install, and run Fireberd DNA-323 to capture and replay voice packets.&lt;br /&gt;
# Connect to the IP network the VoIP conversation is taking place on.&lt;br /&gt;
&lt;br /&gt;
====Data Encryption====&lt;br /&gt;
The most effective countermeasure to eavesdropping is data encryption.  As seen in class, there are many data encryption methods, some more effective than others.  However, all methods introduce overhead which can greatly effect the quality of the conversation by causing large packet loss and packet jitter.  Here are some common ways of implementing data encryption for VoIP: [2,3]&lt;br /&gt;
&lt;br /&gt;
* Using software such as [http://zfoneproject.com/ Zfone]&lt;br /&gt;
* Using VoIP clients with built in encryption such as Skype&lt;br /&gt;
Skype comes with its own propriety encryption method.  Some other common methods include:&lt;br /&gt;
[http://en.wikipedia.org/wiki/Data_Encryption_Standard Data Encryption Standard](DES),  &lt;br /&gt;
[http://en.wikipedia.org/wiki/Triple_DES Triple DES] (3DES), &lt;br /&gt;
[http://en.wikipedia.org/wiki/Advanced_Encryption_Standard Advanced Encryption Standard] (AES)&lt;br /&gt;
* Using a Virtual Private Network (VPN)&lt;br /&gt;
===Theft of Services===&lt;br /&gt;
One of the great things about VoIP is the fact that you can take it anywhere in the world that has internet access and use it.  Unfortunately, this also benefits the hacker so that he or she may steal access to your VoIP services and then possibly do criminal activities with them.  Also known as VoIP &amp;quot;phreaking&amp;quot;, the hacker can steal your VoIP services through two common ways:&lt;br /&gt;
* '''Spoofing'''&lt;br /&gt;
** Accomplished through changing the header data in the voice packet so it looks like it comes from a different source&lt;br /&gt;
** Hacking into SIP changing SIP registrar information&lt;br /&gt;
* '''Man in the middle attack''' (MITM).&lt;br /&gt;
** Accomplished through monitoring traffic, recording it and/or changing it&lt;br /&gt;
&lt;br /&gt;
====Authentication====&lt;br /&gt;
The most effective countermeasure to theft of VoIP services involves implementing authentication.  Fortunately, VoIP protocols include some form of authentication.  Specifically, the H.235 component of H.323 facilitates 3 types of authentication: [4]&lt;br /&gt;
# Symmetric encryption&lt;br /&gt;
# Subscription based&lt;br /&gt;
# IPSEC&lt;br /&gt;
Subscription based is much more CPU intensive than symmetric encryption and requires the sharing of a secret key before communication can begin.  Alternatively, H.235 may allow IPSEC to handle the authentication.&lt;br /&gt;
SIP also provides 3 different types of authentication:&lt;br /&gt;
# Basic authentication&lt;br /&gt;
# Digest authentication&lt;br /&gt;
# PGP authentication&lt;br /&gt;
However, all three are challenge-response based.&lt;br /&gt;
&lt;br /&gt;
Other authentication methods include but not limited to:&lt;br /&gt;
* Public key authentication with certification&lt;br /&gt;
* Diffie-Hellman key exchange&lt;br /&gt;
* [http://www.cisco.ws/en/US/docs/ios/12_1t/12_1t2/feature/guide/uni_osp.html UNI-OSP] from Cisco&lt;br /&gt;
&lt;br /&gt;
===Denial of Services===&lt;br /&gt;
    &lt;br /&gt;
{|align=&amp;quot;right&amp;quot;&lt;br /&gt;
    |[[image:DoS.JPG|right|thumb|600px|Source:http://www.hillside.net/plop/2007/papers/PLoP2007_PelaezEtAl.pdf]]&lt;br /&gt;
    |}&lt;br /&gt;
&lt;br /&gt;
There are two main types of denial of services attacks in the VoIP environment including:&lt;br /&gt;
# Exploiting software bugs to bring down servers&lt;br /&gt;
# Distributed bandwidth attack&lt;br /&gt;
Before a DoS attack can take place, the hacker must first use a sniffing program to look for vulnerable hosts.  As discussed in class, a port scanner is useful to identify those hosts.  In a distributed DoS (DDoS) attack, once the vulnerable host is found, a program sometimes called a bot is installed on the computer and awaits for instructions.  The infected computers, sometimes called zombies as in the image to the right, can then be coordinated to  bombard a target with traffic effectively disabling it.&lt;br /&gt;
&lt;br /&gt;
====Packet Filtering====&lt;br /&gt;
Denial of service attacks are hard to defend against because of the nature of the attack; The attack is hard to distinguish from normal traffic.  The method to defend against DoS attacks used today is mainly packet filtering and/or firewalls.  The packet filter must look for suspicious packets and block them before reaching the target.  There is still a great amount of work that can be done in this area.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
===Summary===&lt;br /&gt;
{| border=&amp;quot;1&amp;quot; align=&amp;quot;right&amp;quot;&lt;br /&gt;
|&lt;br /&gt;
{| border=&amp;quot;5&amp;quot; cellspacing=&amp;quot;5&amp;quot; cellpadding=&amp;quot;2&amp;quot; align=&amp;quot;right&amp;quot;&lt;br /&gt;
|+ '''VoIP Security Vulnerabilities'''&lt;br /&gt;
! Threat!! Countermeasures&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Eavesdropping'''&lt;br /&gt;
| &lt;br /&gt;
Data Encryption&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Theft of services'''&lt;br /&gt;
|&lt;br /&gt;
Authentication&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Denial of Services''' &lt;br /&gt;
|&lt;br /&gt;
Packet Filtering&lt;br /&gt;
|}&lt;br /&gt;
|-&lt;br /&gt;
| align=&amp;quot;center&amp;quot;|A short summary&lt;br /&gt;
|}&lt;br /&gt;
Although there is more than way one to defend against a certain kind of attack, the most common countermeasures to the attacks listed in this wiki are summarized in the table to the right.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==Recommendations==&lt;br /&gt;
&lt;br /&gt;
Although a network cannot be completely immune to attack, here are some recommendations to secure your VoIP network. [8]&lt;br /&gt;
&lt;br /&gt;
#	Do not user shared media devices (ie hubs) on networks&lt;br /&gt;
#	All VoIP traffic should be encrypted&lt;br /&gt;
#	VoIP servers with confidential information should be treated as a confidential database&lt;br /&gt;
#	Build redundancy into VoIP network.&lt;br /&gt;
#	Make sure firewall is VoIP aware&lt;br /&gt;
&lt;br /&gt;
==References==&lt;br /&gt;
# Jaikumar Vijayan. &amp;quot;VOIP: Don't overlook security&amp;quot;.  Retrieved on 2008-04-08. [http://www.computerworld.com/securitytopics/security/story/0,10801,74840,00.html]&lt;br /&gt;
# Bruce Schneier.  &amp;quot;VOIP Encryption&amp;quot;.  Retrieved on 2008-04-12. [http://www.schneier.com/blog/archives/2006/04/voip_encryption.html]&lt;br /&gt;
# &amp;quot;How to: Encrypt Your VoIP&amp;quot;. Retrieved on 2008-04-11. [http://www.voipnow.org/2007/04/how_to_encrypt_.html]&lt;br /&gt;
# &amp;quot;VoIP Authentication (UNI-OSP) Feature&amp;quot;. Retrieved on 2008-04-12. [http://www.cisco.ws/en/US/docs/ios/12_1t/12_1t2/feature/guide/uni_osp.html]&lt;br /&gt;
# &amp;quot;Overview of the Session Initiation Protocol&amp;quot;. Retrieved on 2008-04-12. [http://www.cisco.com/univercd/cc/td/doc/product/voice/sipsols/biggulp/bgsipov.htm]&lt;br /&gt;
# Tom Long. &amp;quot;Eavesdropping an IP Telephony Call&amp;quot;. Retrieved on 2008-04-09. [http://www.sans.org/reading_room/whitepapers/telephone/318.php]&lt;br /&gt;
# Philip Bednarz. &amp;quot;How VoIP is changing the network security equation&amp;quot;. Retrieved on 2008-04-09. [http://www.eetimes.com/showArticle.jhtml;jsessionid=ERU1FKTFCHUJUQSNDLPCKH0CJUNN2JVN?articleID=16505939]&lt;br /&gt;
# Eric Weiss. &amp;quot;Security Concerns with VOIP&amp;quot;. Retrieved on 2008-04-09. [http://www.sans.org/reading_room/whitepapers/voip/323.php]&lt;br /&gt;
# Peter Thermos. &amp;quot;Two attacks against VoIP&amp;quot;. Rerieved on 2008-04-09. [http://www.securityfocus.com/infocus/1862]&lt;br /&gt;
# Juan C. Pelaez, Eduardo B. Fernandez, Maria M. Larrondo-Petrie, Christian Wieser. &amp;quot;Attack Patterns in VoIP&amp;quot;. Retrieved on 2008-04-12. [http://www.hillside.net/plop/2007/papers/PLoP2007_PelaezEtAl.pdf]&lt;br /&gt;
==See Also==&lt;br /&gt;
[[Two-factor Authentication]]&amp;lt;BR&amp;gt;&lt;br /&gt;
[[Public Key Encryption Algorithms]]&amp;lt;BR&amp;gt;&lt;br /&gt;
[[Peer to Peer Network Security]]&amp;lt;BR&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==External Links==&lt;br /&gt;
* [http://en.wikipedia.org/wiki/Session_Initiation_Protocol Session Initiation Protocol]&lt;br /&gt;
* [http://en.wikipedia.org/wiki/H.323 H.323]&lt;br /&gt;
* [http://en.wikipedia.org/wiki/VoIP VoIP]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
--[[User:Chenc8|Chenc8]] 13:29, 13 April 2008 (EDT)&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security</id>
		<title>VoIP (Voice Over IP) Security</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security"/>
				<updated>2008-04-14T02:27:44Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''VoIP''' (Voice over Internet Protocol) is a protocol used for the transmission of voice data across the Internet.  IP telephony treats voice as another form of data that is compressed and optimized for network traffic and is vulnerable to attacks traditional data would be on the network.  VoIP security is akin to network security; voice data traveling the network will look like any other normal data.&lt;br /&gt;
[[Image:oldphone.JPG|frame|right|Has VoIP evolved enough so that the benefits outweigh the costs?]]&lt;br /&gt;
Corporations generally place VoIP concerns on the voice quality, latency, and quality of service above the overall security when VoIP telephony is actually more vulnerable to certain attacks compared to the traditional phone system.  The most common threats found in the VoIP environment include eavesdropping, theft of services, and denial of service attacks. &lt;br /&gt;
&lt;br /&gt;
==Introduction==&lt;br /&gt;
To greater understand VoIP security, a general overview of VoIP systems is useful.  &lt;br /&gt;
&lt;br /&gt;
===Components===&lt;br /&gt;
A typical VoIP system includes four components:&lt;br /&gt;
&lt;br /&gt;
{| border=&amp;quot;1&amp;quot; cellpadding=&amp;quot;2&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
|width=&amp;quot;5%&amp;quot;|'''Data Network'''&lt;br /&gt;
|width=&amp;quot;90%&amp;quot;|&lt;br /&gt;
* Must be high performance to avoid choppy communication&lt;br /&gt;
* QoS (Quality of Service) standard to prioritize voice traffic over data traffic&lt;br /&gt;
** DiffServ&lt;br /&gt;
*** Layer 3 QoS mechanism&lt;br /&gt;
** 802.1p&lt;br /&gt;
*** Layer 2 QoS mechanism&lt;br /&gt;
|-&lt;br /&gt;
|'''IP Handset'''&lt;br /&gt;
|&lt;br /&gt;
* Handset has to be IP enabled so audio stream can be digitized to be transmitted on the IP network&lt;br /&gt;
|-&lt;br /&gt;
|'''Call Server'''&lt;br /&gt;
| &lt;br /&gt;
* Application running on dedicated workstation&lt;br /&gt;
* Provides all call signaling&lt;br /&gt;
* Provides all call control functionality&lt;br /&gt;
* Core operating code of a PBX (Private Branch Exchange) transferred here&lt;br /&gt;
|-&lt;br /&gt;
|'''Gateway'''&lt;br /&gt;
|&lt;br /&gt;
* Voice connectivity between IP network and public carrier network&lt;br /&gt;
* Can be taken over by hackers to make free calls&lt;br /&gt;
|}&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
===VoIP Protocols===&lt;br /&gt;
Voice is connection oriented, hence communication between two parties must be set up first.  Two of the most common protocols used are H.323 and Session Initiation Protocol (SIP).&lt;br /&gt;
&lt;br /&gt;
====H.323====&lt;br /&gt;
H.323 is a standard to promote compatibility in video conference transmissions over IP networks. (cite)&lt;br /&gt;
&lt;br /&gt;
H.323 has four main components:&lt;br /&gt;
# Terminal&lt;br /&gt;
# Gateway&lt;br /&gt;
# Multipoint Control Unit (MCU)&lt;br /&gt;
# Gatekeeper&lt;br /&gt;
&lt;br /&gt;
====Session Initiation Protocol====&lt;br /&gt;
[[Image:SIP.JPG|right|thumb|Source:http://www.cisco.com/univercd/cc/td/doc/product/voice/sipsols/biggulp/bgsipov.htm]]&lt;br /&gt;
SIP is a peer-to-peer standard protocol for multimedia conferencing over IP.  SIP exists on the application layer used to initiate, maintain, as well as terminate a call.  SIP contains 3 components: &lt;br /&gt;
# User agent client or user agent server&lt;br /&gt;
# Proxy server&lt;br /&gt;
# Redirect server&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
==Attacks==&lt;br /&gt;
There are three main types of attacks that the VoIP environment are susceptible to including eavesdropping, theft of services, and denial of service attacks.&lt;br /&gt;
&lt;br /&gt;
===Eavesdropping===&lt;br /&gt;
Eavesdropping on VoIP calls involves third parties monitoring the call signal packets in which the hacker may learn of confidential information such as name, passwords, and other personal information.  This is especially significant to businesses as corporate sensitive information may be revealed.&lt;br /&gt;
&lt;br /&gt;
VoIP eavesdropping is easier accomplished that eavesdropping the traditional telephone line through physical wiretap since the hacker must physically place the wiretap.  Since VoIP calls send data across the network, the hacker can sniff for packets anywhere along the network.&lt;br /&gt;
&lt;br /&gt;
To eavesdrop a call there are 3 simple steps:&lt;br /&gt;
# Understanding how IP Telephony works.  &lt;br /&gt;
# Obtain tools.  &lt;br /&gt;
# Connect the tools into the IP network.&lt;br /&gt;
&lt;br /&gt;
A typical eavesdropper would:&lt;br /&gt;
# Perform a side channel attack based on the fact all IP Telephony implementations use Real Time Protocol(RTP) to transfer packets.&lt;br /&gt;
# Download, install, and run Fireberd DNA-323 to capture and replay voice packets.&lt;br /&gt;
# Connect to the IP network the VoIP conversation is taking place on.&lt;br /&gt;
&lt;br /&gt;
====Data Encryption====&lt;br /&gt;
The most effective countermeasure to eavesdropping is data encryption.  As seen in class, there are many data encryption methods, some more effective than others.  However, all methods introduce overhead which can greatly effect the quality of the conversation by causing large packet loss and packet jitter.  Here are some common ways of implementing data encryption for VoIP:&lt;br /&gt;
&lt;br /&gt;
* Using software such as [http://zfoneproject.com/ Zfone]&lt;br /&gt;
* Using VoIP clients with built in encryption such as Skype&lt;br /&gt;
Skype comes with its own propriety encryption method.  Some other common methods include:&lt;br /&gt;
[http://en.wikipedia.org/wiki/Data_Encryption_Standard Data Encryption Standard](DES),  &lt;br /&gt;
[http://en.wikipedia.org/wiki/Triple_DES Triple DES] (3DES), &lt;br /&gt;
[http://en.wikipedia.org/wiki/Advanced_Encryption_Standard Advanced Encryption Standard] (AES)&lt;br /&gt;
* Using a Virtual Private Network (VPN)&lt;br /&gt;
===Theft of Services===&lt;br /&gt;
One of the great things about VoIP is the fact that you can take it anywhere in the world that has internet access and use it.  Unfortunately, this also benefits the hacker so that he or she may steal access to your VoIP services and then possibly do criminal activities with them.  Also known as VoIP &amp;quot;phreaking&amp;quot;, the hacker can steal your VoIP services through two common ways:&lt;br /&gt;
* '''Spoofing'''&lt;br /&gt;
** Accomplished through changing the header data in the voice packet so it looks like it comes from a different source&lt;br /&gt;
** Hacking into SIP changing SIP registrar information&lt;br /&gt;
* '''Man in the middle attack''' (MITM).&lt;br /&gt;
** Accomplished through monitoring traffic, recording it and/or changing it&lt;br /&gt;
&lt;br /&gt;
====Authentication====&lt;br /&gt;
The most effective countermeasure to theft of VoIP services involves implementing authentication.  Fortunalty, VoIP protocols include some form of authentication.  Specifically, the H.235 component of H.323 facilitates 3 types of authentication:&lt;br /&gt;
# Symmetric encryption&lt;br /&gt;
# Subscription based&lt;br /&gt;
# IPSEC&lt;br /&gt;
Subscription based is much more CPU intensive than symmetric encryption and requires the sharing of a secret key before communication can begin.  Alternatively, H.235 may allow IPSEC to handle the authentication.&lt;br /&gt;
SIP also provides 3 different types of authentication:&lt;br /&gt;
# Basic authentication&lt;br /&gt;
# Digest authentication&lt;br /&gt;
# PGP authentication&lt;br /&gt;
However, all three are challenge-response based.&lt;br /&gt;
&lt;br /&gt;
Other authentication methods include but not limited to:&lt;br /&gt;
* Public key authentication with certification&lt;br /&gt;
* Diffie-Hellman key exchange&lt;br /&gt;
* [http://www.cisco.ws/en/US/docs/ios/12_1t/12_1t2/feature/guide/uni_osp.html UNI-OSP] from Cisco&lt;br /&gt;
&lt;br /&gt;
===Denial of Services===&lt;br /&gt;
    &lt;br /&gt;
{|align=&amp;quot;right&amp;quot;&lt;br /&gt;
    |[[image:DoS.JPG|right|thumb|500px|Source:http://www.hillside.net/plop/2007/papers/PLoP2007_PelaezEtAl.pdf]]&lt;br /&gt;
    |}&lt;br /&gt;
&lt;br /&gt;
There are two main types of denial of services attacks in the VoIP environment including:&lt;br /&gt;
# Exploiting software bugs to bring down servers&lt;br /&gt;
# Distributed bandwidth attack&lt;br /&gt;
Before a DoS attack can take place, the hacker must first use a sniffing program to look for vulnerable hosts.  As discussed in class, a port scanner is useful to identify those hosts.  In a distributed DoS (DDoS) attack, once the vulnerable host is found, a program sometimes called a bot is installed on the computer and awaits for instructions.  The infected computers, sometimes called zombies as in the image to the right, can then be coordinated to  bombard a target with traffic effectively disabling it.&lt;br /&gt;
&lt;br /&gt;
====Packet Filtering====&lt;br /&gt;
Denial of service attacks are hard to defend against because of the nature of the attack; The attack is hard to distinguish from normal traffic.  The method to defend against DoS attacks used today is mainly packet filtering and/or firewalls.  The packet filter must look for suspicious packets and block them before reaching the target.  There is still a great amount of work that can be done in this area.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
===Summary===&lt;br /&gt;
{| border=&amp;quot;1&amp;quot; align=&amp;quot;right&amp;quot;&lt;br /&gt;
|&lt;br /&gt;
{| border=&amp;quot;5&amp;quot; cellspacing=&amp;quot;5&amp;quot; cellpadding=&amp;quot;2&amp;quot; align=&amp;quot;right&amp;quot;&lt;br /&gt;
|+ '''VoIP Security Vulnerabilities'''&lt;br /&gt;
! Threat!! Countermeasures&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Eavesdropping'''&lt;br /&gt;
| &lt;br /&gt;
Data Encryption&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Theft of services'''&lt;br /&gt;
|&lt;br /&gt;
Authentication&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Denial of Services''' &lt;br /&gt;
|&lt;br /&gt;
Packet Filtering&lt;br /&gt;
|}&lt;br /&gt;
|-&lt;br /&gt;
| align=&amp;quot;center&amp;quot;|A short summary&lt;br /&gt;
|}&lt;br /&gt;
Although there is more than way one to defend against a certain kind of attack, the most common countermeasures to the attacks listed in this wiki are summarized in the table to the right.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==Recommendations==&lt;br /&gt;
&lt;br /&gt;
Although a network cannot be completely immune to attack, here are some recommendations to secure your VoIP network.&lt;br /&gt;
&lt;br /&gt;
#	Do not user shared media devices (ie hubs) on networks&lt;br /&gt;
#	All VoIP traffic should be encrypted&lt;br /&gt;
#	VoIP servers with confidential information should be treated as a confidential database&lt;br /&gt;
#	Build redundancy into VoIP network.&lt;br /&gt;
#	Make sure firewall is VoIP aware&lt;br /&gt;
&lt;br /&gt;
==References==&lt;br /&gt;
# Jaikumar Vijayan. &amp;quot;VOIP: Don't overlook security&amp;quot;.  Retrieved on 2008-04-08. [http://www.computerworld.com/securitytopics/security/story/0,10801,74840,00.html]&lt;br /&gt;
# Bruce Schneier.  &amp;quot;VOIP Encryption&amp;quot;.  Retrieved on 2008-04-12. [http://www.schneier.com/blog/archives/2006/04/voip_encryption.html]&lt;br /&gt;
# &amp;quot;How to: Encrypt Your VoIP&amp;quot;. Retrieved on 2008-04-11. [http://www.voipnow.org/2007/04/how_to_encrypt_.html]&lt;br /&gt;
# &amp;quot;VoIP Authentication (UNI-OSP) Feature&amp;quot;. Retrieved on 2008-04-12. [http://www.cisco.ws/en/US/docs/ios/12_1t/12_1t2/feature/guide/uni_osp.html]&lt;br /&gt;
# &amp;quot;Overview of the Session Initiation Protocol&amp;quot;. Retrieved on 2008-04-12. [http://www.cisco.com/univercd/cc/td/doc/product/voice/sipsols/biggulp/bgsipov.htm]&lt;br /&gt;
# Tom Long. &amp;quot;Eavesdropping an IP Telephony Call&amp;quot;. Retrieved on 2008-04-09. [http://www.sans.org/reading_room/whitepapers/telephone/318.php]&lt;br /&gt;
# Philip Bednarz. &amp;quot;How VoIP is changing the network security equation&amp;quot;. Retrieved on 2008-04-09. [http://www.eetimes.com/showArticle.jhtml;jsessionid=ERU1FKTFCHUJUQSNDLPCKH0CJUNN2JVN?articleID=16505939]&lt;br /&gt;
# Eric Weiss. &amp;quot;Security Concerns with VOIP&amp;quot;. Retrieved on 2008-04-09. [http://www.sans.org/reading_room/whitepapers/voip/323.php]&lt;br /&gt;
# Peter Thermos. &amp;quot;Two attacks against VoIP&amp;quot;. Rerieved on 2008-04-09. [http://www.securityfocus.com/infocus/1862]&lt;br /&gt;
# Juan C. Pelaez, Eduardo B. Fernandez, Maria M. Larrondo-Petrie, Christian Wieser. &amp;quot;Attack Patterns in VoIP&amp;quot;. Retrieved on 2008-04-12. [http://www.hillside.net/plop/2007/papers/PLoP2007_PelaezEtAl.pdf]&lt;br /&gt;
==See Also==&lt;br /&gt;
[[Two-factor Authentication]]&amp;lt;BR&amp;gt;&lt;br /&gt;
[[Public Key Encryption Algorithms]]&amp;lt;BR&amp;gt;&lt;br /&gt;
[[Peer to Peer Network Security]]&amp;lt;BR&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==External Links==&lt;br /&gt;
* [http://en.wikipedia.org/wiki/Session_Initiation_Protocol Session Initiation Protocol]&lt;br /&gt;
* [http://en.wikipedia.org/wiki/H.323 H.323]&lt;br /&gt;
* [http://en.wikipedia.org/wiki/VoIP VoIP]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
--[[User:Chenc8|Chenc8]] 13:29, 13 April 2008 (EDT)&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/File:DoS.JPG</id>
		<title>File:DoS.JPG</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/File:DoS.JPG"/>
				<updated>2008-04-14T02:16:29Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security</id>
		<title>VoIP (Voice Over IP) Security</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security"/>
				<updated>2008-04-14T02:06:45Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''VoIP''' (Voice over Internet Protocol) is a protocol used for the transmission of voice data across the Internet.  IP telephony treats voice as another form of data that is compressed and optimized for network traffic and is vulnerable to attacks traditional data would be on the network.  VoIP security is akin to network security; voice data traveling the network will look like any other normal data.&lt;br /&gt;
[[Image:oldphone.JPG|frame|right|Has VoIP evolved enough so that the benefits outweigh the costs?]]&lt;br /&gt;
Corporations generally place VoIP concerns on the voice quality, latency, and quality of service above the overall security when VoIP telephony is actually more vulnerable to certain attacks compared to the traditional phone system.  The most common threats found in the VoIP environment include eavesdropping, theft of services, and denial of service attacks. &lt;br /&gt;
&lt;br /&gt;
==Introduction==&lt;br /&gt;
To greater understand VoIP security, a general overview of VoIP systems is useful.  &lt;br /&gt;
&lt;br /&gt;
===Components===&lt;br /&gt;
A typical VoIP system includes four components:&lt;br /&gt;
&lt;br /&gt;
{| border=&amp;quot;1&amp;quot; cellpadding=&amp;quot;2&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
|width=&amp;quot;5%&amp;quot;|'''Data Network'''&lt;br /&gt;
|width=&amp;quot;90%&amp;quot;|&lt;br /&gt;
* Must be high performance to avoid choppy communication&lt;br /&gt;
* QoS (Quality of Service) standard to prioritize voice traffic over data traffic&lt;br /&gt;
** DiffServ&lt;br /&gt;
*** Layer 3 QoS mechanism&lt;br /&gt;
** 802.1p&lt;br /&gt;
*** Layer 2 QoS mechanism&lt;br /&gt;
|-&lt;br /&gt;
|'''IP Handset'''&lt;br /&gt;
|&lt;br /&gt;
* Handset has to be IP enabled so audio stream can be digitized to be transmitted on the IP network&lt;br /&gt;
|-&lt;br /&gt;
|'''Call Server'''&lt;br /&gt;
| &lt;br /&gt;
* Application running on dedicated workstation&lt;br /&gt;
* Provides all call signaling&lt;br /&gt;
* Provides all call control functionality&lt;br /&gt;
* Core operating code of a PBX (Private Branch Exchange) transferred here&lt;br /&gt;
|-&lt;br /&gt;
|'''Gateway'''&lt;br /&gt;
|&lt;br /&gt;
* Voice connectivity between IP network and public carrier network&lt;br /&gt;
* Can be taken over by hackers to make free calls&lt;br /&gt;
|}&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
===VoIP Protocols===&lt;br /&gt;
Voice is connection oriented, hence communication between two parties must be set up first.  Two of the most common protocols used are H.323 and Session Initiation Protocol (SIP).&lt;br /&gt;
&lt;br /&gt;
====H.323====&lt;br /&gt;
H.323 is a standard to promote compatibility in video conference transmissions over IP networks. (cite)&lt;br /&gt;
&lt;br /&gt;
H.323 has four main components:&lt;br /&gt;
# Terminal&lt;br /&gt;
# Gateway&lt;br /&gt;
# Multipoint Control Unit (MCU)&lt;br /&gt;
# Gatekeeper&lt;br /&gt;
&lt;br /&gt;
====Session Initiation Protocol====&lt;br /&gt;
[[Image:SIP.JPG|right|thumb|Source:http://www.cisco.com/univercd/cc/td/doc/product/voice/sipsols/biggulp/bgsipov.htm]]&lt;br /&gt;
SIP is a peer-to-peer standard protocol for multimedia conferencing over IP.  SIP exists on the application layer used to initiate, maintain, as well as terminate a call.  SIP contains 3 components: &lt;br /&gt;
# User agent client or user agent server&lt;br /&gt;
# Proxy server&lt;br /&gt;
# Redirect server&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
==Attacks==&lt;br /&gt;
There are three main types of attacks that the VoIP environment are susceptible to including eavesdropping, theft of services, and denial of service attacks.&lt;br /&gt;
&lt;br /&gt;
===Eavesdropping===&lt;br /&gt;
Eavesdropping on VoIP calls involves third parties monitoring the call signal packets in which the hacker may learn of confidential information such as name, passwords, and other personal information.  This is especially significant to businesses as corporate sensitive information may be revealed.&lt;br /&gt;
&lt;br /&gt;
VoIP eavesdropping is easier accomplished that eavesdropping the traditional telephone line through physical wiretap since the hacker must physically place the wiretap.  Since VoIP calls send data across the network, the hacker can sniff for packets anywhere along the network.&lt;br /&gt;
&lt;br /&gt;
To eavesdrop a call there are 3 simple steps:&lt;br /&gt;
# Understanding how IP Telephony works.  &lt;br /&gt;
# Obtain tools.  &lt;br /&gt;
# Connect the tools into the IP network.&lt;br /&gt;
&lt;br /&gt;
A typical eavesdropper would:&lt;br /&gt;
# Perform a side channel attack based on the fact all IP Telephony implementations use Real Time Protocol(RTP) to transfer packets.&lt;br /&gt;
# Download, install, and run Fireberd DNA-323 to capture and replay voice packets.&lt;br /&gt;
# Connect to the IP network the VoIP conversation is taking place on.&lt;br /&gt;
&lt;br /&gt;
====Data Encryption====&lt;br /&gt;
The most effective countermeasure to eavesdropping is data encryption.  As seen in class, there are many data encryption methods, some more effective than others.  However, all methods introduce overhead which can greatly effect the quality of the conversation by causing large packet loss and packet jitter.  Here are some common ways of implementing data encryption for VoIP:&lt;br /&gt;
&lt;br /&gt;
* Using software such as [http://zfoneproject.com/ Zfone]&lt;br /&gt;
* Using VoIP clients with built in encryption such as Skype&lt;br /&gt;
Skype comes with its own propriety encryption method.  Some other common methods include:&lt;br /&gt;
[http://en.wikipedia.org/wiki/Data_Encryption_Standard Data Encryption Standard](DES),  &lt;br /&gt;
[http://en.wikipedia.org/wiki/Triple_DES Triple DES] (3DES), &lt;br /&gt;
[http://en.wikipedia.org/wiki/Advanced_Encryption_Standard Advanced Encryption Standard] (AES)&lt;br /&gt;
* Using a Virtual Private Network (VPN)&lt;br /&gt;
===Theft of Services===&lt;br /&gt;
One of the great things about VoIP is the fact that you can take it anywhere in the world that has internet access and use it.  Unfortunately, this also benefits the hacker so that he or she may steal access to your VoIP services and then possibly do criminal activities with them.  Also known as VoIP &amp;quot;phreaking&amp;quot;, the hacker can steal your VoIP services through two common ways:&lt;br /&gt;
* '''Spoofing'''&lt;br /&gt;
** Accomplished through changing the header data in the voice packet so it looks like it comes from a different source&lt;br /&gt;
** Hacking into SIP changing SIP registrar information&lt;br /&gt;
* '''Man in the middle attack''' (MITM).&lt;br /&gt;
