Comment by bradleyland | Hacker News Reader

Comment by bradleyland | Hacker News Reader

Probably worth pointing out that one should remain aware of their local laws when carrying out such activities as the ones outlined in this HOW TO. Because you're blindly hitting hosts and attempting logins, you don't know whose infrastructure you're probing. If you accidentally knock on the wrong door, the simple act of attempting a log in can cause issues for you (legal and otherwise).

I'm trying to avoid sounding like Chicken Little here, but this article makes these actions very accessible. If you're someone who is just getting started toying with networks and security, it's likely that you haven't thought through what can happen if something you try actually works.

Nmap has a great page that discusses the ins-and-outs of the civil and legal issues involved with port scanning (a related activity). However, keep in mind that the guide linked here goes well beyond port scanning in to actually attempting, and presumably, gaining access to someone else's network. While the legality of port scanning is ambiguous, accessing someone else's network is not. If you land on the wrong guy's lawn, you can end up in a very expensive, and potentially dangerous place.

http://nmap.org/book/legal-issues.html

When I read the announcement, I got the feeling that what he's doing isn't so much leveraging other people's routers as providing the owners of those routers with plausible deniability.

Legal and IMO worthy of much praise.

Of course you can ignore all that if you are attacking from Nigeria.

Laws are exciting and important (especially good ones like Newton's laws of motion), but laws could improve too: If someone gets caught doing this they probably ought to do community service working on some bug bounty program instead of going to jail.

I love this impression that if you're connecting from <insert somewhere in Africa>, laws don't apply. I'd wager nobody that's ever actually lived anywhere in 3rd world bandies it about.

True, you're less likely to actually be convicted, but the months/years waiting for trail is guaranteed to be worse than your actual sentence elsewhere, if not fatal.

The parent specifically mentioned Nigeria. Africa is not a country, and his comment may not apply to say, South Africa or Morocco. You're the one generalizing about 3rd world countries, not him.

If you think LLE or even the FBI is going to open the diplomatic channels necessary to pursue someone in Nigeria over access to a consumer-grade router, you're kidding yourself. For all practical purposes, these laws do not in fact apply there.

Unless that consumer grade router is running a bank of a nuclear power plant.

There are very few places outside the reach of US law enforcement. Especially if they bother to get Interpol involved.

I am now imagining wardriving to a nuclear power plant parking lot in order to score free wifi off their NetGear.

Why not, it worked against TJX, right?

Orders of magnitude more likely to find an open WiFi in a bank's parking lot than you are to find a WAN-facing consumer-grade router. Any employee in the company could screw up the former ("I didn't get good wifi so I brought in a router from home!"). The latter requires grossly incompetent netsec.

> it's likely that you haven't thought through what can happen if something you try actually works.

Yup. Luckily, when I tried something similar, I was very much a minor, so the only consequence was that our ISP banned our previous account and required us to sign up for a new one.

Reply on news.ycombinator.com