2 Feb
2002
2 Feb
'02
2:17 p.m.
This is sort of a sanity check. I'm putting the question here because
of the cumulative years of professional experience here, as well as an
"international" perspective.
How would you react to a guest in your (not normally open to the
public) building plugging a computer into a random ethernet port and
asking for a DHCP lease? Is there any non-emergency consideration that
would make that appropriate?
Doc
2 Feb
2 Feb
3:25 p.m.
On Sat, 2 Feb 2002, Doc Shipley wrote:
How would you react to a guest in your (not normally
open to the
public) building plugging a computer into a random ethernet port and
asking for a DHCP lease? Is there any non-emergency consideration that
would make that appropriate?
A little amplification -
The building in question is a secured building. Guests are required
to log in & out, and rooms other than snack area & restrooms are locked.
It is a government building. Space is donated to a local computer
group. A member of that group simply plugged into the local LAN. The
building's rep did state that the port should not have been left hot,
and nobody has admitted, or claimed, that the member did anything but
access the internet.
I guess my opinion, which isn't very popular here, is that unless
permission has been explicitly given, one should not assume permission
to a local LAN, or internet access through the LAN. I do recognize that
my position is due to working frequently at secured sites. One such
facility, in San Antonio, prohibits ANY access to their network by
non-employees. Contractors must tell a technician what commands to
enter, and which buttons to click.
Doc
4:54 p.m.
I guess my opinion, which isn't very popular
here, is that unless
permission has been explicitly given, one should not assume permission
to a local LAN, or internet access through the LAN. I do recognize that
my position is due to working frequently at secured sites. One such
facility, in San Antonio, prohibits ANY access to their network by
non-employees. Contractors must tell a technician what commands to
enter, and which buttons to click.
I agree with the above. Nobody should ever just assume it is
ok to do whatever they wish on somebody elses network withouth
getting explicit permission first. I have similar problems with
contractors in a similar secure building. If for no other reason
than it is bad etiquette to impose yourself into someone elses area
without permission to do so.
Jeff
--
Home of the TRS-80 Model 2000 FAQ File
http://www.cchaven.com
http://www.geocities.com/siliconvalley/lakes/6757
5:38 p.m.
On Sat, 2 Feb 2002, Doc wrote:
I guess my opinion, which isn't very popular
here, is that unless
permission has been explicitly given, one should not assume permission
to a local LAN, or internet access through the LAN. I do recognize
that my position is due to working frequently at secured sites. One
such facility, in San Antonio, prohibits ANY access to their network
by non-employees. Contractors must tell a technician what commands to
enter, and which buttons to click.
Of course, there is a conceptually simple way to prevent 99.9% of people
from accessing a lan in this kind of situation. Wire
the wall-mounted RJ45
jacks to use the normally unused pairs for TX/RX, and use
custom made
patch cables to connect to the computer's NIC. For some ultra-secure type
site, wiring the other two pairs to detect a connection, and or to deliver
48VDC (from a spare telephone switch supply) would deter all but the most
determined.
-Toth
6:54 p.m.
On Sat, 2 Feb 2002, Tothwolf wrote:
For some ultra-secure type site, wiring the other two
pairs to detect a
connection, and or to deliver 48VDC (from a spare telephone switch
supply) would deter all but the most determined.
Or even have it so that unused RJ45 wall jacks are wired to a nearby
electric outlet. "Oh, you plugged into one of our proprietary power
ports...".
Or use (or invent, if they do not exist) wall jack panels that have a
lockable metal door.
--
Jeffrey S. Sharp
jss(a)subatomix.com
8:20 p.m.
On Sat, 2 Feb 2002, Jeffrey S. Sharp wrote:
On Sat, 2 Feb 2002, Tothwolf wrote:
Well, I wouldn't want to go that far, as it would likely electrocute
anyone who happened to touch the other end of the cable plugged into the
jack. 48VDC across some TX/RX pins would still certainly take the NIC for
a thrill ride, and it would likely loose its magic smoke in the process.
I'd think that would be enough of an incentive for all but the most
determined intruder to not try it again.
For some ultra-secure type site, wiring the other
two pairs to detect a
connection, and or to deliver 48VDC (from a spare telephone switch
supply) would deter all but the most determined.