** Accomplished through monitoring traffic, recording it and/or changing it&lt;br /&gt;
&lt;br /&gt;
====Authentication====&lt;br /&gt;
The most effective countermeasure to theft of VoIP services involves implementing authentication.  Fortunalty, VoIP protocols include some form of authentication.  Specifically, the H.235 component of H.323 facilitates 3 types of authentication:&lt;br /&gt;
# Symmetric encryption&lt;br /&gt;
# Subscription based&lt;br /&gt;
# IPSEC&lt;br /&gt;
Subscription based is much more CPU intensive than symmetric encryption and requires the sharing of a secret key before communication can begin.  Alternatively, H.235 may allow IPSEC to handle the authentication.&lt;br /&gt;
SIP also provides 3 different types of authentication:&lt;br /&gt;
# Basic authentication&lt;br /&gt;
# Digest authentication&lt;br /&gt;
# PGP authentication&lt;br /&gt;
However, all three are challenge-response based.&lt;br /&gt;
&lt;br /&gt;
Other authentication methods include but not limited to:&lt;br /&gt;
* Public key authentication with certification&lt;br /&gt;
* Diffie-Hellman key exchange&lt;br /&gt;
* [http://www.cisco.ws/en/US/docs/ios/12_1t/12_1t2/feature/guide/uni_osp.html UNI-OSP] from Cisco&lt;br /&gt;
&lt;br /&gt;
===Denial of Services===&lt;br /&gt;
There are two main types of denial of services attacks in the VoIP environment including:&lt;br /&gt;
# Exploiting software bugs to bring down servers&lt;br /&gt;
# Distributed bandwidth attack&lt;br /&gt;
Before a DoS attack can take place, the hacker must first use a sniffing program to look for vulnerable hosts.  As discussed in class, a port scanner is useful to identify those hosts.  In a distributed DoS (DDoS) attack, once the vulnerable host is found, a program sometimes called a bot is installed on the computer and awaits for instructions.  The hacker can the send a message to all bots to bombard a target with traffic effectively disabling it.&lt;br /&gt;
&lt;br /&gt;
====Packet Filtering====&lt;br /&gt;
Denial of service attacks are hard to defend against because of the nature of the attack; The attack is hard to distinguish from normal traffic.  The method to defend against DoS attacks used today is mainly packet filtering.  The packet filter must look for suspicious packets and block them before reaching the target.  There is still a great amount of work that can be done in this area.&lt;br /&gt;
&lt;br /&gt;
===Summary===&lt;br /&gt;
{| border=&amp;quot;1&amp;quot; align=&amp;quot;right&amp;quot;&lt;br /&gt;
|&lt;br /&gt;
{| border=&amp;quot;5&amp;quot; cellspacing=&amp;quot;5&amp;quot; cellpadding=&amp;quot;2&amp;quot; align=&amp;quot;right&amp;quot;&lt;br /&gt;
|+ '''VoIP Security Vulnerabilities'''&lt;br /&gt;
! Threat!! Countermeasures&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Eavesdropping'''&lt;br /&gt;
| &lt;br /&gt;
Data Encryption&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Theft of services'''&lt;br /&gt;
|&lt;br /&gt;
Authentication&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Denial of Services''' &lt;br /&gt;
|&lt;br /&gt;
Packet Filtering&lt;br /&gt;
|}&lt;br /&gt;
|-&lt;br /&gt;
| align=&amp;quot;center&amp;quot;|A short summary&lt;br /&gt;
|}&lt;br /&gt;
Although there is more than way one to defend against a certain kind of attack, the most common countermeasures to the attacks listed in this wiki are summarized in the table to the right.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==Recommendations==&lt;br /&gt;
&lt;br /&gt;
Although a network cannot be completely immune to attack, here are some recommendations to secure your VoIP network.&lt;br /&gt;
&lt;br /&gt;
#	Do not user shared media devices (ie hubs) on networks&lt;br /&gt;
#	All VoIP traffic should be encrypted&lt;br /&gt;
#	VoIP servers with confidential information should be treated as a confidential database&lt;br /&gt;
#	Build redundancy into VoIP network.&lt;br /&gt;
#	Make sure firewall is VoIP aware&lt;br /&gt;
&lt;br /&gt;
==References==&lt;br /&gt;
# Jaikumar Vijayan. &amp;quot;VOIP: Don't overlook security&amp;quot;.  Retrieved on 2008-04-08. [http://www.computerworld.com/securitytopics/security/story/0,10801,74840,00.html]&lt;br /&gt;
# Bruce Schneier.  &amp;quot;VOIP Encryption&amp;quot;.  Retrieved on 2008-04-12. [http://www.schneier.com/blog/archives/2006/04/voip_encryption.html]&lt;br /&gt;
# &amp;quot;How to: Encrypt Your VoIP&amp;quot;. Retrieved on 2008-04-11. [http://www.voipnow.org/2007/04/how_to_encrypt_.html]&lt;br /&gt;
# &amp;quot;VoIP Authentication (UNI-OSP) Feature&amp;quot;. Retrieved on 2008-04-12. [http://www.cisco.ws/en/US/docs/ios/12_1t/12_1t2/feature/guide/uni_osp.html]&lt;br /&gt;
# &amp;quot;Overview of the Session Initiation Protocol&amp;quot;. Retrieved on 2008-04-12. [http://www.cisco.com/univercd/cc/td/doc/product/voice/sipsols/biggulp/bgsipov.htm]&lt;br /&gt;
# Tom Long. &amp;quot;Eavesdropping an IP Telephony Call&amp;quot;. Retrieved on 2008-04-09. [http://www.sans.org/reading_room/whitepapers/telephone/318.php]&lt;br /&gt;
# Philip Bednarz. &amp;quot;How VoIP is changing the network security equation&amp;quot;. Retrieved on 2008-04-09. [http://www.eetimes.com/showArticle.jhtml;jsessionid=ERU1FKTFCHUJUQSNDLPCKH0CJUNN2JVN?articleID=16505939]&lt;br /&gt;
# Eric Weiss. &amp;quot;Security Concerns with VOIP&amp;quot;. Retrieved on 2008-04-09. [http://www.sans.org/reading_room/whitepapers/voip/323.php]&lt;br /&gt;
# Peter Thermos. &amp;quot;Two attacks against VoIP&amp;quot;. Rerieved on 2008-04-09. [http://www.securityfocus.com/infocus/1862]&lt;br /&gt;
&lt;br /&gt;
==See Also==&lt;br /&gt;
[[Two-factor Authentication]]&amp;lt;BR&amp;gt;&lt;br /&gt;
[[Public Key Encryption Algorithms]]&amp;lt;BR&amp;gt;&lt;br /&gt;
[[Peer to Peer Network Security]]&amp;lt;BR&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==External Links==&lt;br /&gt;
* [http://en.wikipedia.org/wiki/Session_Initiation_Protocol Session Initiation Protocol]&lt;br /&gt;
* [http://en.wikipedia.org/wiki/H.323 H.323]&lt;br /&gt;
* [http://en.wikipedia.org/wiki/VoIP VoIP]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
--[[User:Chenc8|Chenc8]] 13:29, 13 April 2008 (EDT)&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security</id>
		<title>VoIP (Voice Over IP) Security</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security"/>
				<updated>2008-04-14T01:17:20Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''VoIP''' (Voice over Internet Protocol) is a protocol used for the transmission of voice data across the Internet.  IP telephony treats voice as another form of data that is compressed and optimized for network traffic and is vulnerable to attacks traditional data would be on the network.  VoIP security is akin to network security; voice data traveling the network will look like any other normal data.&lt;br /&gt;
[[Image:oldphone.JPG|frame|right|Has VoIP evolved enough so that the benefits outweigh the costs?]]&lt;br /&gt;
Corporations generally place VoIP concerns on the voice quality, latency, and quality of service above the overall security when VoIP telephony is actually more vulnerable to certain attacks compared to the traditional phone system.  The most common threats found in the VoIP environment include eavesdropping, theft of services, and denial of service attacks. &lt;br /&gt;
&lt;br /&gt;
==Introduction==&lt;br /&gt;
To greater understand VoIP security, a general overview of VoIP systems is useful.  &lt;br /&gt;
&lt;br /&gt;
===Components===&lt;br /&gt;
A typical VoIP system includes four components:&lt;br /&gt;
&lt;br /&gt;
{| border=&amp;quot;1&amp;quot; cellpadding=&amp;quot;2&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
|width=&amp;quot;5%&amp;quot;|'''Data Network'''&lt;br /&gt;
|width=&amp;quot;90%&amp;quot;|&lt;br /&gt;
* Must be high performance to avoid choppy communication&lt;br /&gt;
* QoS (Quality of Service) standard to prioritize voice traffic over data traffic&lt;br /&gt;
** DiffServ&lt;br /&gt;
*** Layer 3 QoS mechanism&lt;br /&gt;
** 802.1p&lt;br /&gt;
*** Layer 2 QoS mechanism&lt;br /&gt;
|-&lt;br /&gt;
|'''IP Handset'''&lt;br /&gt;
|&lt;br /&gt;
* Handset has to be IP enabled so audio stream can be digitized to be transmitted on the IP network&lt;br /&gt;
|-&lt;br /&gt;
|'''Call Server'''&lt;br /&gt;
| &lt;br /&gt;
* Application running on dedicated workstation&lt;br /&gt;
* Provides all call signaling&lt;br /&gt;
* Provides all call control functionality&lt;br /&gt;
* Core operating code of a PBX (Private Branch Exchange) transferred here&lt;br /&gt;
|-&lt;br /&gt;
|'''Gateway'''&lt;br /&gt;
|&lt;br /&gt;
* Voice connectivity between IP network and public carrier network&lt;br /&gt;
* Can be taken over by hackers to make free calls&lt;br /&gt;
|}&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
===VoIP Protocols===&lt;br /&gt;
Voice is connection oriented, hence communication between two parties must be set up first.  Two of the most common protocols used are H.323 and Session Initiation Protocol (SIP).&lt;br /&gt;
&lt;br /&gt;
====H.323====&lt;br /&gt;
H.323 is a standard to promote compatibility in video conference transmissions over IP networks. (cite)&lt;br /&gt;
&lt;br /&gt;
H.323 has four main components:&lt;br /&gt;
# Terminal&lt;br /&gt;
# Gateway&lt;br /&gt;
# Multipoint Control Unit (MCU)&lt;br /&gt;
# Gatekeeper&lt;br /&gt;
&lt;br /&gt;
====Session Initiation Protocol====&lt;br /&gt;
[[Image:SIP.JPG|right|thumb|Source:http://www.cisco.com/univercd/cc/td/doc/product/voice/sipsols/biggulp/bgsipov.htm]]&lt;br /&gt;
SIP is a peer-to-peer standard protocol for multimedia conferencing over IP.  SIP exists on the application layer used to initiate, maintain, as well as terminate a call.  SIP contains 3 components: &lt;br /&gt;
# User agent client or user agent server&lt;br /&gt;
# Proxy server&lt;br /&gt;
# Redirect server&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
==Attacks==&lt;br /&gt;
There are three main types of attacks that the VoIP environment are susceptible to including eavesdropping, theft of services, and denial of service attacks.&lt;br /&gt;
&lt;br /&gt;
===Eavesdropping===&lt;br /&gt;
Eavesdropping on VoIP calls involves third parties monitoring the call signal packets in which the hacker may learn of confidential information such as name, passwords, and other personal information.  This is especially significant to businesses as corporate sensitive information may be revealed.&lt;br /&gt;
&lt;br /&gt;
VoIP eavesdropping is easier accomplished that eavesdropping the traditional telephone line through physical wiretap since the hacker must physically place the wiretap.  Since VoIP calls send data across the network, the hacker can sniff for packets anywhere along the network.&lt;br /&gt;
&lt;br /&gt;
To eavesdrop a call there are 3 simple steps:&lt;br /&gt;
# Understanding how IP Telephony works.  &lt;br /&gt;
# Obtain tools.  &lt;br /&gt;
# Connect the tools into the IP network.&lt;br /&gt;
&lt;br /&gt;
A typical eavesdropper would:&lt;br /&gt;
# Perform a side channel attack based on the fact all IP Telephony implementations use Real Time Protocol(RTP) to transfer packets.&lt;br /&gt;
# Download, install, and run Fireberd DNA-323 to capture and replay voice packets.&lt;br /&gt;
# Connect to the IP network the VoIP conversation is taking place on.&lt;br /&gt;
&lt;br /&gt;
====Data Encryption====&lt;br /&gt;
The most effective countermeasure to eavesdropping is data encryption.  As seen in class, there are many data encryption methods, some more effective than others.  However, all methods introduce overhead which can greatly effect the quality of the conversation by causing large packet loss and packet jitter.  Here are some common ways of implementing data encryption for VoIP:&lt;br /&gt;
&lt;br /&gt;
* Using software such as [http://zfoneproject.com/ Zfone]&lt;br /&gt;
* Using VoIP clients with built in encryption such as Skype&lt;br /&gt;
Skype comes with its own propriety encryption method.  Some other common methods include:&lt;br /&gt;
[http://en.wikipedia.org/wiki/Data_Encryption_Standard Data Encryption Standard](DES),  &lt;br /&gt;
[http://en.wikipedia.org/wiki/Triple_DES Triple DES] (3DES), &lt;br /&gt;
[http://en.wikipedia.org/wiki/Advanced_Encryption_Standard Advanced Encryption Standard] (AES)&lt;br /&gt;
* Using a Virtual Private Network (VPN)&lt;br /&gt;
===Theft of Services===&lt;br /&gt;
One of the great things about VoIP is the fact that you can take it anywhere in the world that has internet access and use it.  Unfortunately, this also benefits the hacker so that he or she may steal access to your VoIP services and then possibly do criminal activities with them.  Also known as VoIP &amp;quot;phreaking&amp;quot;, the hacker can steal your VoIP services through two common ways:&lt;br /&gt;
* '''Spoofing'''&lt;br /&gt;
** Accomplished through changing the header data in the voice packet so it looks like it comes from a different source&lt;br /&gt;
** Hacking into SIP changing SIP registrar information&lt;br /&gt;
* '''Man in the middle attack''' (MITM).&lt;br /&gt;
** Accomplished through monitoring traffic, recording it and/or changing it&lt;br /&gt;
&lt;br /&gt;
====Authentication====&lt;br /&gt;
The most effective countermeasure to theft of VoIP services involves implementing authentication.  Fortunalty, VoIP protocols include some form of authentication.  Specifically, the H.235 component of H.323 facilitates 3 types of authentication:&lt;br /&gt;
# Symmetric encryption&lt;br /&gt;
# Subscription based&lt;br /&gt;
# IPSEC&lt;br /&gt;
Subscription based is much more CPU intensive than symmetric encryption and requires the sharing of a secret key before communication can begin.  Alternatively, H.235 may allow IPSEC to handle the authentication.&lt;br /&gt;
SIP also provides 3 different types of authentication:&lt;br /&gt;
# Basic authentication&lt;br /&gt;
# Digest authentication&lt;br /&gt;
# PGP authentication&lt;br /&gt;
However, all three are challenge-response based.&lt;br /&gt;
&lt;br /&gt;
Other authentication methods include but not limited to:&lt;br /&gt;
* Public key authentication with certification&lt;br /&gt;
* Diffie-Hellman key exchange&lt;br /&gt;
* [http://www.cisco.ws/en/US/docs/ios/12_1t/12_1t2/feature/guide/uni_osp.html UNI-OSP] from Cisco&lt;br /&gt;
&lt;br /&gt;
===Denial of Services===&lt;br /&gt;
There are two main types of denial of services attacks in the VoIP environment including:&lt;br /&gt;
# Exploiting software bugs to bring down servers&lt;br /&gt;
# Distributed bandwidth attack&lt;br /&gt;
Before a DoS attack can take place, the hacker must first use a sniffing program to look for vulnerable hosts.  As discussed in class, a port scanner is useful to identify those hosts.  In a distributed DoS (DDoS) attack, once the vulnerable host is found, a program sometimes called a bot is installed on the computer and awaits for instructions.  The hacker can the send a message to all bots to bombard a target with traffic effectively disabling it.&lt;br /&gt;
&lt;br /&gt;
====Packet Filtering====&lt;br /&gt;
Denial of service attacks are hard to defend against because of the nature of the attack; The attack is hard to distinguish from normal traffic.  The method to defend against DoS attacks used today is mainly packet filtering.  The packet filter must look for suspicious packets and block them before reaching the target.  There is still a great amount of work that can be done in this area.&lt;br /&gt;
&lt;br /&gt;
===Summary===&lt;br /&gt;
{| border=&amp;quot;5&amp;quot; cellspacing=&amp;quot;5&amp;quot; cellpadding=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;&lt;br /&gt;
|+ '''VoIP Security Vulnerabilities'''&lt;br /&gt;
! Threat!! Countermeasures&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Eavesdropping'''&lt;br /&gt;
| &lt;br /&gt;
Data Encryption&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Theft of services'''&lt;br /&gt;
|&lt;br /&gt;
Authentication&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Denial of Services''' &lt;br /&gt;
|&lt;br /&gt;
Packet Filtering&lt;br /&gt;
|}&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==Recommendations==&lt;br /&gt;
&lt;br /&gt;
Although a network cannot be completely immune to attack, here are some recommendations to secure your VoIP network.&lt;br /&gt;
&lt;br /&gt;
#	Do not user shared media devices (ie hubs) on networks&lt;br /&gt;
#	All VoIP traffic should be encrypted&lt;br /&gt;
#	VoIP servers with confidential information should be treated as a confidential database&lt;br /&gt;
#	Build redundancy into VoIP network.&lt;br /&gt;
#	Make sure firewall is VoIP aware&lt;br /&gt;
&lt;br /&gt;
==References==&lt;br /&gt;
# Jaikumar Vijayan. &amp;quot;VOIP: Don't overlook security&amp;quot;.  Retrieved on 2008-04-08. [http://www.computerworld.com/securitytopics/security/story/0,10801,74840,00.html]&lt;br /&gt;
# Bruce Schneier.  &amp;quot;VOIP Encryption&amp;quot;.  Retrieved on 2008-04-12. [http://www.schneier.com/blog/archives/2006/04/voip_encryption.html]&lt;br /&gt;
# &amp;quot;How to: Encrypt Your VoIP&amp;quot;. Retrieved on 2008-04-11. [http://www.voipnow.org/2007/04/how_to_encrypt_.html]&lt;br /&gt;
# &amp;quot;VoIP Authentication (UNI-OSP) Feature&amp;quot;. Retrieved on 2008-04-12. [http://www.cisco.ws/en/US/docs/ios/12_1t/12_1t2/feature/guide/uni_osp.html]&lt;br /&gt;
# &amp;quot;Overview of the Session Initiation Protocol&amp;quot;. Retrieved on 2008-04-12. [http://www.cisco.com/univercd/cc/td/doc/product/voice/sipsols/biggulp/bgsipov.htm]&lt;br /&gt;
# Tom Long. &amp;quot;Eavesdropping an IP Telephony Call&amp;quot;. Retrieved on 2008-04-09. [http://www.sans.org/reading_room/whitepapers/telephone/318.php]&lt;br /&gt;
# Philip Bednarz. &amp;quot;How VoIP is changing the network security equation&amp;quot;. Retrieved on 2008-04-09. [http://www.eetimes.com/showArticle.jhtml;jsessionid=ERU1FKTFCHUJUQSNDLPCKH0CJUNN2JVN?articleID=16505939]&lt;br /&gt;
# Eric Weiss. &amp;quot;Security Concerns with VOIP&amp;quot;. Retrieved on 2008-04-09. [http://www.sans.org/reading_room/whitepapers/voip/323.php]&lt;br /&gt;
# Peter Thermos. &amp;quot;Two attacks against VoIP&amp;quot;. Rerieved on 2008-04-09. [http://www.securityfocus.com/infocus/1862]&lt;br /&gt;
&lt;br /&gt;
==See Also==&lt;br /&gt;
&lt;br /&gt;
==External Links==&lt;br /&gt;
&lt;br /&gt;
--[[User:Chenc8|Chenc8]] 13:29, 13 April 2008 (EDT)&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security</id>
		<title>VoIP (Voice Over IP) Security</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security"/>
				<updated>2008-04-14T00:58:13Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''VoIP''' (Voice over Internet Protocol) is a protocol used for the transmission of voice data across the Internet.  IP telephony treats voice as another form of data that is compressed and optimized for network traffic and is vulnerable to attacks traditional data would be on the network.  VoIP security is akin to network security; voice data traveling the network will look like any other normal data.&lt;br /&gt;
[[Image:oldphone.JPG|frame|right|Has VoIP evolved enough so that the benefits outweigh the costs?]]&lt;br /&gt;
Corporations generally place VoIP concerns on the voice quality, latency, and quality of service above the overall security when VoIP telephony is actually more vulnerable to certain attacks compared to the traditional phone system.  The most common threats found in the VoIP environment include eavesdropping, theft of services, and denial of service attacks. &lt;br /&gt;
&lt;br /&gt;
==Introduction==&lt;br /&gt;
To greater understand VoIP security, a general overview of VoIP systems is useful.  &lt;br /&gt;
&lt;br /&gt;
===Components===&lt;br /&gt;
A typical VoIP system includes four components:&lt;br /&gt;
&lt;br /&gt;
{| border=&amp;quot;1&amp;quot; cellpadding=&amp;quot;2&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
|width=&amp;quot;5%&amp;quot;|'''Data Network'''&lt;br /&gt;
|width=&amp;quot;90%&amp;quot;|&lt;br /&gt;
* Must be high performance to avoid choppy communication&lt;br /&gt;
* QoS (Quality of Service) standard to prioritize voice traffic over data traffic&lt;br /&gt;
** DiffServ&lt;br /&gt;
*** Layer 3 QoS mechanism&lt;br /&gt;
** 802.1p&lt;br /&gt;
*** Layer 2 QoS mechanism&lt;br /&gt;
|-&lt;br /&gt;
|'''IP Handset'''&lt;br /&gt;
|&lt;br /&gt;
* Handset has to be IP enabled so audio stream can be digitized to be transmitted on the IP network&lt;br /&gt;
|-&lt;br /&gt;
|'''Call Server'''&lt;br /&gt;
| &lt;br /&gt;
* Application running on dedicated workstation&lt;br /&gt;
* Provides all call signaling&lt;br /&gt;
* Provides all call control functionality&lt;br /&gt;
* Core operating code of a PBX (Private Branch Exchange) transferred here&lt;br /&gt;
|-&lt;br /&gt;
|'''Gateway'''&lt;br /&gt;
|&lt;br /&gt;
* Voice connectivity between IP network and public carrier network&lt;br /&gt;
* Can be taken over by hackers to make free calls&lt;br /&gt;
|}&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
===VoIP Protocols===&lt;br /&gt;
Voice is connection oriented, hence communication between two parties must be set up first.  Two of the most common protocols used are H.323 and Session Initiation Protocol (SIP).&lt;br /&gt;
&lt;br /&gt;
====H.323====&lt;br /&gt;
H.323 is a standard to promote compatibility in video conference transmissions over IP networks. (cite)&lt;br /&gt;
&lt;br /&gt;
H.323 has four main components:&lt;br /&gt;
# Terminal&lt;br /&gt;
# Gateway&lt;br /&gt;
# Multipoint Control Unit (MCU)&lt;br /&gt;
# Gatekeeper&lt;br /&gt;
&lt;br /&gt;
====Session Initiation Protocol====&lt;br /&gt;
[[Image:SIP.JPG|right|thumb|Source:http://www.cisco.com/univercd/cc/td/doc/product/voice/sipsols/biggulp/bgsipov.htm]]&lt;br /&gt;
SIP is a peer-to-peer standard protocol for multimedia conferencing over IP.  SIP exists on the application layer used to initiate, maintain, as well as terminate a call.  SIP contains 3 components: &lt;br /&gt;
# User agent client or user agent server&lt;br /&gt;
# Proxy server&lt;br /&gt;
# Redirect server&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
==Attacks==&lt;br /&gt;
There are three main types of attacks that the VoIP environment are susceptible to including eavesdropping, theft of services, and denial of service attacks.&lt;br /&gt;
&lt;br /&gt;
===Eavesdropping===&lt;br /&gt;
Eavesdropping on VoIP calls involves third parties monitoring the call signal packets in which the hacker may learn of confidential information such as name, passwords, and other personal information.  This is especially significant to businesses as corporate sensitive information may be revealed.&lt;br /&gt;
&lt;br /&gt;
VoIP eavesdropping is easier accomplished that eavesdropping the traditional telephone line through physical wiretap since the hacker must physically place the wiretap.  Since VoIP calls send data across the network, the hacker can sniff for packets anywhere along the network.&lt;br /&gt;
&lt;br /&gt;
To eavesdrop a call there are 3 simple steps:&lt;br /&gt;
# Understanding how IP Telephony works.  &lt;br /&gt;
# Obtain tools.  &lt;br /&gt;
# Connect the tools into the IP network.&lt;br /&gt;
&lt;br /&gt;
A typical eavesdropper would:&lt;br /&gt;
# Perform a side channel attack based on the fact all IP Telephony implementations use Real Time Protocol(RTP) to transfer packets.&lt;br /&gt;
# Download, install, and run Fireberd DNA-323 to capture and replay voice packets.&lt;br /&gt;
# Connect to the IP network the VoIP conversation is taking place on.&lt;br /&gt;
&lt;br /&gt;
====Data Encryption====&lt;br /&gt;
The most effective countermeasure to eavesdropping is data encryption.  As seen in class, there are many data encryption methods, some more effective than others.  However, all methods introduce overhead which can greatly effect the quality of the conversation by causing large packet loss and packet jitter.  Here are some common ways of implementing data encryption for VoIP:&lt;br /&gt;
&lt;br /&gt;
* Using software such as [http://zfoneproject.com/ Zfone]&lt;br /&gt;
* Using VoIP clients with built in encryption such as Skype&lt;br /&gt;
Skype comes with its own propriety encryption method.  Some other common methods include:&lt;br /&gt;
[http://en.wikipedia.org/wiki/Data_Encryption_Standard Data Encryption Standard](DES),  &lt;br /&gt;
[http://en.wikipedia.org/wiki/Triple_DES Triple DES] (3DES), &lt;br /&gt;
[http://en.wikipedia.org/wiki/Advanced_Encryption_Standard Advanced Encryption Standard] (AES)&lt;br /&gt;
* Using a Virtual Private Network (VPN)&lt;br /&gt;
===Theft of Services===&lt;br /&gt;
One of the great things about VoIP is the fact that you can take it anywhere in the world that has internet access and use it.  Unfortunately, this also benefits the hacker so that he or she may steal access to your VoIP services and then possibly do criminal activities with them.  Also known as VoIP &amp;quot;phreaking&amp;quot;, the hacker can steal your VoIP services through two common ways:&lt;br /&gt;
* '''Spoofing'''&lt;br /&gt;
** Accomplished through changing the header data in the voice packet so it looks like it comes from a different source&lt;br /&gt;
** Hacking into SIP changing SIP registrar information&lt;br /&gt;
* '''Man in the middle attack''' (MITM).&lt;br /&gt;
** Accomplished through monitoring traffic, recording it and/or changing it&lt;br /&gt;
&lt;br /&gt;
====Authentication====&lt;br /&gt;
The most effective countermeasure to theft of VoIP services involves implementing authentication.  Fortunalty, VoIP protocols include some form of authentication.  Specifically, the H.235 component of H.323 facilitates 3 types of authentication:&lt;br /&gt;
# Symmetric encryption&lt;br /&gt;
# Subscription based&lt;br /&gt;
# IPSEC&lt;br /&gt;
Subscription based is much more CPU intensive than symmetric encryption and requires the sharing of a secret key before communication can begin.  Alternatively, H.235 may allow IPSEC to handle the authentication.&lt;br /&gt;
SIP also provides 3 different types of authentication:&lt;br /&gt;
# Basic authentication&lt;br /&gt;
# Digest authentication&lt;br /&gt;
# PGP authentication&lt;br /&gt;
However, all three are challenge-response based.&lt;br /&gt;
&lt;br /&gt;
Other authentication methods include but not limited to:&lt;br /&gt;
* Public key authentication with certification&lt;br /&gt;
* Diffie-Hellman key exchange&lt;br /&gt;
* [http://www.cisco.ws/en/US/docs/ios/12_1t/12_1t2/feature/guide/uni_osp.html UNI-OSP] from Cisco&lt;br /&gt;
&lt;br /&gt;
===Denial of Services===&lt;br /&gt;
There are two main types of denial of services attacks in the VoIP environment including:&lt;br /&gt;
# Exploiting software bugs to bring down servers&lt;br /&gt;
# Distributed bandwidth attack&lt;br /&gt;
Before a DoS attack can take place, the hacker must first use a sniffing program to look for vulnerable hosts.  As discussed in class, a port scanner is useful to identify those hosts.  In a distributed DoS (DDoS) attack, once the vulnerable host is found, a program sometimes called a bot is installed on the computer and awaits for instructions.  The hacker can the send a message to all bots to bombard a target with traffic effectively disabling it.&lt;br /&gt;
&lt;br /&gt;
====Packet Filtering====&lt;br /&gt;
Denial of service attacks are hard to defend against because of the nature of the attack; The attack is hard to distinguish from normal traffic.  The method to defend against DoS attacks used today is mainly packet filtering.  The packet filter must look for suspicious packets and block them before reaching the target.  There is still a great amount of work that can be done in this area.&lt;br /&gt;
&lt;br /&gt;
===Summary===&lt;br /&gt;
{| border=&amp;quot;5&amp;quot; cellspacing=&amp;quot;5&amp;quot; cellpadding=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;&lt;br /&gt;
|+ '''VoIP Security Vulnerabilities'''&lt;br /&gt;
! Threat!! Countermeasures&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Eavesdropping'''&lt;br /&gt;
| &lt;br /&gt;
Data Encryption&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Theft of services'''&lt;br /&gt;
|&lt;br /&gt;
Authentication&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Denial of Services''' &lt;br /&gt;
|&lt;br /&gt;
Packet Filtering&lt;br /&gt;
|}&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==Recommendations==&lt;br /&gt;
&lt;br /&gt;
Although a network cannot be completely immune to attack, here are some recommendations to secure your VoIP network.&lt;br /&gt;
&lt;br /&gt;
#	Do not user shared media devices (ie hubs) on networks&lt;br /&gt;
#	All VoIP traffic should be encrypted&lt;br /&gt;
#	VoIP servers with confidential information should be treated as a confidential database&lt;br /&gt;
#	Build redundancy into VoIP network.&lt;br /&gt;
#	Make sure firewall is VoIP aware&lt;br /&gt;
&lt;br /&gt;
==References==&lt;br /&gt;
# http://www.eetimes.com/showArticle.jhtml;jsessionid=ERU1FKTFCHUJUQSNDLPCKH0CJUNN2JVN?articleID=16505939&lt;br /&gt;
==See Also==&lt;br /&gt;
&lt;br /&gt;
==External Links==&lt;br /&gt;
&lt;br /&gt;
--[[User:Chenc8|Chenc8]] 13:29, 13 April 2008 (EDT)&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security</id>
