Home page logo

Vulnerability Development mailing list archives

RE: Wlan @ bestbuy is cleartext?
From: Ron DuFresne <dufresne () winternet com>
Date: Wed, 1 May 2002 14:25:13 -0500 (CDT)

The legailites I believe bearout like so:

passive scanning does not constitute a criminal trespass under current
law.  Most laws on transmissions relate to voice transactions.  There have
also been issues raised with video war driving/scanning, with devices such
as the X10 and XCam2 devices, wireless video equipment, often marketed as
'nanny-cams' and even used by some small businesses and home folks as
'security' equipment.  I have a paper I'm seeking to publish, just looking
at whom is interested in publishing it, on these issues.

Once one actually makes a network connection, they are then most probably
guilty of tresspass and criminal computer laws infringment.  Of course,
most of those are worded towards the wired environments and we might well
see precedents being set and some legal issues having to be dropped once
statrted due to current laws on the books.  It will depend upon how savvy
and tech capable the defenses are for those first apprehended.


Ron DuFresne

On Wed, 1 May 2002, H C wrote:

Checking into it may be a legality problem.

This concept...the legality of "checking into"
problems...was an interesting thread on another list
for a while.  Some feel that guys like Lamo and what
he did to gain access to NYTimes is not only legal,
but justified.  Others don't feel that way.  I guess
the only real opinion that matters is that of a judge.

For those of you
interested in trying this one out at your local
BestBuy, be aware they may already know...

Already know what?  That their WLAN is insecure.  If
they are already aware of that, and do nothing...does
that then constitute negligence?

Anyway, at this point, I suggest you contact local
law enforcement
and ask them what they think.  By now, I would hope
most areas have a
network tasks forces that can at least address the
issue either for
you or with you when you  confront BestBuy.

"Network tasks forces"?  Are you saying that it's your
opinion that all law enforcement jurisdictions should,
by now, have 'tasks forces' [sic] for dealing with
problems such as these?  That's hardly
realistic...some may, but I certainly wouldn't count
on any arbitrary jurisdiction having the necessary LEO
staff for such things.

From the description of his activities performed, it
doesn't sound as if the OP has done anything wrong.  I
would suggest that he attempt to contact someone at
Best Buy corporate headquarters, and clearly state his
concerns (if it's a letter, run spell check, and have
someone check the grammar, that sort of thing).  Maybe
he can implore BlueBoar for one more favor.  Going to
law enforcement isn't going to yield anything at this
point...has a crime been committed?  So far, it
doesn't sound like it.

I'd suggest first contacting Best Buy, either by phone
or letter.  If phone calls don't work, try a letter.
Document your efforts.  If that doesn't work, take
your documentation to a consumer advocacy group.

Also, I wouldn't doddle on this, you may prevent an
identity theft!

I hope the OP at least stops making credit card
purchases at BestBuy, until the situation is resolved.
 He should suggest that his friends do the same.

Do You Yahoo!?
Yahoo! Health - your guide to health and wellness

"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation." -- Johnny Hart
        ***testing, only testing, and damn good at it too!***

OK, so you're a Ph.D.  Just don't touch anything.

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]