Merry Christmas & Happy Holidays To All!
I'll be gone for Christmas!
Could not find any better Family Guy videos ( which haven't been removed for copyright reasons).
See ya all next year!
Dr.Huang Shoou Chyuan
Saturday, December 23, 2006
Wednesday, December 20, 2006
WI-FI Theft: Any punishment for abetting the crime?
Pre-sentence report for youth who tapped on wireless internet illegally
By David Teo/Noor Mohd Aziz, Channel NewsAsia Posted: 19 December 2006 2017 hrs
SINGAPORE: A 17-year-old, charged with illegally hopping onto another's wireless internet connection, will have to wait a little longer to know his fate.
This is the first such case to go to the courts in Singapore.
A district court judge has called for a pre-sentence report on Garyl Tan Jia Luo, who has pleaded guilty to using his laptop to gain unauthorised access to a home wireless network.
Details that came out of court say that early on 13th May, Tan was "bored" and wanted to access the internet but his mother had locked up the cable modem.
He left home with his laptop, and went in search of an unprotected internet connection in his neighbourhood which he found outside 6 and 7, Casuarina Walk.
A man who spotted him surfing illegally on the kerb side questioned him, and called the police.
In mitigation, Tan was remorseful and said he did not know it was an offence.
He was a first-year student at Republic Polytechnic and had dropped out of the course, said his lawyer.
The pre-sentence report will be heard on the 16th January. - CNA/so
Dear friends,
Correct me if I am wrong.
Wasn’t Gary extremely resourceful? His mum punished him by taking away his internet connection and he went out and did what any one would have done. He walked around and found an unsecured wireless access.
Unless I am mistaken, he did not use fraud to break into the network. He did not crack the password to hack into the system.
I have wireless connections in my house. And it is UNSECURED. ( I won’t tell you the address).
I expect that once in a while, my neigbours might be using my bandwidths with my compliments. But I don’t make a fuss about it. If I did not want to share my bandwidth, I would have password-secured it!
Is it not like this scenario?: A man keeps the front door of his house open, and through this door daily flies out wads and wads of dollar notes for no conceivable reason. The man makes no attempt to close the door and his neighbours had been walking past to pick up the notes from day One.
On the 2,345th day, Gary walks by and picks up a two-dollar note. Some nosy guy then stops him and calls the police. Gary gets to see the judge and then gets the slammer?
The person who let the dollar notes out for the previous 2344 day is not guilty of abetting this "hideous" crime ?
What’s happening?
No wonder, JBJ says ,” The Law is an ASS”
Lawyers please enlighten me. I am confused.
Merry Christmas everyone!
Dr.Huang Shoou Chyuan
1st Addendum from an Infosec professional ( Capella)
Cappella said...
I am not a lawyer, but a InfoSec Professional.
WiFi, otherwise known as IEEE 802.11, was DESIGNED to have OPEN access. They put in security is so as to RESTRICT unauthorised people from accessing it. Look at the IEEE specs to understand the intentions of the people who design the specification.
If the owner of the Wifi does not secure their network, by IEEE 802.11 standard, it means you give consent for people to access it. In Wifi, the onus is for the owner to secure it.
I think the law has gone TOO FAR in finding a scapegoat. They probably think Wifi is just like a normal Internet connection where accessing it illegally is a crime. The law-enforcers never know that Wifi was meant to be shared openly in the first place, with security implemented if you want to have restricted access. HAIZ!
1:21 PM
Latest addendum from Capella (22.12.06 11.42am) "Wireless 101 Class"
Cappella said...
Dr Huang, thanks for quoting me in verbatim in the ST Forum. All of a sudden my friends start calling me and said I am in ST Forum!??! :P
Anyway everyone, I shall conduct a Wireless 101 lesson here. Short and brief, to explain why what the law thinks has nothing to do with the way this technology was designed.
IEEE 802.11 clearly states that it already does not have the security and privacy of a wired network. Why so? Wired network is secure for the fact that you need to PHYSICALLY be connected to the network to be secure. For wireless, as it uses air as a broadcast medium, there is simply no way to control how the radio waves reach the intended client.