		<title>VoIP (Voice Over IP) Security</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security"/>
				<updated>2008-04-14T00:08:36Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''VoIP''' (Voice over Internet Protocol) is a protocol used for the transmission of voice data across the Internet.  IP telephony treats voice as another form of data that is compressed and optimized for network traffic and is vulnerable to attacks traditional data would be on the network.  VoIP security is akin to network security; voice data traveling the network will look like any other normal data.&lt;br /&gt;
[[Image:oldphone.JPG|frame|right|Has VoIP come far enough so that the benefits outweigh the costs to justify its use?]]&lt;br /&gt;
Corporations generally place VoIP concerns on the voice quality, latency, and quality of service above the overall security when VoIP telephony is actually more vulnerable to certain attacks compared to the traditional phone system.  The most common threats found in the VoIP environment include eavesdropping, theft of services, and denial of service attacks. &lt;br /&gt;
&lt;br /&gt;
==Introduction==&lt;br /&gt;
To greater understand VoIP security, a general overview of VoIP systems is useful.  &lt;br /&gt;
&lt;br /&gt;
===Components===&lt;br /&gt;
A typical VoIP system includes four components:&lt;br /&gt;
{| border=&amp;quot;5&amp;quot; cellspacing=&amp;quot;5&amp;quot; cellpadding=&amp;quot;2&amp;quot; align=&amp;quot;left&amp;quot;&lt;br /&gt;
|+ '''VoIP system Components'''&lt;br /&gt;
! Component !! Description&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Data Network'''&lt;br /&gt;
| &lt;br /&gt;
* Must be high performance to avoid choppy communication&lt;br /&gt;
* QoS (Quality of Service) standard to prioritize voice traffic over data traffic&lt;br /&gt;
** DiffServ&lt;br /&gt;
*** Layer 3 QoS mechanism&lt;br /&gt;
** 802.1p&lt;br /&gt;
*** Layer 2 QoS mechanism&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''IP Handset'''&lt;br /&gt;
|&lt;br /&gt;
* Handset has to be IP enabled so audio stream can be digitized to be transmitted on the IP network&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Call Server''' &lt;br /&gt;
|&lt;br /&gt;
* Application running on dedicated workstation&lt;br /&gt;
* Provides all call signaling&lt;br /&gt;
* Provides all call control functionality&lt;br /&gt;
* Core operating code of a PBX (Private Branch Exchange) transferred here&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Gateway'''&lt;br /&gt;
|&lt;br /&gt;
* Voice connectivity between IP network and public carrier network&lt;br /&gt;
* Can be taken over by hackers to make free calls&lt;br /&gt;
|}&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===VoIP Protocols===&lt;br /&gt;
Voice is connection oriented, hence communication between two parties must be set up first.  Two of the most common protocols used are H.323 and Session Initiation Protocol (SIP).&lt;br /&gt;
&lt;br /&gt;
====H.323====&lt;br /&gt;
H.323 is a standard to promote compatibility in video conference transmissions over IP networks. (cite)&lt;br /&gt;
&lt;br /&gt;
H.323 has four main components:&lt;br /&gt;
# Terminal&lt;br /&gt;
# Gateway&lt;br /&gt;
# Multipoint Control Unit (MCU)&lt;br /&gt;
# Gatekeeper&lt;br /&gt;
&lt;br /&gt;
====Session Initiation Protocol====&lt;br /&gt;
[[Image:SIP.JPG|right|thumb|Source:http://www.cisco.com/univercd/cc/td/doc/product/voice/sipsols/biggulp/bgsipov.htm]]&lt;br /&gt;
SIP is a peer-to-peer standard protocol for multimedia conferencing over IP.  SIP exists on the application layer used to initiate, maintain, as well as terminate a call.  SIP contains 3 components: &lt;br /&gt;
# User agent client or user agent server&lt;br /&gt;
# Proxy server&lt;br /&gt;
# Redirect server&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
==Attacks==&lt;br /&gt;
There are three main types of attacks that the VoIP environment are susceptible to including eavesdropping, theft of services, and denial of service attacks.&lt;br /&gt;
&lt;br /&gt;
===Eavesdropping===&lt;br /&gt;
Eavesdropping on VoIP calls involves third parties monitoring the call signal packets in which the hacker may learn of confidential information such as name, passwords, and other personal information.  This is especially significant to businesses as corporate sensitive information may be revealed.&lt;br /&gt;
&lt;br /&gt;
VoIP eavesdropping is easier accomplished that eavesdropping the traditional telephone line through physical wiretap since the hacker must physically place the wiretap.  Since VoIP calls send data across the network, the hacker can sniff for packets anywhere along the network.&lt;br /&gt;
&lt;br /&gt;
To eavesdrop a call there are 3 simple steps:&lt;br /&gt;
# Understanding how IP Telephony works.  &lt;br /&gt;
# Obtain tools.  &lt;br /&gt;
# Connect the tools into the IP network.&lt;br /&gt;
&lt;br /&gt;
A typical eavesdropper would:&lt;br /&gt;
# Perform a side channel attack based on the fact all IP Telephony implementations use Real Time Protocol(RTP) to transfer packets.&lt;br /&gt;
# Download, install, and run Fireberd DNA-323 to capture and replay voice packets.&lt;br /&gt;
# Connect to the IP network the VoIP conversation is taking place on.&lt;br /&gt;
&lt;br /&gt;
====Data Encryption====&lt;br /&gt;
The most effective countermeasure to eavesdropping is data encryption.  As seen in class, there are many data encryption methods, some more effective than others.  However, all methods introduce overhead which can greatly effect the quality of the conversation by causing large packet loss and packet jitter.  Here are some common ways of implementing data encryption for VoIP:&lt;br /&gt;
&lt;br /&gt;
* Using software such as [http://zfoneproject.com/ Zfone]&lt;br /&gt;
* Using VoIP clients with built in encryption such as Skype&lt;br /&gt;
Skype comes with its own propriety encryption method.  Some other common methods include:&lt;br /&gt;
[http://en.wikipedia.org/wiki/Data_Encryption_Standard Data Encryption Standard](DES),  &lt;br /&gt;
[http://en.wikipedia.org/wiki/Triple_DES Triple DES] (3DES), &lt;br /&gt;
[http://en.wikipedia.org/wiki/Advanced_Encryption_Standard Advanced Encryption Standard] (AES)&lt;br /&gt;
* Using a Virtual Private Network (VPN)&lt;br /&gt;
===Theft of Services===&lt;br /&gt;
One of the great things about VoIP is the fact that you can take it anywhere in the world that has internet access and use it.  Unfortunately, this also benefits the hacker so that he or she may steal access to your VoIP services and then possibly do criminal activities with them.  Also known as VoIP &amp;quot;phreaking&amp;quot;, the hacker can steal your VoIP services through two common ways:&lt;br /&gt;
* '''Spoofing'''&lt;br /&gt;
** Accomplished through changing the header data in the voice packet so it looks like it comes from a different source&lt;br /&gt;
** Hacking into SIP changing SIP registrar information&lt;br /&gt;
* '''Man in the middle attack''' (MITM).&lt;br /&gt;
** Accomplished through monitoring traffic, recording it and/or changing it&lt;br /&gt;
&lt;br /&gt;
====Authentication====&lt;br /&gt;
The most effective countermeasure to theft of VoIP services involves implementing authentication.  Fortunalty, VoIP protocols include some form of authentication.  Specifically, the H.235 component of H.323 facilitates 3 types of authentication:&lt;br /&gt;
# Symmetric encryption&lt;br /&gt;
# Subscription based&lt;br /&gt;
# IPSEC&lt;br /&gt;
Subscription based is much more CPU intensive than symmetric encryption and requires the sharing of a secret key before communication can begin.  Alternatively, H.235 may allow IPSEC to handle the authentication.&lt;br /&gt;
SIP also provides 3 different types of authentication:&lt;br /&gt;
# Basic authentication&lt;br /&gt;
# Digest authentication&lt;br /&gt;
# PGP authentication&lt;br /&gt;
However, all three are challenge-response based.&lt;br /&gt;
&lt;br /&gt;
Other authentication methods include but not limited to:&lt;br /&gt;
* Public key authentication with certification&lt;br /&gt;
* Diffie-Hellman key exchange&lt;br /&gt;
* [http://www.cisco.ws/en/US/docs/ios/12_1t/12_1t2/feature/guide/uni_osp.html UNI-OSP] from Cisco&lt;br /&gt;
&lt;br /&gt;
===Denial of Services===&lt;br /&gt;
There are two main types of denial of services attacks in the VoIP environment including:&lt;br /&gt;
# Exploiting software bugs to bring down servers&lt;br /&gt;
# Distributed bandwidth attack&lt;br /&gt;
Before a DoS attack can take place, the hacker must first use a sniffing program to look for vulnerable hosts.  As discussed in class, a port scanner is useful to identify those hosts.  In a distributed DoS (DDoS) attack, once the vulnerable host is found, a program sometimes called a bot is installed on the computer and awaits for instructions.  The hacker can the send a message to all bots to bombard a target with traffic effectively disabling it.&lt;br /&gt;
&lt;br /&gt;
====Packet Filtering====&lt;br /&gt;
Denial of service attacks are hard to defend against because of the nature of the attack; The attack is hard to distinguish from normal traffic.  The method to defend against DoS attacks used today is mainly packet filtering.  The packet filter must look for suspicious packets and block them before reaching the target.  There is still a great amount of work that can be done in this area.&lt;br /&gt;
&lt;br /&gt;
==Recommendations==&lt;br /&gt;
&lt;br /&gt;
Although a network cannot be completely immune to attack, here are some recommendations to secure your VoIP network.&lt;br /&gt;
&lt;br /&gt;
#	Do not user shared media devices (ie hubs) on networks&lt;br /&gt;
#	All VoIP traffic should be encrypted&lt;br /&gt;
#	VoIP servers with confidential information should be treated as a confidential database&lt;br /&gt;
#	Build redundancy into VoIP network.&lt;br /&gt;
#	Make sure firewall is VoIP aware&lt;br /&gt;
&lt;br /&gt;
==References==&lt;br /&gt;
# http://www.eetimes.com/showArticle.jhtml;jsessionid=ERU1FKTFCHUJUQSNDLPCKH0CJUNN2JVN?articleID=16505939&lt;br /&gt;
==See Also==&lt;br /&gt;
&lt;br /&gt;
==External Links==&lt;br /&gt;
&lt;br /&gt;
--[[User:Chenc8|Chenc8]] 13:29, 13 April 2008 (EDT)&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/File:Oldphone.JPG</id>
		<title>File:Oldphone.JPG</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/File:Oldphone.JPG"/>
				<updated>2008-04-14T00:04:33Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security</id>
		<title>VoIP (Voice Over IP) Security</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security"/>
				<updated>2008-04-14T00:02:42Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''VoIP''' (Voice over Internet Protocol) is a protocol used for the transmission of voice data across the Internet.  IP telephony treats voice as another form of data that is compressed and optimized for network traffic and is vulnerable to attacks traditional data would be on the network.  VoIP security is akin to network security; voice data traveling the network will look like any other normal data.&lt;br /&gt;
&lt;br /&gt;
Corporations generally place VoIP concerns on the voice quality, latency, and quality of service above the overall security when VoIP telephony is actually more vulnerable to certain attacks compared to the traditional phone system.  The most common threats found in the VoIP environment include eavesdropping, theft of services, and denial of service attacks.  Has VoIP come far enough so that the benefits outweigh the costs to justify its use?&lt;br /&gt;
&lt;br /&gt;
==Introduction==&lt;br /&gt;
&lt;br /&gt;
To greater understand VoIP security, a general overview of VoIP systems is useful.  &lt;br /&gt;
&lt;br /&gt;
===Components===&lt;br /&gt;
A typical VoIP system includes four components:&lt;br /&gt;
{| border=&amp;quot;5&amp;quot; cellspacing=&amp;quot;5&amp;quot; cellpadding=&amp;quot;2&amp;quot; align=&amp;quot;left&amp;quot;&lt;br /&gt;
|+ '''VoIP system Components'''&lt;br /&gt;
! Component !! Description&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Data Network'''&lt;br /&gt;
| &lt;br /&gt;
* Must be high performance to avoid choppy communication&lt;br /&gt;
* QoS (Quality of Service) standard to prioritize voice traffic over data traffic&lt;br /&gt;
** DiffServ&lt;br /&gt;
*** Layer 3 QoS mechanism&lt;br /&gt;
** 802.1p&lt;br /&gt;
*** Layer 2 QoS mechanism&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''IP Handset'''&lt;br /&gt;
|&lt;br /&gt;
* Handset has to be IP enabled so audio stream can be digitized to be transmitted on the IP network&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Call Server''' &lt;br /&gt;
|&lt;br /&gt;
* Application running on dedicated workstation&lt;br /&gt;
* Provides all call signaling&lt;br /&gt;
* Provides all call control functionality&lt;br /&gt;
* Core operating code of a PBX (Private Branch Exchange) transferred here&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Gateway'''&lt;br /&gt;
|&lt;br /&gt;
* Voice connectivity between IP network and public carrier network&lt;br /&gt;
* Can be taken over by hackers to make free calls&lt;br /&gt;
|}&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===VoIP Protocols===&lt;br /&gt;
Voice is connection oriented, hence communication between two parties must be set up first.  Two of the most common protocols used are H.323 and Session Initiation Protocol (SIP).&lt;br /&gt;
&lt;br /&gt;
====H.323====&lt;br /&gt;
H.323 is a standard to promote compatibility in video conference transmissions over IP networks. (cite)&lt;br /&gt;
&lt;br /&gt;
H.323 has four main components:&lt;br /&gt;
# Terminal&lt;br /&gt;
# Gateway&lt;br /&gt;
# Multipoint Control Unit (MCU)&lt;br /&gt;
# Gatekeeper&lt;br /&gt;
&lt;br /&gt;
====Session Initiation Protocol====&lt;br /&gt;
[[Image:SIP.JPG|right|thumb|Source:http://www.cisco.com/univercd/cc/td/doc/product/voice/sipsols/biggulp/bgsipov.htm]]&lt;br /&gt;
SIP is a peer-to-peer standard protocol for multimedia conferencing over IP.  SIP exists on the application layer used to initiate, maintain, as well as terminate a call.  SIP contains 3 components: &lt;br /&gt;
# User agent client or user agent server&lt;br /&gt;
# Proxy server&lt;br /&gt;
# Redirect server&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
==Attacks==&lt;br /&gt;
There are three main types of attacks that the VoIP environment are susceptible to including eavesdropping, theft of services, and denial of service attacks.&lt;br /&gt;
&lt;br /&gt;
===Eavesdropping===&lt;br /&gt;
Eavesdropping on VoIP calls involves third parties monitoring the call signal packets in which the hacker may learn of confidential information such as name, passwords, and other personal information.  This is especially significant to businesses as corporate sensitive information may be revealed.&lt;br /&gt;
&lt;br /&gt;
VoIP eavesdropping is easier accomplished that eavesdropping the traditional telephone line through physical wiretap since the hacker must physically place the wiretap.  Since VoIP calls send data across the network, the hacker can sniff for packets anywhere along the network.&lt;br /&gt;
&lt;br /&gt;
To eavesdrop a call there are 3 simple steps:&lt;br /&gt;
# Understanding how IP Telephony works.  &lt;br /&gt;
# Obtain tools.  &lt;br /&gt;
# Connect the tools into the IP network.&lt;br /&gt;
&lt;br /&gt;
A typical eavesdropper would:&lt;br /&gt;
# Perform a side channel attack based on the fact all IP Telephony implementations use Real Time Protocol(RTP) to transfer packets.&lt;br /&gt;
# Download, install, and run Fireberd DNA-323 to capture and replay voice packets.&lt;br /&gt;
# Connect to the IP network the VoIP conversation is taking place on.&lt;br /&gt;
&lt;br /&gt;
====Data Encryption====&lt;br /&gt;
The most effective countermeasure to eavesdropping is data encryption.  As seen in class, there are many data encryption methods, some more effective than others.  However, all methods introduce overhead which can greatly effect the quality of the conversation by causing large packet loss and packet jitter.  Here are some common ways of implementing data encryption for VoIP:&lt;br /&gt;
&lt;br /&gt;
* Using software such as [http://zfoneproject.com/ Zfone]&lt;br /&gt;
* Using VoIP clients with built in encryption such as Skype&lt;br /&gt;
Skype comes with its own propriety encryption method.  Some other common methods include:&lt;br /&gt;
[http://en.wikipedia.org/wiki/Data_Encryption_Standard Data Encryption Standard](DES),  &lt;br /&gt;
[http://en.wikipedia.org/wiki/Triple_DES Triple DES] (3DES), &lt;br /&gt;
[http://en.wikipedia.org/wiki/Advanced_Encryption_Standard Advanced Encryption Standard] (AES)&lt;br /&gt;
* Using a Virtual Private Network (VPN)&lt;br /&gt;
===Theft of Services===&lt;br /&gt;
One of the great things about VoIP is the fact that you can take it anywhere in the world that has internet access and use it.  Unfortunately, this also benefits the hacker so that he or she may steal access to your VoIP services and then possibly do criminal activities with them.  Also known as VoIP &amp;quot;phreaking&amp;quot;, the hacker can steal your VoIP services through two common ways:&lt;br /&gt;
* '''Spoofing'''&lt;br /&gt;
** Accomplished through changing the header data in the voice packet so it looks like it comes from a different source&lt;br /&gt;
** Hacking into SIP changing SIP registrar information&lt;br /&gt;
* '''Man in the middle attack''' (MITM).&lt;br /&gt;
** Accomplished through monitoring traffic, recording it and/or changing it&lt;br /&gt;
&lt;br /&gt;
====Authentication====&lt;br /&gt;
The most effective countermeasure to theft of VoIP services involves implementing authentication.  Fortunalty, VoIP protocols include some form of authentication.  Specifically, the H.235 component of H.323 facilitates 3 types of authentication:&lt;br /&gt;
# Symmetric encryption&lt;br /&gt;
# Subscription based&lt;br /&gt;
# IPSEC&lt;br /&gt;
Subscription based is much more CPU intensive than symmetric encryption and requires the sharing of a secret key before communication can begin.  Alternatively, H.235 may allow IPSEC to handle the authentication.&lt;br /&gt;
SIP also provides 3 different types of authentication:&lt;br /&gt;
# Basic authentication&lt;br /&gt;
# Digest authentication&lt;br /&gt;
# PGP authentication&lt;br /&gt;
However, all three are challenge-response based.&lt;br /&gt;
&lt;br /&gt;
Other authentication methods include but not limited to:&lt;br /&gt;
* Public key authentication with certification&lt;br /&gt;
* Diffie-Hellman key exchange&lt;br /&gt;
* [http://www.cisco.ws/en/US/docs/ios/12_1t/12_1t2/feature/guide/uni_osp.html UNI-OSP] from Cisco&lt;br /&gt;
&lt;br /&gt;
===Denial of Services===&lt;br /&gt;
There are two main types of denial of services attacks in the VoIP environment including:&lt;br /&gt;
# Exploiting software bugs to bring down servers&lt;br /&gt;
# Distributed bandwidth attack&lt;br /&gt;
Before a DoS attack can take place, the hacker must first use a sniffing program to look for vulnerable hosts.  As discussed in class, a port scanner is useful to identify those hosts.  In a distributed DoS (DDoS) attack, once the vulnerable host is found, a program sometimes called a bot is installed on the computer and awaits for instructions.  The hacker can the send a message to all bots to bombard a target with traffic effectively disabling it.&lt;br /&gt;
&lt;br /&gt;
====Packet Filtering====&lt;br /&gt;
Denial of service attacks are hard to defend against because of the nature of the attack; The attack is hard to distinguish from normal traffic.  The method to defend against DoS attacks used today is mainly packet filtering.  The packet filter must look for suspicious packets and block them before reaching the target.  There is still a great amount of work that can be done in this area.&lt;br /&gt;
&lt;br /&gt;
==Recommendations==&lt;br /&gt;
&lt;br /&gt;
Although a network cannot be completely immune to attack, here are some recommendations to secure your VoIP network.&lt;br /&gt;
&lt;br /&gt;
#	Do not user shared media devices (ie hubs) on networks&lt;br /&gt;
#	All VoIP traffic should be encrypted&lt;br /&gt;
#	VoIP servers with confidential information should be treated as a confidential database&lt;br /&gt;
#	Build redundancy into VoIP network.&lt;br /&gt;
#	Make sure firewall is VoIP aware&lt;br /&gt;
&lt;br /&gt;
==References==&lt;br /&gt;
# http://www.eetimes.com/showArticle.jhtml;jsessionid=ERU1FKTFCHUJUQSNDLPCKH0CJUNN2JVN?articleID=16505939&lt;br /&gt;
==See Also==&lt;br /&gt;
&lt;br /&gt;
==External Links==&lt;br /&gt;
&lt;br /&gt;
--[[User:Chenc8|Chenc8]] 13:29, 13 April 2008 (EDT)&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/File:SIP.JPG</id>
		<title>File:SIP.JPG</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/File:SIP.JPG"/>
				<updated>2008-04-13T23:56:14Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security</id>
		<title>VoIP (Voice Over IP) Security</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security"/>
				<updated>2008-04-13T23:53:18Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''VoIP''' (Voice over Internet Protocol) is a protocol used for the transmission of voice data across the Internet.  IP telephony treats voice as another form of data that is compressed and optimized for network traffic and is vulnerable to attacks traditional data would be on the network.  VoIP security is akin to network security; voice data traveling the network will look like any other normal data.&lt;br /&gt;
&lt;br /&gt;
Corporations generally place VoIP concerns on the voice quality, latency, and quality of service above the overall security when VoIP telephony is actually more vulnerable to certain attacks compared to the traditional phone system.  The most common threats found in the VoIP environment include eavesdropping, theft of services, and denial of service attacks.  Has VoIP come far enough so that the benefits outweigh the costs to justify its use?&lt;br /&gt;
&lt;br /&gt;
==Introduction==&lt;br /&gt;
&lt;br /&gt;
To greater understand VoIP security, a general overview of VoIP systems is useful.  &lt;br /&gt;
&lt;br /&gt;
===Components===&lt;br /&gt;
A typical VoIP system includes four components:&lt;br /&gt;
{| border=&amp;quot;5&amp;quot; cellspacing=&amp;quot;5&amp;quot; cellpadding=&amp;quot;2&amp;quot; align=&amp;quot;left&amp;quot;&lt;br /&gt;
|+ '''VoIP system Components'''&lt;br /&gt;
! Component !! Description&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Data Network'''&lt;br /&gt;
| &lt;br /&gt;
* Must be high performance to avoid choppy communication&lt;br /&gt;
* QoS (Quality of Service) standard to prioritize voice traffic over data traffic&lt;br /&gt;
** DiffServ&lt;br /&gt;
*** Layer 3 QoS mechanism&lt;br /&gt;
** 802.1p&lt;br /&gt;
*** Layer 2 QoS mechanism&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''IP Handset'''&lt;br /&gt;
|&lt;br /&gt;
* Handset has to be IP enabled so audio stream can be digitized to be transmitted on the IP network&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Call Server''' &lt;br /&gt;
|&lt;br /&gt;
* Application running on dedicated workstation&lt;br /&gt;
* Provides all call signaling&lt;br /&gt;
* Provides all call control functionality&lt;br /&gt;
* Core operating code of a PBX (Private Branch Exchange) transferred here&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Gateway'''&lt;br /&gt;
|&lt;br /&gt;
* Voice connectivity between IP network and public carrier network&lt;br /&gt;
* Can be taken over by hackers to make free calls&lt;br /&gt;
|}&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===VoIP Protocols===&lt;br /&gt;
Voice is connection oriented, hence communication between two parties must be set up first.  Two of the most common protocols used are H.323 and Session Initiation Protocol (SIP).&lt;br /&gt;
&lt;br /&gt;
====H.323====&lt;br /&gt;
H.323 is a standard to promote compatibility in video conference transmissions over IP networks. (cite)&lt;br /&gt;
&lt;br /&gt;
H.323 has four main components:&lt;br /&gt;
# Terminal&lt;br /&gt;
# Gateway&lt;br /&gt;
# Multipoint Control Unit (MCU)&lt;br /&gt;
# Gatekeeper&lt;br /&gt;
&lt;br /&gt;
====Session Initiation Protocol====&lt;br /&gt;
SIP is a peer-to-peer standard protocol for multimedia conferencing over IP.  SIP exists on the application layer used to initiate, maintain, as well as terminate a call.  SIP contains 3 components:&lt;br /&gt;
# User agent client or user agent server&lt;br /&gt;
# Proxy server&lt;br /&gt;
# Redirect server&lt;br /&gt;
&lt;br /&gt;
==Attacks==&lt;br /&gt;
&lt;br /&gt;
There are three main types of attacks that the VoIP environment are susceptible to including eavesdropping, theft of services, and denial of service attacks.&lt;br /&gt;
&lt;br /&gt;
===Eavesdropping===&lt;br /&gt;
Eavesdropping on VoIP calls involves third parties monitoring the call signal packets in which the hacker may learn of confidential information such as name, passwords, and other personal information.  This is especially significant to businesses as corporate sensitive information may be revealed.&lt;br /&gt;
&lt;br /&gt;
VoIP eavesdropping is easier accomplished that eavesdropping the traditional telephone line through physical wiretap since the hacker must physically place the wiretap.  Since VoIP calls send data across the network, the hacker can sniff for packets anywhere along the network.&lt;br /&gt;
&lt;br /&gt;
To eavesdrop a call there are 3 simple steps:&lt;br /&gt;
# Understanding how IP Telephony works.  &lt;br /&gt;
# Obtain tools.  &lt;br /&gt;
# Connect the tools into the IP network.&lt;br /&gt;
&lt;br /&gt;
A typical eavesdropper would:&lt;br /&gt;
# Perform a side channel attack based on the fact all IP Telephony implementations use Real Time Protocol(RTP) to transfer packets.&lt;br /&gt;
# Download, install, and run Fireberd DNA-323 to capture and replay voice packets.&lt;br /&gt;
# Connect to the IP network the VoIP conversation is taking place on.&lt;br /&gt;
&lt;br /&gt;
====Data Encryption====&lt;br /&gt;
The most effective countermeasure to eavesdropping is data encryption.  As seen in class, there are many data encryption methods, some more effective than others.  However, all methods introduce overhead which can greatly effect the quality of the conversation by causing large packet loss and packet jitter.  Here are some common ways of implementing data encryption for VoIP:&lt;br /&gt;
&lt;br /&gt;
* Using software such as [http://zfoneproject.com/ Zfone]&lt;br /&gt;
* Using VoIP clients with built in encryption such as Skype&lt;br /&gt;
Skype comes with its own propriety encryption method.  Some other common methods include:&lt;br /&gt;
[http://en.wikipedia.org/wiki/Data_Encryption_Standard Data Encryption Standard](DES),  &lt;br /&gt;
[http://en.wikipedia.org/wiki/Triple_DES Triple DES] (3DES), &lt;br /&gt;
[http://en.wikipedia.org/wiki/Advanced_Encryption_Standard Advanced Encryption Standard] (AES)&lt;br /&gt;
* Using a Virtual Private Network (VPN)&lt;br /&gt;
===Theft of Services===&lt;br /&gt;
One of the great things about VoIP is the fact that you can take it anywhere in the world that has internet access and use it.  Unfortunately, this also benefits the hacker so that he or she may steal access to your VoIP services and then possibly do criminal activities with them.  Also known as VoIP &amp;quot;phreaking&amp;quot;, the hacker can steal your VoIP services through two common ways:&lt;br /&gt;
* '''Spoofing'''&lt;br /&gt;
** Accomplished through changing the header data in the voice packet so it looks like it comes from a different source&lt;br /&gt;
** Hacking into SIP changing SIP registrar information&lt;br /&gt;
* '''Man in the middle attack''' (MITM).&lt;br /&gt;
** Accomplished through monitoring traffic, recording it and/or changing it&lt;br /&gt;
&lt;br /&gt;
====Authentication====&lt;br /&gt;
The most effective countermeasure to theft of VoIP services involves implementing authentication.  Fortunalty, VoIP protocols include some form of authentication.  Specifically, the H.235 component of H.323 facilitates 3 types of authentication:&lt;br /&gt;
# Symmetric encryption&lt;br /&gt;
# Subscription based&lt;br /&gt;
# IPSEC&lt;br /&gt;
Subscription based is much more CPU intensive than symmetric encryption and requires the sharing of a secret key before communication can begin.  Alternatively, H.235 may allow IPSEC to handle the authentication.&lt;br /&gt;
SIP also provides 3 different types of authentication:&lt;br /&gt;
# Basic authentication&lt;br /&gt;
# Digest authentication&lt;br /&gt;
# PGP authentication&lt;br /&gt;
However, all three are challenge-response based.&lt;br /&gt;
&lt;br /&gt;
Other authentication methods include but not limited to:&lt;br /&gt;
* Public key authentication with certification&lt;br /&gt;
* Diffie-Hellman key exchange&lt;br /&gt;
* [http://www.cisco.ws/en/US/docs/ios/12_1t/12_1t2/feature/guide/uni_osp.html UNI-OSP] from Cisco&lt;br /&gt;
&lt;br /&gt;
===Denial of Services===&lt;br /&gt;
There are two main types of denial of services attacks in the VoIP environment including:&lt;br /&gt;
