0

Lets say I have created an "Offensive" security system. It runs on my own private network on my laptop any where I go. My private network has a wireless access point called "Malicious Wifi" and it is unsecured (Anyone can connect to it without a password).

My security system will attack any unauthorized devices that connect to it. The goal of the attack is to gain access to the system by any means necessary but without any interest of the internal data of the device. Just to gain control of the device.

If I goto any location (Starbucks for example), and someone connects to my private (albeit unsecured) network out of curiosity.

Can I be held civil and/or criminally liable for any damages that arise from my security system attacking their device on my private network?

What if no permanent damage was done and no data was taken or used for malicious intent. Just temporary control of the device. Does this avoid or reduce potential liability?

  • "infection" sounds a lot like unauthorized access. – user4460 Nov 3 '17 at 20:39
  • Are you using Starbuck's wi-fi at all? I assume not, as you will need your own wi-fi router and laptop to configure and run the malicious network access point. But you are physically in a Starbuck's, so laws of malicious activity while on their property may apply. As well as unauthorized access to the "infected" devices and networks. – BlueDogRanch Nov 3 '17 at 21:10
  • @BlueDogRanch A Wi-Fi pineapple would facilitate what you suggested. But in regards to the question. No it is not connect to Starbucks Wi-Fi. Also, not sure how Starbucks rules apply to a "Private" network albeit unsecured. – Digital fire Nov 3 '17 at 21:30
  • Starbucks' network rules don't apply, as I pointed out; you're not using their network. But local laws about forms of malicious activity in a public space - like a store open to the public - may very well apply. But mostly, there are laws concerning unauthorized access to those people's devices to install the malicious software; that's what is primarily illegal. Really doesn't matter how or where you do it. – BlueDogRanch Nov 3 '17 at 21:51
  • @BlueDogRanch Right but it's on a private network (unsecured or not). It's like a home owners dog biting an intruder who decided to walk through an unlocked gate on to private property with a "vicious dog" sign. – Digital fire Nov 3 '17 at 21:58
2

18 USC 1030 starts

Whoever— (1) having knowingly accessed a computer without authorization or exceeding authorized access

In this scenario, I will refer to the person running the access point as Malicious, and the person accessing it as Curious. When Curious accesses the network, they have done so without authorization. Accessing a computer is not itself a crime, and other elements are required to make it a crime – under (2)(C) that includes obtaining "information from any protected computer" (cellphones and modern computers are protected computers, since they are capable of affecting interstate commerce). Also under (5)(C), it becomes a crime if one

intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss.

Other conditions involve accessing financial data, committing fraud, threatening, etc. and do not seem obviously applicable. It is not obvious that access to an unsecured network falls under the ambit of (2)(C) or (5)(C). In so connecting to Malicious's computer, Curious obtains an IP address, which constitutes information, and also consumes a tiny amount of bandwidth (miniscule loss). At the same time, any attempt to access any network or web page is always done without explicit authorization (yet), and always involves obtaining information (HTML, some means of asking the user to agree, and getting the user's agreement). As far as I know, it has not been found that accessing a computer without prior permission violates 18 USC 1030. In the case of US v. Drew, defendant accessed a web page but violated the TOS – the government argued that that made the access "without (and/or in excess of) authorization" (defendant did obtain actual information, not just an IP address, and used it maliciously). However, the conviction was vacated on the grounds that violating TOS does not clearly constitute having unauthorized access. Since Curious caused no harm and did not snoop on Malicious's computer, since all computers with wireless automatically probe all sorts of devices out there without pre-authorization to ask for authorization, I see no reasonable change that Curious has committed a crime; and clearly, Curious has caused no harm.

Malicious has more clearly violated the law, by likewise accessing Curious's computer but also (5)(A)

knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer

Malicious does not have to specifically know that his machine is transmitting the virus to Curious: he knows (or should know) that he has cause the situation where the virus will transmit, and that damage will result. Under 18 USC 1030(g), Curious may seek compensation in a civil action.

Since every state has its own wireless-access laws, we'd need a specific state to see if a state law has been violated.

  • Thank you for your great answer! The only misinterpretation is that "Malicious" in your example is actually a Wi-Fi network. Not a computer. But since the network IS connected to a computer that will be on the attack. Your answer is pretty close. I'm just unsure of certain elements of it. The gist of it being that - Curious has entered a private network that has an "Offensive" security mechanism. – Digital fire Nov 4 '17 at 1:01
  • Not wanting to get deep into compu details, but does the network operate without a device that satisfies the criteria of being a computer? For instance, it's a set of things that a cell phone or laptop hot spot does. If "Malicious" isn't even legally computer, so much the better for Curious. – user6726 Nov 4 '17 at 1:41
  • After reading through 18 USC 1030 (e) (1) - the network device itself could loosely be interpreted as a computer. – Digital fire Nov 4 '17 at 1:50
  • I modified the question to be a bit more clear on my intent. – Digital fire Nov 4 '17 at 2:56
1

This message brought to you by the legal concepts "reasonable man", "attractive nuisance" and "booby trap".

The first problem is that you are advertising the SSID. That is, when Innocent queries "any WiFi networks in the area?", your system is jumping up and answering "Yes! Right here! My name is Malicious_Wifi and I am open."