Because of this, they have implemented an authentication mechanism to help the implementors of wireless network to secure their networks. Now, what makes the whole thing damn confusing BACK THEN was that there was two kinds of authentication mechanism: Open System and Shared Key. According to IEEE 802.11 standard Page 59 Section 8.1.1, "Open System authentication is the default authentication algorithm." Now, in case you think it is anything special, Open System authentication is not even a secure form of authentication, all it requires from the client is to specify the correct SSID, and you are in.
You may think, hey, that is not secure at all. Yes and no. If today the Wireless@SG network access uses a different unique SSID for every single access point, the users will feel extremely frustrated as they roam from one wireless network to another (EBSS mode), because they have to change their SSID constantly. So, by using this default authentication mechanism, users can be assured that they are connected to the very same "GROUP" of wireless network. The problem here lies in the fact that the people who design the standard never expect that one day the SSID "linksys" actually can be implemented by 100 people staying near the same block, but are actually not related to one another.
Because of this, IEEE 802.11 also provides provision for the secure implementation of password security, which most of you probably have heard terms like WEP, WPA, WPA2. On top of that, high end wireless routers implement 802.1x, which authenticates by each individual wireless client. Most also implement stuff like MAC address authentication (which is pretty easy to break anyway). All in all, there are features to help the implementor of access point to secure their wireless network, but they HAVE TO ENABLE IT. Out of the box, if you look at all the access points available in the market, NONE has security enabled. The maker of the wireless product DOES NOT KNOW how is it being used. That is why I have said earlier, the onus is for the owner to enable it if they do not want people to use their wireless network. Otherwise, it is implicitly taken that you intend to share out your wireless network.
That is why in the last 1 to 2 years, most wireless routers vendors tend to put additional text or information about securing the wireless network for these people who are technically illiterate to make them aware about this issue. So for these people, even after reading these text, they still think they do not want to go through the hassle of enabling it, then again, you are implicitly allowing people to access, since you have been warned to secure it but you did not.
The law in Singapore has sided too much on the clueless. It is time to throw the responsibility back on these clueless and make them take responsibility for it. Just as you will not let someone who has no driving licence to drive a car, you will also expect that the user of a wireless access point should have some technical competency to secure it. I for one will be peeved if I found out that someone's wireless network has been taken control of by a malicious user attacking my PC. Yes, the malicious user is to be faulted, but the owner of the wireless network should never have provide that chance for the malicious user to hijack their network to attack my PC in the first place.
So all in all, I support the view of Dr Huang and others that this whole this is nothing but a mere scapegoat catching exercise. :P
By David Teo/Noor Mohd Aziz, Channel NewsAsia Posted: 19 December 2006 2017 hrs
SINGAPORE: A 17-year-old, charged with illegally hopping onto another's wireless internet connection, will have to wait a little longer to know his fate.
This is the first such case to go to the courts in Singapore.
A district court judge has called for a pre-sentence report on Garyl Tan Jia Luo, who has pleaded guilty to using his laptop to gain unauthorised access to a home wireless network.
Details that came out of court say that early on 13th May, Tan was "bored" and wanted to access the internet but his mother had locked up the cable modem.
He left home with his laptop, and went in search of an unprotected internet connection in his neighbourhood which he found outside 6 and 7, Casuarina Walk.
A man who spotted him surfing illegally on the kerb side questioned him, and called the police.
In mitigation, Tan was remorseful and said he did not know it was an offence.
He was a first-year student at Republic Polytechnic and had dropped out of the course, said his lawyer.
The pre-sentence report will be heard on the 16th January. - CNA/so
Dear friends,
Correct me if I am wrong.
Wasn’t Gary extremely resourceful? His mum punished him by taking away his internet connection and he went out and did what any one would have done. He walked around and found an unsecured wireless access.
Unless I am mistaken, he did not use fraud to break into the network. He did not crack the password to hack into the system.
I have wireless connections in my house. And it is UNSECURED. ( I won’t tell you the address).