# Exploiting software bugs to bring down servers&lt;br /&gt;
# Distributed bandwidth attack&lt;br /&gt;
Before a DoS attack can take place, the hacker must first use a sniffing program to look for vulnerable hosts.  As discussed in class, a port scanner is useful to identify those hosts.  In a distributed DoS (DDoS) attack, once the vulnerable host is found, a program sometimes called a bot is installed on the computer and awaits for instructions.  The hacker can the send a message to all bots to bombard a target with traffic effectively disabling it.&lt;br /&gt;
&lt;br /&gt;
====Packet Filtering====&lt;br /&gt;
Denial of service attacks are hard to defend against because of the nature of the attack; The attack is hard to distinguish from normal traffic.  The method to defend against DoS attacks used today is mainly packet filtering.  The packet filter must look for suspicious packets and block them before reaching the target.  There is still a great amount of work that can be done in this area.&lt;br /&gt;
&lt;br /&gt;
==Recommendations==&lt;br /&gt;
&lt;br /&gt;
Although a network cannot be completely immune to attack, here are some recommendations to secure your VoIP network.&lt;br /&gt;
&lt;br /&gt;
#	Do not user shared media devices (ie hubs) on networks&lt;br /&gt;
#	All VoIP traffic should be encrypted&lt;br /&gt;
#	VoIP servers with confidential information should be treated as a confidential database&lt;br /&gt;
#	Build redundancy into VoIP network.&lt;br /&gt;
#	Make sure firewall is VoIP aware&lt;br /&gt;
&lt;br /&gt;
==References==&lt;br /&gt;
# http://www.eetimes.com/showArticle.jhtml;jsessionid=ERU1FKTFCHUJUQSNDLPCKH0CJUNN2JVN?articleID=16505939&lt;br /&gt;
==See Also==&lt;br /&gt;
&lt;br /&gt;
==External Links==&lt;br /&gt;
&lt;br /&gt;
--[[User:Chenc8|Chenc8]] 13:29, 13 April 2008 (EDT)&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security</id>
		<title>VoIP (Voice Over IP) Security</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security"/>
				<updated>2008-04-13T18:26:58Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''VoIP''' (Voice over Internet Protocol) is a protocol used for the transmission of voice data across the Internet.  IP telephony treats voice as another form of data that is compressed and optimized for network traffic and is vulnerable to attacks traditional data would be on the network.  VoIP security is akin to network security; voice data traveling the network will look like any other normal data.&lt;br /&gt;
&lt;br /&gt;
Corporations generally place VoIP concerns on the voice quality, latency, and quality of service above the overall security when VoIP telephony is actually more vulnerable to certain attacks compared to the traditional phone system.  The most common threats found in the VoIP environment include eavesdropping, theft of services, and denial of service attacks.  Has VoIP come far enough so that the benefits outweigh the costs to justify its use?&lt;br /&gt;
&lt;br /&gt;
==Introduction==&lt;br /&gt;
&lt;br /&gt;
To greater understand VoIP security, a general overview of VoIP systems is useful.  &lt;br /&gt;
&lt;br /&gt;
===Components===&lt;br /&gt;
A typical VoIP system includes four components:&lt;br /&gt;
{| border=&amp;quot;5&amp;quot; cellspacing=&amp;quot;5&amp;quot; cellpadding=&amp;quot;2&amp;quot; align=&amp;quot;left&amp;quot;&lt;br /&gt;
|+ '''VoIP system Components'''&lt;br /&gt;
! Component !! Description&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Data Network'''&lt;br /&gt;
| &lt;br /&gt;
* Must be high performance to avoid choppy communication&lt;br /&gt;
* Must be resilient in the sense that traffic congestion will not greatly effect voice quality&lt;br /&gt;
* QoS (Quality of Service) standard to prioritize voice traffic over data traffic&lt;br /&gt;
** DiffServ&lt;br /&gt;
*** Layer 3 QoS mechanism&lt;br /&gt;
*** Redefines 6-bits of the Type of Service byte in IP header&lt;br /&gt;
*** DSCP (DiffServ Code Point) used to prioritize the IP packet&lt;br /&gt;
** 802.1p&lt;br /&gt;
*** Layer 2 QoS mechanism&lt;br /&gt;
*** Uses 3-bits of 802.1Q frame tag to prioritize an Ethernet frame&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''IP Handset'''&lt;br /&gt;
|&lt;br /&gt;
* Handset has to be IP enabled so audio stream can be digitized to be transmitted on the IP network&lt;br /&gt;
* Uses Cat5 cable&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Call Server''' &lt;br /&gt;
|&lt;br /&gt;
* Application running on dedicated workstation&lt;br /&gt;
* Provides all call signaling&lt;br /&gt;
* Provides all call control functionality&lt;br /&gt;
* Core operating code of a PBX (Private Branch Exchange) transferred here&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Gateway'''&lt;br /&gt;
|&lt;br /&gt;
* Voice connectivity between IP network and public carrier network&lt;br /&gt;
* Can be taken over by hackers to make free calls&lt;br /&gt;
|}&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==Attacks==&lt;br /&gt;
&lt;br /&gt;
There are three main types of attacks that the VoIP environment are susceptible to including eavesdropping, theft of services, and denial of service attacks.&lt;br /&gt;
&lt;br /&gt;
===Eavesdropping===&lt;br /&gt;
Eavesdropping on VoIP calls involves third parties monitoring the call signal packets in which the hacker may learn of confidential information such as name, passwords, and other personal information.  This is especially significant to businesses as corporate sensitive information may be revealed.&lt;br /&gt;
&lt;br /&gt;
VoIP eavesdropping is easier accomplished that eavesdropping the traditional telephone line through physical wiretap since the hacker must physically place the wiretap.  Since VoIP calls send data across the network, the hacker can sniff for packets anywhere along the network.&lt;br /&gt;
&lt;br /&gt;
====Data Encryption====&lt;br /&gt;
The most effective countermeasure to eavesdropping is data encryption.  As seen in class, there are many data encryption methods, some more effective than others.  However, all methods introduce overhead which can greatly effect the quality of the conversation by causing large packet loss and packet jitter.  Here are some common ways of implementing data encryption for VoIP:&lt;br /&gt;
&lt;br /&gt;
* Using software such as [http://zfoneproject.com/ Zfone]&lt;br /&gt;
* Using VoIP clients with built in encryption such as Skype&lt;br /&gt;
Skype comes with its own propriety encryption method.  Some other common methods include:&lt;br /&gt;
[http://en.wikipedia.org/wiki/Data_Encryption_Standard Data Encryption Standard](DES),  &lt;br /&gt;
[http://en.wikipedia.org/wiki/Triple_DES Triple DES] (3DES), &lt;br /&gt;
[http://en.wikipedia.org/wiki/Advanced_Encryption_Standard Advanced Encryption Standard] (AES)&lt;br /&gt;
* Using a Virtual Private Network (VPN)&lt;br /&gt;
===Theft of Services===&lt;br /&gt;
&lt;br /&gt;
===Denial of Services===&lt;br /&gt;
&lt;br /&gt;
==Recommendations==&lt;br /&gt;
&lt;br /&gt;
Although a network cannot be completely immune to attack, here are some recommendations to secure your VoIP network.&lt;br /&gt;
&lt;br /&gt;
#	Do not user shared media devices (ie hubs) on networks&lt;br /&gt;
#	All VoIP traffic should be encrypted&lt;br /&gt;
#	VoIP servers with confidential information should be treated as a confidential database&lt;br /&gt;
#	Build redundancy into VoIP network.&lt;br /&gt;
#	Make sure firewall is VoIP aware&lt;br /&gt;
&lt;br /&gt;
==References==&lt;br /&gt;
&lt;br /&gt;
==See Also==&lt;br /&gt;
&lt;br /&gt;
==External Links==&lt;br /&gt;
&lt;br /&gt;
--[[User:Chenc8|Chenc8]] 13:29, 13 April 2008 (EDT)&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security</id>
		<title>VoIP (Voice Over IP) Security</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security"/>
				<updated>2008-04-13T17:29:21Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''VoIP''' (Voice over Internet Protocol) is a protocol used for the transmission of voice data across the Internet.  IP telephony treats voice as another form of data that is compressed and optimized for network traffic and is vulnerable to attacks traditional data would be on the network.  VoIP security is akin to network security; voice data traveling the network will look like any other normal data.&lt;br /&gt;
&lt;br /&gt;
Corporations generally place VoIP concerns on the voice quality, latency, and quality of service above the overall security when VoIP telephony is actually more vulnerable to certain attacks compared to the traditional phone system.  The most common threats found in the VoIP environment include eavesdropping, theft of services, and denial of service attacks.  Has VoIP come far enough so that the benefits outweigh the costs to justify its use?&lt;br /&gt;
&lt;br /&gt;
==Introduction==&lt;br /&gt;
&lt;br /&gt;
To greater understand VoIP security, a general overview of VoIP systems is useful.  &lt;br /&gt;
&lt;br /&gt;
===Components===&lt;br /&gt;
A typical VoIP system includes four components:&lt;br /&gt;
{| border=&amp;quot;5&amp;quot; cellspacing=&amp;quot;5&amp;quot; cellpadding=&amp;quot;2&amp;quot; align=&amp;quot;left&amp;quot;&lt;br /&gt;
|+ '''VoIP system Components'''&lt;br /&gt;
! Component !! Description&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Data Network'''&lt;br /&gt;
| &lt;br /&gt;
* Must be high performance to avoid choppy communication&lt;br /&gt;
* Must be resilient in the sense that traffic congestion will not greatly effect voice quality&lt;br /&gt;
* QoS (Quality of Service) standard to prioritize voice traffic over data traffic&lt;br /&gt;
** DiffServ&lt;br /&gt;
*** Layer 3 QoS mechanism&lt;br /&gt;
*** Redefines 6-bits of the Type of Service byte in IP header&lt;br /&gt;
*** DSCP (DiffServ Code Point) used to prioritize the IP packet&lt;br /&gt;
** 802.1p&lt;br /&gt;
*** Layer 2 QoS mechanism&lt;br /&gt;
*** Uses 3-bits of 802.1Q frame tag to prioritize an Ethernet frame&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''IP Handset'''&lt;br /&gt;
|&lt;br /&gt;
* Handset has to be IP enabled so audio stream can be digitized to be transmitted on the IP network&lt;br /&gt;
* Uses Cat5 cable&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Call Server''' &lt;br /&gt;
|&lt;br /&gt;
* Application running on dedicated workstation&lt;br /&gt;
* Provides all call signaling&lt;br /&gt;
* Provides all call control functionality&lt;br /&gt;
* Core operating code of a PBX (Private Branch Exchange) transferred here&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Gateway'''&lt;br /&gt;
|&lt;br /&gt;
* Voice connectivity between IP network and public carrier network&lt;br /&gt;
* Can be taken over by hackers to make free calls&lt;br /&gt;
|}&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==Attacks==&lt;br /&gt;
&lt;br /&gt;
There are three main types of attacks that the VoIP environment are susceptible to including eavesdropping, theft of services, and denial of service attacks.&lt;br /&gt;
&lt;br /&gt;
===Eavesdropping===&lt;br /&gt;
Eavesdropping on VoIP calls involves third parties monitoring the call signal packets in which the hacker may learn of confidential information such as name, passwords, and other personal information.  This is especially significant to businesses as corporate sensitive information may be revealed.&lt;br /&gt;
&lt;br /&gt;
VoIP eavesdropping is easier accomplished that eavesdropping the traditional telephone line through physical wiretap since the hacker must physically place the wiretap.  Since VoIP calls send data across the network, the hacker can sniff for packets anywhere along the network.&lt;br /&gt;
&lt;br /&gt;
====Data Encryption====&lt;br /&gt;
The most effective countermeasure to eavesdropping is data encryption.  As seen in class, there are many data encryption methods, some more effective than others.  However, all methods introduce overhead which can greatly effect the quality of the conversation by causing large packet loss and packet jitter.  Here are some common data encryption methods:&lt;br /&gt;
&lt;br /&gt;
* Data Encryption Standard(DES) [[Wikipedia:Data Encryption Standard|Data Encryption Standard]]&lt;br /&gt;
* &lt;br /&gt;
===Theft of Services===&lt;br /&gt;
&lt;br /&gt;
===Denial of Services===&lt;br /&gt;
&lt;br /&gt;
==Recommendations==&lt;br /&gt;
&lt;br /&gt;
Although a network cannot be completely immune to attack, here are some recommendations to secure your VoIP network.&lt;br /&gt;
&lt;br /&gt;
#	Do not user shared media devices (ie hubs) on networks&lt;br /&gt;
#	All VoIP traffic should be encrypted&lt;br /&gt;
#	VoIP servers with confidential information should be treated as a confidential database&lt;br /&gt;
#	Build redundancy into VoIP network.&lt;br /&gt;
#	Make sure firewall is VoIP aware&lt;br /&gt;
&lt;br /&gt;
==References==&lt;br /&gt;
&lt;br /&gt;
==See Also==&lt;br /&gt;
&lt;br /&gt;
==External Links==&lt;br /&gt;
&lt;br /&gt;
--[[User:Chenc8|Chenc8]] 13:29, 13 April 2008 (EDT)&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security</id>
		<title>VoIP (Voice Over IP) Security</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security"/>
				<updated>2008-04-13T03:37:39Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''VoIP''' (Voice over Internet Protocol) is a protocol used for the transmission of voice data across the Internet.  IP telephony treats voice as another form of data that is compressed and optimized for network traffic and is vulnerable to attacks traditional data would be on the network.  VoIP security is akin to network security; voice data traveling the network will look like any other normal data.&lt;br /&gt;
&lt;br /&gt;
Corporations generally place VoIP concerns on the voice quality, latency, and quality of service above the overall security when VoIP telephony is actually more vulnerable to certain attacks compared to the traditional phone system.  The most common threats found in the VoIP environment include eavesdropping, theft of services, and denial of service attacks.  Has VoIP come far enough so that the benefits outweigh the costs to justify its use?&lt;br /&gt;
&lt;br /&gt;
==Introduction==&lt;br /&gt;
&lt;br /&gt;
To greater understand VoIP security, a general overview of VoIP systems is useful.  &lt;br /&gt;
&lt;br /&gt;
===Components===&lt;br /&gt;
A typical VoIP system includes four components:&lt;br /&gt;
{| border=&amp;quot;5&amp;quot; cellspacing=&amp;quot;5&amp;quot; cellpadding=&amp;quot;2&amp;quot; align=&amp;quot;left&amp;quot;&lt;br /&gt;
|+ '''VoIP system Components'''&lt;br /&gt;
! Component !! Description&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Data Network'''&lt;br /&gt;
| &lt;br /&gt;
* Must be high performance to avoid choppy communication&lt;br /&gt;
* Must be resilient in the sense that traffic congestion will not greatly effect voice quality&lt;br /&gt;
* QoS (Quality of Service) standard to prioritize voice traffic over data traffic&lt;br /&gt;
** DiffServ&lt;br /&gt;
*** Layer 3 QoS mechanism&lt;br /&gt;
*** Redefines 6-bits of the Type of Service byte in IP header&lt;br /&gt;
*** DSCP (DiffServ Code Point) used to prioritize the IP packet&lt;br /&gt;
** 802.1p&lt;br /&gt;
*** Layer 2 QoS mechanism&lt;br /&gt;
*** Uses 3-bits of 802.1Q frame tag to prioritize an Ethernet frame&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''IP Handset'''&lt;br /&gt;
|&lt;br /&gt;
* Handset has to be IP enabled so audio stream can be digitized to be transmitted on the IP network&lt;br /&gt;
* Uses Cat5 cable&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Call Server''' &lt;br /&gt;
|&lt;br /&gt;
* Application running on dedicated workstation&lt;br /&gt;
* Provides all call signaling&lt;br /&gt;
* Provides all call control functionality&lt;br /&gt;
* Core operating code of a PBX (Private Branch Exchange) transferred here&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
'''Gateway'''&lt;br /&gt;
|&lt;br /&gt;
* Voice connectivity between IP network and public carrier network&lt;br /&gt;
|}&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==Attacks==&lt;br /&gt;
&lt;br /&gt;
There are three main types of attacks that the VoIP environment are susceptible to including eavesdropping, theft of services, and denial of service attacks.&lt;br /&gt;
&lt;br /&gt;
===Eavesdropping===&lt;br /&gt;
&lt;br /&gt;
===Theft of Services===&lt;br /&gt;
&lt;br /&gt;
===Denial of Services===&lt;br /&gt;
&lt;br /&gt;
==Recommendations==&lt;br /&gt;
&lt;br /&gt;
Although a network cannot be completely immune to attack, here are some recommendations to secure your VoIP network.&lt;br /&gt;
&lt;br /&gt;
#	Do not user shared media devices (ie hubs) on networks&lt;br /&gt;
#	All VoIP traffic should be encrypted&lt;br /&gt;
#	VoIP servers with confidential information should be treated as a confidential database&lt;br /&gt;
#	Build redundancy into VoIP network.&lt;br /&gt;
#	Make sure firewall is VoIP aware&lt;br /&gt;
&lt;br /&gt;
==References==&lt;br /&gt;
&lt;br /&gt;
==See Also==&lt;br /&gt;
&lt;br /&gt;
==External Links==&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security</id>
		<title>VoIP (Voice Over IP) Security</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security"/>
				<updated>2008-04-13T02:55:32Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;VoIP (Voice over Internet Protocol) is a protocol used for the transmission of voice data across the Internet.  IP telephony treats voice as another form of data that is compressed and optimized for network traffic and is vulnerable to attacks traditional data would be on the network.  VoIP security is akin to network security; voice data traveling the network will look like any other normal data.&lt;br /&gt;
&lt;br /&gt;
Corporations generally place VoIP concerns on the voice quality, latency, and quality of service above the overall security when VoIP telephony is actually more vulnerable to certain attacks compared to the traditional phone system.  The most common threats found in the VoIP environment include eavesdropping, theft of services, and denial of service attacks.  Has VoIP come far enough so that the benefits outweigh the costs to justify its use?&lt;br /&gt;
&lt;br /&gt;
==Introduction==&lt;br /&gt;
&lt;br /&gt;
VoIP has the immediate benefits of reduced costs of operations to corporations with the dual use of the existing data networks already in place for voice and data packets contrast to the more expensive alternative of a separate traditional phone line network from the data network.  &lt;br /&gt;
&lt;br /&gt;
==Attacks==&lt;br /&gt;
&lt;br /&gt;
There are three main types of attacks that the VoIP environment are susceptible to including eavesdropping, theft of services, and denial of service attacks.&lt;br /&gt;
&lt;br /&gt;
===Eavesdropping===&lt;br /&gt;
&lt;br /&gt;
===Theft of Services===&lt;br /&gt;
&lt;br /&gt;
===Denial of Services===&lt;br /&gt;
&lt;br /&gt;
==Recommendations==&lt;br /&gt;
&lt;br /&gt;
Although a network cannot be completely immune to attack, here are some recommendations to secure your VoIP network.&lt;br /&gt;
&lt;br /&gt;
#	Do not user shared media devices (ie hubs) on networks&lt;br /&gt;
#	All VoIP traffic should be encrypted&lt;br /&gt;
#	VoIP servers with confidential information should be treated as a confidential database&lt;br /&gt;
#	Build redundancy into VoIP network.&lt;br /&gt;
#	Make sure firewall is VoIP aware&lt;br /&gt;
&lt;br /&gt;
==References==&lt;br /&gt;
&lt;br /&gt;
==See Also==&lt;br /&gt;
&lt;br /&gt;
==External Links==&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security</id>
		<title>VoIP (Voice Over IP) Security</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/VoIP_(Voice_Over_IP)_Security"/>
				<updated>2008-04-11T17:22:54Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;Initial creation&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;-Abstract-&lt;br /&gt;
VoIP has the immediate benefits of reduced costs of operations to corporations with the dual use of the existing data networks already in place for voice and data packets contrast to the more expensive alternative of a separate traditional phone line network from the data network.  Companies generally place their concern of voice quality, latency, and quality of service of VoIP above the overall security when in fact VoIP telephony is actually more vulnerable to certain attacks.  This wiki will outline three of the most common threats found in the VoIP environment including eavesdropping, theft of services, and denial of service attacks as well as the counter measures employed by security officers against these threats.  Has VoIP come far enough so that the benefits outweigh the costs to justify its use?&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/Piggybacking</id>
		<title>Piggybacking</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/Piggybacking"/>
				<updated>2007-12-02T05:23:07Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''Piggybacking''' internet access is the practice of gaining network services by moving their computer into range a broadcasting access point of someone’s wireless connection without the owner’s explicit permission or knowledge.&lt;br /&gt;
&lt;br /&gt;
[[Image:Networks.JPG|frame|right|Is connecting to someone's network without their permission wrong?]]&lt;br /&gt;
&lt;br /&gt;
== Background ==&lt;br /&gt;
&lt;br /&gt;
The recent explosive growth of wireless technology found in the market can be attributed to the many benefits wireless telecommunications provide. From the casual Internet surfer to the technological inclined power user, wireless networks provide the convenience of mobility, keeping up with today’s trends in increasing portability and decreasing size of our devices.  Unfortunately, wireless networks also suffer from more attacks and abuse because of how easy it is to locate and connect to wireless networks in comparison to traditional wired ones.  In combination with the lack of strong default security counter measures, the controversial practice of piggybacking has increasingly become more common.&lt;br /&gt;
&lt;br /&gt;
Piggybacking should not be confused with [http://en.wikipedia.org/wiki/Wardriving wardriving] which involves only the mapping of the insecure access points.  In addition, people connecting to a hotspot service provided by businesses is generally not considered as piggybacking.&lt;br /&gt;
&lt;br /&gt;
== Statistics ==&lt;br /&gt;
Concerns of piggybacking is a cultural state of mind.  In the past, piggybacking has not been a major cause for concern and only recently has begun to work its way into our laws.  Taking a look at people's opinion through surveys can help depict society's overall thoughts on piggybacking.&lt;br /&gt;
&lt;br /&gt;
=== Online Poll ===&lt;br /&gt;
[[Image:Online_poll.jpg|right|thumb|This poll has over 3000 votes]]&lt;br /&gt;
From an online poll taken from lifehacker.com since March 2006&lt;br /&gt;
*~60% of voters said they would gladly hop onto someone’s wireless network if they didn’t have access to their own at the moment.  &lt;br /&gt;
*~25% of voters said they piggybacking is their main source of internet.  &lt;br /&gt;
Combined that’s 85% of voters admitting to the practice.&lt;br /&gt;
*~7% said they sometimes piggyback but only in an emergency.&lt;br /&gt;
*~8% said their morals would never allow them to do such a thing.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
=== McMaster University Poll ===&lt;br /&gt;
[[Image:Mcmaster_poll.jpg|left|thumb|This poll had 100 votes]]&lt;br /&gt;
Just as a comparison, I conducted a small survey sampling our fellow students at McMaster.  I attempted to cover a broad range of students from different faculties so I only asked a few students in this class as I did not want to contaminate the data with biased answers.  About 55% of the students I surveyed admitted to have piggybacked before and 45% said they have not.  Mind you, I was patiently waiting for them to finish filling out the survey so I suspect some may have not been telling the truth in fear of embarrassment.&lt;br /&gt;
&lt;br /&gt;
Of all the student’s surveyed, only about 20% expressed concerned about security issues when using somebody’s wireless network and said they would not send passwords or do any other information sensitive actions.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Views and Ethics ==&lt;br /&gt;
Views on piggybacking vary widely amongst people because of the controversial nature of the practice.  On one side, advocates believe the practice does not harm anyone while benefiting the piggybacker.  On the other side, advocates describe the practice to &amp;quot;freeloading&amp;quot; as bandwidth costs money and the piggybacker essentially gets it for free.  The table below summarizes some of these arguments with analogies.&lt;br /&gt;
&lt;br /&gt;
{| border=&amp;quot;5&amp;quot; cellspacing=&amp;quot;5&amp;quot; cellpadding=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;&lt;br /&gt;
|+ '''Analogies to Piggybacking Wireless Internet'''&lt;br /&gt;
! Advocates For !! Advocates Against&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
* Drinking from a public water fountain &lt;br /&gt;
* Reading over someone's shoulder &lt;br /&gt;
* Eating leftovers a restaurant has thrown away&lt;br /&gt;
* Borrowing a cup of sugar&lt;br /&gt;
* Enjoying music playing from a neighbor's backyard&lt;br /&gt;
| &lt;br /&gt;
* Entering a home just because the door is unlocked &lt;br /&gt;
* Stealing cable from a neighbor with a splitter &lt;br /&gt;
* Hanging on the outside of a bus to get a free ride &lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
About 30% of the students surveyed in the McMaster University survey who said they have piggybacked in the past or present believe it is the network owner's responsibility to enable security.  Responses such as &amp;quot;It is their fault for not enabling security in the first place&amp;quot; and &amp;quot;It's fair game&amp;quot; are some of the more cynical reasons students said in favor for piggybacking.  One writes, “Leaving a network open is just being a good neighbor”.&lt;br /&gt;
&lt;br /&gt;
A person can commit some serious crimes with the Internet services he or she gains through piggybacking, such as hacking into sensitive information, downloading child pornography, etc while remaining pretty much anonymous without a trail leading back them.  Especially if many people piggyback on a single network, bandwidth can become an issue.  Users on the network may experience major slow down if many people are using the network simultaneously or if there are a lot of downloads.&lt;br /&gt;
&lt;br /&gt;
== Prevention ==&lt;br /&gt;
There are several ways to prevent piggybacking however some are more effective than others.&lt;br /&gt;
=== WEP ===&lt;br /&gt;
It is very ineffective against people with a little computer knowledge and the will to gain access to the network since WEP is cryptographically weak and takes only a few minutes to crack.  There have been attempts to enhance the security such as:&lt;br /&gt;
*WEP2&lt;br /&gt;
** Enforces the minimum size of encryption to 128 bits &lt;br /&gt;
*WEP+&lt;br /&gt;
** Proprietary enhancement by Agere Systems which strengthens initialization vectors&lt;br /&gt;
*Dynamic WEP &lt;br /&gt;
** Changes the key periodically &lt;br /&gt;
None are substantially more effective.&lt;br /&gt;
=== MAC Address Authentication ===&lt;br /&gt;
A computer trying to connect to the network will be allowed to do so if and only if their MAC address conforms the list of allowed MAC addresses.  This is cumbersome to setup for the administrator as he or she will have to add everyone’s MAC address to the list.  This method does not prevent data from being stolen since there is no encryption.  And even then, an attacker can observe network traffic and obtain valid MAC addresses and then spoof their MAC address to gain access.&lt;br /&gt;
=== Honeypot ===&lt;br /&gt;
One can set up a fake network for would-be piggybackers to connect to and see what they do.  After they connect and their MAC address is logged, one can ban their MAC address from connecting to their network.&lt;br /&gt;
=== IPSec ===&lt;br /&gt;
Ip security or IPSec is used to encrypt traffic, reducing or possibly eliminating all plain text information sent across the network.  It is composed of a suite of protocols such as authentication, encrypting IP packets, or cryptographic key establishment as we have read about in Chapter 9 Key Management of the textbook.&lt;br /&gt;
=== WPA ===&lt;br /&gt;
Wi-FI protected access, commonly referred to as WPA, was created by Wi-Fi Alliance and one of the major improvements over WEP is the Temporal Key Integrity Protocol which basically changes the key dynamically as the system is being used.  &lt;br /&gt;
WPA also boasts a more secure message integrity code or MIC with the Michael algorithm. &lt;br /&gt;
Later, they introduced WPA2 which strengthens the security with new algorithms such as CCMP which stands for Counter Mode with Cipher Block Chaining Message Authentication Protocol.&lt;br /&gt;
While generally strong, an exploit to WPA's flaw can crack the encryption.  This method relies on obtaining the Pre-Shared Key (PSK) by monitoring network traffic packets when a valid computer logs into the network.  Some tools that facilitate this are kisMAC or coWPATTY.&lt;br /&gt;