First, if you do not desire intrusion into your WiFi network, you are granted ample ability to lock it down:

  • you can fail to advertise the SSID (force them to know the SSID)
  • you can use WAP, WPA etc. to set a password on the WiFi
  • you can have an "open" WiFi but one which answers every HTTP request with an interstitial logon challenge.

By doing none of these, you are inviting connection. Now your grandfather with no computer experience, in your small town, might have a case against weird people parking vans on his street to poach his Open WiFi becuase he didn't know how to secure it. But as a techie you have no standing to criticize. You have created an attraction.

If you use the UI's of many mobile devices, you know it can be awkward to control them precisely; for instance it may pop up an interstitial inviting you to jon Starbucks WiFi, then 50ms before you actually tap it, change the interstitial to inviting you to join Malicious_WiFi. tablets do this accidentally. This stuff is not safety-engineeered because the industry philosophy is "features before bugfixes" or "move fast and break things". And of course, people don't really pay that much attention. So this kills your presumption that everyone who joins your network has mens rea, a thoughtful intention to do so. You are at too high risk to snare innocents, which is why I call them "Innocent" instead of "Curious".

If you have a spooky old house or installation which attracts the curious/urban explorers, and you make efforts to secure it but they keep breaking in anyway, and it draws crime or there's risk of getting hurt in there, that is called an attractive nuisance. This increases your liability for what happens in there. You don't become criminally liable for cooking meth, but you certainly will be civilly liable if somebody puts their foot through a faulty stair.

That's not normally the case. Once a criminal broke into a house, and tried to exit through the garage. The interior door locked behind him, and for some reason (gross mechanical incompetence?), he was unable to open the garage door. He subsisted on large bags of dogfood and bottled water. He sued the family for his misery, and lost, because it was happenstance and not an intentional booby-trap. It met the very minimal duty of care every facility manager has to first responders and trespassers to not leave the most gross hazards unguarded (open pits, rotted stairs, exposed electrical wiring) etc. You know sometimes, people get in trouble with that standard, with pools.

Obviously, this "duty of care" excludes booby-traps. If you intentionally create a hazard to a trespasser, then you have crossed the line from negligent to malice aforethought: here it is you who has mens rea. You are criminally accountable for the trespasser's injuries same as if you attacked him in the street. Indeed, when Fort Knox type places use booby traps, they merely contain the intruder long enough for security to capture her, and they have a system to positively alert security immediately before the trespasser needs an insulin shot.

How does this apply to your situation? From the reasonable citizen's view. You will find it very hard to seat a jury who will consider it a despicable act to log onto an open WiFi. They will consider your hacking to be a wildly disproportionate response, and not a response at all, but the origin crime.

They will consider your hacking in this context to be a "booby trap", again a crime all its own. Yes, I realize your idea makes sense from inside its own bubble. But the view from 30,000 feet is this is just a slight variation on other Trojan horse wifi networks which seek to infect other systems for nefarious purposes: it only differs by using a cutesie name for the SSID. And even that makes sense: there's a reason phishers still claim to be from Nigeria and swerve out of their way to do so. You look, walk and quack like an actual Trojaner.

"I'm the bad guy?" 'Fraid so.

0

It doesn't matter where or how you conduct your attempts at unauthorized access to other peoples' computers - i.e., by fooling them into connecting to your wi-fi network in a public space - becuase it is still illegal: Computer Fraud and Abuse Act - Wikipedia.

As to the SSID (wi-fi network name) being named "Malicious." Many people's devices simply connect to any open network; they may not even see the SSID. Or, they may, and they are curious; do they waive all their rights to access by you by connecting to the network?

Your unauthorized access could also be compounded by where you were when you set up your wi-fi point. Starbucks could go after you - in a civil sense - for using their premises for your illegal activity.

  • It wasn't fooling the user. The network is literally called "Malicious Wifi". If it were called "Starbucks Wifi", I could see your point. Further more, the activity being "illegal" is debatable as it is security testing done on a private network. – Digital fire Nov 3 '17 at 22:04
  • Your idea of "security testing" is unauthorized access to other people's devices; your own private network is a necessary tool to do that. Is there a difference if you hotwire a car or steal it with a dealership key? And, many people's devices simply connect to any open network; they may not even see the SSID. Or, they may, and they are curious; do they waive all their rights by connecting? – BlueDogRanch Nov 3 '17 at 22:20
  • When connecting to most wifi connections that are owned by private companies. They make you agree to the terms they set. Which can include observing everything the user does over that network. It is the user's responsibility to use HTTPS to secure themselves.. not the private company providing internet access. Under your premise, the company can get sued because the user did not secure their connection and someone else connected to the network sniffed their credit card and went on a shopping spree. – Digital fire Nov 3 '17 at 22:26
  • @DigitalFire: Do you seriously think if you trick people into T&Cs that claim to allow you spying on their computer or hacking into their computers that would protect you legally? – gnasher729 Nov 4 '17 at 0:24
  • @gnasher729 1) I was explaining that private companies who offer Wi-Fi to customers have the right to monitor networks. I never said what you are suggesting. 2) if someone else is on that network sniffing the network. And you are stupid enough to use that network with unencrypted communication. Your are an idiot or naive. 3) My question is about security testing on a private network with an unsecured Wi-Fi. The fact that someone joined that network is not the networks responsibility. – Digital fire Nov 4 '17 at 0:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.