I expect that once in a while, my neigbours might be using my bandwidths with my compliments. But I don’t make a fuss about it. If I did not want to share my bandwidth, I would have password-secured it!
Is it not like this scenario?: A man keeps the front door of his house open, and through this door daily flies out wads and wads of dollar notes for no conceivable reason. The man makes no attempt to close the door and his neighbours had been walking past to pick up the notes from day One.
On the 2,345th day, Gary walks by and picks up a two-dollar note. Some nosy guy then stops him and calls the police. Gary gets to see the judge and then gets the slammer?
The person who let the dollar notes out for the previous 2344 day is not guilty of abetting this "hideous" crime ?
What’s happening?
No wonder, JBJ says ,” The Law is an ASS”
Lawyers please enlighten me. I am confused.
Merry Christmas everyone!
Dr.Huang Shoou Chyuan
1st Addendum from an Infosec professional ( Capella)
Cappella said...
I am not a lawyer, but a InfoSec Professional.
WiFi, otherwise known as IEEE 802.11, was DESIGNED to have OPEN access. They put in security is so as to RESTRICT unauthorised people from accessing it. Look at the IEEE specs to understand the intentions of the people who design the specification.
If the owner of the Wifi does not secure their network, by IEEE 802.11 standard, it means you give consent for people to access it. In Wifi, the onus is for the owner to secure it.
I think the law has gone TOO FAR in finding a scapegoat. They probably think Wifi is just like a normal Internet connection where accessing it illegally is a crime. The law-enforcers never know that Wifi was meant to be shared openly in the first place, with security implemented if you want to have restricted access. HAIZ!
1:21 PM
Latest addendum from Capella (22.12.06 11.42am) "Wireless 101 Class"
Cappella said...
Dr Huang, thanks for quoting me in verbatim in the ST Forum. All of a sudden my friends start calling me and said I am in ST Forum!??! :P
Anyway everyone, I shall conduct a Wireless 101 lesson here. Short and brief, to explain why what the law thinks has nothing to do with the way this technology was designed.
IEEE 802.11 clearly states that it already does not have the security and privacy of a wired network. Why so? Wired network is secure for the fact that you need to PHYSICALLY be connected to the network to be secure. For wireless, as it uses air as a broadcast medium, there is simply no way to control how the radio waves reach the intended client.
Because of this, they have implemented an authentication mechanism to help the implementors of wireless network to secure their networks. Now, what makes the whole thing damn confusing BACK THEN was that there was two kinds of authentication mechanism: Open System and Shared Key. According to IEEE 802.11 standard Page 59 Section 8.1.1, "Open System authentication is the default authentication algorithm." Now, in case you think it is anything special, Open System authentication is not even a secure form of authentication, all it requires from the client is to specify the correct SSID, and you are in.
You may think, hey, that is not secure at all. Yes and no. If today the Wireless@SG network access uses a different unique SSID for every single access point, the users will feel extremely frustrated as they roam from one wireless network to another (EBSS mode), because they have to change their SSID constantly. So, by using this default authentication mechanism, users can be assured that they are connected to the very same "GROUP" of wireless network. The problem here lies in the fact that the people who design the standard never expect that one day the SSID "linksys" actually can be implemented by 100 people staying near the same block, but are actually not related to one another.
Because of this, IEEE 802.11 also provides provision for the secure implementation of password security, which most of you probably have heard terms like WEP, WPA, WPA2. On top of that, high end wireless routers implement 802.1x, which authenticates by each individual wireless client. Most also implement stuff like MAC address authentication (which is pretty easy to break anyway). All in all, there are features to help the implementor of access point to secure their wireless network, but they HAVE TO ENABLE IT. Out of the box, if you look at all the access points available in the market, NONE has security enabled. The maker of the wireless product DOES NOT KNOW how is it being used. That is why I have said earlier, the onus is for the owner to enable it if they do not want people to use their wireless network. Otherwise, it is implicitly taken that you intend to share out your wireless network.