&lt;br /&gt;
== Legalities ==&lt;br /&gt;
=== Canada ===&lt;br /&gt;
While there are many differences in the laws between one country and another, in Canada the law could be interpreted in such a way that makes piggybacking illegal.  A Toronto lawyer Gil Zvulony commented on CBC’s Spark Radio recently and says that if the police ever showed up because you were piggybacking, the only way you can be charged was if the crown could prove you knew it was wrong to piggyback.&lt;br /&gt;
&lt;br /&gt;
The closest thing someone being charged with piggybacking was where a Toronto man was caught literally with his pants down downloading child pornography using someone's wireless network.  Ultimately, he was charged for the pornography and not the piggybacking.&lt;br /&gt;
&lt;br /&gt;
=== Singapore ===&lt;br /&gt;
&lt;br /&gt;
Garyl Tan Jia Luo became the first man to be convicted of piggybacking on January 16th, 2007 and was sentenced for 18 months probation with 80 hours of community service.&lt;br /&gt;
Lin Zhenghuang was convicted and sentenced to 3 months jail time and a $4000 fine when he used his neighbor's internet to post a fake bombing report on forums managed by HardwareZone.  The judge clarified the jail time would not be sentenced for piggybacking alone but for piggybacking &amp;quot;committed in order to facilitate the commission of or to avoid detection for some more serious offense&amp;quot; as with Mr. Zhenguang's case.&lt;br /&gt;
&lt;br /&gt;
== References ==&lt;br /&gt;
&lt;br /&gt;
# Michel Marriott. &amp;quot;Hey Neighbor, Stop Piggybacking on My Wireless&amp;quot;, The New York Times, 2006-03-05.  Retrieved on 2007-11-27. &amp;lt;http://www.nytimes.com/2006/03/05/technology/05wireless.html?_r=1&amp;amp;oref=slogin&amp;gt;&lt;br /&gt;
# Bradley Mitchell. &amp;quot;Wireless / Networking&amp;quot;, About.  Retrieved on 2007-11-27. &amp;lt;http://compnetworking.about.com/od/wirelessfaqs/f/legal_free_wifi.htm&amp;gt;&lt;br /&gt;
# Wikipedia. &amp;quot;Piggybacking (internet access)&amp;quot;, Wikipedia, 2007-11-14.  Retrieved on 2007-11-27. &amp;lt;http://en.wikipedia.org/wiki/Piggybacking_(internet_access)&amp;gt;&lt;br /&gt;
# Adam Pash. &amp;quot;Reader Poll: Do you piggyback wireless internet?&amp;quot;, lifehacker.  Retrieved on 2007-11-27. &amp;lt;http://lifehacker.com/software/poll/reader-poll-do-you-piggyback-wireless-internet-158613.php&amp;gt;&lt;br /&gt;
# News Report. &amp;quot;Research Shows Wi-Fi Piggybacking Widespread&amp;quot;, digital communities.  Retrieved on 2007-11-27. &amp;lt;http://www.govtech.com/dc/articles/186157&amp;gt;&lt;br /&gt;
# bwilds. &amp;quot;WPA Encryption Cracking&amp;quot;, ITtoolbox Blogs. Retrieved on 2007-11-27. &amp;lt;http://blogs.ittoolbox.com/wireless/networks/archives/wpa-encryption-cracking-7419&amp;gt;&lt;br /&gt;
# Byran Rite. &amp;quot;Cracking WEP and WPA Wireless Networks&amp;quot;, Alkaloid Docupedia.  Retrieved on 2007-11-27. &amp;lt;http://docs.lucidinteractive.ca/index.php/Cracking_WEP_and_WPA_Wireless_Networks&amp;gt;&lt;br /&gt;
# Glenn Fleishman. &amp;quot;WPA Cracking Proof Concept Available&amp;quot;, Wi-fi Net News.  Retrieved on 2007-11-27. &amp;lt;http://www.wifinetnews.com/archives/004428.html&amp;gt;&lt;br /&gt;
# Wikipedia. &amp;quot;Wired Equivalent Privacy&amp;quot;, Wikipedia, 2007-11-26.  Retrieved on 2007-11-27. &amp;lt;http://en.wikipedia.org/wiki/Wired_Equivalent_Privacy&amp;gt;&lt;br /&gt;
# Michael Ossmann. &amp;quot;WEP: Dead Again, Part 1&amp;quot;, 2004-12-14.  Retrieved on 2007-11-27. &amp;lt;http://www.securityfocus.com/infocus/1814&amp;gt;&lt;br /&gt;
# CBC Spark Radio Podcast: &amp;lt;http://podcast.cbc.ca/mp3/spark_20071107_3820.mp3&amp;gt;.  Retrieved on 2007-11-27.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== See Also ==&lt;br /&gt;
[[Social engineering]]&amp;lt;BR&amp;gt;&lt;br /&gt;
[[Honeypot]]&amp;lt;BR&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== External Links ==&lt;br /&gt;
* [http://www.zvulony.com/ Zvuloney &amp;amp; Co]&lt;br /&gt;
* [http://en.wikipedia.org/wiki/Wireless_community_network Wireless Community Networks]&lt;br /&gt;
&lt;br /&gt;
--[[User:Chenc8|Chenc8]] 13:53, 1 December 2007 (EST) Jinn Tarng Christopher Chen&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/Piggybacking</id>
		<title>Piggybacking</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/Piggybacking"/>
				<updated>2007-12-02T04:37:16Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''Piggybacking''' internet access is the practice of gaining network services by moving their computer into range a broadcasting access point of someone’s wireless connection without the owner’s explicit permission or knowledge.&lt;br /&gt;
&lt;br /&gt;
[[Image:Networks.JPG|frame|right|Is connecting to someone's network without their permission wrong?]]&lt;br /&gt;
&lt;br /&gt;
== Background ==&lt;br /&gt;
&lt;br /&gt;
The recent explosive growth of wireless technology found in the market can be attributed to the many benefits wireless telecommunications provide. From the casual Internet surfer to the technological inclined power user, wireless networks provide the convenience of mobility, keeping up with today’s trends in increasing portability and decreasing size of our devices.  Unfortunately, wireless networks also suffer from more attacks and abuse because of how easy it is to locate and connect to wireless networks in comparison to traditional wired ones.  In combination with the lack of strong default security counter measures, the controversial practice of piggybacking has increasingly become more common.&lt;br /&gt;
&lt;br /&gt;
Piggybacking should not be confused with [http://en.wikipedia.org/wiki/Wardriving wardriving] which involves only the mapping of the insecure access points.  In addition, people connecting to a hotspot service provided by businesses is generally not considered as piggybacking.&lt;br /&gt;
&lt;br /&gt;
== Statistics ==&lt;br /&gt;
Concerns of piggybacking is a cultural state of mind.  In the past, piggybacking has not been a major cause for concern and only recently has begun to work its way into our laws.  Taking a look at people's opinion through surveys can help depict society's overall thoughts on piggybacking.&lt;br /&gt;
&lt;br /&gt;
=== Online Poll ===&lt;br /&gt;
[[Image:Online_poll.jpg|right|thumb|This poll has over 3000 votes]]&lt;br /&gt;
From an online poll taken from lifehacker.com since March 2006&lt;br /&gt;
*~60% of voters said they would gladly hop onto someone’s wireless network if they didn’t have access to their own at the moment.  &lt;br /&gt;
*~25% of voters said they piggybacking is their main source of internet.  &lt;br /&gt;
Combined that’s 85% of voters admitting to the practice.&lt;br /&gt;
*~7% said they sometimes piggyback but only in an emergency.&lt;br /&gt;
*~8% said their morals would never allow them to do such a thing.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
=== McMaster University Poll ===&lt;br /&gt;
[[Image:Mcmaster_poll.jpg|left|thumb|This poll had 100 votes]]&lt;br /&gt;
Just as a comparison, I conducted a small survey sampling our fellow students at McMaster.  I attempted to cover a broad range of students from different faculties so I only asked a few students in this class as I did not want to contaminate the data with biased answers.  About 55% of the students I surveyed admitted to have piggybacked before and 45% said they have not.  Mind you, I was patiently waiting for them to finish filling out the survey so I suspect some may have not been telling the truth in fear of embarrassment.&lt;br /&gt;
&lt;br /&gt;
Of all the student’s surveyed, only about 20% expressed concerned about security issues when using somebody’s wireless network and said they would not send passwords or do any other information sensitive actions.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Views and Ethics ==&lt;br /&gt;
Views on piggybacking vary widely amongst people because of the controversial nature of the practice.  On one side, advocates believe the practice does not harm anyone while benefiting the piggybacker.  On the other side, advocates describe the practice to &amp;quot;freeloading&amp;quot; as bandwidth costs money and the piggybacker essentially gets it for free.  The table below summarizes some of these arguments with anologies.&lt;br /&gt;
&lt;br /&gt;
{| border=&amp;quot;5&amp;quot; cellspacing=&amp;quot;5&amp;quot; cellpadding=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;&lt;br /&gt;
|+ '''Analogies to Piggybacking Wireless Internet'''&lt;br /&gt;
! Advocates For !! Advocates Against&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
* Drinking from a public water fountain &lt;br /&gt;
* Reading over someone's shoulder &lt;br /&gt;
* Eating leftovers a restaurant has thrown away&lt;br /&gt;
* Borrowing a cup of sugar&lt;br /&gt;
* Enjoying music playing from a neighbor's backyard&lt;br /&gt;
| &lt;br /&gt;
* Entering a home just because the door is unlocked &lt;br /&gt;
* Stealing cable from a neighbor with a splitter &lt;br /&gt;
* Hanging on the outside of a bus to get a free ride &lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
About 30% of the students surveyed in the McMaster University survey who said they have piggybacked in the past or present believe it is the network owner's responsibility to enable security.  Responses such as &amp;quot;It is their fault for not enabling security in the first place&amp;quot; and &amp;quot;It's fair game&amp;quot; are some of the more cynical reasons students said in favor for piggybacking.  One writes, “Leaving a network open is just being a good neighbor”.&lt;br /&gt;
&lt;br /&gt;
A person can commit some serious crimes with the Internet services he or she gains through piggybacking, such as hacking into sensitive information, downloading child pornography, etc while remaining pretty much anonymous without a trail leading back them.  Especially if many people piggyback on a single network, bandwidth can become an issue.  Users on the network may experience major slow down if many people are using the network simultaneously or if there are a lot of downloads.&lt;br /&gt;
&lt;br /&gt;
== Prevention ==&lt;br /&gt;
There are several ways to prevent piggybacking however some are more effective than others.&lt;br /&gt;
=== WEP ===&lt;br /&gt;
It is very ineffective against people with a little computer knowledge and the will to gain access to the network since WEP is cryptographically weak and takes only a few minutes to crack.  There have been attempts to enhance the security such as:&lt;br /&gt;
*WEP2&lt;br /&gt;
** Enforces the minimum size of encryption to 128 bits &lt;br /&gt;
*WEP+&lt;br /&gt;
** Proprietary enhancement by Agere Systems which strengthens initialization vectors&lt;br /&gt;
*Dynamic WEP &lt;br /&gt;
** Changes the key periodically &lt;br /&gt;
None are substantially more effective.&lt;br /&gt;
=== MAC Address Authentication ===&lt;br /&gt;
A computer trying to connect to the network will be allowed to do so if and only if their MAC address conforms the list of allowed MAC addresses.  This is cumbersome to setup for the administrator as he or she will have to add everyone’s MAC address to the list.  This method does not prevent data from being stolen since there is no encryption.  And even then, an attacker can observe network traffic and obtain valid MAC addresses and then spoof their MAC address to gain access.&lt;br /&gt;
=== Honeypot ===&lt;br /&gt;
One can set up a fake network for would-be piggybackers to connect to and see what they do.  After they connect and their MAC address is logged, one can ban their MAC address from connecting to their network.&lt;br /&gt;
=== IPSec ===&lt;br /&gt;
Ip security or IPSec is used to encrypt traffic, reducing or possibly eliminating all plain text information sent across the network.  It is composed of a suite of protocols such as authentication, encrypting IP packets, or cryptographic key establishment as we have read about in Chapter 9 Key Management of the textbook.&lt;br /&gt;
=== WPA ===&lt;br /&gt;
Wi-FI protected access, commonly referred to as WPA, was created by Wi-Fi Alliance and one of the major improvements over WEP is the Temporal Key Integrity Protocol which basically changes the key dynamically as the system is being used.  &lt;br /&gt;
WPA also boasts a more secure message integrity code or MIC with the Michael algorithm. &lt;br /&gt;
Later, they introduced WPA2 which strengthens the security with new algorithms such as CCMP which stands for Counter Mode with Cipher Block Chaining Message Authentication Protocol.&lt;br /&gt;
&lt;br /&gt;
== Legalities ==&lt;br /&gt;
=== Canada ===&lt;br /&gt;
While there are many differences in the laws between one country and another, in Canada the law could be interpreted in such a way that makes piggybacking illegal.  A Toronto lawyer Gil Zvulony commented on CBC’s Spark Radio recently and says that if the police ever showed up because you were piggybacking, the only way you can be charged was if the crown could proof you knew that  you were doing something wrong.&lt;br /&gt;
&lt;br /&gt;
The closest thing someone being charged with piggybacking was where a Toronto man was caught literally with his pants down downloading child pornography using someone's wireless network.  Ultimately, he was charged for the pornography and not the piggybacking.&lt;br /&gt;
&lt;br /&gt;
=== Singapore ===&lt;br /&gt;
&lt;br /&gt;
In Singapore, Garyl Tan Jia Luo became the first man to be convicted of piggybacking on January 16th, 2007 and was sentenced for 18 months probation with 80 hours of community service.&lt;br /&gt;
&lt;br /&gt;
== References ==&lt;br /&gt;
&lt;br /&gt;
# Michel Marriott. &amp;quot;Hey Neighbor, Stop Piggybacking on My Wireless&amp;quot;, The New York Times, 2006-03-05.  Retrieved on 2007-11-27. &amp;lt;http://www.nytimes.com/2006/03/05/technology/05wireless.html?_r=1&amp;amp;oref=slogin&amp;gt;&lt;br /&gt;
# Bradley Mitchell. &amp;quot;Wireless / Networking&amp;quot;, About.  Retrieved on 2007-11-27. &amp;lt;http://compnetworking.about.com/od/wirelessfaqs/f/legal_free_wifi.htm&amp;gt;&lt;br /&gt;
# Wikipedia. &amp;quot;Piggybacking (internet access)&amp;quot;, Wikipedia, 2007-11-14.  Retrieved on 2007-11-27. &amp;lt;http://en.wikipedia.org/wiki/Piggybacking_(internet_access)&amp;gt;&lt;br /&gt;
# Adam Pash. &amp;quot;Reader Poll: Do you piggyback wireless internet?&amp;quot;, lifehacker.  Retrieved on 2007-11-27. &amp;lt;http://lifehacker.com/software/poll/reader-poll-do-you-piggyback-wireless-internet-158613.php&amp;gt;&lt;br /&gt;
# News Report. &amp;quot;Research Shows Wi-Fi Piggybacking Widespread&amp;quot;, digital communities.  Retrieved on 2007-11-27. &amp;lt;http://www.govtech.com/dc/articles/186157&amp;gt;&lt;br /&gt;
# bwilds. &amp;quot;WPA Encryption Cracking&amp;quot;, ITtoolbox Blogs. Retrieved on 2007-11-27. &amp;lt;http://blogs.ittoolbox.com/wireless/networks/archives/wpa-encryption-cracking-7419&amp;gt;&lt;br /&gt;
# Byran Rite. &amp;quot;Cracking WEP and WPA Wireless Networks&amp;quot;, Alkaloid Docupedia.  Retrieved on 2007-11-27. &amp;lt;http://docs.lucidinteractive.ca/index.php/Cracking_WEP_and_WPA_Wireless_Networks&amp;gt;&lt;br /&gt;
# Glenn Fleishman. &amp;quot;WPA Cracking Proof Concept Available&amp;quot;, Wi-fi Net News.  Retrieved on 2007-11-27. &amp;lt;http://www.wifinetnews.com/archives/004428.html&amp;gt;&lt;br /&gt;
# Wikipedia. &amp;quot;Wired Equivalent Privacy&amp;quot;, Wikipedia, 2007-11-26.  Retrieved on 2007-11-27. &amp;lt;http://en.wikipedia.org/wiki/Wired_Equivalent_Privacy&amp;gt;&lt;br /&gt;
# Michael Ossmann. &amp;quot;WEP: Dead Again, Part 1&amp;quot;, 2004-12-14.  Retrieved on 2007-11-27. &amp;lt;http://www.securityfocus.com/infocus/1814&amp;gt;&lt;br /&gt;
# CBC Spark Radio Podcast: &amp;lt;http://podcast.cbc.ca/mp3/spark_20071107_3820.mp3&amp;gt;.  Retrieved on 2007-11-27.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== See Also ==&lt;br /&gt;
[[Social engineering]]&amp;lt;BR&amp;gt;&lt;br /&gt;
[[Honeypot]]&amp;lt;BR&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== External Links ==&lt;br /&gt;
* [http://www.zvulony.com/ Zvuloney &amp;amp; Co]&lt;br /&gt;
* [http://en.wikipedia.org/wiki/Wireless_community_network Wireless Community Networks]&lt;br /&gt;
&lt;br /&gt;
--[[User:Chenc8|Chenc8]] 13:53, 1 December 2007 (EST) Jinn Tarng Christopher Chen&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/Piggybacking</id>
		<title>Piggybacking</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/Piggybacking"/>
				<updated>2007-12-02T04:23:32Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''Piggybacking''' internet access is the practice of gaining network services by moving their computer into range a broadcasting access point of someone’s wireless connection without the owner’s explicit permission or knowledge.&lt;br /&gt;
&lt;br /&gt;
[[Image:Networks.JPG|frame|right|Is connecting to someone's network without their permission wrong?]]&lt;br /&gt;
&lt;br /&gt;
== Background ==&lt;br /&gt;
&lt;br /&gt;
The recent explosive growth of wireless technology found in the market can be attributed to the many benefits wireless telecommunications provide. From the casual Internet surfer to the technological inclined power user, wireless networks provide the convenience of mobility, keeping up with today’s trends in increasing portability and decreasing size of our devices.  Unfortunately, wireless networks also suffer from more attacks and abuse because of how easy it is to locate and connect to wireless networks in comparison to traditional wired ones.  In combination with the lack of strong default security counter measures, the controversial practice of piggybacking has increasingly become more common.&lt;br /&gt;
&lt;br /&gt;
Piggybacking should not be confused with [http://en.wikipedia.org/wiki/Wardriving wardriving] which involves only the mapping of the insecure access points.  In addition, people connecting to a hotspot service provided by businesses is generally not considered as piggybacking.&lt;br /&gt;
&lt;br /&gt;
== Statistics ==&lt;br /&gt;
Concerns of piggybacking is a cultural state of mind.  In the past, piggybacking has not been a major cause for concern and only recently has begun to work its way into our laws.  Taking a look at people's opinion through surveys can help depict society's overall thoughts on piggybacking.&lt;br /&gt;
&lt;br /&gt;
=== Online Poll ===&lt;br /&gt;
[[Image:Online_poll.jpg|right|thumb|This poll has over 3000 votes]]&lt;br /&gt;
From an online poll taken from lifehacker.com since March 2006&lt;br /&gt;
*~60% of voters said they would gladly hop onto someone’s wireless network if they didn’t have access to their own at the moment.  &lt;br /&gt;
*~25% of voters said they piggybacking is their main source of internet.  &lt;br /&gt;
Combined that’s 85% of voters admitting to the practice.&lt;br /&gt;
*~7% said they sometimes piggyback but only in an emergency.&lt;br /&gt;
*~8% said their morals would never allow them to do such a thing.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
=== McMaster University Poll ===&lt;br /&gt;
[[Image:Mcmaster_poll.jpg|left|thumb|This poll had 100 votes]]&lt;br /&gt;
Just as a comparison, I conducted a small survey sampling our fellow students at McMaster.  I attempted to cover a broad range of students from different faculties so I only asked a few students in this class as I did not want to contaminate the data with biased answers.  About 55% of the students I surveyed admitted to have piggybacked before and 45% said they have not.  Mind you, I was patiently waiting for them to finish filling out the survey so I suspect some may have not been telling the truth in fear of embarrassment.&lt;br /&gt;
&lt;br /&gt;
Of all the student’s surveyed, only about 20% expressed concerned about security issues when using somebody’s wireless network and said they would not send passwords or do any other information sensitive actions.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Views and Ethics ==&lt;br /&gt;
Views on piggybacking vary widely amongst people because of the controversial nature of the practice.  On one side, advocates believe the practice does not harm anyone while benefiting the piggybacker.  On the other side, advocates describe the practice to &amp;quot;freeloading&amp;quot; as bandwidth costs money and the piggybacker essentially gets it for free.  The table below summarizes some of these arguments with anologies.&lt;br /&gt;
&lt;br /&gt;
{| border=&amp;quot;5&amp;quot; cellspacing=&amp;quot;5&amp;quot; cellpadding=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;&lt;br /&gt;
|+ '''Analogies to Piggybacking Wireless Internet'''&lt;br /&gt;
! Advocates For !! Advocates Against&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
* Drinking from a public water fountain &lt;br /&gt;
* Reading over someone's shoulder &lt;br /&gt;
* Eating leftovers a restaurant has thrown away&lt;br /&gt;
* Borrowing a cup of sugar&lt;br /&gt;
* Enjoying music playing from a neighbor's backyard&lt;br /&gt;
| &lt;br /&gt;
* Entering a home just because the door is unlocked &lt;br /&gt;
* Stealing cable from a neighbor with a splitter &lt;br /&gt;
* Hanging on the outside of a bus to get a free ride &lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
About 30% of the students surveyed in the McMaster University survey who said they have piggybacked in the past or present believe it is the network owner's responsibility to enable security.  Responses such as &amp;quot;It is their fault for not enabling security in the first place&amp;quot; and &amp;quot;It's fair game&amp;quot; are some of the more cynical reasons students said in favor for piggybacking.  One writes, “Leaving a network open is just being a good neighbor”.&lt;br /&gt;
&lt;br /&gt;
A person can commit some serious crimes with the Internet services he or she gains through piggybacking, such as hacking into sensitive information, downloading child pornography, etc while remaining pretty much anonymous without a trail leading back them.  Especially if many people piggyback on a single network, bandwidth can become an issue.  Users on the network may experience major slow down if many people are using the network simultaneously or if there are a lot of downloads.&lt;br /&gt;
&lt;br /&gt;
== Prevention ==&lt;br /&gt;
There are several ways to prevent piggybacking however some are more effective than others.&lt;br /&gt;
=== WEP ===&lt;br /&gt;
It is very ineffective against people with a little computer knowledge and the will to gain access to the network since WEP is cryptographically weak and takes only a few minutes to crack.  There have been attempts to enhance the security such as:&lt;br /&gt;
*WEP2&lt;br /&gt;
*WEP+&lt;br /&gt;
*dynamic WEP which changes the key periodically &lt;br /&gt;
None are substantially more effective.&lt;br /&gt;
=== MAC Address Authentication ===&lt;br /&gt;
A computer trying to connect to the network will be allowed to do so if and only if their MAC address conforms the list of allowed MAC addresses.  This is cumbersome to setup for the administrator as he or she will have to add everyone’s MAC address to the list.  This method does not prevent data from being stolen since there is no encryption.  And even then, an attacker can observe network traffic and obtain valid MAC addresses and then spoof their MAC address to gain access.&lt;br /&gt;
&lt;br /&gt;
=== IPSec ===&lt;br /&gt;
Ip security or IPSec is used to encrypt traffic, reducing or possibly eliminating all plain text information sent across the network.  It is composed of a suite of protocols such as authentication, encrypting IP packets, or cryptographic key establishment as we have read about in Chapter 9 Key Management of the textbook.&lt;br /&gt;
=== WPA ===&lt;br /&gt;
Wi-FI protected access, commonly referred to as WPA, was created by Wi-Fi Alliance and one of the major improvements over WEP is the Temporal Key Integrity Protocol which basically changes the key dynamically as the system is being used.  &lt;br /&gt;
WPA also boasts a more secure message integrity code or MIC with the Michael algorithm. &lt;br /&gt;
Later, they introduced WPA2 which strengthens the security with new algorithms such as CCMP which stands for Counter Mode with Cipher Block Chaining Message Authentication Protocol.&lt;br /&gt;
&lt;br /&gt;
== Legalities ==&lt;br /&gt;
=== Canada ===&lt;br /&gt;
While there are many differences in the laws between one country and another, in Canada the law could be interpreted in such a way that makes piggybacking illegal.  A Toronto lawyer Gil Zvulony commented on CBC’s Spark Radio recently and says that if the police ever showed up because you were piggybacking, the only way you can be charged was if the crown could proof you knew that  you were doing something wrong.&lt;br /&gt;
&lt;br /&gt;
The closest thing someone being charged with piggybacking was where a Toronto man was caught literally with his pants down downloading child pornography using someone's wireless network.  Ultimately, he was charged for the pornography and not the piggybacking.&lt;br /&gt;
&lt;br /&gt;
=== Singapore ===&lt;br /&gt;
&lt;br /&gt;
In Singapore, Garyl Tan Jia Luo became the first man to be convicted of piggybacking on January 16th, 2007 and was sentenced for 18 months probation with 80 hours of community service.&lt;br /&gt;
&lt;br /&gt;
== References ==&lt;br /&gt;
&lt;br /&gt;
# Michel Marriott. &amp;quot;Hey Neighbor, Stop Piggybacking on My Wireless&amp;quot;, The New York Times, 2006-03-05.  Retrieved on 2007-11-27. &amp;lt;http://www.nytimes.com/2006/03/05/technology/05wireless.html?_r=1&amp;amp;oref=slogin&amp;gt;&lt;br /&gt;
# Bradley Mitchell. &amp;quot;Wireless / Networking&amp;quot;, About.  Retrieved on 2007-11-27. &amp;lt;http://compnetworking.about.com/od/wirelessfaqs/f/legal_free_wifi.htm&amp;gt;&lt;br /&gt;
# Wikipedia. &amp;quot;Piggybacking (internet access)&amp;quot;, Wikipedia, 2007-11-14.  Retrieved on 2007-11-27. &amp;lt;http://en.wikipedia.org/wiki/Piggybacking_(internet_access)&amp;gt;&lt;br /&gt;
# Adam Pash. &amp;quot;Reader Poll: Do you piggyback wireless internet?&amp;quot;, lifehacker.  Retrieved on 2007-11-27. &amp;lt;http://lifehacker.com/software/poll/reader-poll-do-you-piggyback-wireless-internet-158613.php&amp;gt;&lt;br /&gt;
# News Report. &amp;quot;Research Shows Wi-Fi Piggybacking Widespread&amp;quot;, digital communities.  Retrieved on 2007-11-27. &amp;lt;http://www.govtech.com/dc/articles/186157&amp;gt;&lt;br /&gt;
# bwilds. &amp;quot;WPA Encryption Cracking&amp;quot;, ITtoolbox Blogs. Retrieved on 2007-11-27. &amp;lt;http://blogs.ittoolbox.com/wireless/networks/archives/wpa-encryption-cracking-7419&amp;gt;&lt;br /&gt;
# Byran Rite. &amp;quot;Cracking WEP and WPA Wireless Networks&amp;quot;, Alkaloid Docupedia.  Retrieved on 2007-11-27. &amp;lt;http://docs.lucidinteractive.ca/index.php/Cracking_WEP_and_WPA_Wireless_Networks&amp;gt;&lt;br /&gt;
# Glenn Fleishman. &amp;quot;WPA Cracking Proof Concept Available&amp;quot;, Wi-fi Net News.  Retrieved on 2007-11-27. &amp;lt;http://www.wifinetnews.com/archives/004428.html&amp;gt;&lt;br /&gt;
# Wikipedia. &amp;quot;Wired Equivalent Privacy&amp;quot;, Wikipedia, 2007-11-26.  Retrieved on 2007-11-27. &amp;lt;http://en.wikipedia.org/wiki/Wired_Equivalent_Privacy&amp;gt;&lt;br /&gt;
# Michael Ossmann. &amp;quot;WEP: Dead Again, Part 1&amp;quot;, 2004-12-14.  Retrieved on 2007-11-27. &amp;lt;http://www.securityfocus.com/infocus/1814&amp;gt;&lt;br /&gt;
# CBC Spark Radio Podcast: &amp;lt;http://podcast.cbc.ca/mp3/spark_20071107_3820.mp3&amp;gt;.  Retrieved on 2007-11-27.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== See Also ==&lt;br /&gt;
[[Social engineering]]&amp;lt;BR&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== External Links ==&lt;br /&gt;
* [http://www.zvulony.com/ Zvuloney &amp;amp; Co]&lt;br /&gt;
&lt;br /&gt;
--[[User:Chenc8|Chenc8]] 13:53, 1 December 2007 (EST) Jinn Tarng Christopher Chen&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/Piggybacking</id>
		<title>Piggybacking</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/Piggybacking"/>
				<updated>2007-12-01T21:45:15Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''Piggybacking''' internet access is the practice of gaining network services by moving their computer into range a broadcasting access point of someone’s wireless connection without the owner’s explicit permission or knowledge.&lt;br /&gt;
&lt;br /&gt;
[[Image:Networks.JPG|frame|right|Is connecting to someone's network without their permission wrong?]]&lt;br /&gt;
&lt;br /&gt;
== Background ==&lt;br /&gt;
&lt;br /&gt;
The recent explosive growth of wireless technology found in the market can be attributed to the many benefits wireless telecommunications provide. From the casual Internet surfer to the technological inclined power user, wireless networks provide the convenience of mobility, keeping up with today’s trends in increasing portability and decreasing size of our devices.  Unfortunately, wireless networks also suffer from more attacks and abuse because of how easy it is to locate and connect to wireless networks in comparison to traditional wired ones.  In combination with the lack of strong default security counter measures, the controversial practice of piggybacking has increasingly become more common.&lt;br /&gt;
