Go Back   Wireless and Wifi Forums > News > Newsgroups > alt.internet.wireless
Register FAQ Forum Rules Members List Calendar Search Today's Posts Advertise Mark Forums Read

 
Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 07-17-2011, 02:27 PM
arkland
Guest
 
Posts: n/a
Default Packet sniffing wi-Fi-hacking neighbor (

I read with interest this CNN article (http://tinyurl.com/62o9s4x) titled:
"Wi-Fi-hacking neighbor sentenced to 18 years".
http://www.cnn.com/2011/TECH/web/07/13/
wifi.hacking.neighbor.sentenced.wired/

Can someone further explain this sentence in that article?

"With Kostolnik's permission, they installed a packet sniffer on his
network to try and get to the bottom of the incidents ... A forensics
computer investigator working for Kostolnik's law firm examined the
packet logs... In the data surrounding the threatening traffic, they
found traffic containing Ardolf's name and Comcast account .

Two fundamental questions:

1. What packet sniffer would I install (Ubuntu & WRT54G) if I were to
look for snooping neighbors ... and .. .
2. Why would a connection to the neighbor's router also leave the
perpetrator's actual name and comcast account information?

Thanks for any advice as this both scares and intrigues me.

Reply With Quote
  #2 (permalink)  
Old 07-17-2011, 03:36 PM
Rich Johnson
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

On 7/17/2011 7:27 AM, arkland wrote:
> I read with interest this CNN article (http://tinyurl.com/62o9s4x) titled:
> "Wi-Fi-hacking neighbor sentenced to 18 years".
> http://www.cnn.com/2011/TECH/web/07/13/
> wifi.hacking.neighbor.sentenced.wired/
>
> Can someone further explain this sentence in that article?
>
> "With Kostolnik's permission, they installed a packet sniffer on his
> network to try and get to the bottom of the incidents ... A forensics
> computer investigator working for Kostolnik's law firm examined the
> packet logs... In the data surrounding the threatening traffic, they
> found traffic containing Ardolf's name and Comcast account .
>
> Two fundamental questions:
>
> 1. What packet sniffer would I install (Ubuntu& WRT54G) if I were to
> look for snooping neighbors ... and .. .
> 2. Why would a connection to the neighbor's router also leave the
> perpetrator's actual name and comcast account information?
>
> Thanks for any advice as this both scares and intrigues me.

The hacker, thinking he was undetectable/undetectable probably logged
into his own email at Comcast at one point. Also, unless he was
spoofing his MAC address they had that as well. A packet sniffer of any
sort would work, placed in between the router and the VDSL modem, along
with a hub.



Reply With Quote
  #3 (permalink)  
Old 07-18-2011, 03:10 AM
Jeff Liebermann
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

On Sun, 17 Jul 2011 14:27:15 +0000 (UTC), arkland <arkland@gmail.com>
wrote:

>A forensics
>computer investigator working for Kostolnik's law firm examined the
>packet logs... In the data surrounding the threatening traffic, they
>found traffic containing Ardolf's name and Comcast account .


Packet logs is not exactly the correct term. Syslog would be more
exact. It's *NOT* a packet sniffer. It merely shows connection
source, destination, time, and maybe some other stuff. There's also
no need for a local syslog server (data collector), since it can be
sent over the internet, but in this case, I guess an "invisible" local
logger would be useful. Something like this:
<http://www.kiwisyslog.com/kiwi-syslog-server-overview/>
<http://www.syslog.org/logged/windows-syslog/>
Linux and OS/X can play syslog server out of the box.
Many routers have built in syslog and proprietary versions built in.
Similar information could also be obtained via SNMP.

I don't think they used something like Wireshark to capture packets
for later analysis because it seems that they were monitoring for at
least several weeks. The amount of data that would need to be
collected and analyzed would be monumental.

>Two fundamental questions:
>
>1. What packet sniffer would I install (Ubuntu & WRT54G) if I were to
>look for snooping neighbors ... and .. .


Start with arpwatch, which will detect if any new MAC addresses appear
on the network. Then, search for "Linux intrusion detection system"
which offers many applications such as:
<http://www.lids.org/lids-faq/lids-faq.html>

There's also Airsnare for Windoze:
<http://home.comcast.net/~jay.deboer/airsnare/>

If your WRT54G is running one of the alternative firmware packages
(DD-WRT, OpenWRT, Tomato, etc), you could run the IDS on the router.
Arpwatch certainly will run after some installation problems. Hint:
ipkg -force-depends install arpwatch

>2. Why would a connection to the neighbor's router also leave the
>perpetrator's actual name and comcast account information?


It didn't. They were probably also sniffing the traffic on the WAN
side of the router specifically looking for email headers. Once those
were collected, the header would have the comcast email address. It's
fairly trivial to sniff for email headers (and other common file
formats) but I don't want to post any specific methods.
Hint: You can do it with sed or awk/nawk.

>Thanks for any advice as this both scares and intrigues me.


Only the paranoid survive.

--
Jeff Liebermann jeffl@cruzio.com
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558

Reply With Quote
  #4 (permalink)  
Old 07-18-2011, 06:01 PM
alexd
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

Meanwhile, at the alt.internet.wireless Job Justification Hearings, eppie
chose the tried and tested strategy of:

> Wouldn't a sniffer on the victims computer do the same thing?


Only if the "hacking" was being done on the victims computer.

--
<http://ale.cx/> (AIM:troffasky) (UnSoEsNpEaTm@ale.cx)
18:56:41 up 26 days, 20:39, 6 users, load average: 0.42, 0.26, 0.34
"People believe any quote they read on the internet
if it fits their preconceived notions." - Martin Luther King


Reply With Quote
  #5 (permalink)  
Old 07-18-2011, 08:02 PM
Rich Johnson
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

On 7/17/2011 7:28 PM, eppie wrote:
> Rich Johnson<richj@remove.this.tairedd.com> wrote in
> news:ivuvjj02sq2@news6.newsguy.com:
>
>> On 7/17/2011 7:27 AM, arkland wrote:
>>> I read with interest this CNN article
>>> (http://tinyurl.com/62o9s4x) titled: "Wi-Fi-hacking
>>> neighbor sentenced to 18 years".
>>> http://www.cnn.com/2011/TECH/web/07/13/
>>> wifi.hacking.neighbor.sentenced.wired/
>>>
>>> Can someone further explain this sentence in that article?
>>>
>>> "With Kostolnik's permission, they installed a packet
>>> sniffer on his network to try and get to the bottom of the
>>> incidents ... A forensics computer investigator working
>>> for Kostolnik's law firm examined the packet logs... In
>>> the data surrounding the threatening traffic, they found
>>> traffic containing Ardolf's name and Comcast account .
>>>
>>> Two fundamental questions:
>>>
>>> 1. What packet sniffer would I install (Ubuntu& WRT54G)
>>> if I were to look for snooping neighbors ... and .. .
>>> 2. Why would a connection to the neighbor's router also
>>> leave the perpetrator's actual name and comcast account
>>> information?
>>>
>>> Thanks for any advice as this both scares and intrigues
>>> me.

>> The hacker, thinking he was undetectable/undetectable
>> probably logged into his own email at Comcast at one point.
>> Also, unless he was spoofing his MAC address they had that
>> as well. A packet sniffer of any sort would work, placed
>> in between the router and the VDSL modem, along with a hub.
>>

>
> Not sure what you mean? You talking about a separate computer
> with sniffer program connected between the router and modem?
> Or what? Wouldn't a sniffer on the victims computer do the
> same thing?

No, it would not. Routers and Switches only put packets to the port (on
the router) that goes to a specific machine. If you put it on the
victims machine, and the hacker is talking to an Internet account, the
victims machine would never see it. (I am talking on a mixed wired and
wireless system, which most are.) Of course in a fully wireless system,
you would see everything. The only way to see everything that
transpires that goes to the Internet, the hub and sniffer on the WAN
side of the router (to the modem) would be the best way to check the
Internet traffic.


