Wardriving

1
Wardriving

• By Joaquin Avellan

2
Definition of Wardriving

• Wardriving is an activity consisting of driving
  around with a Wi-Fi-equipped laptop or a PDA in
  one's vehicle, detecting Wi-Fi wireless networks.
  (from Wikipedia)
• The term was first coined by Peter Shipely from
  Berkeley,CA in 1999. He was the first to automate
  the process with dedicated software and GPS.
• A simpler definition would be
  Driving around looking for wireless networks.

3
How does Wardriving work?

• Show 5 minute Fox 25 Boston report in February,
  2003.

4
Stefan Puffer 2002

• Puffer had demonstrated how insecure the countys
  wireless networks were to a county official and a
  Houston reporter .
• Puffer, who was briefly employed by the countys
  IT Office, was indicted on two accounts of fraud
  by the Harris County district. Prosecutors
  claimed he had caused 5,000 worth of damages by
  the intrusion.
• Puffer was acquitted of all charges. The Jury
  unanimously agreed he had no harmful intent.

5
Stefan Puffer 2002

• Did the county have the right to prosecute
  Puffer?
• Was Puffer right in exposing the countys
  wireless network? After the report the county
  eventually shutdown the wireless network which
  cost the taxpayers in the end.

6
Nicholas Tombros 2003

• Tombros admitted to using unsecured wireless
  networks to distribute pornographic spam in
  Venice, CA.
• He faces up to 3yrs in prison and was indicted
  under the CAN-SPAM act.
• Unsecured residential wireless networks are not
  held liable under federal law.
• However in New Hampshire bill HB495 is in process
  of being passed which would hold operators of
  wireless networks liable if unsecured.
  Furthermore, if an alleged intruder can prove the
  network was intended to be open he would be
  innocent.

7
Are criminals solely to blame?

• As broadband and wireless networks proliferate
  should operators of unsecured networks be held
  liable?

8
Toronto, Canada 2003

• Police stopped a car for a traffic infraction and
  find a naked man viewing a child pornography
  video in Toronto.
• The man was using an unsecured residential
  wireless network and was charged with the
  creation and distribution of child pornography.
• Police almost filed charges against the resident
  since they felt they were negligent in setting
  up security.

9
Child Pornography Cyber Terrorism

• Are unsecured networks havens for child
  pornography?
• Are they havens for cyber terrorism? Could
  terrorists use unsecured wireless networks to
  bring down larger ones using DDOS attacks?

10
Salcedo Botbyl 2004

• Two 21yr old men discover a unsecured wireless
  network at a Lowes store while wardriving. Later
  they hack into the network and steal credit card
  numbers (6 numbers were stolen in the end).
• They get caught soon after by the FBI and decided
  it would be best to cooperate with authorities
  and create a better security system at Lowes.
• Salcedo is given 9 yrs in prison and Botbyl 2yrs
  plus 2yrs supervised release. Prosecutors say the
  damage could have been 2.5 million hence the
  harsh prison term.

11
Salcedo Botbyl 2004

• Should the penalties for wireless crimes be more
  harsh than others? This is the case for Salcedo
  Botbyl.
• In 2001 a 21yr old hacked into NASA to store his
  downloaded movies, he was caught and received 6
  months in prison. The intrusion caused systems to
  crash and took technicians hours to fix. Total
  damages were about 200,000.

12
Myron Tereshchuk 2004

• Tereshchuk pleaded guilty to extortion after
  demanding 17 million from a patent company in
  exchange for not broadcasting patent information
  he stole using unsecured wireless networks.
• Tereshchuk used 3 different unsecured networks to
  accomplish his goal and made tracking him down
  very tough.
• In the end, Tereshchuk was caught after much
  surveillance and his sentence is to be determined.

13
The FBIs point of view

• From a letter in 2002 Identifying the presence
  of a wireless network may not be a criminal
  violation, however, there may be criminal
  violations if the network is actually accessed
  including theft of services, interception of
  communications, misuse of computing resources, up
  to and including violations of the Federal
  Computer Fraud and Abuse Statute, Theft of Trade
  Secrets, and other federal violations.

14
Hacking Wireless Networks

• Show 5 min video on hacking encrypted wireless
  networks.