&lt;br /&gt;
Piggybacking should not be confused with [http://en.wikipedia.org/wiki/Wardriving wardriving] which involves only the mapping of the insecure access points.  In addition, people connecting to a hotspot service provided by businesses is generally not considered as piggybacking.&lt;br /&gt;
&lt;br /&gt;
== Statistics ==&lt;br /&gt;
Concerns of piggybacking is a cultural state of mind.  In the past, piggybacking has not been a major cause for concern and only recently has begun to work its way into our laws.  Taking a look at people's opinion through surveys can help depict society's overall thoughts on piggybacking.&lt;br /&gt;
&lt;br /&gt;
=== Online Poll ===&lt;br /&gt;
[[Image:Online_poll.jpg|right|thumb|This poll has over 3000 votes]]&lt;br /&gt;
From an online poll taken from lifehacker.com since March 2006&lt;br /&gt;
*~60% of voters said they would gladly hop onto someone’s wireless network if they didn’t have access to their own at the moment.  &lt;br /&gt;
*~25% of voters said they piggybacking is their main source of internet.  &lt;br /&gt;
Combined that’s 85% of voters admitting to the practice.&lt;br /&gt;
*~7% said they sometimes piggyback but only in an emergency.&lt;br /&gt;
*~8% said their morals would never allow them to do such a thing.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
=== McMaster University Poll ===&lt;br /&gt;
[[Image:Mcmaster_poll.jpg|left|thumb|This poll had 100 votes]]&lt;br /&gt;
Just as a comparison, I conducted a small survey sampling our fellow students at McMaster.  I attempted to cover a broad range of students from different faculties so I only asked a few students in this class as I did not want to contaminate the data with biased answers.  About 55% of the students I surveyed admitted to have piggybacked before and 45% said they have not.  Mind you, I was patiently waiting for them to finish filling out the survey so I suspect some may have not been telling the truth in fear of embarrassment.&lt;br /&gt;
&lt;br /&gt;
Of all the student’s surveyed, only about 20% expressed concerned about security issues when using somebody’s wireless network and said they would not send passwords or do any other information sensitive actions.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
== Views and Ethics ==&lt;br /&gt;
Advocates for piggybacking state that the practice is harmless and compare it to drinking from a public water fountain or sharing a cup of sugar.  One writes, “Leaving a network open is just being a good neighbor”.&lt;br /&gt;
Advocates against piggybacking compare the practice to entering a home just because it is unlocked or stealing cable from your neighbor with a splitter.&lt;br /&gt;
&lt;br /&gt;
Besides the bandwidth loss, a person can commit some serious crimes with the Internet services he or she gains through piggybacking, such as hacking into sensitive information, downloading child pornography, etc.&lt;br /&gt;
&lt;br /&gt;
== Prevention ==&lt;br /&gt;
There are several ways to prevent piggybacking however some are more effective than others.&lt;br /&gt;
=== WEP ===&lt;br /&gt;
It is very ineffective against people with a little computer knowledge and the will to gain access to the network since WEP is cryptographically weak and takes only a few minutes to crack.  There have been attempts to enhance the security such as:&lt;br /&gt;
*WEP2&lt;br /&gt;
*WEP+&lt;br /&gt;
*dynamic WEP which changes the key periodically &lt;br /&gt;
None are substantially more effective.&lt;br /&gt;
=== MAC Address Authentication ===&lt;br /&gt;
A computer trying to connect to the network will be allowed to do so if and only if their MAC address conforms the list of allowed MAC addresses.  This is cumbersome to setup for the administrator as he or she will have to add everyone’s MAC address to the list.  This method does not prevent data from being stolen since there is no encryption.  And even then, an attacker can observe network traffic and obtain valid MAC addresses and then spoof their MAC address to gain access.&lt;br /&gt;
&lt;br /&gt;
=== IPSec ===&lt;br /&gt;
Ip security or IPSec is used to encrypt traffic, reducing or possibly eliminating all plain text information sent across the network.  It is composed of a suite of protocols such as authentication, encrypting IP packets, or cryptographic key establishment as we have read about in Chapter 9 Key Management of the textbook.&lt;br /&gt;
=== WPA ===&lt;br /&gt;
Wi-FI protected access, commonly referred to as WPA, was created by Wi-Fi Alliance and one of the major improvements over WEP is the Temporal Key Integrity Protocol which basically changes the key dynamically as the system is being used.  &lt;br /&gt;
WPA also boasts a more secure message integrity code or MIC with the Michael algorithm. &lt;br /&gt;
Later, they introduced WPA2 which strengthens the security with new algorithms such as CCMP which stands for Counter Mode with Cipher Block Chaining Message Authentication Protocol.&lt;br /&gt;
&lt;br /&gt;
== Legalities ==&lt;br /&gt;
=== Canada ===&lt;br /&gt;
While there are many differences in the laws between one country and another, in Canada the law could be interpreted in such a way that makes piggybacking illegal.  A Toronto lawyer Gil Zvulony commented on CBC’s Spark Radio recently and says that if the police ever showed up because you were piggybacking, the only way you can be charged was if the crown could proof you knew that  you were doing something wrong.&lt;br /&gt;
&lt;br /&gt;
The closest thing someone being charged with piggybacking was where a Toronto man was caught literally with his pants down downloading child pornography using someone's wireless network.  Ultimately, he was charged for the pornography and not the piggybacking.&lt;br /&gt;
&lt;br /&gt;
=== Singapore ===&lt;br /&gt;
&lt;br /&gt;
In Singapore, Garyl Tan Jia Luo became the first man to be convicted of piggybacking on January 16th, 2007 and was sentenced for 18 months probation with 80 hours of community service.&lt;br /&gt;
&lt;br /&gt;
== References ==&lt;br /&gt;
&lt;br /&gt;
# Michel Marriott. &amp;quot;Hey Neighbor, Stop Piggybacking on My Wireless&amp;quot;, The New York Times, 2006-03-05.  Retrieved on 2007-11-27. &amp;lt;http://www.nytimes.com/2006/03/05/technology/05wireless.html?_r=1&amp;amp;oref=slogin&amp;gt;&lt;br /&gt;
# Bradley Mitchell. &amp;quot;Wireless / Networking&amp;quot;, About.  Retrieved on 2007-11-27. &amp;lt;http://compnetworking.about.com/od/wirelessfaqs/f/legal_free_wifi.htm&amp;gt;&lt;br /&gt;
# Wikipedia. &amp;quot;Piggybacking (internet access)&amp;quot;, Wikipedia, 2007-11-14.  Retrieved on 2007-11-27. &amp;lt;http://en.wikipedia.org/wiki/Piggybacking_(internet_access)&amp;gt;&lt;br /&gt;
# Adam Pash. &amp;quot;Reader Poll: Do you piggyback wireless internet?&amp;quot;, lifehacker.  Retrieved on 2007-11-27. &amp;lt;http://lifehacker.com/software/poll/reader-poll-do-you-piggyback-wireless-internet-158613.php&amp;gt;&lt;br /&gt;
# News Report. &amp;quot;Research Shows Wi-Fi Piggybacking Widespread&amp;quot;, digital communities.  Retrieved on 2007-11-27. &amp;lt;http://www.govtech.com/dc/articles/186157&amp;gt;&lt;br /&gt;
# bwilds. &amp;quot;WPA Encryption Cracking&amp;quot;, ITtoolbox Blogs. Retrieved on 2007-11-27. &amp;lt;http://blogs.ittoolbox.com/wireless/networks/archives/wpa-encryption-cracking-7419&amp;gt;&lt;br /&gt;
# Byran Rite. &amp;quot;Cracking WEP and WPA Wireless Networks&amp;quot;, Alkaloid Docupedia.  Retrieved on 2007-11-27. &amp;lt;http://docs.lucidinteractive.ca/index.php/Cracking_WEP_and_WPA_Wireless_Networks&amp;gt;&lt;br /&gt;
# Glenn Fleishman. &amp;quot;WPA Cracking Proof Concept Available&amp;quot;, Wi-fi Net News.  Retrieved on 2007-11-27. &amp;lt;http://www.wifinetnews.com/archives/004428.html&amp;gt;&lt;br /&gt;
# Wikipedia. &amp;quot;Wired Equivalent Privacy&amp;quot;, Wikipedia, 2007-11-26.  Retrieved on 2007-11-27. &amp;lt;http://en.wikipedia.org/wiki/Wired_Equivalent_Privacy&amp;gt;&lt;br /&gt;
# Michael Ossmann. &amp;quot;WEP: Dead Again, Part 1&amp;quot;, 2004-12-14.  Retrieved on 2007-11-27. &amp;lt;http://www.securityfocus.com/infocus/1814&amp;gt;&lt;br /&gt;
# CBC Spark Radio Podcast: &amp;lt;http://podcast.cbc.ca/mp3/spark_20071107_3820.mp3&amp;gt;.  Retrieved on 2007-11-27.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== See Also ==&lt;br /&gt;
[[Social engineering]]&amp;lt;BR&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== External Links ==&lt;br /&gt;
* [http://www.zvulony.com/ Zvuloney &amp;amp; Co]&lt;br /&gt;
&lt;br /&gt;
--[[User:Chenc8|Chenc8]] 13:53, 1 December 2007 (EST) Jinn Tarng Christopher Chen&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/Piggybacking</id>
		<title>Piggybacking</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/Piggybacking"/>
				<updated>2007-12-01T21:22:23Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''Piggybacking''' internet access is the practice of gaining network services by moving their computer into range a broadcasting access point of someone’s wireless connection without the owner’s explicit permission or knowledge.&lt;br /&gt;
&lt;br /&gt;
[[Image:Networks.JPG|frame|right|Is connecting to someone's network without their permission wrong?]]&lt;br /&gt;
&lt;br /&gt;
== Background ==&lt;br /&gt;
&lt;br /&gt;
The recent explosive growth of wireless technology found in the market can be attributed to the many benefits wireless telecommunications provide. From the casual Internet surfer to the technological inclined power user, wireless networks provide the convenience of mobility, keeping up with today’s trends in increasing portability and decreasing size of our devices.  Unfortunately, wireless networks also suffer from more attacks and abuse because of how easy it is to locate and connect to wireless networks in comparison to traditional wired ones.  In combination with the lack of strong default security counter measures, the controversial practice of piggybacking has increasingly become more common.&lt;br /&gt;
&lt;br /&gt;
Piggybacking should not be confused with wardriving which involves only the mapping of the insecure access points.  In addition, people connecting to a hotspot service provided by businesses is generally not considered as piggybacking.&lt;br /&gt;
&lt;br /&gt;
== Statistics ==&lt;br /&gt;
Concerns of piggybacking is a cultural state of mind.  In the past, piggybacking has not been a major cause for concern and only recently has begun to work its way into our laws.  Taking a look at people's opinion through surveys can help depict society's overall thoughts on piggybacking.&lt;br /&gt;
&lt;br /&gt;
=== Online Poll ===&lt;br /&gt;
[[Image:Online_poll.jpg|right|thumb|This poll has over 3000 votes]]&lt;br /&gt;
From an online poll taken from lifehacker.com since March 2006&lt;br /&gt;
*~60% of voters said they would gladly hop onto someone’s wireless network if they didn’t have access to their own at the moment.  &lt;br /&gt;
*~25% of voters said they piggybacking is their main source of internet.  &lt;br /&gt;
Combined that’s 85% of voters admitting to the practice.&lt;br /&gt;
*~7% said they sometimes piggyback but only in an emergency.&lt;br /&gt;
*~8% said their morals would never allow them to do such a thing.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
=== McMaster University Poll ===&lt;br /&gt;
[[Image:Mcmaster_poll.jpg|left|thumb|This poll had 100 votes]]&lt;br /&gt;
Just as a comparison, I conducted a small survey sampling our fellow students at McMaster.  I attempted to cover a broad range of students from different faculties so I only asked a few students in this class as I did not want to contaminate the data with biased answers.  About 55% of the students I surveyed admitted to have piggybacked before and 45% said they have not.  Mind you, I was patiently waiting for them to finish filling out the survey so I suspect some may have not been telling the truth in fear of embarrassment.&lt;br /&gt;
&lt;br /&gt;
Of all the student’s surveyed, only about 20% expressed concerned about security issues when using somebody’s wireless network and said they would not send passwords or do any other information sensitive actions.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
== Views and Ethics ==&lt;br /&gt;
Advocates for piggybacking state that the practice is harmless and compare it to drinking from a public water fountain or sharing a cup of sugar.  One writes, “Leaving a network open is just being a good neighbor”.&lt;br /&gt;
Advocates against piggybacking compare the practice to entering a home just because it is unlocked or stealing cable from your neighbor with a splitter.&lt;br /&gt;
&lt;br /&gt;
Besides the bandwidth loss, a person can commit some serious crimes with the Internet services he or she gains through piggybacking, such as hacking into sensitive information, downloading child pornography, etc.&lt;br /&gt;
&lt;br /&gt;
== Prevention ==&lt;br /&gt;
There are several ways to prevent piggybacking however some are more effective than others.&lt;br /&gt;
=== WEP ===&lt;br /&gt;
It is very ineffective against people with a little computer knowledge and the will to gain access to the network since WEP is cryptographically weak and takes only a few minutes to crack.  There have been attempts to enhance the security such as:&lt;br /&gt;
*WEP2&lt;br /&gt;
*WEP+&lt;br /&gt;
*dynamic WEP which changes the key periodically &lt;br /&gt;
None are substantially more effective.&lt;br /&gt;
=== MAC Address Authentication ===&lt;br /&gt;
A computer trying to connect to the network will be allowed to do so if and only if their MAC address conforms the list of allowed MAC addresses.  This is cumbersome to setup for the administrator as he or she will have to add everyone’s MAC address to the list.  This method does not prevent data from being stolen since there is no encryption.  And even then, an attacker can observe network traffic and obtain valid MAC addresses and then spoof their MAC address to gain access.&lt;br /&gt;
&lt;br /&gt;
=== IPSec ===&lt;br /&gt;
Ip security or IPSec is used to encrypt traffic, reducing or possibly eliminating all plain text information sent across the network.  It is composed of a suite of protocols such as authentication, encrypting IP packets, or cryptographic key establishment as we have read about in Chapter 9 Key Management of the textbook.&lt;br /&gt;
=== WPA ===&lt;br /&gt;
Wi-FI protected access, commonly referred to as WPA, was created by Wi-Fi Alliance and one of the major improvements over WEP is the Temporal Key Integrity Protocol which basically changes the key dynamically as the system is being used.  &lt;br /&gt;
WPA also boasts a more secure message integrity code or MIC with the Michael algorithm. &lt;br /&gt;
Later, they introduced WPA2 which strengthens the security with new algorithms such as CCMP which stands for Counter Mode with Cipher Block Chaining Message Authentication Protocol.&lt;br /&gt;
&lt;br /&gt;
== Legalities ==&lt;br /&gt;
=== Canada ===&lt;br /&gt;
While there are many differences in the laws between one country and another, in Canada the law could be interpreted in such a way that makes piggybacking illegal.  A Toronto lawyer Gil Zvulony commented on CBC’s Spark Radio recently and says that if the police ever showed up because you were piggybacking, the only way you can be charged was if the crown could proof you knew that  you were doing something wrong.&lt;br /&gt;
&lt;br /&gt;
The closest thing someone being charged with piggybacking was where a Toronto man was caught literally with his pants down downloading child pornography using someone's wireless network.  Ultimately, he was charged for the pornography and not the piggybacking.&lt;br /&gt;
&lt;br /&gt;
=== Singapore ===&lt;br /&gt;
&lt;br /&gt;
In Singapore, Garyl Tan Jia Luo became the first man to be convicted of piggybacking on January 16th, 2007 and was sentenced for 18 months probation with 80 hours of community service.&lt;br /&gt;
&lt;br /&gt;
== References ==&lt;br /&gt;
&lt;br /&gt;
# Michel Marriott. &amp;quot;Hey Neighbor, Stop Piggybacking on My Wireless&amp;quot;, The New York Times, 2006-03-05.  Retrieved on 2007-11-27. &amp;lt;http://www.nytimes.com/2006/03/05/technology/05wireless.html?_r=1&amp;amp;oref=slogin&amp;gt;&lt;br /&gt;
# Bradley Mitchell. &amp;quot;Wireless / Networking&amp;quot;, About.  Retrieved on 2007-11-27. &amp;lt;http://compnetworking.about.com/od/wirelessfaqs/f/legal_free_wifi.htm&amp;gt;&lt;br /&gt;
# Wikipedia. &amp;quot;Piggybacking (internet access)&amp;quot;, Wikipedia, 2007-11-14.  Retrieved on 2007-11-27. &amp;lt;http://en.wikipedia.org/wiki/Piggybacking_(internet_access)&amp;gt;&lt;br /&gt;
# Adam Pash. &amp;quot;Reader Poll: Do you piggyback wireless internet?&amp;quot;, lifehacker.  Retrieved on 2007-11-27. &amp;lt;http://lifehacker.com/software/poll/reader-poll-do-you-piggyback-wireless-internet-158613.php&amp;gt;&lt;br /&gt;
# News Report. &amp;quot;Research Shows Wi-Fi Piggybacking Widespread&amp;quot;, digital communities.  Retrieved on 2007-11-27. &amp;lt;http://www.govtech.com/dc/articles/186157&amp;gt;&lt;br /&gt;
# bwilds. &amp;quot;WPA Encryption Cracking&amp;quot;, ITtoolbox Blogs. Retrieved on 2007-11-27. &amp;lt;http://blogs.ittoolbox.com/wireless/networks/archives/wpa-encryption-cracking-7419&amp;gt;&lt;br /&gt;
# Byran Rite. &amp;quot;Cracking WEP and WPA Wireless Networks&amp;quot;, Alkaloid Docupedia.  Retrieved on 2007-11-27. &amp;lt;http://docs.lucidinteractive.ca/index.php/Cracking_WEP_and_WPA_Wireless_Networks&amp;gt;&lt;br /&gt;
# Glenn Fleishman. &amp;quot;WPA Cracking Proof Concept Available&amp;quot;, Wi-fi Net News.  Retrieved on 2007-11-27. &amp;lt;http://www.wifinetnews.com/archives/004428.html&amp;gt;&lt;br /&gt;
# Wikipedia. &amp;quot;Wired Equivalent Privacy&amp;quot;, Wikipedia, 2007-11-26.  Retrieved on 2007-11-27. &amp;lt;http://en.wikipedia.org/wiki/Wired_Equivalent_Privacy&amp;gt;&lt;br /&gt;
# Michael Ossmann. &amp;quot;WEP: Dead Again, Part 1&amp;quot;, 2004-12-14.  Retrieved on 2007-11-27. &amp;lt;http://www.securityfocus.com/infocus/1814&amp;gt;&lt;br /&gt;
# CBC Spark Radio Podcast: &amp;lt;http://podcast.cbc.ca/mp3/spark_20071107_3820.mp3&amp;gt;.  Retrieved on 2007-11-27.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== See Also ==&lt;br /&gt;
&lt;br /&gt;
== External Links ==&lt;br /&gt;
--[[User:Chenc8|Chenc8]] 13:53, 1 December 2007 (EST) Christopher Chen&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/Piggybacking</id>
		<title>Piggybacking</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/Piggybacking"/>
				<updated>2007-12-01T21:11:02Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''Piggybacking''' internet access is the practice of gaining network services by moving their computer into range a broadcasting access point of someone’s wireless connection without the owner’s explicit permission or knowledge.&lt;br /&gt;
&lt;br /&gt;
[[Image:Networks.JPG|frame|right|Is connecting to someone's network without their permission wrong?]]&lt;br /&gt;
&lt;br /&gt;
== Background ==&lt;br /&gt;
&lt;br /&gt;
The recent explosive growth of wireless technology found in the market can be attributed to the many benefits wireless telecommunications provide. From the casual Internet surfer to the technological inclined power user, wireless networks provide the convenience of mobility, keeping up with today’s trends in increasing portability and decreasing size of our devices.  Unfortunately, wireless networks also suffer from more attacks and abuse because of how easy it is to locate and connect to wireless networks in comparison to traditional wired ones.  In combination with the lack of strong default security counter measures, the controversial practice of piggybacking has increasingly become more common.&lt;br /&gt;
&lt;br /&gt;
Piggybacking should not be confused with wardriving which involves only the mapping of the insecure access points.  In addition, people connecting to a hotspot service provided by businesses is generally not considered as piggybacking.&lt;br /&gt;
&lt;br /&gt;
== Statistics ==&lt;br /&gt;
Concerns of piggybacking is a cultural state of mind.  In the past, piggybacking has not been a major cause for concern and only recently has begun to work its way into our laws.  Taking a look at people's opinion through surveys can help depict society's overall thoughts on piggybacking.&lt;br /&gt;
&lt;br /&gt;
=== Online Poll ===&lt;br /&gt;
[[Image:Online_poll.jpg|right|thumb|This poll has over 3000 votes]]&lt;br /&gt;
From an online poll taken from lifehacker.com since March 2006&lt;br /&gt;
*~60% of voters said they would gladly hop onto someone’s wireless network if they didn’t have access to their own at the moment.  &lt;br /&gt;
*~25% of voters said they piggybacking is their main source of internet.  &lt;br /&gt;
Combined that’s 85% of voters admitting to the practice.&lt;br /&gt;
*~7% said they sometimes piggyback but only in an emergency.&lt;br /&gt;
*~8% said their morals would never allow them to do such a thing.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
=== McMaster University Poll ===&lt;br /&gt;
[[Image:Mcmaster_poll.jpg|left|thumb|This poll had 100 votes]]&lt;br /&gt;
Just as a comparison, I conducted a small survey sampling our fellow students at McMaster.  I attempted to cover a broad range of students from different faculties so I only asked a few students in this class as I did not want to contaminate the data with biased answers.  About 55% of the students I surveyed admitted to have piggybacked before and 45% said they have not.  Mind you, I was patiently waiting for them to finish filling out the survey so I suspect some may have not been telling the truth in fear of embarrassment.&lt;br /&gt;
&lt;br /&gt;
Of all the student’s surveyed, only about 20% expressed concerned about security issues when using somebody’s wireless network and said they would not send passwords or do any other information sensitive actions.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
== Views and Ethics ==&lt;br /&gt;
Advocates for piggybacking state that the practice is harmless and compare it to drinking from a public water fountain or sharing a cup of sugar.  One writes, “Leaving a network open is just being a good neighbor”.&lt;br /&gt;
Advocates against piggybacking compare the practice to entering a home just because it is unlocked or stealing cable from your neighbor with a splitter.&lt;br /&gt;
&lt;br /&gt;
Besides the bandwidth loss, a person can commit some serious crimes with the Internet services he or she gains through piggybacking, such as hacking into sensitive information, downloading child pornography, etc.&lt;br /&gt;
&lt;br /&gt;
== Prevention ==&lt;br /&gt;
There are several ways to prevent piggybacking however some are more effective than others.&lt;br /&gt;
=== WEP ===&lt;br /&gt;
It is very ineffective against people with a little computer knowledge and the will to gain access to the network since WEP is cryptographically weak and takes only a few minutes to crack.  There have been attempts to enhance the security such as:&lt;br /&gt;
*WEP2&lt;br /&gt;
*WEP+&lt;br /&gt;
*dynamic WEP which changes the key periodically &lt;br /&gt;
None are substantially more effective.&lt;br /&gt;
=== MAC Address Authentication ===&lt;br /&gt;
A computer trying to connect to the network will be allowed to do so if and only if their MAC address conforms the list of allowed MAC addresses.  This is cumbersome to setup for the administrator as he or she will have to add everyone’s MAC address to the list.  This method does not prevent data from being stolen since there is no encryption.  And even then, an attacker can observe network traffic and obtain valid MAC addresses and then spoof their MAC address to gain access.&lt;br /&gt;
&lt;br /&gt;
=== IPSec ===&lt;br /&gt;
Ip security or IPSec is used to encrypt traffic, reducing or possibly eliminating all plain text information sent across the network.  It is composed of a suite of protocols such as authentication, encrypting IP packets, or cryptographic key establishment as we have read about in Chapter 9 Key Management of the textbook.&lt;br /&gt;
=== WPA ===&lt;br /&gt;
Wi-FI protected access, commonly referred to as WPA, was created by Wi-Fi Alliance and one of the major improvements over WEP is the Temporal Key Integrity Protocol which basically changes the key dynamically as the system is being used.  &lt;br /&gt;
WPA also boasts a more secure message integrity code or MIC with the Michael algorithm. &lt;br /&gt;
Later, they introduced WPA2 which strengthens the security with new algorithms such as CCMP which stands for Counter Mode with Cipher Block Chaining Message Authentication Protocol.&lt;br /&gt;
&lt;br /&gt;
== Legalities ==&lt;br /&gt;
=== Canada ===&lt;br /&gt;
While there are many differences in the laws between one country and another, in Canada the law could be interpreted in such a way that makes piggybacking illegal.  A Toronto lawyer Gil Zvulony commented on CBC’s Spark Radio recently and says that if the police ever showed up because you were piggybacking, the only way you can be charged was if the crown could proof you knew that  you were doing something wrong.&lt;br /&gt;
&lt;br /&gt;
The closest thing someone being charged with piggybacking was where a Toronto man was caught literally with his pants down downloading child pornography using someone's wireless network.  Ultimately, he was charged for the pornography and not the piggybacking.&lt;br /&gt;
&lt;br /&gt;
=== Singapore ===&lt;br /&gt;
&lt;br /&gt;
In Singapore, Garyl Tan Jia Luo became the first man to be convicted of piggybacking on January 16th, 2007 and was sentenced for 18 months probation with 80 hours of community service.&lt;br /&gt;
&lt;br /&gt;
== References ==&lt;br /&gt;
&lt;br /&gt;
# Michel Marriott. &amp;quot;Hey Neighbor, Stop Piggybacking on My Wireless&amp;quot;, The New York Times, 2006-03-05.  Retrieved on 2007-11-27.&lt;br /&gt;
# Bradley Mitchell. &amp;quot;Wireless / Networking&amp;quot;, About.  Retrieved on 2007-11-27.&lt;br /&gt;
# Wikipedia. &amp;quot;Piggybacking (internet access)&amp;quot;, Wikipedia, 2007-11-14.  Retrieved on 2007-11-27.&lt;br /&gt;
# Adam Pash. &amp;quot;Reader Poll: Do you piggyback wireless internet?&amp;quot;, lifehacker.  Retrieved on 2007-11-27.&lt;br /&gt;
# News Report. &amp;quot;Research Shows Wi-Fi Piggybacking Widespread&amp;quot;, digital communities.  Retrieved on 2007-11-27.&lt;br /&gt;
# bwilds. &amp;quot;WPA Encryption Cracking&amp;quot;, ITtoolbox Blogs. Retrieved on 2007-11-27.&lt;br /&gt;
# Byran Rite. &amp;quot;Cracking WEP and WPA Wireless Networks&amp;quot;, Alkaloid Docupedia.  Retrieved on 2007-11-27.&lt;br /&gt;
# Glenn Fleishman. &amp;quot;WPA Cracking Proof Concept Available&amp;quot;, Wi-fi Net News.  Retrieved on 2007-11-27.&lt;br /&gt;
# Wikipedia. &amp;quot;Wired Equivalent Privacy&amp;quot;, Wikipedia, 2007-11-26.  Retrieved on 2007-11-27.&lt;br /&gt;
# Michael Ossmann. &amp;quot;WEP: Dead Again, Part 1&amp;quot;, 2004-12-14.  Retrieved on 2007-11-27.&lt;br /&gt;
# CBC Spark Radio Podcast: &amp;lt;[http://podcast.cbc.ca/mp3/spark_20071107_3820.mp3]&amp;gt;.  Retrieved on 2007-11-27.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== See Also ==&lt;br /&gt;
&lt;br /&gt;
== External Links ==&lt;br /&gt;
--[[User:Chenc8|Chenc8]] 13:53, 1 December 2007 (EST) Christopher Chen&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/Piggybacking</id>
		<title>Piggybacking</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/Piggybacking"/>
				<updated>2007-12-01T18:53:52Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''Piggybacking''' internet access is the practice of gaining network services by moving their computer into range a broadcasting access point of someone’s wireless connection without the owner’s explicit permission or knowledge.&lt;br /&gt;
&lt;br /&gt;
[[Image:Networks.JPG|frame|right|Is connecting to someone's network without their permission wrong?]]&lt;br /&gt;
&lt;br /&gt;
== Background ==&lt;br /&gt;
&lt;br /&gt;
The recent explosive growth of wireless technology found in the market can be attributed to the many benefits wireless telecommunications provide. From the casual Internet surfer to the technological inclined power user, wireless networks provide the convenience of mobility, keeping up with today’s trends in increasing portability and decreasing size of our devices.  Unfortunately, wireless networks also suffer from more attacks and abuse because of how easy it is to locate and connect to wireless networks in comparison to traditional wired ones.  In combination with the lack of strong default security counter measures, the controversial practice of piggybacking has increasingly become more common.&lt;br /&gt;
&lt;br /&gt;