Reply With Quote
  #6 (permalink)  
Old 07-18-2011, 08:25 PM
Jeff Liebermann
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

On Mon, 18 Jul 2011 19:34:08 +0000 (UTC), weedbyanyothername
<weedbyanyothername@nowhere.com> wrote:

>Please explain for us dummies:
>
>> "There's also no need for a local syslog
>> server (data collector), since it can be sent over the
>> internet, but in this case, I guess an "invisible" local
>> logger would be useful"


Syslog is a standard method of generating ummm... log files commonly
found on Unix, Mac, and Linux servers.
<http://www.sawmill.net/log_formats.html>
The Syslog daemon (program) that does the work has a config file that
points to a specific Syslog server, which collects the data. The
syslog server could be the local machine (127.0.0.1), a machine on the
local network (192.168.xxx.xxx) or any machine reachable on the
internet.

In this case, if the router had the ability to generate syslog logs,
then simply turning it on, and pointing it to suitable data collector
would be sufficient. However, there's a chance that the perpetrator
might notice this change, so I guess a sniffer would be more
appropriate than syslog.

Light reading:
<http://www.linuxjournal.com/article/5476>
<http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch05_:_Troubleshooting_Linux_with_sy slog>

>How is this done remotely


By pointing configuring syslog.conf to point to an IP address. If you
have a Mac, look at /etc/syslog.conf

>and how do they separate out the
>data for the victim's putah from all other net data? Just not
>sure what you mean by the above?


Filters. syslog.conf has various filters to keep the logging level
sane. Here's an example of some syslog output. Note the line with
the sample email message:
<http://userpages.umbc.edu/~jack/ifsm498d/syslog.html#examples>

There are also numerous syslog report generators and analyzers, that
look for security breaches and generate reports. (There's nothing
more dull and boring than reading log files).

>> Start with arpwatch, which will detect if any new MAC
>> addresses appear on the network. Then, search for "Linux
>> intrusion detection system" which offers many applications
>> such as: <http://www.lids.org/lids-faq/lids-faq.html>

>
>Of course if his MAC address is spoofed and keeps changing
>that will do no good?


Please note the word "detect". Arpwatch will detect if there are any
new machines on the network. Once a new machine has been detected,
other tools are used to block or identify the hacker.

>The op said that they found headers "surrounding" the
>threatening messages. How can they definitively tell that that
>was the same source as the email headers?


No clue. I have no idea what "surrounding" means in an email header.
My guess(tm) would be that the Comcast machine name was somewhere in
the email header chain.


--
Jeff Liebermann jeffl@cruzio.com
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558

Reply With Quote
  #7 (permalink)  
Old 07-19-2011, 05:19 AM
SF Man
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

On Mon, 18 Jul 2011 13:25:34 -0700, Jeff Liebermann wrote:

> No clue. I have no idea what "surrounding" means in an email header.
> My guess(tm) would be that the Comcast machine name was somewhere in
> the email header chain.


http://www.networkworld.com/news/201...wifi-hack.html
This article says "The packet logs finally bore fruit. A forensics computer
investigator found the e-mail sessions sending the threats and in the
associated packet information discovered Ardolf's name and his Comcast
account."

Reply With Quote
  #8 (permalink)  
Old 07-19-2011, 05:32 AM
SF Man
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

On Sun, 17 Jul 2011 20:10:15 -0700, Jeff Liebermann wrote:

> Only the paranoid survive.


What could the Kostolnik's have done to PREVENT access to all their
computers?

Here is the sentencing memo with more detail:
http://www.wired.com/images_blogs/th...encingmemo.pdf

UNITED STATES DISTRICT COURT DISTRICT OF MINNESOTA Criminal No. 10-159
(DWF/FLN)
.... (indicates lots of stuff deleted to fit posting size limits) ...

In or about February 2009, Ardolf illegally gained access to the
Kostolniks・ wireless router. To do so, he circumvented the router・s
encryption by using password-cracking software called :aircrack.; It took
Ardolf at least two weeks to complete the hack, first identifying the
Kostolniks・ router out of the many in the neighborhood and then launching a
series of attacks on the router designed to break its encryption password.
With access to the Kostolniks・ router, Ardolf was able to communicate with
the Internet through the router, using the Kostolniks・ Qwest Internet
account, in a way that the communications would trace back to the
Kostolniks. Ardolf was also able to access all of the Kostolniks・ computers
that were connected to the router. This was part of Ardolf・s scheme to
destroy Matt Kostolnik both personally and professionally.

.... From an analysis of the router・s
logs, the investigator concluded that a device unknown to the Kostolniks
had connected to the router. ...

To attempt to determine the source of any future unauthorized use of the
router, the Kostolniks agreed to allow the investigator to connect a
:packet capturing; device to their router, which would keep a record of all
data (transmitted in units called :packets;) that passed through the
router.

G. April and May 2009 Email Threats to the Vice President

In April 2009, the Secret Service visited Matt Kostolnik at his workplace
after an email containing a death threat was sent on April 1, 2009 to the
Vice President of the United States from a yahoo.com email address in the
name of both Matt and Bethany Kostolnik
(:matt_bethany_kostolnik_2009@yahoo.com;). ...

The subject line of the email read: :This is a terrorist threat! ....

After the May 6, 2009 email was sent to the Vice President and other public
officials, investigator Johnson reviewed the :packet capture; data from
around the time the email was sent. Searching through the activity
surrounding the day the threat email was sent to the Vice President,
Ardolf・s name and Comcast account were visible on the data pulled from the
Kostolniks・ router. The text of the threat email was also contained in the
:packet capture; data, and a review of the data also revealed that the same
computer that transmitted the data containing Ardolf・s name and Comcast
account also sent the threat email.

The :packet capture; data was provided to SA Robert Cameron of the FBI・s
Cyber Crime Task Force. Agent Cameron analyzed the data and also learned,
by way of grand jury subpoena, that Ardolf had Comcast Internet service.
With this information, combined with other evidence developed during his
investigation, Agent Cameron obtained a warrant to search Ardolf・s
residence. The search occurred July 21, 2009. During the search,
investigators found numerous computers, electronic storage media, manuals
on hacking, notes related to Ardolf・s cracking of the encryption key for
the Kostolniks・ wireless router (essentially the password for accessing the
router), as well as open pieces of the Kostolniks・ mail under Ardolf・s bed.
See Govt. Tr. Exs. 102-108, 110-121, 123-134, 136-142 and 145.

Examination of the computers and electronic storage devices revealed that
Ardolf kept detailed notes on the hacking of the Kostolniks・ router and
computers, as well as notes on the various emails he sent to Matt
Kostolnik・s coworkers and to the Vice President. ...For example,
on a thumb drive located in Ardolf・s bedroom during the July 21, 2009
search warrant execution, Agent Cameron located a text file entitled :I bet
my co2.txt; containing (1) the identifying number and encryption key to the
Kostolniks・ router; (2) the text of the February 22, 2009 email from
:mattkostolnik@yahoo.com; to YoungP@moss-barnett.com;

(3) the email addresses and telephone numbers at Moss & Barnett forDave
Senger, Brenda Murphy, Philip Young, Joseph Maternowski and Anthony
Dorland; (4) the password and security question answer for the
:mattkostolnik@yahoo.com; email account; (5) the text of the :About Me;
section of the false MySpace page set up in Matt Kostolnik・s name; and (6)
the password and security question answer for the false MySpace page. See
Govt. Tr. Ex. 3. Similarly, Agent Cameron located a text file on the thumb
drive entitled :Alamo MATT all stuff.txt; containing passwords for several
other yahoo.com accounts Ardolf had created in Matt Kostolnik・s name. See
Govt. Tr. Ex. 4.

Agent Cameron also found a file entitled :March 6.txt; on the thumb drive
in Ardolf・s bedroom, which contained (1) the password and security question
and answer for :MarySill2008@gmail.com,; (2) the name, phone number and
city of residence of Mary Sill, (3) the names, telephone numbers and email
addresses of Anthony Dorland and Joseph Maternowski, and (4) text of the
March 8, 2009 email from :marysill2008@gmail.com; to Dorland and
Maternowksi. See Govt. Tr. Ex. 37.

Finally, Agent Cameron found the text file :matts-nics-2.txt; on the thumb
drive in Ardolf・s bedroom containing (1) the password and security question
answer for the yahoo.com email account used to send the threat emails to
the Vice President and other public officials
(:matt_bethany_kostolnik_2009@yahoo.com;), (2) email addresses of
recipients of threat emails, and (3) the text of the May 6, 2009 email from
:matt_bethany_kostolnik_2009@yahoo.com; to vice.president@whitehouse.gov
(with the same misspelling as in the email received by the Vice President).
See Govt. Tr. Ex. 45.

