freeze! drop that router!

Oh, how awesome is this?

One of my daily reads is the Live Bookmark feed of the newspaper for my old German home city of Muenster.  One of the latest news items is the tale of a Muenster resident who was recently paid a visit by the Muenster police SEK (their equivalent of a SWAT team).  Apparently, someone had announced a gun rampage intention online, and the cops traced the threats back to the ISP account of the citizen in question.  The Muenster SEK dutifully rolled up in their tactical van, turned the guy’s front door into matchsticks, and proned the fellow out at gunpoint in his living room.

Problem is, he had his WiFi router set to the Open Network setting, without requiring a password for access, and a 27-year-old neighbor was piggybacking on that open connection.  Said neighbor was the culprit in question, so the SEK broke into the wrong guy’s home.

Now the police are denying any sort of legal or financial culpability.  According to the police spokesman, the wrongfully proned-out fellow is no better than someone who “goes on vacation, leaves his doors and windows open, and is then surprised when people commit felonies in his house while he’s gone.”

Now, keeping your WiFi access unsecured is not too smart, especially if you live in an urban area.  You don’t want to let your neighbor, Creepy Steve, piggy-back off your DSL pipe and shovel gigabytes of kiddie porn onto his PC through your connection.  However, as a former IT support guy, I know that the Magic Elf Box is a container of riddles wrapped into enigmas to a lot of people, and I’m pretty sure that the majority of folks who pick up a WiFi router at ChumpUSA just fire it up and leave all the settings at their default stage, because they don’t have a clue how to change them.

I think this calls for a new warning label on the WiFi router boxes: “Failure to secure your wireless network may result in your door getting stomped in by the local fuzz.”

12 thoughts on “freeze! drop that router!

  1. T.Stahl says:

    Prime example why I have a cable running from that black box near the phone, behind the Billy shelf, over the doorframe, behind another shelf, and then into this other box.

    Ok, I admit. It’s only because I got no clue how to set up a wireless LAN. What’s English for DAU?

  2. Anonymoose says:

    Leaving your front door open is stupid.

    It doesn’t make someone an un-thief if they take your things.

  3. BryanP says:

    I’m pretty sure that the majority of folks who pick up a WiFi router at ChumpUSA just fire it up and leave all the settings at their default stage,

    That’s becoming less and less so. I live in a little town just outside of Nashville, TN. When I first fired up wireless I noticed two other WAPs in range, both unsecured. Over the past few years the number has jumped to over a dozen wireless networks within detection range of my house. Only one is unsecured.

  4. Dave says:

    I don’t know about in Germany, but in the US, s/door/kitten/

  5. Unix-Jedi says:

    It gets even stupider when you consider that hacking wireless isn’t all that hard – the encryptions that the cheap routers support can be cracked by any decently new machine without all that much trouble.

    Which means that use of your “protected wireless” means you’re *in on the crime*.

    It’s a damn if you do, damn if you don’t situation – the better way is to leave it on the default, since attempting – and failing – to encrypt/protect is more problematic and fraught with more legal risk (IANAL, and this is based on US law anyway) than just running it out of the box.

  6. theflatwhite says:

    @Unix-Jedi
    Home wireless networks can and should be MAC address restricted.

  7. Tony says:

    MAC addresses can be spoofed. Not a bomb-proof method of restricting access.

  8. theflatwhite says:

    Sure sure, of course.

    But that along with the (albeit weak) encryption provided in most home wireless routers should be enough to prevent your average neighborly pervert from using your network.

    Me? I still prefer running Ethernet cable through the crawl space….

  9. Sigivald says:

    Don’t most home routers do non-weak WPA these days?

    (Though, really, even WEP will be sufficient to stop a casual connection-“borrower”.

    Sure, any PC can crack the key (or spoof a MAC, if it’s unlocked but MAC restricted). But 99.9% of people don’t know that, wouldn’t know where to get or use the tools, etc. They’re just looking for any open network, even if they’re being illicit.

    The real black-hats aren’t going to try and attack WPA to get internet connectivity… so it’s plenty good enough for any likely threat. Someone who wants your data that bad can just break into your house.)

  10. Unix-Jedi says:

    “Sure, any PC can crack the key (or spoof a MAC, if it’s unlocked but MAC restricted). ”

    Then from a security standpoint (and the point of this story), you’re just wasting your time.

    If you cannot secure the connection, then you’re liable for being held responsible for those using the connection – and since there’s no real way to secure wireless without going above and beyond what the “home” wireless routers have available, there’s not a definate benefit there at all.

    “But 99.9% of people don’t know that, wouldn’t know where to get or use the tools, etc. ”

    Which would also be the 99.9% you’re suggesting would have no problem *securing* the network. I suggest to you that you’ve got a conflict in your viewpoint.

    Additionally, my experience would show that it’s well above 20-30% of the population with computers, and of those attempting to hide their illicit activities it’s approaching unity.

  11. Unix-Jedi says:

    “Sure sure, of course.”

    theflatwhite, and Sigivald, I really don’t mean this in an insulting manner, but did you read the original story?

    The issue isn’t really about encryption, it’s about someone being charged due to someone else using their equipment without their knowledge.

    “But that along with the (albeit weak) encryption provided in most home wireless routers should be enough to prevent your average neighborly pervert from using your network.”

    Not if they’re out to hide their tracks and can use Google.

    But this is the reason I ask you that: You both have said “Well, they should have done X” and *then immediately* admitted that few are smart enough to do it, or that it’s easily defeated.

    If it’s security theater and of marginal utility, why bother? Would that have saved the subject of this post being proned out if he’d enabled encryption and the accused person had cracked it?

    Or would it suggest to authorities looking to cover their own butt that there was likely collusion between the two? That was my point – that wasting your time with marginal, easily defeated security was worse than no security at all.

  12. Bob Jones says:

    To me it sounds like the police are blaming the victim. Is “goes on vacation, leaves his doors and windows open, and is then surprised when people commit felonies in his house while he’s gone” really that far a step from asking “what was she wearing” when you hear about a rape?

Comments are closed.