That is why in the last 1 to 2 years, most wireless routers vendors tend to put additional text or information about securing the wireless network for these people who are technically illiterate to make them aware about this issue. So for these people, even after reading these text, they still think they do not want to go through the hassle of enabling it, then again, you are implicitly allowing people to access, since you have been warned to secure it but you did not.
The law in Singapore has sided too much on the clueless. It is time to throw the responsibility back on these clueless and make them take responsibility for it. Just as you will not let someone who has no driving licence to drive a car, you will also expect that the user of a wireless access point should have some technical competency to secure it. I for one will be peeved if I found out that someone's wireless network has been taken control of by a malicious user attacking my PC. Yes, the malicious user is to be faulted, but the owner of the wireless network should never have provide that chance for the malicious user to hijack their network to attack my PC in the first place.
So all in all, I support the view of Dr Huang and others that this whole this is nothing but a mere scapegoat catching exercise. :P
Sunday, December 17, 2006
Self-regulation of Singapore Blogosphere- Whatever for??
Dear Friends,
Although I have great admiration for people like Yadav, Bernard Leong,Aaron and Gerald, I must come out to confess that I am totally against the idea of self-regulation to our blogosphere.
The blogosphere as we know it now, is the last bastion of truly free expression.
What was there before there was blog?
What did we have before the internet gave all of us this precious gift?
Granted, the MSM-MainStream Media (or their masters) have loosened their grip and are allowing more divergent views to be published in their forum pages. But the MSM is still firmly and totally controlled by the government.
The views of the government on the functions of the media are well known. When push come to shove, one of the government leaders would invariably mouth something like,” We will not let the editors/journalists/media etc… set the agenda”-ad nauseum.
Our MSM ain't no Fourth Estate
The MSM in Singapore is never going to be the “Fourth Estate” as is the case in the western democracies.
The “Fourth Estate’s” coinage has been attributed to Edmund Burke (1729 - 1797), a British politician. It comes from a quote in Thomas Carlyle's book, "Heros and Hero Worship in History" (1841).
"Burke said that there were three Estates in Parliament, but in the Reporters Gallery yonder, there sat a fourth Estate more important far than they all."
The three estates in the above quote referred to the British parliament,( the Lords Temporal, the Lords Spiritual and the Commons). The Lords Temporal and the Lords Spiritual combined being The House of Lords, the upper House of parliament. And the Commons is The House of Commons or the British lower House.
Singapore’s MSM is not there to be a watchdog; a check and balance of the government’s abuse of power. If Woodward and Bernstein were journalists in Singapore, they would not be heroes. Very likely, they would have been detained under the Internal Security’s Act if they had tried to publish details of the happenings at the Watergate hotel on that fateful day in June 1972.
We have the Speaker’s Corner, I hear you say. You have to register at the police station next to Hong Lim Square and you also cannot use any form of amplification!
If you try a “Chee Soon Juan” and as much as walk together in larger than a group of four’s, you will share the same fate and ignominy as him. I do admire CSJ’s guts.
That leaves us precious little left.
We can just take it ( like most Singaporeans have done in the past) or leave it ( as many more have done in the present).
Or we can blog…
The “gahmen” has seemingly turned a blind eye to Singapore’s nascent blogosphere. The IDA or the police may actually visit to read the contents ( they do, I assure you) but unless one is so stupid as to write defamatory stuff about certain families and characters, or worse incite racial or religious hatred ( which I am vehemently against-incitement of hatred that is), then for godknowswhatreason, they have let us be.
Perhaps they want us to let off some steam (words in cyberspace are infinitely better than a revolution downtown) , or maybe they want to know what these “radical intellectual-types” actually feel? or maybe they are really closet liberals waiting to come out (ok just joking). I don’t know and I don’t care.
So why oh why?
We have the freedom now. So, why do we want to self-regulate? Have we been so used to being a subjugated people that when freedom has been thrust upon us, we tell them, “No, please we don’t deserve freedom” ( Xenoboy talk the most sense of us all here).
History repeating itself?
Back in the early days of Singapore’s internet, we had soc.culture.singapore which was a newsgroup.It was like the present Sammyboy’s internet forum.