In addition, FBI forensic examiners located the child ****ography images
Ardolf had sent to Matt Kostolnik・s coworker and posted on the MySpace page
on several computers and electronic storage devices found in Ardolf・s
bedroom. See Govt. Tr. Exs. 6-10, 13-19 and 22-26.



I. Manuals for Hacking Wep-encrypted Wireless Routers Foundin Ardolf・s
Cubicle at Medtronic

Up until his termination in June of 2010, Ardolf worked at Medtronic as a
neuromodulation device repair technician. When he was terminated, a
supervisor cleaned out his work space and found 25 printed pages containing
articles relating to hacking into WEP-encrypted wireless routers. See Govt.
Tr. Exs. 60 (Manual entitled :Cracking WEP Using Backtrack: A Beginner・s
Guide;); 62 (Manual entitled :Tutorial: Simple WEP Crack [Aircrack-ng];);
64 (Printed on-line articles related to Back Track 3, including manual
entitled :Cracking WEP with BackTrack 3 -Step by Step instructions;); and
66 (Manual entitled :Tutorial: Cracking WEP Using Backtrack 3;). One of the
manuals had Ardolf・s handwriting on it (Govt. Tr. Ex. 66), and another had
the unique identifying ID for the Kostolniks・ router typed into it (Govt.
Tr. Ex. 64). Electronic versions of all theses manuals were also found on
Ardolf・s computers seized during the search of his residence. See Govt. Tr.
Exs. 61, 63, 65 and 67.

J. Other Harassment of the Kostolniks

In addition to finding evidence of the February and March emails sent to
Moss & Barnett employees, the false MySpace page, and the threat emails to
the Vice President and the other public officials, during the course of
examination of the computers and other electronic storage media seized from
Ardolf・s residence, Agent Cameron identified a number of files related to
other harassment of the Kostolniks.

1. :BethanyKostolnik; Text File Found on Ardolf・sThumb Drive

Ardolf kept a text file entitled :BethanyKostolnik; on his thumb drive,
which was recovered during the search of Ardolf・s bedroom. See Govt. Tr.
Ex. 76. The file contained Bethany Kostolnik・s contact information at work,
including her email address. Below the website address for Bethany
Kostolnik・s

employer, Ardolf wrote the following note:

Use the above page and send bad emails from Matt to

Beth[.s] co-workers.

This will kill her carear [sic].

See Govt. Tr. Ex. 76-4. The text file contained the draft of an

email to be sent to Bethany Kostolnik from a fictitious woman

alleging an affair with Kostolnik. The draft email read:

I know your husband Matt, he is a lawyer of course. [W]ehad sex just before
you had your baby this past fall. Iwanted to let you know I・m sorry but
Matt and I have beenhaving an afair [sic] behind your back. I have asked
himto divorce you but he is afraid of loosing [sic] to [sic]much to you in
a divorce. . . noone@noplace.com

See Govt. Tr. Ex. 76-4. In addition, the text file contained the

draft of an email dated March 6, 2009, to be sent to :kill;

Bethany・s career:

I had a bit of a situation with my realtor bethanykostolnik. She suggested
she would satisfy myneeds if I bought a house from her. She was
suggestingsomething inappropriate and she knew it. I don・t thinkEdina
Realty would want to keep an employee like her. Iknow the housing business
is in a slump but Beth has gonetoo far. I・m to [sic] embarrassed to use my
real name andI・m not going to give Edina Realty my business anylonger!

Id.

2. July 6, 2009 Email Threat to Bethany Kostolnik From:Liz Sharpen;

On July 6, 2009, Ardolf sent an email to Bethany Kostolnik

through her employer Edina Realty・s website. The falsely-created email
account from fictitious :Liz Sharpen; had as its subject

:Inquiries.; The text of the email provided the following threat:

I know your husband Matt[,] and I・m going to get him!He・s going to pay for
getting me pregnant. Hell, healready has 3 kids with you. I don・t blame him
for asking me to have an abortion. He goes out at night buthe isn・t alwasy
[sic] doing what you think he・s doing!

See Govt. Tr. Ex. 75.

3. Text file found :Matt P Kostolnik Phone Number and Relatives;

Ardolf kept a text file titled :Matt P Kostolnik Phone Number and
Relatives; on his thumb drive, which was recovered during the July 21, 2009
search. See Govt. Tr. Ex. 73. The file contained Kostolnik・s personal
contact information, including information about Kostolnik・s relatives.

4. July 6, 2009 Email Threat to Matt Kostolnik From:noone@noplace.com;

On July 6, 2009, Matt Kostolnik received an email through the legal website
FindLaw from :noone@noplace.com.; The text of the email contained the
following threat:

I know where you and your family live[,] and I・m going to

get you back for sueing [sic] us. See Govt. Tr. Ex. 74.

On the text file :Alamo MATT all stuff.txt,; Ardolf had saved the following
links: :http://pview.findlaw.com/view/3352002_1?noconfirm=;
http://pview.findlaw.com/cmd/emailVi...02_1&which=0; If typed
into an Internet browser, these links bring up, respectively, Matt
Kostolnik・s Findlaw Moss & Barnett web page and a form to send email
through FindLaw to Matt Kostolnik at Moss & Barnett. See Govt. Tr. Exs. 78
and 79.

K. Ardolf・s Hacking and Harassment of His Former Neighbors

During the course of examination of the computers seized from Ardolf・s
residence, FBI Agent Cameron identified a file titled :**** me hard 425.;
The file contained the Social Security account numbers, dates of birth, and
the home address for Karl A. Carstens, Nannette Carstens, and their minor
children. Ardolf resided across the street from the Carstens in Brooklyn
Park until mid-2008.

Agent Cameron stopped the search and contacted the Carstens to confirm that
they did not authorize anyone to have their Social Security numbers. The
Carstens also informed Agent Cameron that they had received a threatening
message in their mail box in March 2009 consisting of a one-page, color
print-out of their :TurboTax; return with personal identification
information and several skull images. That letter threatened: :I told you
about a year ago that you should be very afraid. I can destroy you at will,
you sorry *** excuse for a human.; See Govt. Tr. Ex. 85. The Carstens had
reported the letter to the Brooklyn Park Police Department.

Ardolf had lived across the street from the Carstens in Brooklyn Park for
several years before Ardolf moved to Blaine. Ardolf often complained to the
Carstens about the personal care attendants (PCAs) who cared for the
Carstens・ twin daughters, both of whom are disabled. Ardolf was upset that
they parked in front of his home. At one point, Ardolf demanded the full
names and telephone numbers of all of the PCAs that worked at the Carstens・
residence, but the Carstens declined to provide that information. Over the
years, the PCAs・ vehicles were vandalized; mirrors were broken and maple
syrup was poured onto them. The vandalism, however, was never witnessed or
definitively connected back to Ardolf.

Based on his investigation and belief that Ardolf had the technical
expertise to be able to hack into the Carstens・ computer account, Agent
Cameron submitted an affidavit in April 2010 for a search warrant
authorizing him to examine Ardolf・s computers for evidence of other crimes
against the Carstens.

After the search was authorized, Agent Cameron recovered evidence of other
crimes, wrongs, or acts by Ardolf against his former neighbors. This
evidence includes (1) a threatening letter mailed by Ardolf to the
Carstens; (2) a number of text files containing personal identification and
financial information of the Carstens found on a thumb drive recovered from
Ardolf・s bedroom in a folder labeled :HackHimBad;; (3) images of the
Carstens・ payment by personal check of billing invoices to Discover Card
and CenterPoint Energy, which Ardolf had scanned and saved onto a CD; and
(4) Girl Scout Troop materials for the Carstens・ daughters. See Govt. Tr.
Exs. 85-91, 124.

Significantly, the second threatening letter to the Carstens was sent in
March of 2009 - approximately nine months after Ardolf had moved to his new
house in Blaine - showing how long Ardolf maintained his anger and
continued exacting revenge.