Piggybacking should not be confused with wardriving which involves only the mapping of the insecure access points.  In addition, people connecting to a hotspot service provided by businesses is generally not considered as piggybacking.&lt;br /&gt;
&lt;br /&gt;
== Statistics ==&lt;br /&gt;
Concerns of piggybacking is a cultural state of mind.  In the past, piggybacking has not been a major cause for concern and only recently has begun to work its way into our laws.  Taking a look at people's opinion through surveys can help depict society's overall thoughts on piggybacking.&lt;br /&gt;
&lt;br /&gt;
=== Online Poll ===&lt;br /&gt;
[[Image:Online_poll.jpg|right|thumb|This poll has over 3000 votes]]&lt;br /&gt;
From an online poll taken from lifehacker.com since March 2006&lt;br /&gt;
*~60% of voters said they would gladly hop onto someone’s wireless network if they didn’t have access to their own at the moment.  &lt;br /&gt;
*~25% of voters said they piggybacking is their main source of internet.  &lt;br /&gt;
Combined that’s 85% of voters admitting to the practice.&lt;br /&gt;
*~7% said they sometimes piggyback but only in an emergency.&lt;br /&gt;
*~8% said their morals would never allow them to do such a thing.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
=== McMaster University Poll ===&lt;br /&gt;
[[Image:Mcmaster_poll.jpg|left|thumb|This poll had 100 votes]]&lt;br /&gt;
Just as a comparison, I conducted a small survey sampling our fellow students at McMaster.  I attempted to cover a broad range of students from different faculties so I only asked a few students in this class as I did not want to contaminate the data with biased answers.  About 55% of the students I surveyed admitted to have piggybacked before and 45% said they have not.  Mind you, I was patiently waiting for them to finish filling out the survey so I suspect some may have not been telling the truth in fear of embarrassment.&lt;br /&gt;
&lt;br /&gt;
Of all the student’s surveyed, only about 20% expressed concerned about security issues when using somebody’s wireless network and said they would not send passwords or do any other information sensitive actions.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
== Views and Ethics ==&lt;br /&gt;
Advocates for piggybacking state that the practice is harmless and compare it to drinking from a public water fountain or sharing a cup of sugar.  One writes, “Leaving a network open is just being a good neighbor”.&lt;br /&gt;
Advocates against piggybacking compare the practice to entering a home just because it is unlocked or stealing cable from your neighbor with a splitter.&lt;br /&gt;
&lt;br /&gt;
Besides the bandwidth loss, a person can commit some serious crimes with the Internet services he or she gains through piggybacking, such as hacking into sensitive information, downloading child pornography, etc.&lt;br /&gt;
&lt;br /&gt;
== Prevention ==&lt;br /&gt;
There are several ways to prevent piggybacking however some are more effective than others.&lt;br /&gt;
=== WEP ===&lt;br /&gt;
It is very ineffective against people with a little computer knowledge and the will to gain access to the network since WEP is cryptographically weak and takes only a few minutes to crack.  There have been attempts to enhance the security such as:&lt;br /&gt;
*WEP2&lt;br /&gt;
*WEP+&lt;br /&gt;
*dynamic WEP which changes the key periodically &lt;br /&gt;
None are substantially more effective.&lt;br /&gt;
=== MAC Address Authentication ===&lt;br /&gt;
A computer trying to connect to the network will be allowed to do so if and only if their MAC address conforms the list of allowed MAC addresses.  This is cumbersome to setup for the administrator as he or she will have to add everyone’s MAC address to the list.  This method does not prevent data from being stolen since there is no encryption.  And even then, an attacker can observe network traffic and obtain valid MAC addresses and then spoof their MAC address to gain access.&lt;br /&gt;
&lt;br /&gt;
=== IPSec ===&lt;br /&gt;
Ip security or IPSec is used to encrypt traffic, reducing or possibly eliminating all plain text information sent across the network.  It is composed of a suite of protocols such as authentication, encrypting IP packets, or cryptographic key establishment as we have read about in Chapter 9 Key Management of the textbook.&lt;br /&gt;
=== WPA ===&lt;br /&gt;
Wi-FI protected access, commonly referred to as WPA, was created by Wi-Fi Alliance and one of the major improvements over WEP is the Temporal Key Integrity Protocol which basically changes the key dynamically as the system is being used.  &lt;br /&gt;
WPA also boasts a more secure message integrity code or MIC with the Michael algorithm. &lt;br /&gt;
Later, they introduced WPA2 which strengthens the security with new algorithms such as CCMP which stands for Counter Mode with Cipher Block Chaining Message Authentication Protocol.&lt;br /&gt;
&lt;br /&gt;
== Legalities ==&lt;br /&gt;
=== Canada ===&lt;br /&gt;
While there are many differences in the laws between one country and another, in Canada the law could be interpreted in such a way that makes piggybacking illegal.  A Toronto lawyer Gil Zvulony commented on CBC’s Spark Radio recently and says that if the police ever showed up because you were piggybacking, the only way you can be charged was if the crown could proof you knew that  you were doing something wrong.&lt;br /&gt;
&lt;br /&gt;
The closest thing someone being charged with piggybacking was where a Toronto man was caught literally with his pants down downloading child pornography using someone's wireless network.  Ultimately, he was charged for the pornography and not the piggybacking.&lt;br /&gt;
&lt;br /&gt;
=== Singapore ===&lt;br /&gt;
&lt;br /&gt;
In Singapore, Garyl Tan Jia Luo became the first man to be convicted of piggybacking on January 16th, 2007 and was sentenced for 18 months probation with 80 hours of community service.&lt;br /&gt;
&lt;br /&gt;
== References ==&lt;br /&gt;
&lt;br /&gt;
== See Also ==&lt;br /&gt;
&lt;br /&gt;
== External Links ==&lt;br /&gt;
--[[User:Chenc8|Chenc8]] 13:53, 1 December 2007 (EST) Christopher Chen&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/Piggybacking</id>
		<title>Piggybacking</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/Piggybacking"/>
				<updated>2007-12-01T08:11:06Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''Piggybacking''' internet access is the practice of gaining network services of someone’s wireless connection without the owner’s explicit permission or knowledge by moving their own computer into range of the broadcasting access point in question.&lt;br /&gt;
&lt;br /&gt;
[[Image:Networks.JPG|frame|right|Is connecting to someone's network without their permission wrong?]]&lt;br /&gt;
&lt;br /&gt;
== Background ==&lt;br /&gt;
&lt;br /&gt;
The recent explosive growth of wireless technology found in the market can be attributed to the many benefits wireless telecommunications provide. From the casual Internet surfer to the technological inclined power user, wireless networks provide the convenience of mobility, keeping up with today’s trends in increasing portability and decreasing size of our devices.  Unfortunately, wireless networks also suffer from more attacks and abuse because of how easy it is to locate and connect to wireless networks in comparison to traditional wired ones.  In combination with the lack of strong default security counter measures, the controversial practice of piggybacking has increasingly become more common.&lt;br /&gt;
&lt;br /&gt;
Piggybacking should not be confused with wardriving which involves only the mapping of the insecure access points.  In addition, people connecting to a hotspot service provided by businesses is generally not considered as piggybacking.&lt;br /&gt;
&lt;br /&gt;
== Statistics ==&lt;br /&gt;
Concerns of piggybacking is a cultural state of mind.  In the past, piggybacking has not been a major cause for concern and only recently has begun to work its way into our laws.  Taking a look at people's opinion through surveys can help depict society's overall thoughts on piggybacking.&lt;br /&gt;
&lt;br /&gt;
=== Online Poll ===&lt;br /&gt;
[[Image:Online_poll.jpg|right|thumb|This poll has over 3000 votes]]&lt;br /&gt;
From an online poll taken from lifehacker.com since March 2006&lt;br /&gt;
*~60% of voters said they would gladly hop onto someone’s wireless network if they didn’t have access to their own at the moment.  &lt;br /&gt;
*~25% of voters said they piggybacking is their main source of internet.  &lt;br /&gt;
Combined that’s 85% of voters admitting to the practice.&lt;br /&gt;
*~7% said they sometimes piggyback but only in an emergency.&lt;br /&gt;
*~8% said their morals would never allow them to do such a thing.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
=== McMaster University Poll ===&lt;br /&gt;
[[Image:Mcmaster_poll.jpg|left|thumb|This poll had 100 votes]]&lt;br /&gt;
Just as a comparison, I conducted a small survey sampling our fellow students at McMaster.  I attempted to cover a broad range of students from different faculties so I only asked a few students in this class as I did not want to contaminate the data with biased answers.  About 55% of the students I surveyed admitted to have piggybacked before and 45% said they have not.  Mind you, I was patiently waiting for them to finish filling out the survey so I suspect some may have not been telling the truth in fear of embarrassment.&lt;br /&gt;
&lt;br /&gt;
Of all the student’s surveyed, only about 20% expressed concerned about security issues when using somebody’s wireless network and said they would not send passwords or do any other information sensitive actions.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
== Views and Ethics ==&lt;br /&gt;
Advocates for piggybacking state that the practice is harmless and compare it to drinking from a public water fountain or sharing a cup of sugar.  One writes, “Leaving a network open is just being a good neighbor”.&lt;br /&gt;
Advocates against piggybacking compare the practice to entering a home just because it is unlocked or stealing cable from your neighbor with a splitter.&lt;br /&gt;
&lt;br /&gt;
Besides the bandwidth loss, a person can commit some serious crimes with the Internet services he or she gains through piggybacking, such as hacking into sensitive information, downloading child pornography, etc.&lt;br /&gt;
&lt;br /&gt;
== Prevention ==&lt;br /&gt;
There are several ways to prevent piggybacking however some are more effective than others.&lt;br /&gt;
=== WEP ===&lt;br /&gt;
It is very ineffective against people with a little computer knowledge and the will to gain access to the network since WEP is cryptographically weak and takes only a few minutes to crack.  There have been attempts to enhance the security such as:&lt;br /&gt;
*WEP2&lt;br /&gt;
*WEP+&lt;br /&gt;
*dynamic WEP which changes the key periodically &lt;br /&gt;
None are substantially more effective.&lt;br /&gt;
=== MAC Address Authentication ===&lt;br /&gt;
A computer trying to connect to the network will be allowed to do so if and only if their MAC address conforms the list of allowed MAC addresses.  This is cumbersome to setup for the administrator as he or she will have to add everyone’s MAC address to the list.  This method does not prevent data from being stolen since there is no encryption.  And even then, an attacker can observe network traffic and obtain valid MAC addresses and then spoof their MAC address to gain access.&lt;br /&gt;
&lt;br /&gt;
=== IPSec ===&lt;br /&gt;
Ip security or IPSec is used to encrypt traffic, reducing or possibly eliminating all plain text information sent across the network.  It is composed of a suite of protocols such as authentication, encrypting IP packets, or cryptographic key establishment as we have read about in Chapter 9 Key Management of the textbook.&lt;br /&gt;
=== WPA ===&lt;br /&gt;
Wi-FI protected access, commonly referred to as WPA, was created by Wi-Fi Alliance and one of the major improvements over WEP is the Temporal Key Integrity Protocol which basically changes the key dynamically as the system is being used.  &lt;br /&gt;
WPA also boasts a more secure message integrity code or MIC with the Michael algorithm. &lt;br /&gt;
Later, they introduced WPA2 which strengthens the security with new algorithms such as CCMP which stands for Counter Mode with Cipher Block Chaining Message Authentication Protocol.&lt;br /&gt;
&lt;br /&gt;
== Legalities ==&lt;br /&gt;
=== Canada ===&lt;br /&gt;
While there are many differences in the laws between one country and another, in Canada the law could be interpreted in such a way that makes piggybacking illegal.  A Toronto lawyer Gil Zvulony commented on CBC’s Spark Radio recently and says that if the police ever showed up because you were piggybacking, the only way you can be charged was if the crown could proof you knew that  you were doing something wrong.&lt;br /&gt;
&lt;br /&gt;
The closest thing someone being charged with piggybacking was where a Toronto man was caught literally with his pants down downloading child pornography using someone's wireless network.  Ultimately, he was charged for the pornography and not the piggybacking.&lt;br /&gt;
&lt;br /&gt;
=== Singapore ===&lt;br /&gt;
&lt;br /&gt;
In Singapore, Garyl Tan Jia Luo became the first man to be convicted of piggybacking on January 16th, 2007 and was sentenced for 18 months probation with 80 hours of community service.&lt;br /&gt;
&lt;br /&gt;
== References ==&lt;br /&gt;
&lt;br /&gt;
== See Also ==&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/Piggybacking</id>
		<title>Piggybacking</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/Piggybacking"/>
				<updated>2007-12-01T08:04:29Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''Piggybacking''' internet access is the practice of gaining network services of someone’s wireless connection without the owner’s explicit permission or knowledge by moving their own computer into range of the broadcasting access point in question.&lt;br /&gt;
&lt;br /&gt;
[[Image:Networks.JPG|frame|right|Is connecting to someone's network without their permission illegal?]]&lt;br /&gt;
&lt;br /&gt;
== Background ==&lt;br /&gt;
&lt;br /&gt;
The recent explosive growth of wireless technology found in the market can be attributed to the many benefits wireless telecommunications provide. From the casual Internet surfer to the technological inclined power user, wireless networks provide the convenience of mobility, keeping up with today’s trends in increasing portability and decreasing size of our devices.  Unfortunately, wireless networks also suffer from more attacks and abuse because of how easy it is to locate and connect to wireless networks in comparison to traditional wired ones.  In combination with the lack of strong default security counter measures, the controversial practice of piggybacking has increasingly become more common.&lt;br /&gt;
&lt;br /&gt;
Piggybacking should not be confused with wardriving which involves only the mapping of the insecure access points.  In addition, people connecting to a hotspot service provided by businesses is generally not considered as piggybacking.&lt;br /&gt;
&lt;br /&gt;
== Statistics ==&lt;br /&gt;
=== Online Poll ===&lt;br /&gt;
[[Image:Online_poll.jpg|right|thumb|This poll has over 3000 votes]]&lt;br /&gt;
From an online poll taken from lifehacker.com since March 2006&lt;br /&gt;
*~60% of voters said they would gladly hop onto someone’s wireless network if they didn’t have access to their own at the moment.  &lt;br /&gt;
*~25% of voters said they piggybacking is their main source of internet.  &lt;br /&gt;
Combined that’s 85% of voters admitting to the practice.&lt;br /&gt;
*~7% said they sometimes piggyback but only in an emergency.&lt;br /&gt;
*~8% said their morals would never allow them to do such a thing.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
=== McMaster University Poll ===&lt;br /&gt;
[[Image:Mcmaster_poll.jpg|left|thumb|This poll had 100 votes]]&lt;br /&gt;
Just as a comparison, I conducted a small survey sampling our fellow students at McMaster.  I attempted to cover a broad range of students from different faculties so I only asked a few students in this class as I did not want to contaminate the data with biased answers.  About 55% of the students I surveyed admitted to have piggybacked before and 45% said they have not.  Mind you, I was patiently waiting for them to finish filling out the survey so I suspect some may have not been telling the truth in fear of embarrassment.&lt;br /&gt;
&lt;br /&gt;
Of all the student’s surveyed, only about 20% expressed concerned about security issues when using somebody’s wireless network and said they would not send passwords or do any other information sensitive actions.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
== Views and Ethics ==&lt;br /&gt;
Advocates for piggybacking state that the practice is harmless and compare it to drinking from a public water fountain or sharing a cup of sugar.  One writes, “Leaving a network open is just being a good neighbor”.&lt;br /&gt;
Advocates against piggybacking compare the practice to entering a home just because it is unlocked or stealing cable from your neighbor with a splitter.&lt;br /&gt;
&lt;br /&gt;
Besides the bandwidth loss, a person can commit some serious crimes with the Internet services he or she gains through piggybacking, such as hacking into sensitive information, downloading child pornography, etc.&lt;br /&gt;
&lt;br /&gt;
== Prevention ==&lt;br /&gt;
There are several ways to prevent piggybacking however some are more effective than others.&lt;br /&gt;
=== WEP ===&lt;br /&gt;
It is very ineffective against people with a little computer knowledge and the will to gain access to the network since WEP is cryptographically weak and takes only a few minutes to crack.  There have been attempts to enhance the security such as:&lt;br /&gt;
*WEP2&lt;br /&gt;
*WEP+&lt;br /&gt;
*dynamic WEP which changes the key periodically &lt;br /&gt;
None are substantially more effective.&lt;br /&gt;
=== MAC Address Authentication ===&lt;br /&gt;
A computer trying to connect to the network will be allowed to do so if and only if their MAC address conforms the list of allowed MAC addresses.  This is cumbersome to setup for the administrator as he or she will have to add everyone’s MAC address to the list.  This method does not prevent data from being stolen since there is no encryption.  And even then, an attacker can observe network traffic and obtain valid MAC addresses and then spoof their MAC address to gain access.&lt;br /&gt;
&lt;br /&gt;
=== IPSec ===&lt;br /&gt;
Ip security or IPSec is used to encrypt traffic, reducing or possibly eliminating all plain text information sent across the network.  It is composed of a suite of protocols such as authentication, encrypting IP packets, or cryptographic key establishment as we have read about in Chapter 9 Key Management of the textbook.&lt;br /&gt;
=== WPA ===&lt;br /&gt;
Wi-FI protected access, commonly referred to as WPA, was created by Wi-Fi Alliance and one of the major improvements over WEP is the Temporal Key Integrity Protocol which basically changes the key dynamically as the system is being used.  &lt;br /&gt;
WPA also boasts a more secure message integrity code or MIC with the Michael algorithm. &lt;br /&gt;
Later, they introduced WPA2 which strengthens the security with new algorithms such as CCMP which stands for Counter Mode with Cipher Block Chaining Message Authentication Protocol.&lt;br /&gt;
&lt;br /&gt;
== Legalities ==&lt;br /&gt;
=== Canada ===&lt;br /&gt;
While there are many differences in the laws between one country and another, in Canada the law could be interpreted in such a way that makes piggybacking illegal.  A Toronto lawyer Gil Zvulony commented on CBC’s Spark Radio recently and says that if the police ever showed up because you were piggybacking, the only way you can be charged was if the crown could proof you knew that  you were doing something wrong.&lt;br /&gt;
&lt;br /&gt;
The closest thing someone being charged with piggybacking was where a Toronto man was caught literally with his pants down downloading child pornography using someone's wireless network.  Ultimately, he was charged for the pornography and not the piggybacking.&lt;br /&gt;
&lt;br /&gt;
=== Singapore ===&lt;br /&gt;
&lt;br /&gt;
In Singapore, Garyl Tan Jia Luo became the first man to be convicted of piggybacking on January 16th, 2007 and was sentenced for 18 months probation with 80 hours of community service.&lt;br /&gt;
&lt;br /&gt;
== References ==&lt;br /&gt;
&lt;br /&gt;
== See Also ==&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/Piggybacking</id>
		<title>Piggybacking</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/Piggybacking"/>
				<updated>2007-12-01T07:59:27Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''Piggybacking''' internet access is the practice of gaining network services of someone’s wireless connection without the owner’s explicit permission or knowledge by moving their own computer into range of the broadcasting access point in question.&lt;br /&gt;
&lt;br /&gt;
[[Image:Networks.JPG|frame|right|Is connecting to someone's network without their permission illegal?]]&lt;br /&gt;
&lt;br /&gt;
== Background ==&lt;br /&gt;
&lt;br /&gt;
The recent explosive growth of wireless technology found in the market can be attributed to the many benefits wireless telecommunications provide. From the casual Internet surfer to the technological inclined power user, wireless networks provide the convenience of mobility, keeping up with today’s trends in increasing portability and decreasing size of our devices.  Unfortunately, wireless networks also suffer from more attacks and abuse because of how easy it is to locate and connect to wireless networks in comparison to traditional wired ones.  In combination with the lack of strong default security counter measures, the controversial practice of piggybacking has increasingly become more common.&lt;br /&gt;
&lt;br /&gt;
Piggybacking should not be confused with wardriving which involves only the mapping of the insecure access points.  In addition, people connecting to a hotspot service provided by businesses is generally not considered as piggybacking.&lt;br /&gt;
&lt;br /&gt;
== Statistics ==&lt;br /&gt;
=== Online Poll ===&lt;br /&gt;
[[Image:Online_poll.jpg|right|thumb|This poll has over 3000 votes]]&lt;br /&gt;
From an online poll taken from lifehacker.com since March 2006, just a little above 60% of voters said they would gladly hop onto someone’s wireless network if they didn’t have access to their own at the moment.  &lt;br /&gt;
A little below 25% of voters said they piggybacking is their main source of internet.  &lt;br /&gt;
Combined that’s 85% of voters admitting to the practice.&lt;br /&gt;
About 7% said they sometimes piggyback but only in an emergency while 8% said their morals would never allow them to do such a thing.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
=== McMaster University Poll ===&lt;br /&gt;
[[Image:Mcmaster_poll.jpg|left|thumb|This poll had 100 votes]]&lt;br /&gt;
Just as a comparison, I conducted a small survey sampling our fellow students at McMaster.  I attempted to cover a broad range of students from different faculties so I only asked a few students in this class as I did not want to contaminate the data with biased answers.  About 55% of the students I surveyed admitted to have piggybacked before and 45% said they have not.  Mind you, I was patiently waiting for them to finish filling out the survey so I suspect some may have not been telling the truth in fear of embarrassment.&lt;br /&gt;
&lt;br /&gt;
Of all the student’s surveyed, only about 20% expressed concerned about security issues when using somebody’s wireless network and said they would not send passwords or do any other information sensitive actions.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
== Views and Ethics ==&lt;br /&gt;
Advocates for piggybacking state that the practice is harmless and compare it to drinking from a public water fountain or sharing a cup of sugar.  One writes, “Leaving a network open is just being a good neighbor”.&lt;br /&gt;
Advocates against piggybacking compare the practice to entering a home just because it is unlocked or stealing cable from your neighbor with a splitter.&lt;br /&gt;
&lt;br /&gt;
Besides the bandwidth loss, a person can commit some serious crimes with the Internet services he or she gains through piggybacking, such as hacking into sensitive information, downloading child pornography, etc.&lt;br /&gt;
&lt;br /&gt;
== Prevention ==&lt;br /&gt;
There are several ways to prevent piggybacking however some are more effective than others.&lt;br /&gt;
=== WEP ===&lt;br /&gt;
It is very ineffective against people with a little computer knowledge and the will to gain access to the network since WEP is cryptographically weak and takes only a few minutes to crack.  There have been attempts to enhance the security such as:&lt;br /&gt;
*WEP2&lt;br /&gt;
*WEP+&lt;br /&gt;
*dynamic WEP which changes the key periodically &lt;br /&gt;
None are substantially more effective.&lt;br /&gt;
=== MAC Address Authentication ===&lt;br /&gt;
A computer trying to connect to the network will be allowed to do so if and only if their MAC address conforms the list of allowed MAC addresses.  This is cumbersome to setup for the administrator as he or she will have to add everyone’s MAC address to the list.  This method does not prevent data from being stolen since there is no encryption.  And even then, an attacker can observe network traffic and obtain valid MAC addresses and then spoof their MAC address to gain access.&lt;br /&gt;
&lt;br /&gt;
=== IPSec ===&lt;br /&gt;
Ip security or IPSec is used to encrypt traffic, reducing or possibly eliminating all plain text information sent across the network.  It is composed of a suite of protocols such as authentication, encrypting IP packets, or cryptographic key establishment as we have read about in Chapter 9 Key Management of the textbook.&lt;br /&gt;
=== WPA ===&lt;br /&gt;
Wi-FI protected access, commonly referred to as WPA, was created by Wi-Fi Alliance and one of the major improvements over WEP is the Temporal Key Integrity Protocol which basically changes the key dynamically as the system is being used.  &lt;br /&gt;
WPA also boasts a more secure message integrity code or MIC with the Michael algorithm. &lt;br /&gt;
Later, they introduced WPA2 which strengthens the security with new algorithms such as CCMP which stands for Counter Mode with Cipher Block Chaining Message Authentication Protocol.&lt;br /&gt;
&lt;br /&gt;
== Legalities ==&lt;br /&gt;
=== Canada ===&lt;br /&gt;
While there are many differences in the laws between one country and another, in Canada the law could be interpreted in such a way that makes piggybacking illegal.  A Toronto lawyer Gil Zvulony commented on CBC’s Spark Radio recently and says that if the police ever showed up because you were piggybacking, the only way you can be charged was if the crown could proof you knew that  you were doing something wrong.&lt;br /&gt;
&lt;br /&gt;
The closest thing someone being charged with piggybacking was where a Toronto man was caught literally with his pants down downloading child pornography using someone's wireless network.  Ultimately, he was charged for the pornography and not the piggybacking.&lt;br /&gt;
&lt;br /&gt;
=== Singapore ===&lt;br /&gt;
&lt;br /&gt;
In Singapore, Garyl Tan Jia Luo became the first man to be convicted of piggybacking on January 16th, 2007 and was sentenced for 18 months probation with 80 hours of community service.&lt;br /&gt;
&lt;br /&gt;
== References ==&lt;br /&gt;
&lt;br /&gt;
== See Also ==&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/Piggybacking</id>
		<title>Piggybacking</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/Piggybacking"/>
				<updated>2007-12-01T07:56:46Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''Piggybacking''' internet access is the practice of gaining network services of someone’s wireless connection without the owner’s explicit permission or knowledge by moving their own computer into range of the broadcasting access point in question.&lt;br /&gt;
&lt;br /&gt;
[[Image:Networks.jpg|right|Is connecting to someone's network without their permission illegal?]]&lt;br /&gt;
&lt;br /&gt;
== Background ==&lt;br /&gt;
&lt;br /&gt;
The recent explosive growth of wireless technology found in the market can be attributed to the many benefits wireless telecommunications provide. From the casual Internet surfer to the technological inclined power user, wireless networks provide the convenience of mobility, keeping up with today’s trends in increasing portability and decreasing size of our devices.  Unfortunately, wireless networks also suffer from more attacks and abuse because of how easy it is to locate and connect to wireless networks in comparison to traditional wired ones.  In combination with the lack of strong default security counter measures, the controversial practice of piggybacking has increasingly become more common.&lt;br /&gt;
&lt;br /&gt;