When some (intellectual-types) advocated that we self-regulate ( or they called it “moderation”) I was adamantly opposed to it.
I was amongst a minority who voiced out vociferously against this. However,the majority went ahead to form "moderated.soc.culture.singapore".
You guessed it. It died a quick death. Uncelebrated-no funeral.
None of you even knew such a newsgroup existed. You know whatimean?
So, I say what I said then, “NO!”
Cheers
Dr.Huang Shoou Chyuan
Although I have great admiration for people like Yadav, Bernard Leong,Aaron and Gerald, I must come out to confess that I am totally against the idea of self-regulation to our blogosphere.
The blogosphere as we know it now, is the last bastion of truly free expression.
What was there before there was blog?
What did we have before the internet gave all of us this precious gift?
Granted, the MSM-MainStream Media (or their masters) have loosened their grip and are allowing more divergent views to be published in their forum pages. But the MSM is still firmly and totally controlled by the government.
The views of the government on the functions of the media are well known. When push come to shove, one of the government leaders would invariably mouth something like,” We will not let the editors/journalists/media etc… set the agenda”-ad nauseum.
Our MSM ain't no Fourth Estate
The MSM in Singapore is never going to be the “Fourth Estate” as is the case in the western democracies.
The “Fourth Estate’s” coinage has been attributed to Edmund Burke (1729 - 1797), a British politician. It comes from a quote in Thomas Carlyle's book, "Heros and Hero Worship in History" (1841).
"Burke said that there were three Estates in Parliament, but in the Reporters Gallery yonder, there sat a fourth Estate more important far than they all."
The three estates in the above quote referred to the British parliament,( the Lords Temporal, the Lords Spiritual and the Commons). The Lords Temporal and the Lords Spiritual combined being The House of Lords, the upper House of parliament. And the Commons is The House of Commons or the British lower House.
Singapore’s MSM is not there to be a watchdog; a check and balance of the government’s abuse of power. If Woodward and Bernstein were journalists in Singapore, they would not be heroes. Very likely, they would have been detained under the Internal Security’s Act if they had tried to publish details of the happenings at the Watergate hotel on that fateful day in June 1972.
We have the Speaker’s Corner, I hear you say. You have to register at the police station next to Hong Lim Square and you also cannot use any form of amplification!
If you try a “Chee Soon Juan” and as much as walk together in larger than a group of four’s, you will share the same fate and ignominy as him. I do admire CSJ’s guts.
That leaves us precious little left.
We can just take it ( like most Singaporeans have done in the past) or leave it ( as many more have done in the present).
Or we can blog…
The “gahmen” has seemingly turned a blind eye to Singapore’s nascent blogosphere. The IDA or the police may actually visit to read the contents ( they do, I assure you) but unless one is so stupid as to write defamatory stuff about certain families and characters, or worse incite racial or religious hatred ( which I am vehemently against-incitement of hatred that is), then for godknowswhatreason, they have let us be.
Perhaps they want us to let off some steam (words in cyberspace are infinitely better than a revolution downtown) , or maybe they want to know what these “radical intellectual-types” actually feel? or maybe they are really closet liberals waiting to come out (ok just joking). I don’t know and I don’t care.
So why oh why?
We have the freedom now. So, why do we want to self-regulate? Have we been so used to being a subjugated people that when freedom has been thrust upon us, we tell them, “No, please we don’t deserve freedom” ( Xenoboy talk the most sense of us all here).
History repeating itself?
Back in the early days of Singapore’s internet, we had soc.culture.singapore which was a newsgroup.It was like the present Sammyboy’s internet forum.
When some (intellectual-types) advocated that we self-regulate ( or they called it “moderation”) I was adamantly opposed to it.
I was amongst a minority who voiced out vociferously against this. However,the majority went ahead to form "moderated.soc.culture.singapore".
You guessed it. It died a quick death. Uncelebrated-no funeral.
None of you even knew such a newsgroup existed. You know whatimean?
So, I say what I said then, “NO!”
Cheers
Dr.Huang Shoou Chyuan
Subscribe to:
Posts (Atom)