III. Procedural History

A. Ardolf Agrees to Plead Guilty in June of 2010, ThenChanges His Mind

In the spring of 2010, after law enforcement had a chance to review the
large amounts of data seized from Ardolf・s residence, definitively
connecting Ardolf to the crimes in this case, the prosecutor and case agent
met with Ardolf and his attorney to show them an overview of the evidence.
After that meeting, the defendant agreed to plead guilty, and a plea
hearing was scheduled for Tuesday, June 15, 2010.

The Friday before the plea hearing, Ardolf・s lawyer contacted the
prosecutor, indicating that he had been fired, that Ardolf had retained
another attorney, and that Ardolf was going to withdraw from his agreement
to plead guilty. On June 15, 2010, an initial appearance was held on the
information filed in this case. The Court released Ardolf, subject to a
number of conditions, including that he abstain from the use of all
computers and Internet-enabled devices, that all computers and
Internet-enabled devices be removed from his home, and that Ardolf advise
all occupants of the home of the conditions.

B. Ardolf Violates His Conditions of Release

On June 23, 2010, a federal grand jury returned an indictment charging the
defendant with one count of unauthorized access to a protected computer, in
violation of 18 U.S.C.  ̄ 1030, two counts of aggravated identity theft, in
violation of 18 U.S.C.  ̄ 1028A, one count of threats to the President and
successors to the Presidency, in violation of 18 U.S.C.  ̄ 871, one count of
possession of child ****ography, in violation of 18 U.S.C.  ̄ 2252(a)(4)(B),
and count of distribution of child ****ography, in violation of 18 U.S.C.  ̄
2252(a)(1).

On July 8, 2010, the United States moved to revoke Ardolf's release. At a
hearing on the United States' motion, the government presented evidence
that Pretrial Services Officers Lisa Martinetto, Tim Norgren and David
Drake located a laptop computer in defendant・s residence. The computer was
found in the doorway of defendant・s daughter・s bedroom, which bedroom was
located directly across from defendant・s bedroom; the computer was visible
to Officer Martinetto when she stood in the doorway of defendant・s bedroom.
When questioned by Officer Martinetto about the laptop, defendant admitted
he knew it was a violation of his release conditions.

Officer Martinetto testified that she had advised defendant at the
inception of his supervision that he was required under the terms of his
supervision to advise any children living in his residence that no
computers were permitted in the residence. At the hearing on this matter
defendant・s daughter, K.A., testified that the laptop computer found in
defendant・s house belonged to her, that it had been there for more than a
week, and that she had not been advised by her father that neither she nor
anyone else could have a computer in the residence under the terms of his
pretrial release conditions. K.A. further testified that she had seen her
father using a computer in the house several times after June 15, 2010 (the
date the conditions of release were imposed on defendant in this case), and
that she had also seen him using a wireless Internet connection using a
laptop at a Border・s Bookstore after June 15.

Magistrate Judge Noel granted the government's motion to revoke Ardolf's
release, and he was taken into custody on July 9, 2010.

C. Ardolf Lies at the Suppression Hearing

At a motions hearing held on July 28, 2010, the defendant argued that his
statement to law enforcement should be suppressed. Defendant testified at
the hearing, claiming he asked to leave his

house twice during his interview, but was not allowed to go. Magistrate
Judge Noel found that Ardolf lied during his testimony:

Both [the FBI and Secret Service] agents [who interviewedArdolf] also
testified that the Defendant never askedthem for permission to leave to
pick up his son until theconclusion of the Defendant・s interview with
[SecretService Special Agent] Humbert. Both agents furthertestified that
when the Defendant asked to leave to pickup his son, he was granted
permission to do so and did infact leave the premises. The Defendant, in
contrast,testified that he repeatedly asked to leave to pick uphis son and
was ignored. The Court finds that the Defendant・s testimony in this regard
is not credible. TheCourt expressly finds that the Defendant was told that
hewas free to leave.

August 13, 2010 Report and Recommendation, Dkt. 46, at 27.

D. Ardolf Pleads Guilty Three Days into Trial

On December 17, 2010, three days into a jury trial in this case, defendant
Barry Ardolf entered pleas of guilty to all counts with which he was
charged, admitting under oath to all of the allegations in the indictment
and providing a detailed factual basis for each charge. Defendant decided
to plead guilty after the jury had been selected and after the government
had given its opening statement, called thirteen witnesses, admitted nearly
70 exhibits, and was prepared to present a full day of testimony (including
that of the victims). Prior to taking defendant・s plea, the Court engaged
in a thorough examination of the defendant to ensure that his plea was
knowing, voluntary and intelligent. See Transcript of December 17, 2010
Change of Plea Hearing, at 5 - 40.



E. Ardolf Tries to Withdraw His Guilty Plea

On March 18, 2011, Ardolf moved to withdraw his guilty plea, claiming that
he had been coerced into entering the plea. He also claimed that he had
lied at the change of plea hearing and that he did not commit the criminal
acts to which he had pleaded guilty. He also indicated that, if given an
opportunity for a :do over; trial, he would use defenses such as: (1)
suggesting he was :framed; by the victims in this case (see Defendant・s
Memorandum in Support of his Motion to Withdraw (Dkt. 86) at 13) and (2)
trying to show that the previous neighbors he hacked and terrorized had not
obtained a permit for remodeling their basement and were :thus unreliable
citizens; (id. at 14).

After a full briefing and a hearing at which both defendant and his
stand-by counsel were heard, the Court denied defendant・s motion to
withdraw on May 19, 2011. Dkt. 94.

F. In Letters Sent from Jail, Ardolf Coaches His Son's TrialTestimony,
Tells Relatives What to Write (and to Conceal)in Letters to the Court, and
Disparages the Victims

In a November 1, 2010 letter from Ardolf to his son, T.A., he provided T.A.
with a script of 48 questions he will be asked at trial, as well as the 48
answers he expected T.A. to give. In addition, Ardolf coached T.A. as to
how he should testify at trial concerning the incident between Ardolf and
the Kostolnik・s 4-year old son:

You have to confirm that you watched [W.K.] and your

father, and that no kiss occurred. If you don・t I will

likely go to prison. . . .

Tell the court you saw the whole thing and that nothinginnapropriet [sic]
occurred. I don't know if you watchMr. Kostolnik come over the next day,
but if you did,keep to my story.

After Ardolf pleaded guilty, he coached his children and his

sister as to how to write letters to the Court in connection with

his sentencing. In a January 25, 2011 letter to his minor

daughter, K.A., Ardolf he tells her how to write her letter:

I suggest some wording about how you will figuratively bean orphan and tell
him you are crying about not having methere for you. You have about a month
to write this letter. I figure you can write it, mail it to me so Ican add
suggestions and we can mail it back and forth afew times to make it as good
as it can be. This is for you and Taylor to do so I get a letter from each
of you.You can cry about how you lost mom, now you are loosing[sic] Dad.
The better the letter, the smaller jail timethe judge gives me.

Similarly, in a Janaury 6, 2011 letter to his son, T.A., Ardolf

tells him to contact Ardolf・s sister Sheri Anderson, who will be

writing a letter to the Court in connection with his sentencing:

[T]ell Sheri, do not say anything bad about my life. Tellher the gov only
needs my adult life history.Specifically, tell Sheri to say nothing at all
about mychildhood life, except our parents were divorced but weall enjoyed
our childhood. Tell Sheri this report willstay with me all my life so don・t
say anything like Iskipped school all the time or **** like that.

Ardolf also writes in the same letter to T.A. that, in order to get

their computers back, Ardolf will lie to the Court at sentencing,

saying that :there are pictures on there of mom which are one of a kind. I
may say anything I can think of to get the judge to give back everything.;

Finally, in multiple letters - to family, friends, and even a newspaper
reporter - Ardolf disparages the victims in this case, repeatedly blaming
them for his situation and sometimes claiming he was :framed; by them. For
example, in a letter from April of 2011, Ardolf writes that, if the Court
grants his motion to withdraw his guilty plea, he is going to sue the
Kostolniks. In other letters, he promises to :expose; the victims or
otherwise make them look bad in court.