Piggybacking should not be confused with wardriving which involves only the mapping of the insecure access points.  In addition, people connecting to a hotspot service provided by businesses is generally not considered as piggybacking.&lt;br /&gt;
&lt;br /&gt;
== Statistics ==&lt;br /&gt;
=== Online Poll ===&lt;br /&gt;
[[Image:Online_poll.jpg|right|thumb|This poll has over 3000 votes]]&lt;br /&gt;
From an online poll taken from lifehacker.com since March 2006, just a little above 60% of voters said they would gladly hop onto someone’s wireless network if they didn’t have access to their own at the moment.  &lt;br /&gt;
A little below 25% of voters said they piggybacking is their main source of internet.  &lt;br /&gt;
Combined that’s 85% of voters admitting to the practice.&lt;br /&gt;
About 7% said they sometimes piggyback but only in an emergency while 8% said their morals would never allow them to do such a thing.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
=== McMaster University Poll ===&lt;br /&gt;
[[Image:Mcmaster_poll.jpg|left|thumb|This poll had 100 votes]]&lt;br /&gt;
Just as a comparison, I conducted a small survey sampling our fellow students at McMaster.  I attempted to cover a broad range of students from different faculties so I only asked a few students in this class as I did not want to contaminate the data with biased answers.  About 55% of the students I surveyed admitted to have piggybacked before and 45% said they have not.  Mind you, I was patiently waiting for them to finish filling out the survey so I suspect some may have not been telling the truth in fear of embarrassment.&lt;br /&gt;
&lt;br /&gt;
Of all the student’s surveyed, only about 20% expressed concerned about security issues when using somebody’s wireless network and said they would not send passwords or do any other information sensitive actions.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
== Views and Ethics ==&lt;br /&gt;
Advocates for piggybacking state that the practice is harmless and compare it to drinking from a public water fountain or sharing a cup of sugar.  One writes, “Leaving a network open is just being a good neighbor”.&lt;br /&gt;
Advocates against piggybacking compare the practice to entering a home just because it is unlocked or stealing cable from your neighbor with a splitter.&lt;br /&gt;
&lt;br /&gt;
Besides the bandwidth loss, a person can commit some serious crimes with the Internet services he or she gains through piggybacking, such as hacking into sensitive information, downloading child pornography, etc.&lt;br /&gt;
&lt;br /&gt;
== Prevention ==&lt;br /&gt;
There are several ways to prevent piggybacking however some are more effective than others.&lt;br /&gt;
=== WEP ===&lt;br /&gt;
It is very ineffective against people with a little computer knowledge and the will to gain access to the network since WEP is cryptographically weak and takes only a few minutes to crack.  There have been attempts to enhance the security such as:&lt;br /&gt;
*WEP2&lt;br /&gt;
*WEP+&lt;br /&gt;
*dynamic WEP which changes the key periodically &lt;br /&gt;
None are substantially more effective.&lt;br /&gt;
=== MAC Address Authentication ===&lt;br /&gt;
A computer trying to connect to the network will be allowed to do so if and only if their MAC address conforms the list of allowed MAC addresses.  This is cumbersome to setup for the administrator as he or she will have to add everyone’s MAC address to the list.  This method does not prevent data from being stolen since there is no encryption.  And even then, an attacker can observe network traffic and obtain valid MAC addresses and then spoof their MAC address to gain access.&lt;br /&gt;
&lt;br /&gt;
=== IPSec ===&lt;br /&gt;
Ip security or IPSec is used to encrypt traffic, reducing or possibly eliminating all plain text information sent across the network.  It is composed of a suite of protocols such as authentication, encrypting IP packets, or cryptographic key establishment as we have read about in Chapter 9 Key Management of the textbook.&lt;br /&gt;
=== WPA ===&lt;br /&gt;
Wi-FI protected access, commonly referred to as WPA, was created by Wi-Fi Alliance and one of the major improvements over WEP is the Temporal Key Integrity Protocol which basically changes the key dynamically as the system is being used.  &lt;br /&gt;
WPA also boasts a more secure message integrity code or MIC with the Michael algorithm. &lt;br /&gt;
Later, they introduced WPA2 which strengthens the security with new algorithms such as CCMP which stands for Counter Mode with Cipher Block Chaining Message Authentication Protocol.&lt;br /&gt;
&lt;br /&gt;
== Legalities ==&lt;br /&gt;
=== Canada ===&lt;br /&gt;
While there are many differences in the laws between one country and another, in Canada the law could be interpreted in such a way that makes piggybacking illegal.  A Toronto lawyer Gil Zvulony commented on CBC’s Spark Radio recently and says that if the police ever showed up because you were piggybacking, the only way you can be charged was if the crown could proof you knew that  you were doing something wrong.&lt;br /&gt;
&lt;br /&gt;
The closest thing someone being charged with piggybacking was where a Toronto man was caught literally with his pants down downloading child pornography using someone's wireless network.  Ultimately, he was charged for the pornography and not the piggybacking.&lt;br /&gt;
&lt;br /&gt;
=== Singapore ===&lt;br /&gt;
&lt;br /&gt;
In Singapore, Garyl Tan Jia Luo became the first man to be convicted of piggybacking on January 16th, 2007 and was sentenced for 18 months probation with 80 hours of community service.&lt;br /&gt;
&lt;br /&gt;
== References ==&lt;br /&gt;
&lt;br /&gt;
== See Also ==&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/File:Networks.JPG</id>
		<title>File:Networks.JPG</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/File:Networks.JPG"/>
				<updated>2007-12-01T07:54:10Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/Piggybacking</id>
		<title>Piggybacking</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/Piggybacking"/>
				<updated>2007-12-01T07:35:00Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''Piggybacking''' internet access is the practice of gaining network services of someone’s wireless connection without the owner’s explicit permission or knowledge by moving their own computer into range of the broadcasting access point in question.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Background ==&lt;br /&gt;
&lt;br /&gt;
The recent explosive growth of wireless technology found in the market can be attributed to the many benefits wireless telecommunications provide. From the casual Internet surfer to the technological inclined power user, wireless networks provide the convenience of mobility, keeping up with today’s trends in increasing portability and decreasing size of our devices.  Unfortunately, wireless networks also suffer from more attacks and abuse because of how easy it is to locate and connect to wireless networks in comparison to traditional wired ones.  In combination with the lack of strong default security counter measures, the controversial practice of piggybacking has increasingly become more common.&lt;br /&gt;
&lt;br /&gt;
Piggybacking should not be confused with wardriving which involves only the mapping of the insecure access points.  In addition, people connecting to a hotspot service provided by businesses is generally not considered as piggybacking.&lt;br /&gt;
&lt;br /&gt;
== Statistics ==&lt;br /&gt;
=== Online Poll ===&lt;br /&gt;
[[Image:Online_poll.jpg|right|thumb|This poll has over 3000 votes]]&lt;br /&gt;
From an online poll taken from lifehacker.com since March 2006, just a little above 60% of voters said they would gladly hop onto someone’s wireless network if they didn’t have access to their own at the moment.  &lt;br /&gt;
A little below 25% of voters said they piggybacking is their main source of internet.  &lt;br /&gt;
Combined that’s 85% of voters admitting to the practice.&lt;br /&gt;
About 7% said they sometimes piggyback but only in an emergency while 8% said their morals would never allow them to do such a thing.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
=== McMaster University Poll ===&lt;br /&gt;
[[Image:Mcmaster_poll.jpg|left|thumb|This poll had 100 votes]]&lt;br /&gt;
Just as a comparison, I conducted a small survey sampling our fellow students at McMaster.  I attempted to cover a broad range of students from different faculties so I only asked a few students in this class as I did not want to contaminate the data with biased answers.  About 55% of the students I surveyed admitted to have piggybacked before and 45% said they have not.  Mind you, I was patiently waiting for them to finish filling out the survey so I suspect some may have not been telling the truth in fear of embarrassment.&lt;br /&gt;
&lt;br /&gt;
Of all the student’s surveyed, only about 20% expressed concerned about security issues when using somebody’s wireless network and said they would not send passwords or do any other information sensitive actions.&lt;br /&gt;
&amp;lt;br style=&amp;quot;clear:both;&amp;quot;/&amp;gt;&lt;br /&gt;
== Views and Ethics ==&lt;br /&gt;
Advocates for piggybacking state that the practice is harmless and compare it to drinking from a public water fountain or sharing a cup of sugar.  One writes, “Leaving a network open is just being a good neighbor”.&lt;br /&gt;
Advocates against piggybacking compare the practice to entering a home just because it is unlocked or stealing cable from your neighbor with a splitter.&lt;br /&gt;
&lt;br /&gt;
Besides the bandwidth loss, a person can commit some serious crimes with the Internet services he or she gains through piggybacking, such as hacking into sensitive information, downloading child pornography, etc.&lt;br /&gt;
&lt;br /&gt;
== Prevention ==&lt;br /&gt;
There are several ways to prevent piggybacking however some are more effective than others.&lt;br /&gt;
=== WEP ===&lt;br /&gt;
It is very ineffective against people with a little computer knowledge and the will to gain access to the network since WEP is cryptographically weak and takes only a few minutes to crack.  There have been attempts to enhance the security such as:&lt;br /&gt;
*WEP2&lt;br /&gt;
*WEP+&lt;br /&gt;
*dynamic WEP which changes the key periodically &lt;br /&gt;
None are substantially more effective.&lt;br /&gt;
=== MAC Address Authentication ===&lt;br /&gt;
A computer trying to connect to the network will be allowed to do so if and only if their MAC address conforms the list of allowed MAC addresses.  This is cumbersome to setup for the administrator as he or she will have to add everyone’s MAC address to the list.  This method does not prevent data from being stolen since there is no encryption.  And even then, an attacker can observe network traffic and obtain valid MAC addresses and then spoof their MAC address to gain access.&lt;br /&gt;
&lt;br /&gt;
=== IPSec ===&lt;br /&gt;
Ip security or IPSec is used to encrypt traffic, reducing or possibly eliminating all plain text information sent across the network.  It is composed of a suite of protocols such as authentication, encrypting IP packets, or cryptographic key establishment as we have read about in Chapter 9 Key Management of the textbook.&lt;br /&gt;
=== WPA ===&lt;br /&gt;
Wi-FI protected access, commonly referred to as WPA, was created by Wi-Fi Alliance and one of the major improvements over WEP is the Temporal Key Integrity Protocol which basically changes the key dynamically as the system is being used.  &lt;br /&gt;
WPA also boasts a more secure message integrity code or MIC with the Michael algorithm. &lt;br /&gt;
Later, they introduced WPA2 which strengthens the security with new algorithms such as CCMP which stands for Counter Mode with Cipher Block Chaining Message Authentication Protocol.&lt;br /&gt;
&lt;br /&gt;
== Legalities ==&lt;br /&gt;
=== Canada ===&lt;br /&gt;
While there are many differences in the laws between one country and another, in Canada the law could be interpreted in such a way that makes piggybacking illegal.  A Toronto lawyer Gil Zvulony commented on CBC’s Spark Radio recently and says that if the police ever showed up because you were piggybacking, the only way you can be charged was if the crown could proof you knew that  you were doing something wrong.&lt;br /&gt;
&lt;br /&gt;
The closest thing someone being charged with piggybacking was where a Toronto man was caught literally with his pants down downloading child pornography using someone's wireless network.  Ultimately, he was charged for the pornography and not the piggybacking.&lt;br /&gt;
&lt;br /&gt;
=== Singapore ===&lt;br /&gt;
&lt;br /&gt;
In Singapore, Garyl Tan Jia Luo became the first man to be convicted of piggybacking on January 16th, 2007 and was sentenced for 18 months probation with 80 hours of community service.&lt;br /&gt;
&lt;br /&gt;
== References ==&lt;br /&gt;
&lt;br /&gt;
== See Also ==&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/Piggybacking</id>
		<title>Piggybacking</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/Piggybacking"/>
				<updated>2007-12-01T07:26:22Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''Piggybacking''' internet access is the practice of gaining network services of someone’s wireless connection without the owner’s explicit permission or knowledge by moving their own computer into range of the broadcasting access point in question.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Background ==&lt;br /&gt;
&lt;br /&gt;
The recent explosive growth of wireless technology found in the market can be attributed to the many benefits wireless telecommunications provide. From the casual Internet surfer to the technological inclined power user, wireless networks provide the convenience of mobility, keeping up with today’s trends in increasing portability and decreasing size of our devices.  Unfortunately, wireless networks also suffer from more attacks and abuse because of how easy it is to locate and connect to wireless networks in comparison to traditional wired ones.  In combination with the lack of strong default security counter measures, the controversial practice of piggybacking has increasingly become more common.&lt;br /&gt;
&lt;br /&gt;
Piggybacking should not be confused with wardriving which involves only the mapping of the insecure access points.  In addition, people connecting to a hotspot service provided by businesses is generally not considered as piggybacking.&lt;br /&gt;
&lt;br /&gt;
== Statistics ==&lt;br /&gt;
=== Online Poll ===&lt;br /&gt;
&lt;br /&gt;
From an online poll taken from lifehacker.com since March 2006, just a little above 60% of voters said they would gladly hop onto someone’s wireless network if they didn’t have access to their own at the moment.  &lt;br /&gt;
A little below 25% of voters said they piggybacking is their main source of internet.  &lt;br /&gt;
Combined that’s 85% of voters admitting to the practice.&lt;br /&gt;
About 7% said they sometimes piggyback but only in an emergency while 8% said their morals would never allow them to do such a thing.&lt;br /&gt;
[[Image:Online_poll.jpg|500px|right|This poll has over 3000 votes]]&lt;br /&gt;
=== McMaster University Poll ===&lt;br /&gt;
&lt;br /&gt;
Just as a comparison, I conducted a small survey sampling our fellow students at McMaster.  I attempted to cover a broad range of students from different faculties so I only asked a few students in this class as I did not want to contaminate the data with biased answers.  About 55% of the students I surveyed admitted to have piggybacked before and 45% said they have not.  Mind you, I was patiently waiting for them to finish filling out the survey so I suspect some may have not been telling the truth in fear of embarrassment.&lt;br /&gt;
&lt;br /&gt;
Of all the student’s surveyed, only about 20% expressed concerned about security issues when using somebody’s wireless network and said they would not send passwords or do any other information sensitive actions.&lt;br /&gt;
&lt;br /&gt;
== Views and Ethics ==&lt;br /&gt;
Advocates for piggybacking state that the practice is harmless and compare it to drinking from a public water fountain or sharing a cup of sugar.  One writes, “Leaving a network open is just being a good neighbor”.&lt;br /&gt;
Advocates against piggybacking compare the practice to entering a home just because it is unlocked or stealing cable from your neighbor with a splitter.&lt;br /&gt;
&lt;br /&gt;
Besides the bandwidth loss, a person can commit some serious crimes with the Internet services he or she gains through piggybacking, such as hacking into sensitive information, downloading child pornography, etc.&lt;br /&gt;
&lt;br /&gt;
== Prevention ==&lt;br /&gt;
There are several ways to prevent piggybacking however some are more effective than others.&lt;br /&gt;
=== WEP ===&lt;br /&gt;
It is very ineffective against people with a little computer knowledge and the will to gain access to the network since WEP is cryptographically weak and takes only a few minutes to crack.  There have been attempts to enhance the security such as:&lt;br /&gt;
*WEP2&lt;br /&gt;
*WEP+&lt;br /&gt;
*dynamic WEP which changes the key periodically &lt;br /&gt;
None are substantially more effective.&lt;br /&gt;
=== MAC Address Authentication ===&lt;br /&gt;
A computer trying to connect to the network will be allowed to do so if and only if their MAC address conforms the list of allowed MAC addresses.  This is cumbersome to setup for the administrator as he or she will have to add everyone’s MAC address to the list.  This method does not prevent data from being stolen since there is no encryption.  And even then, an attacker can observe network traffic and obtain valid MAC addresses and then spoof their MAC address to gain access.&lt;br /&gt;
&lt;br /&gt;
=== IPSec ===&lt;br /&gt;
Ip security or IPSec is used to encrypt traffic, reducing or possibly eliminating all plain text information sent across the network.  It is composed of a suite of protocols such as authentication, encrypting IP packets, or cryptographic key establishment as we have read about in Chapter 9 Key Management of the textbook.&lt;br /&gt;
=== WPA ===&lt;br /&gt;
Wi-FI protected access, commonly referred to as WPA, was created by Wi-Fi Alliance and one of the major improvements over WEP is the Temporal Key Integrity Protocol which basically changes the key dynamically as the system is being used.  &lt;br /&gt;
WPA also boasts a more secure message integrity code or MIC with the Michael algorithm. &lt;br /&gt;
Later, they introduced WPA2 which strengthens the security with new algorithms such as CCMP which stands for Counter Mode with Cipher Block Chaining Message Authentication Protocol.&lt;br /&gt;
&lt;br /&gt;
== Legalities ==&lt;br /&gt;
=== Canada ===&lt;br /&gt;
While there are many differences in the laws between one country and another, in Canada the law could be interpreted in such a way that makes piggybacking illegal.  A Toronto lawyer Gil Zvulony commented on CBC’s Spark Radio recently and says that if the police ever showed up because you were piggybacking, the only way you can be charged was if the crown could proof you knew that  you were doing something wrong.&lt;br /&gt;
&lt;br /&gt;
The closest thing someone being charged with piggybacking was where a Toronto man was caught literally with his pants down downloading child pornography using someone's wireless network.  Ultimately, he was charged for the pornography and not the piggybacking.&lt;br /&gt;
&lt;br /&gt;
=== Singapore ===&lt;br /&gt;
&lt;br /&gt;
In Singapore, Garyl Tan Jia Luo became the first man to be convicted of piggybacking on January 16th, 2007 and was sentenced for 18 months probation with 80 hours of community service.&lt;br /&gt;
&lt;br /&gt;
== References ==&lt;br /&gt;
&lt;br /&gt;
== See Also ==&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/File:Mcmaster_poll.jpg</id>
		<title>File:Mcmaster poll.jpg</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/File:Mcmaster_poll.jpg"/>
				<updated>2007-12-01T07:14:07Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/File:Online_poll.jpg</id>
		<title>File:Online poll.jpg</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/File:Online_poll.jpg"/>
				<updated>2007-12-01T07:09:31Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/File:Online_poll.png</id>
		<title>File:Online poll.png</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/File:Online_poll.png"/>
				<updated>2007-12-01T07:06:56Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/Piggybacking</id>
		<title>Piggybacking</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/Piggybacking"/>
				<updated>2007-12-01T04:14:02Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''Piggybacking''' internet access is the practice of gaining network services of someone’s wireless connection without the owner’s explicit permission or knowledge by moving their own computer into range of the broadcasting access point in question.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Background ==&lt;br /&gt;
&lt;br /&gt;
The recent explosive growth of wireless technology found in the market can be attributed to the many benefits wireless telecommunications provide. From the casual Internet surfer to the technological inclined power user, wireless networks provide the convenience of mobility, keeping up with today’s trends in increasing portability and decreasing size of our devices.  Unfortunately, wireless networks also suffer from more attacks and abuse because of how easy it is to locate and connect to wireless networks in comparison to traditional wired ones.  In combination with the lack of strong default security counter measures, the controversial practice of piggybacking has increasingly become more common.&lt;br /&gt;
&lt;br /&gt;
Piggybacking should not be confused with wardriving which involves only the mapping of the insecure access points.  In addition, people connecting to a hotspot service provided by businesses is generally not considered as piggybacking.&lt;br /&gt;
&lt;br /&gt;
== Statistics ==&lt;br /&gt;
=== Online Poll ===&lt;br /&gt;
&lt;br /&gt;
From an online poll taken from lifehacker.com since March 2006, just a little above 60% of voters said they would gladly hop onto someone’s wireless network if they didn’t have access to their own at the moment.  &lt;br /&gt;
A little below 25% of voters said they piggybacking is their main source of internet.  &lt;br /&gt;
Combined that’s 85% of voters admitting to the practice.&lt;br /&gt;
About 7% said they sometimes piggyback but only in an emergency while 8% said their morals would never allow them to do such a thing.&lt;br /&gt;
&lt;br /&gt;
=== McMaster University Poll ===&lt;br /&gt;
&lt;br /&gt;
Just as a comparison, I conducted a small survey sampling our fellow students at McMaster.  I attempted to cover a broad range of students from different faculties so I only asked a few students in this class as I did not want to contaminate the data with biased answers.  About 55% of the students I surveyed admitted to have piggybacked before and 45% said they have not.  Mind you, I was patiently waiting for them to finish filling out the survey so I suspect some may have not been telling the truth in fear of embarrassment.&lt;br /&gt;
&lt;br /&gt;
Of all the student’s surveyed, only about 20% expressed concerned about security issues when using somebody’s wireless network and said they would not send passwords or do any other information sensitive actions.&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/Piggybacking</id>
		<title>Piggybacking</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/Piggybacking"/>
				<updated>2007-11-30T21:51:09Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''Piggybacking''' internet access is the practice of gaining network services of someone’s wireless connection without the owner’s explicit permission or knowledge by moving their own computer into range of the broadcasting access point in question.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Background ==&lt;br /&gt;
&lt;br /&gt;
The recent explosive growth of wireless technology found in the market can be attributed to the many benefits wireless telecommunications provide. From the casual Internet surfer to the technological inclined power user, wireless networks provide the convenience of mobility, keeping up with today’s trends in increasing portability and decreasing size of our devices.  Unfortunately, wireless networks also suffer from more attacks and abuse because of how easy it is to locate and connect to wireless networks in comparison to traditional wired ones.  In combination with the lack of strong default security counter measures, the controversial practice of piggybacking has increasingly become more common.&lt;br /&gt;
&lt;br /&gt;
Piggybacking should not be confused with wardriving which involves only the mapping of the insecure access points.  In addition, people connecting to a hotspot service provided by businesses is generally not considered as piggybacking.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== McMaster University Poll ==&lt;br /&gt;
&lt;br /&gt;
Just as a comparison, I conducted a small survey sampling our fellow students at McMaster.  I attempted to cover a broad range of students from different faculties so I only asked a few students in this class as I did not want to contaminate the data with biased answers.  About 55% of the students I surveyed admitted to have piggybacked before and 45% said they have not.  Mind you, I was patiently waiting for them to finish filling out the survey so I suspect some may have not been telling the truth in fear of embarrassment.&lt;br /&gt;
&lt;br /&gt;
Of all the student’s surveyed, only about 20% expressed concerned about security issues when using somebody’s wireless network and said they would not send passwords or do any other information sensitive actions.&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/Piggybacking</id>
		<title>Piggybacking</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/Piggybacking"/>
				<updated>2007-11-30T21:46:30Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''Piggybacking''' internet access is the practice of gaining network services of someone’s wireless connection without the owner’s explicit permission or knowledge by moving their own computer into range of the broadcasting access point in question.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Background ==&lt;br /&gt;
&lt;br /&gt;
The recent explosive growth of wireless technology found in the market can be attributed to the many benefits wireless telecommunications provide. From the casual Internet surfer to the technological inclined power user, wireless networks provide the convenience of mobility, keeping up with today’s trends in increasing portability and decreasing size of our devices.  Unfortunately, wireless networks also suffer from more attacks and abuse because of how easy it is to locate and connect to wireless networks in comparison to traditional wired ones.  In combination with the lack of strong default security counter measures, the controversial practice of piggybacking has increasingly become more common.&lt;br /&gt;
&lt;br /&gt;
Piggybacking should not be confused with wardriving which involves only the mapping of the insecure access points.  In addition, people connecting to a hotspot service provided by businesses is generally not considered as piggybacking.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Headline text ==&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/Piggybacking</id>
		<title>Piggybacking</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/Piggybacking"/>
				<updated>2007-11-30T21:42:39Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''Piggybacking''' internet access is the practice of gaining network services of someone’s wireless connection without the owner’s explicit permission or knowledge by moving their own computer into range of the broadcasting access point in question.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Headline text ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Headline text ==&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	<entry>
		<id>http://wiki.cas.mcmaster.ca/index.php/Piggybacking</id>
		<title>Piggybacking</title>
		<link rel="alternate" type="text/html" href="http://wiki.cas.mcmaster.ca/index.php/Piggybacking"/>
				<updated>2007-11-30T21:38:27Z</updated>
		
		<summary type="html">&lt;p&gt;Chenc8:&amp;#32;New page:  Piggybacking internet access is the practice of gaining network services of someone’s wireless connection without the owner’s explicit permission or knowledge by moving their own comp...&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;br /&gt;
Piggybacking internet access is the practice of gaining network services of someone’s wireless connection without the owner’s explicit permission or knowledge by moving their own computer into range of the broadcasting access point in question.&lt;/div&gt;</summary>
		<author><name>Chenc8</name></author>	</entry>

	</feed>