A Word About Network Security

My previous post about an unknown neighbour with an unencrypted wireless network has provoked some negative comments. People have said I was “stupid” for calling the neighbour an idiot for leaving a network unencrypted. They reasoned that this neighbour might have been very generous, and intentionally left his network open so people could connect and use it.

JamesM said:

Being a generous sole he has decided to setup an open wireless router so others may use the service too.

…

Calling some one an idiot for being generous shows how small minded and stupid you are. Happy to much of others but too intellectually tight fisted to return the favor.

The work of a small and selfish mind. Maybe next time you will see an open network and think, hay, what if the world were like this? What if I shared my connection and encouraged others to do the same?

Hittman said:

It’s always dangerous to assume you know someone else’s motivation. My first thought, reading this post, was that he decided to be generous. And you decided to insult him for it. YOUR ridiculous beliefs, about him, are based on nothing but assumption.

At this point I should make it clear that I never even mentioned or “assumed” anything about the motivation of my neighbour in the article. I assumed nothing, my commentators assumed he was generous. Now lets look at the facts.

My neighbour has an insecure wireless network, open to anyone in range. Whether he is generous or not, it is still open to attack by anyone. It is also open to data theft and a host of other crimes. There is no reason to leave a network open to attack like this.

First, let’s assume my neighbour is generous and has purposefully let the network remain unencrypted. The network is accessible to perhaps 3 or 4 houses judging by the relative positions of the houses and the strengths of the signal. There are two ways you could share this network:

Leave it unencrypted so that anyone can access it.
Encrypt it, and inform the 3-4 houses that you have a wireless network which they are free to use.

My neighbour chose option 1, the most dangerous. It leaves data unencrypted meaning anyone can simply park outside a house and eavesdrop on data going to and from the router.

If they had chosen the second option, given a good wireless encryption (WPA2 for example) then this wouldn’t happen. Everyone who had they key would be able to connect, and everyone would be safe.

It doesn’t take a genius to see which method is more preferable.

This relates back to last year, when I was in university halls. I was living in a flat with 7 other people, but the flat was in a block that contained perhaps 7 other flats. Each room had a wired network, but frequently we would take our laptops to the kitchen. I had installed a wireless router in my bedroom to enable myself to connect to the internet in the kitchen. My flatmates asked if they could also connect, and since I trusted them all, I gave them the encryption key.

If I had not encrypted the network, an estimated 50-60 people could have hypothetically accessed it. Not only would this have slowed the network down, but it would have left a massive amount of information open to attack.

So, I reinforce what I have said before:

A person who leaves their wireless network unencrypted (for any reason) is a fool.

It takes no less effort to encrypt it and share it than it does to leave it open and vulnerable.

In the interests of fairness and fair investigation, once we have a proper network set up for ourselves, I will locate the house where the mystery network is coming from. I will then proceed to talk to the owner, tell them about their insecure network, and how important network security is. They may turn round and thank me for alerting them, they may say they were being generous. Either way, I will make my case for network security and hopefully save them a heap of trouble.

Possibly Related Posts:

Subscribe to my RSS Feed if you like what you read! - View blog reactions

Written by Adrian Hayter

July 28th, 2008 at 6:06 pm

Posted in general

Tagged with home, house, internet, network, security, wireless

0 Blogs linking to this article »

Comments to “A Word About Network Security”

RNB Says:
July 28th, 2008 at 8:55 pm (GMT)

I think you are being a bit harsh. Not on the idiots who can go to school for 12 years and still think that invisible skydaddy gave unique revelation to an illiterate dropout, but on those who have an unsecured wireless network.

I only say that from personal experience. Possibly due to a cheap router or poor positioning or excessive haste in setup, initially we had a lot of trouble getting a wireless network up and running at home. So when eventually it did, I left it untouched for a while. Unsecure, but my laptop still only saw one or two other very weak other signals, and I feared messing with the configuration in case I messed up my own connection, which incidentally didn’t seem affected by neighbours. Eventually (much later) I have got round to adding encryption, but on this PC at least it was not as easy and intuitive as you imply.

Chris Says:
July 28th, 2008 at 9:00 pm (GMT)

If all computers connected to the network are secure, there shouldn’t be a problem, really. I mean, if there’s no breach of a firewall that you’re relying on, there’s an issue, but that shouldn’t happen if your individual computers have their security up to date. I don’t see the problem just offering a free internet connection to people. The worst-case scenario is that someone sits outside your place in their car and downloads a bunch of illegal stuff. Which they’re probably more likely to do at coffee shops or one of the other million places advertising free wireless.

Your same logic would really apply to all WEP encryption users as well - since anyone with the know-how to watch traffic on a line and pick out important data more than likely has the ability to crack WEP easily enough.

Also, banking sites and any sites that require important information are SSL encrypted regardless, so it’s not exactly the easiest endeavor (and not worth a criminal’s time, at today’s rate) to try and crack your SSL connection just so he could get your CC number or other important info.

In my opinion, it’s just not a big deal for your home network, and you’re better off spending your time securing your individual computers.

Adrian Hayter Says:
July 28th, 2008 at 9:04 pm (GMT)

RNB,

I understand where you are coming from, but I’m doing a degree in Computer Science with Information Security. I know how easy it is these days to set up an encryption on a wireless network (every Wi-Fi Certified device now has to have WPA2)

This is an age that is increasingly dependent on digital information. Insecure networks are akin to wearing a T-Shirt with your bank details, passwords, credit card numbers etc, on it.

Trust me when I say that encrypting wireless networks is very easy. If you don’t know how to do it there will be tutorials online, or you can easily hire someone to set it up for you.

Oliver Says:
July 28th, 2008 at 11:12 pm (GMT)

Bruce Schneier, author of Applied Cryptography and security expert, has this to say on open networks:
http://www.wired.com/politics/security/commentary/securitymatters/2008/01/securitymatters_0110?re

Maybe you’ve already read that report, and I can still think of reasons why I might need an open network. When I set up network for clients, I do try to encourage some form of encryption.

Dan Says:
July 31st, 2008 at 4:52 pm (GMT)

I’m on Adrian’s side here. If you have an unsecured wireless network, anyone at all can sit outside your house with a laptop and use your connection. If they use that connection to download illegal porn, the police are going to come knocking on your door with a warrant. The traffic has gone through your IP address, so you’re the prime suspect.

And just saying “it wasn’t me, officer, there must be some mistake” isn’t going to stop them taking away your computers/cameras/camcorders/photo albums etc for analysis. Fair enough, they won’t find anything untoward on your computers (at least you hope they won’t find anything), but you’ll still have to explain to the wife and kids where the computers have gone.

Of course porn is only one example - your wide open bandwidth could just as easily be used to plot a terrorist attack.

You may say this is a worst case scenario, but if someone’s up to no good, you can bet they won’t think twice about stealing someone else’s bandwidth to cover their tracks.

If Adrian’s neighbour is actually being generous with his bandwidth, do you think he’ll be just as generous with his car? I wonder if he leaves that unlocked, or if he minds someone taking it and driving a couple of hundred miles (even if that person does bring the car back afterwards, it’s still got an extra 200 miles on the clock, and half a tank of fuel missing)

Sorry, but if you leave your wireless unencrypted, it’s the same as leaving your house or car unlocked, in my opinion, and you deserve whatever you get.