IV. The Appropriate Sentence in Light of 18 U.S.C.  ̄ 3553(a)

In addition to determining defendant・s Sentencing Guideline range, 18
U.S.C.  ̄ 3553(a)(4), this Court is required to assess the other applicable
sentencing factors under Section 3553(a) of federal sentencing law. Those
factors include the nature and circumstances of the offense; the history
and characteristics of the defendant; the need for the sentence imposed to
reflect the seriousness of the offense, to promote respect for the law, to
provide just punishment for the offense, to afford adequate deterrence to
criminal conduct, and to protect the public from further crimes of the
defendant; the need to avoid unwarranted sentencing disparities; and the
need to provide restitution to victims. See 18 U.S.C.  ̄ 3553(a).

In this case, considering all the appropriate factors, the government
respectfully submits that a sentence of 293 months is appropriate for
Ardolf. Such a sentence would be sufficient but not greater than necessary
to accomplish federal sentencing goals in this case.

First, serious punishment is called for by the nature and circumstance of
defendant・s offenses and the need for the sentence to reflect the
seriousness of the harm caused by defendant. There are real victims here.
To vent his anger, defendant engaged an extensive and cruel campaign to
terrorize the Kostolniks, which the defendant・s own notes show was
calculated to destroy the Kostolniks・ reputations, careers, and marriage.
Ardolf dedicated countless hours to his scheme, starting in or before
November of 2008 and continuing into the summer of 2009, hiding behind his
computer keyboard as he struck repeatedly at the victims. It is hard to
image the emotional trauma inflicted on the Kostolniks over the months as
each new email was uncovered, living under a cloud of suspicion and
enduring uncomfortable meetings with law firm management and workplace
visits from the Secret Service. Moreover, Ardolf perpetrated a similar
campaign of terror against his previous neighbors. Ardolf hacked their
wireless router and stole personal identity and financial information and
threatened to cause them significant harm, sending his last threatening
letter many months after he had moved to a new residence. But for the
aggressive law enforcement in this case (and the expenditure of significant
resources to uncover it), they might never have known that it was Ardolf
had caused them harm.

Second, a lengthy sentence is called for to promote respect for the law, to
provide just punishment, to afford adequate deterrence, and to protect the
public from further crimes of defendant. Not only has defendant failed to
accept responsibility for his conduct in the instant offenses, his
post-plea actions also show no regard for the law. After entering his
guilty plea, defendant attempted to withdraw it for a :do over; trial. He
sent letters to friends and family members to tell them what they could and
could not tell this Court for purposes of sentencing. And, repeatedly,
defendant has attempted to portray himself as a :victim.; Indeed, even when
given a chance to write an :Acceptance of Responsibility Statement,; with
the guidance of his attorney, and with the opportunity to consider every
word, he still attributes his actions to the fact that he felt
:victimized.;

Moreover, throughout this case, Ardolf has shown his complete lack of
respect for the law. In addition to the depraved criminal acts that form
the basis of the charges against him, he also has shown utter disregard for
this Court and the rule of law since he was charged in this case. Indeed,
he blatantly violated his conditions of pretrial release, he lied at the
suppression hearing, he attempted to influence witnesses in their testimony
at trial or in writing letters to the Court, and he lied again in
connection with his motion to withdraw his guilty plea. For Barry Ardolf,
in particular, a lengthy sentence is appropriate to promote adequate
respect for the law.

Finally, and perhaps most important, a lengthy sentence is necessary to
protect the public against further crimes by the defendant. Barry Ardolf is
a dangerous man. As he has amply demonstrated, he uses his technical skills
both to cause harm and to avoid getting caught. Based on his actions, there
is every reason to believe that when Barry Ardolf is released from prison
at the end of his term of commitment, he will do something like this again
to someone else who has angered him, only this time he will be even more
careful. The only way to prevent that is to incarcerate the defendant for a
very long time.

At every turn, the defendant has chosen not to accept responsibility for
his actions and to obstruct justice. This Court has had a firsthand
opportunity to see defendant・s dangerousness, lack of remorse, and
disregard for the law. A lengthy sentence is needed to prevent the
defendant from engaging in any further harm.

CONCLUSION

Defendant is dangerous. Defendant is remorseless. The crimes he committed
caused serious harm to the victims. Just punishment calls for a sentence
commensurate with the defendant・s conduct. In light of all of the guideline
factors in this case, the government

respectfully requests that the Court sentence defendant Barry
Vincent Ardolf to a sentence of 293 month in prison.
Dated: July 8, 2011 Respectfully submitted,


B. TODD JONESUnited States Attorney

s/Timothy C. Rank

BY: TIMOTHY C. RANK Assistant U.S. Attorney

LAURA M. PROVINZINO Assistant U.S. Attorney



Reply With Quote
  #9 (permalink)  
Old 07-19-2011, 05:42 AM
Wilbur H.
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

On Mon, 18 Jul 2011 22:32:32 -0700, SF Man wrote:

> Here is the sentencing memo with more detail:
> http://www.wired.com/images_blogs/th...encingmemo.pdf



I think this is the key sentence:

"The text of the threat email was also contained in the packet capture
data, and a review of the data also revealed that the same computer
that transmitted the data containing Ardolfs name and Comcast
account also sent the threat email."

--- Posted via news://freenews.netfront.net/ - Complaints to news@netfront.net ---

Reply With Quote
  #10 (permalink)  
Old 07-19-2011, 06:11 AM
miso@sushi.com
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

On Jul 17, 7:27*am, arkland <arkl...@gmail.com> wrote:
> I read with interest this CNN article (http://tinyurl.com/62o9s4x) titled:
> "Wi-Fi-hacking neighbor sentenced to 18 years".http://www.cnn.com/2011/TECH/web/07/13/
> wifi.hacking.neighbor.sentenced.wired/
>
> Can someone further explain this sentence in that article?
>
> "With Kostolnik's permission, they installed a packet sniffer on his
> network to try and get to the bottom of the incidents ... A forensics
> computer investigator working for Kostolnik's law firm examined the
> packet logs... In the data surrounding the threatening traffic, they
> found traffic containing Ardolf's name and Comcast account .
>
> Two fundamental questions:
>
> 1. What packet sniffer would I install (Ubuntu & WRT54G) if I were to
> look for snooping neighbors ... and .. .
> 2. Why would a connection to the neighbor's router also leave the
> perpetrator's actual name and comcast account information?
>
> Thanks for any advice as this both scares and intrigues me.


WEP has long been known to be crackable. I suspect the only reason it
is supplied in routers is for comparability with old devices.

What I don't get is why did this go on for so long. Once the myspace
account with kiddie-**** showed up, my hair would have been on fire.
Does anyone believe that once a hacker pulls this crap, they will
stop? When is putting your head in the sand a good plan of action?

I suspect much of the sentence is for the kiddle-****. That was way
over the top. Not only did he download it, but he distributed it. Then
threatening the vice president. Yeah, that won't attract any
attention.

So this guy committed at least three federal crimes. (threaten the VP,
download kiddie ****, distribute kiddie ****.) This is way beyond just
breaking into wifi.

I will mail this around to people I know with open wifi at their
house, but I can't break them out of their habits. "Passwords? That is
too much work."


Reply With Quote
  #11 (permalink)  
Old 07-19-2011, 01:07 PM
Jeff Liebermann
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

On Mon, 18 Jul 2011 22:32:32 -0700, SF Man <lavocado@sbcglobal.net>
wrote:

>On Sun, 17 Jul 2011 20:10:15 -0700, Jeff Liebermann wrote:
>
>> Only the paranoid survive.

>
>What could the Kostolnik's have done to PREVENT access to all their
>computers?


(...major trim)

1. Use WPA or WPA2 encryption, not WEP. This is the main protection
against unauthorized access. Once a hacker gains access to the LAN,
it's too late.
2. Set a router config password other than the default.
3. Turn off remote wireless config on port 8080 or at least change
the port number to something else. It's too obvious a target for
hacking.
4. Deploy an IDS (intrusion detection system) such as:
<http://home.comcast.net/~jay.deboer/airsnare/>
and ocassionally look at the router log files for unauthorized
machines.
5. Control network access to the individual machines with user logins
and passwords. Shared folders and NAS servers on the network should
not be wide open. I'm guessing, but the documents obtained from the
Kostolnik's machine were probably obtained because they were saved in
a directory visible from the network.
6. Turn off the wireless at hours when it is unlikely to be used.
Some routers have a front panel switch. Others have internal timer
settings. An easy way is to use seperate boxes for the modem, router,
and wireless access point. When not in use, just turn off the power
to the wireless access point. The modem and router will still
function for wired connections.
7. There are a wide variety of "obstacle" type of defenses
recommended by various authorities, such as regular password changes,
MAC address filters, and AP isolation. These will slow down
intruders, but do little to actually prevent access by a determined
hacker. If it's a neighbor doing the hacking, they have plenty of
time to sniff, log, and experiment and test what works.
8. Get to know your neighbors.

