A Hacker's Story: Let me tell you just how easily I can steal your personal data | Hacker News Reader

A Hacker's Story: Let me tell you just how easily I can steal your personal data

techvibes.com

50 pointsthomasyale32 comments

Someone is eventually going to go to prison after stupidly uploading evidence of themselves wiretapping a wireless network they don't own.

There's also an interesting double standard here: would it be quite so acceptable to casually listen in on people's GSM calls or wireless house phone calls?

Is that actually also legal to wiretap networks that they own? What about the classic method of setting "Free WiFi" using simple tools and a 3G phone? Does that make it "legal" to wiretap in US, at least?

Does there exist legal precedent for this? It would seem hard to argue for expectation of privacy on an unsecured wireless network on a protocol without TLS.

Why is that so?

A landline phone is also trivial to tap into. Should you not expect some degree of privacy on the phone?

Phones, like mail, are a special case in a whole bunch of ways, legally, is my (Not A Lawyer) understanding. Using them as a basis for comparison is probably not going to reveal a lot.

Well we were talking about expectations here, were we not? I certainly expect my IM, email, VoIP and other forms of communication to be no less private than phone or post. So does, I believe, nearly everyone else. Just because one stumbles (stumble is not the right word though for what article described - the malicious intent was clear) into an unsecured segment does not make it right to eavesdrop.

Do you not picture a distinction between a landline (non-cordless) phone and wireless internet?

By 'trivial' to tap into, you mean I'd have to physically cut your line somewhere and attach a listening device, right? It seems very reasonable to expect privacy on a physical point to point wire.

With Wifi, if you're my neighbor, I need to sit at home with my computer and your photons come straight to my antenna. It's like you're giving them to me. I don't see the similarities.

If one looks at historic FCC regulation, it was always okay to listen to communications, but not to divulge the contents to 3rd parties. Even with just those older regulations, using data "heard" would be prohibited since that would involve transfer to others. I believe strong protections similar to wiretap laws were added for cell service, but unlicensed gear that has no protection from interference generally doesn't have any. For example in spite of an expectation of privacy, cordless phones are unprotected. Anyway, while there may be room to argue over access to certain communications being permissible, it's clear that one is prohibited from using anything heard (obviously including passwords, credit card info etc.)

The FCC rules for WiFi devices basically state that they must not cause any harmful interference and must accept any interference that occurs including that which may cause undesired operation. Read the manual that comes with any WiFi device and the text of that will be in there (the FCC rules require it to be).

Might be this guy, trespassing in the building is a lot different than accessing an open network from a public place.

Actually you can enter a building. If they tell you to leave and you don't THAT is when you can be charged.

Door to Door salesmen "trespass' every single day.

Well, no police have shown up yet. I'm hoping for the best.

Also, the FCC isn't charging Google for what they did. So I assume I'm fine.

So, what exactly is the point of this article? "If you're on an insecure network, people can steal your data." ?? Not such a big surprise...

I look forward to his next article, expanding more on the theme of "look at how easily I can get into a building by using the open door."

To you, maybe not. But to the general population it is.

Remember the huge fuss that came about when people found out Google was getting the same data with their streetview cars... Tis why I started the article with that.

Not to people who read HN, certainly, but just judging from behavior, it's something that's totally lost on a lot of people (even people who ought to know better). There's a weird assumption of nonexistent privacy when people use their computers; a fair number of users seem not to grasp that using the Internet at Starbucks (or at a hotel, or in an airport) is very different and much less secure than using it at home.

Trespassing into an apartment building seemed a bit gratuitous and creepy, though, and might distract from the lesson (by making people think they can really improve their security by being on the lookout for nerds tailgating them in the door). I think the point could have been made just as well by sitting in a coffee shop, or checking into a hotel with free Internet access for an evening.

should be renamed 'A Script Kiddie's Story'

Wow, had no idea the article would become so popular.

I wrote the article and would just like to make a few points.

I am NOT a hacker. I don't claim to be. I'm just a geek that's curious about network security. They called it "A hacker story" because this is what hacking is to the general populace.

I understand that REAL hacking is completely different.

The point of the article is this:

It's REALLY easy for even a non-hacker to get all this information. I'm not saying to stop using open netqworks, just be careful what you do on them. That's all.

Thanks everyone for reading it.

>Also, don't browse hardcore porn on a public network.

OMG people will know someone likes porn!! People do FAP. Get over it.

I'm sorry but looking at packets on an unsecured network is in no way "hacking". Even cracking a WPA network and using a MITM attack is trivial with all the tools and tutorials available.

What is your point? The fact that it is trivial was the point of the article.

Reports of the death of wired Ethernet are greatly exaggerated.

physical intrusion? lame.. get a parabolic or yagi antenna

Let me tell you an even easier way hack - download Firesheep

My first reaction is just like that as well. Sorry for the author of that post.

Firesheep is just an automated GUI for what we've been doing all along. Ettercap, wireshark, etc are far more flexible and can be used to execute a wider variety of attacks. Firesheep, for example, won't ARP poison on a wired network.

Wireshark won't ARP poison either, afaik.

, etc

I mean, I even explicitly mentioned Ettercap, which does ARP spoof. Is there a way I could have made that clearer?

Maybe it was just late and I was too tired for it to make sense. Sorry.

Try Cain Able, its it probably the best ARP spoofing tool around for pc.

You don't need to ARP spoof on an open wireless network.

But Cain is in my standard pentest toolset for various reasons, not just ARP spoofing.

You don't need to ARP spoof on an open wireless network.

Right... which is why he didn't mention wireless networks...

That's like saying, yes SQL injection is powerful, but it doesn't work on CSRF vulnerabilities -- complete non sequitur.

I am on a unix platform, why should I use Cain Able?

Reply on news.ycombinator.com