Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Wireless Piggybackers Put on Notice

New California law encourages users to lock up WLANs, setting the stage for criminal action against hackers and piggybackers

We've all done it: You're using your laptop in a location without hotspot access. You want onto the Internet, so you start scanning for open wireless LANs. You find one and, regardless of who owns it, you piggyback a ride onto the Web.

Yesterday, the California legislature passed a law (AB 2415) that takes the first steps toward outlawing wireless network piggybacking, as well as hacking into wireless LANs. The bill, which was written by Speaker Fabian Nunez (D-Los Angeles), has been submitted to Gov. Schwarzenegger and is expected to be signed. It will go into effect in Jan. and will apply to devices manufactured after Oct. 1, 2007.

The law will require all manufacturers of wireless access products to put warning labels on their products that remind users to password-protect their WLANs before launching them. The warnings could take place as stickers on wireless routers, notes during installation, or an alert that requires buyers to take action before the device is used.

The new legislation stops short of outlawing wireless piggybacking or hacking, but it points out that a password-protected WLAN is protected under state and federal laws against unauthorized access of computers.

"There is disagreement as to whether it is legal for someone to use another person's WiFi connection to browse the Internet if the owner of the WiFi connection has not put a password on it," the proposed legislation observes. However, both Section 502 of the Calif. penal code and the Federal Computer Fraud and Abuse Act "prohibit the intentional access to a computer without authorization."

In a nutshell, then, the law requires manufacturers to warn WLAN users of the potential for abuse, and to clearly explain to users how to password-protect them. If users take the requisite security steps, and if piggybackers or hackers then break into the WLAN, the interlopers could be subject to criminal prosecution.

The legislation quotes a December 2005 study from the National Cyber Security Alliance, which states that 26 percent of homes have a wireless network, but about 47 percent of those homes failed to encrypt their connection, "a safety precaution needed to protect wireless networks from outside intruders."

Manufacturers will get a lot of leeway in how they present the warnings, which might be anything from stickers plugged into wireless router ports to tags that would have to be read and removed before a wireless access point could be activated. Manufacturers are given an option to put the warning in their configuration software as well.

— Tim Wilson, Site Editor, Dark Reading

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Firms Improve Threat Detection but Face Increasingly Disruptive Attacks
Robert Lemos, Contributing Writer,  2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8813
PUBLISHED: 2020-02-22
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.
CVE-2020-9039
PUBLISHED: 2020-02-22
Couchbase Server 4.x and 5.x before 6.0.0 has Insecure Permissions for the projector and indexer REST endpoints (they allow unauthenticated access).
CVE-2020-8860
PUBLISHED: 2020-02-22
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung Galaxy S10 Firmware G973FXXS3ASJA, O(8.x), P(9.0), Q(10.0) devices with Exynos chipsets. User interaction is required to exploit this vulnerability in that the target must answer a phone call. T...
CVE-2020-8861
PUBLISHED: 2020-02-22
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-1330 1.10B01 BETA Wi-Fi range extenders. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue ...
CVE-2020-8862
PUBLISHED: 2020-02-22
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC067 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. The issue results from the ...