In my never humble opinion, one big problem is that concept of the
shared wireless pass phrase is flawed. Physical access to any of the
wireless computers on the Kostolnik's network, for even a few minutes,
could result in the WPA pass phrase (or a usable hash code) being
recovered.
<http://www.nirsoft.net/utils/wireless_key.html>
This did not happen in this case, but is still a major risk. It would
be better to use WPA-RADIUS and a RADIUS server, with individual
logins and passwords, authentication, and one time encryption keys.
However, RADIUS servers are not commonly available on home wireless
systems.

--
Jeff Liebermann jeffl@cruzio.com
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558

Reply With Quote
  #12 (permalink)  
Old 07-20-2011, 03:02 AM
arkland
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

On Tue, 19 Jul 2011 06:07:09 -0700, Jeff Liebermann wrote:

> 4. Deploy an IDS (intrusion detection system) such as:
> <http://home.comcast.net/~jay.deboer/airsnare/> and ocassionally look at
> the router log files for unauthorized machines.


This is a great idea. I'm not sure if that runs on the WRT54G router or
on the Ubuntu computer though ... as I'm confused when I got to the web
page (and there's no installation in the "ubuntu software center"...

Does airsnare go on the router? Or on the computer?

Reply With Quote
  #13 (permalink)  
Old 07-20-2011, 03:07 AM
arkland
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

On Tue, 19 Jul 2011 06:07:09 -0700, Jeff Liebermann wrote:

> 1. Use WPA or WPA2 encryption, not WEP. This is the main protection
> against unauthorized access. Once a hacker gains access to the LAN,
> it's too late.


And, don't use a well-known SSID or an easy-to-guess password (due to
rainbow attacks).


Reply With Quote
  #14 (permalink)  
Old 07-20-2011, 03:08 AM
arkland
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

On Tue, 19 Jul 2011 06:07:09 -0700, Jeff Liebermann wrote:

> 5. Control network access to the individual machines with user logins
> and passwords. Shared folders and NAS servers on the network should not
> be wide open. I'm guessing, but the documents obtained from the
> Kostolnik's machine were probably obtained because they were saved in a
> directory visible from the network.


I don't have any sharing on the Windows XP machines 'except' for printer
sharing.

Does that accomplish what you're suggesting in #5?


Reply With Quote
  #15 (permalink)  
Old 07-20-2011, 03:12 AM
arkland
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

On Tue, 19 Jul 2011 06:07:09 -0700, Jeff Liebermann wrote:

> 7. There are a wide variety of "obstacle" type of defenses recommended
> by various authorities, such as regular password changes, MAC address
> filters, and AP isolation


I understand all but "AP isolation".

Googling ... I see Jeff himself discussed it here: ( http://tinyurl.com/
k64tg )
http://www.wirelessforums.org/alt-in...-isolation-ap-
isolation-how-does-work-774.html

But I still don't understand.

Googling some more ... I see Cisco/Linksys article:
Title: AP Isolation and Enabling/Disabling AP Isolation.
Article ID: 17335 ( http://tinyurl.com/3b6qphy )
http://www6.nohold.net/Cisco2/ukp.aspx?
pid=80&login=1&app=search&vw=1&articleid=17335

But, at least, it looks simple enough to enable in the WRT54G:
- Wireless > Advance Wireless Security and Enable the AP Isolation.




Reply With Quote
  #16 (permalink)  
Old 07-20-2011, 03:21 AM
arkland
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

On Mon, 18 Jul 2011 23:11:12 -0700, miso@sushi.com wrote:

> What I don't get is why did this go on for so long.


I was wondering the 'same' thing!

Probably the best scenario description is the aforementioned PDF file:
( http://tinyurl.com/5sy6lln )
http://www.wired.com/images_blogs/threatlevel/2011/07/
ardolffedssentencingmemo.pdf

It seems the government didn't actually figure anything out, per se,
before the warrant for searching the guy's house. Everything was done by
the hired secondary law firm who installed the 'packet sniffer'.

Why didn't they 'see' the threatening email to the VP, for example? It
was in the logs. Right?

And, why didn't they track where the kiddie **** came from? It must also
have been in the logs. Right?

In short, why did it take so long to catch someone AFTER you put in the
packet sniffer?

Reply With Quote
  #17 (permalink)  
Old 07-20-2011, 03:45 AM
Jeff Liebermann
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

On Wed, 20 Jul 2011 03:02:46 +0000 (UTC), arkland <arkland@gmail.com>
wrote:

>On Tue, 19 Jul 2011 06:07:09 -0700, Jeff Liebermann wrote:
>
>> 4. Deploy an IDS (intrusion detection system) such as:
>> <http://home.comcast.net/~jay.deboer/airsnare/> and ocassionally look at
>> the router log files for unauthorized machines.

>
>This is a great idea. I'm not sure if that runs on the WRT54G router or
>on the Ubuntu computer though ... as I'm confused when I got to the web
>page (and there's no installation in the "ubuntu software center"...


AirSnare is a Windoze program. No clue if it will run under WINE. For
your Ubuntu box, methinks arpwatch will suffice.
<http://aimlinux.com/blog/?p=56>

>Does airsnare go on the router? Or on the computer?


On a Windoze computah. It monitors traffic between the
DSL/cable/satellite modem and the WAN port on the router. It will NOT
work with a modem/router conglomeration in one box where there's no
access to the WAN ethernet port.

--
# Jeff Liebermann 150 Felker St #D Santa Cruz CA 95060
# 831-336-2558
# http://802.11junk.com jeffl@cruzio.com
# http://www.LearnByDestroying.com AE6KS

Reply With Quote
  #18 (permalink)  
Old 07-20-2011, 03:51 AM
Jeff Liebermann
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

On Wed, 20 Jul 2011 03:07:14 +0000 (UTC), arkland <arkland@gmail.com>
wrote:

>On Tue, 19 Jul 2011 06:07:09 -0700, Jeff Liebermann wrote:
>
>> 1. Use WPA or WPA2 encryption, not WEP. This is the main protection
>> against unauthorized access. Once a hacker gains access to the LAN,
>> it's too late.

>
>And, don't use a well-known SSID or an easy-to-guess password (due to
>rainbow attacks).


I use my my home and office addresses as my SSID. For customers, I
use the company name. I also broadcast the SSID so that everyone can
see it. Security by obscurity is of little value. Providing contact
info in the SSID allows anyone that is receiving interference to
contact the owner. Also it allows people that want to "borrow"
connectivity to get permission from the owner.

<http://en.wikipedia.org/wiki/Rainbow_table#Defense_against_rainbow_tables>
Rainbow tables and other precomputation attacks do not work
against passwords that contain symbols outside the range
presupposed, or that are longer than those precomputed by
the attacker.
Use a pass phrase with no spaces, that's fairly long, full of
non-dictionary words, and stuffed with symbols.

--
# Jeff Liebermann 150 Felker St #D Santa Cruz CA 95060
# 831-336-2558
# http://802.11junk.com jeffl@cruzio.com
# http://www.LearnByDestroying.com AE6KS

Reply With Quote
  #19 (permalink)  
Old 07-20-2011, 03:54 AM
Jeff Liebermann
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

On Wed, 20 Jul 2011 03:08:05 +0000 (UTC), arkland <arkland@gmail.com>
wrote:

>On Tue, 19 Jul 2011 06:07:09 -0700, Jeff Liebermann wrote:
>
>> 5. Control network access to the individual machines with user logins
>> and passwords. Shared folders and NAS servers on the network should not
>> be wide open. I'm guessing, but the documents obtained from the
>> Kostolnik's machine were probably obtained because they were saved in a
>> directory visible from the network.


>I don't have any sharing on the Windows XP machines 'except' for printer
>sharing.
>
>Does that accomplish what you're suggesting in #5?


Nope. On XP, try:
start -> run -> cmd <enter>
net share

Here's mine. Everything listed is an open share. However, they're
all require a password to read and none of them are writeable.
C:\>net share
Share name Resource Remark
-------------------------------------------------------
IPC$ Remote IPC
Chaos C:\Chaos
ie60sp1 C:\Old\ie60sp1
JUNK C:\JUNK
mp3 C:\mp3
W2K SP4 C:\Old\Windoze\W2K SP4
ZIP C:\ZIP
Zip-Misc C:\Zip-Misc
The command completed successfully.

--
# Jeff Liebermann 150 Felker St #D Santa Cruz CA 95060
# 831-336-2558
# http://802.11junk.com jeffl@cruzio.com
# http://www.LearnByDestroying.com AE6KS

Reply With Quote
  #20 (permalink)  
Old 07-20-2011, 03:58 AM
Jeff Liebermann
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

On Wed, 20 Jul 2011 03:12:32 +0000 (UTC), arkland <arkland@gmail.com>
wrote:

>On Tue, 19 Jul 2011 06:07:09 -0700, Jeff Liebermann wrote:
>
>> 7. There are a wide variety of "obstacle" type of defenses recommended
>> by various authorities, such as regular password changes, MAC address
>> filters, and AP isolation

>
>I understand all but "AP isolation".
>
>Googling ... I see Jeff himself discussed it here: ( http://tinyurl.com/k64tg )
>http://www.wirelessforums.org/alt-in...-work-774.html
>
>But I still don't understand.


It's a misnamed feature of many access points and is especially useful
for wireless hot spots and coffee shops. It should be called
"wireless client isolation". It prevents wireless users from seeing
and attacking other wireless users. Basically, it prevents bridging
(all wireless is bridging) between two wireless clients. The wireless
clients can only bridge to the access point, and then to the router
and out to the internet. They cannot bridge to each other.

--
# Jeff Liebermann 150 Felker St #D Santa Cruz CA 95060
# 831-336-2558
# http://802.11junk.com jeffl@cruzio.com
# http://www.LearnByDestroying.com AE6KS

Reply With Quote
  #21 (permalink)  
Old 07-20-2011, 05:47 AM
arkland
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

On Tue, 19 Jul 2011 20:58:00 -0700, Jeff Liebermann wrote:

> Basically, it prevents bridging (all wireless is
> bridging) between two wireless clients. The wireless clients can only
> bridge to the access point, and then to the router and out to the
> internet. They cannot bridge to each other.


Thanks for the advice. I had never heard of "AP isolation" but it was
trivial to turn the default "No" into a "Yes" on my Linksys WRT54G router!


Reply With Quote
  #22 (permalink)  
Old 07-20-2011, 05:56 AM
arkland
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

On Tue, 19 Jul 2011 20:45:09 -0700, Jeff Liebermann wrote:

> For your Ubuntu box, methinks arpwatch will suffice.
> <http://aimlinux.com/blog/?p=56>


Arpwatch keeps track for ethernet/ip address pairings. It syslogs
activity and reports certain changes via email. Arpwatch uses pcap(3)
to listen for arp packets on a local ethernet interface.

Note: you must have exim4 or postfix setup with SMTP, be it local or
external if you wish to send out alerts to external email address.

Run the following commands from terminal.
sudo apt-get install arpwatch
Create empty file for storing host information:
sudo touch /var/lib/arpwatch/arp.dat
Edit the config file:
sudo nano /etc/arpwatch.conf
insert line like this:
eth0 -a -n 192.168.1.0/24 -m youremail@mydomain.com
Restart arpwatch:
sudo /etc/init.d/arpwatch restart
Check if the process is running:
ps ef | grep arpwatch
root 218 1 0 11:38 ? 00:00:00 /usr/sbin/arpwatch ...

I changed the IP address line to this because I wanted to sniff the wlan:
wlan0 -a -n 192.168.1.1/24 -m email@domain.com

Reply With Quote
  #23 (permalink)  
Old 07-20-2011, 05:50 PM
alexd
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

Meanwhile, at the alt.internet.wireless Job Justification Hearings, Jeff
Liebermann chose the tried and tested strategy of:

> Use a pass phrase with no spaces, that's fairly long, full of
> non-dictionary words, and stuffed with symbols.


OOI, why would you suggest avoiding spaces?

--
<http://ale.cx/> (AIM:troffasky) (UnSoEsNpEaTm@ale.cx)
18:50:37 up 40 min, 2 users, load average: 0.00, 0.67, 0.80
"People believe any quote they read on the internet
if it fits their preconceived notions." - Martin Luther King


Reply With Quote
  #24 (permalink)  
Old 07-21-2011, 12:34 AM
LouB
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

Jeff Liebermann wrote:
> On Wed, 20 Jul 2011 03:07:14 +0000 (UTC), arkland <arkland@gmail.com>
> wrote:
>
>> On Tue, 19 Jul 2011 06:07:09 -0700, Jeff Liebermann wrote:
>>
>>> 1. Use WPA or WPA2 encryption, not WEP. This is the main protection
>>> against unauthorized access. Once a hacker gains access to the LAN,
>>> it's too late.

>> And, don't use a well-known SSID or an easy-to-guess password (due to
>> rainbow attacks).

>
> I use my my home and office addresses as my SSID. For customers, I
> use the company name. I also broadcast the SSID so that everyone can
> see it. Security by obscurity is of little value. Providing contact
> info in the SSID allows anyone that is receiving interference to
> contact the owner. Also it allows people that want to "borrow"
> connectivity to get permission from the owner.
>
> <http://en.wikipedia.org/wiki/Rainbow_table#Defense_against_rainbow_tables>
> Rainbow tables and other precomputation attacks do not work
> against passwords that contain symbols outside the range
> presupposed, or that are longer than those precomputed by
> the attacker.
> Use a pass phrase with no spaces, that's fairly long, full of
> non-dictionary words, and stuffed with symbols.
>

There appear to be addresses in your sig

Reply With Quote
  #25 (permalink)  
Old 07-21-2011, 01:04 AM
Jeff Liebermann
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

On Wed, 20 Jul 2011 18:50:58 +0100, alexd <troffasky@hotmail.com>
wrote:

>Meanwhile, at the alt.internet.wireless Job Justification Hearings, Jeff
>Liebermann chose the tried and tested strategy of:
>
>> Use a pass phrase with no spaces, that's fairly long, full of
>> non-dictionary words, and stuffed with symbols.

>
>OOI, why would you suggest avoiding spaces?


Good question. If the password contains dictionary words, seperated
by spaces, it's somewhat easier to recognize the words. However, I
just realized that the spaces are of no benfit with rainbow tables.
I've done it out of habit from the old days of cryptography, where an
indication of success in recovering encrypted text is to test for
dictionary words, or maximize the spaces and common letters (etaoins).
That also doesn't make much sense with just passwords. Never mind,
it's not necessary.

--
# Jeff Liebermann 150 Felker St #D Santa Cruz CA 95060
# 831-336-2558
# http://802.11junk.com jeffl@cruzio.com
# http://www.LearnByDestroying.com AE6KS

Reply With Quote
  #26 (permalink)  
Old 07-21-2011, 01:07 AM
Jeff Liebermann
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

On Wed, 20 Jul 2011 20:34:30 -0400, LouB <Lou@invalid.invalid> wrote:

>There appear to be addresses in your sig


Is that a problem? That email address has been there for maybe 15
years, with another email address (that's still alive) for another 10
years. I don't get any more or less spam than those desperately
trying to hide behind throw away addresses. Anyway, this has nothing
to do with wi-fi, hacking, or wireless security.



--
# Jeff Liebermann 150 Felker St #D Santa Cruz CA 95060
# 831-336-2558
# http://802.11junk.com jeffl@cruzio.com
# http://www.LearnByDestroying.com AE6KS

Reply With Quote
  #27 (permalink)  
Old 07-21-2011, 07:23 AM
miso@sushi.com
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

On Jul 19, 8:21*pm, arkland <arkl...@gmail.com> wrote:
> On Mon, 18 Jul 2011 23:11:12 -0700, m...@sushi.com wrote:
> > What I don't get is why did this go on for so long.

>
> I was wondering the 'same' thing!
>
> Probably the best scenario description is the aforementioned PDF file:
> (http://tinyurl.com/5sy6lln)http://ww...level/2011/07/
> ardolffedssentencingmemo.pdf
>
> It seems the government didn't actually figure anything out, per se,
> before the warrant for searching the guy's house. Everything was done by
> the hired secondary law firm who installed the 'packet sniffer'.
>
> Why didn't they 'see' the threatening email to the VP, for example? It
> was in the logs. Right?
>
> And, why didn't they track where the kiddie **** came from? It must also
> have been in the logs. Right?
>
> In short, why did it take so long to catch someone AFTER you put in the
> packet sniffer?


Fortunately an easy read, even if 30 pages.

I'm bugged that the search warrant was based on what the private
investigator found. If that step could have been tossed out, then
everything else is the "fruits of the poisoned tree" argument. The
private detective should have brought the FBI on to the case and only
then use evidence that the FBI gathered. I never liked private
investigators, and after than Carly Fiorina caper, I think the PIs are
borderline crooks. [I'm not a liar! I just pretext. Right......]

But after they searched his house, there is no denying the kiddie
****. Apparently it has to be "known" kiddie ****, one assumes to
identify the age of those in the photo. Possession of social security
numbers certainly doesn't look good, though he didn't seem to do
anything with them. [The two *******s that hacked my credit card
probably never spent a second in jail. If they aren't hacking me in
NYC, they are hacking me in Miami.]

The other thing that was funny was it wasn't the victim's email
account, but an account created by this jerk. I would have been on the
phone to yahoo and asked ***. Now MySpace is probably the kind of
thing I would never look for. I don't read MySpace, Facebook, etc. I'm
old school. Apparently there are 5 Lady Gagas on Google Plus, not that
I would know from having an account. So fake names are everywhere. Now
if the jerk didn't have the thumb drive with the kiddie ****, that
would have saved him 7 years.

It looks like they didn't bother to get him for the other wifi he
cracked.

I'm not all that sad this guy is convicted, but the time is way too
much. You get less time for murder these days. This jerk should have
collected some dog crap, put it in a paper bag, drop it on the
neighbors porch, ignite it, right the door bell, and run. That would
have been plenty of questionably craved revenge.

Now for your movie viewing this week, I suggest "Pacific Heights" or
"Arlington Road." Talk about your loony neighbors!


Reply With Quote
  #28 (permalink)  
Old 07-21-2011, 07:28 AM
miso@sushi.com
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

On Jul 20, 6:04*pm, Jeff Liebermann <je...@cruzio.com> wrote:
> On Wed, 20 Jul 2011 18:50:58 +0100, alexd <troffa...@hotmail.com>
> wrote:
>
> >Meanwhile, at the alt.internet.wireless Job Justification Hearings, Jeff
> >Liebermann chose the tried and tested strategy of:

>
> >> Use a pass phrase with no spaces, that's fairly long, full of
> >> non-dictionary words, and stuffed with symbols.

>
> >OOI, why would you suggest avoiding spaces?

>
> Good question. *If the password contains dictionary words, seperated
> by spaces, it's somewhat easier to recognize the words. *However, I
> just realized that the spaces are of no benfit with rainbow tables.
> I've done it out of habit from the old days of cryptography, where an
> indication of success in recovering encrypted text is to test for
> dictionary words, or maximize the spaces and common letters (etaoins).
> That also doesn't make much sense with just passwords. *Never mind,
> it's not necessary.
>
> --
> # Jeff Liebermann 150 Felker St #D Santa Cruz CA 95060
> # 831-336-2558
> #http://802.11junk.com* * * * * * * je...@cruzio.com
> #http://www.LearnByDestroying.com* * * * * * * AE6KS


In the dark ages when encoding was just a simple letter by letter
replacement, traffic analysis of the words would yield clues. How many
one letter words are there? A, I? blah blah blah.

Reply With Quote
  #29 (permalink)  
Old 07-21-2011, 07:17 PM
alexd
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

Meanwhile, at the alt.internet.wireless Job Justification Hearings,
miso@sushi.com chose the tried and tested strategy of:

> Apparently there are 5 Lady Gagas on Google Plus


You've got to hand it to Google's marketing department.

"Google+: Now with 5x more Lady Gaga than real life!"

--
<http://ale.cx/> (AIM:troffasky) (UnSoEsNpEaTm@ale.cx)
20:15:51 up 1 day, 2:05, 5 users, load average: 0.20, 0.16, 0.32
"People believe any quote they read on the internet
if it fits their preconceived notions." - Martin Luther King

Reply With Quote
  #30 (permalink)  
Old 07-21-2011, 09:33 PM
Rich Johnson
Guest
 
Posts: n/a
Default Re: Packet sniffing wi-Fi-hacking neighbor (

On 7/21/2011 12:23 AM, miso@sushi.com wrote:
> On Jul 19, 8:21 pm, arkland<arkl...@gmail.com> wrote:
>> On Mon, 18 Jul 2011 23:11:12 -0700, m...@sushi.com wrote:
>>> What I don't get is why did this go on for so long.

>>
>> I was wondering the 'same' thing!
>>
>> Probably the best scenario description is the aforementioned PDF file:
>> (http://tinyurl.com/5sy6lln)http://ww...level/2011/07/
>> ardolffedssentencingmemo.pdf
>>
>> It seems the government didn't actually figure anything out, per se,
>> before the warrant for searching the guy's house. Everything was done by
>> the hired secondary law firm who installed the 'packet sniffer'.
>>
>> Why didn't they 'see' the threatening email to the VP, for example? It
>> was in the logs. Right?
>>
>> And, why didn't they track where the kiddie **** came from? It must also
>> have been in the logs. Right?
>>
>> In short, why did it take so long to catch someone AFTER you put in the
>> packet sniffer?

>
> Fortunately an easy read, even if 30 pages.
>
> I'm bugged that the search warrant was based on what the private
> investigator found. If that step could have been tossed out, then
> everything else is the "fruits of the poisoned tree" argument. The
> private detective should have brought the FBI on to the case and only
> then use evidence that the FBI gathered. I never liked private
> investigators, and after than Carly Fiorina caper, I think the PIs are
> borderline crooks. [I'm not a liar! I just pretext. Right......]
>
> But after they searched his house, there is no denying the kiddie
> ****. Apparently it has to be "known" kiddie ****, one assumes to
> identify the age of those in the photo. Possession of social security
> numbers certainly doesn't look good, though he didn't seem to do
> anything with them. [The two *******s that hacked my credit card
> probably never spent a second in jail. If they aren't hacking me in
> NYC, they are hacking me in Miami.]
>
> The other thing that was funny was it wasn't the victim's email
> account, but an account created by this jerk. I would have been on the
> phone to yahoo and asked ***. Now MySpace is probably the kind of
> thing I would never look for. I don't read MySpace, Facebook, etc. I'm
> old school. Apparently there are 5 Lady Gagas on Google Plus, not that
> I would know from having an account. So fake names are everywhere. Now
> if the jerk didn't have the thumb drive with the kiddie ****, that
> would have saved him 7 years.
>
> It looks like they didn't bother to get him for the other wifi he
> cracked.
>
> I'm not all that sad this guy is convicted, but the time is way too
> much. You get less time for murder these days. This jerk should have
> collected some dog crap, put it in a paper bag, drop it on the
> neighbors porch, ignite it, right the door bell, and run. That would
> have been plenty of questionably craved revenge.
>
> Now for your movie viewing this week, I suggest "Pacific Heights" or
> "Arlington Road." Talk about your loony neighbors!
>

On the search warrant based upon evidence the P.I. found. The P.I. had
permission to place the evidence gathering device on the victim's
network. No search warrant was needed for that as the owner gave
permission. All data on his network was his to gather at will.
(Especially since the network was fully secured and not a "public" network.)

As to his conviction and sentence, I think he is lucky he got off so
easily.



Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are Off
[IMG] code is Off
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


Similar Threads
Thread Thread Starter Forum Replies Last Post
netgear ta612v behind netgear DG834G wireless adsl router problems limoncino VOIP 10 02-10-2010 12:45 PM
56k dial up on laptop 802.11G ? bumtracks alt.internet.wireless 117 08-06-2005 06:09 PM


All times are GMT. The time now is 05:53 PM.



Powered by vBulletin® Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.6.0 PL2

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45