Or even have it so that unused RJ45 wall jacks are wired to a nearby
electric outlet. "Oh, you plugged into one of our proprietary power
ports...". Or use (or invent, if they do not exist) wall jack
panels that have a
lockable metal door.
Locking covers are available for Leviton "Decra style" receptacles, and
there are "Decra style" keystone plates available. There are several
problems in implementing this idea however. Those locking covers are both
ugly, and expensive, and it is also quite likely they would end up being
left unlocked anyway.
IMHO, the best way to avoid this kind of problem is to not install RJ45
jacks in insecure areas in the first place. The next best way to avoid
this kind of problem is to disconnect the jack completely, or at the very
least, restrict what can be done via a connection to the jack.
-Toth
3 Feb
3 Feb
10:13 a.m.
A non-text attachment was scrubbed...
Name: not available
Type: text
Size: 524 bytes
Desc: not available
Url :
http://www.classiccmp.org/pipermail/cctalk/attachments/20020203/c92ae546/at…
2 Feb
2 Feb
7:17 p.m.
How would you react to a guest in your (not normally open to the
public) building plugging a computer into a random ethernet port and
asking for a DHCP lease? Is there any non-emergency consideration that
would make that appropriate?
Doc
How would I react? I would inform our network administrator that someone
forgot to turn the Hub Security back on after the last major computer
upgrades. Once hub security is once again established, I dont have to
worry about anyone plugging in unauthorized computers, or moving
computers to another room without informing the proper people who
would then do the move, etc.
Of course, I work at a university. Theres always some student who thinks they
can tap into our network ports, or a smart one who thinks they can just
configure their laptop to an existing IP number, and unplug the network
connection of the computer that is supposed to use that IP, etc. Once they
realize it doesnt work, we usually dont have any problems.
-Lawrence LeMay
3 Feb
3 Feb
4:20 p.m.
How would you react to a guest in your (not normally open to the
public) building plugging a computer into a random ethernet port and
asking for a DHCP lease? Is there any non-emergency consideration that
would make that appropriate?
Doc
The laptop should have been confiscated until it could be verified no
company proprietary information and been copied to it. If there are
encrypted files, the owner should be willing to decrypt them, or face
the complete wipe of his hard drive.
Clint
4:42 p.m.
On Sun, 3 Feb 2002, Clint Wolff (VAX collector) wrote:
The laptop should have been confiscated until it could be verified no
company proprietary information and been copied to it. If there are
encrypted files, the owner should be willing to decrypt them, or face
the complete wipe of his hard drive.
At the San Antonio facility I mentioned before, where we have to do
commands and diags through their technicians, you have to submit your
laptop to a virus scan on entering the building. If they catch you with
a cat5 cable *in* the building, or catch you plugging in, they don't
care whether you got an IP or not. They wipe your drive. Period.
We left our laptops at home....
Doc
5:05 p.m.
On Sun, 3 Feb 2002, Doc wrote:
This would be the perfect occasion to use the exploding laptop.
Peace... Sridhar
The laptop
should have been confiscated until it could be verified no
company proprietary information and been copied to it. If there are
encrypted files, the owner should be willing to decrypt them, or face
the complete wipe of his hard drive.
At the San Antonio facility I mentioned before, where we have to do
commands and diags through their technicians, you have to submit your
laptop to a virus scan on entering the building. If they catch you with
a cat5 cable *in* the building, or catch you plugging in, they don't
care whether you got an IP or not. They wipe your drive. Period.
We left our laptops at home....
12:28 p.m.
On Sat, 2 Feb 2002, Doc Shipley wrote:
This is sort of a sanity check. I'm putting the question here because
of the cumulative years of professional experience here, as well as an
"international" perspective.
I want to thank everyone who's responded to this. I don't feel quite
as much like an intransigient old barstid now....
The issue has pretty much stabilized here. (Did I mention I'm an
elected slave of the computer group in question?) We're drafting a
letter to the hosting agency, apologising for the mishap. We're
probably going to make a 12x24 "Dos & Don'ts" placard for the meetings.
And this may have been the final weight on the scales to ratify & post a
group FAQ.
I'm still pretty much floored by the reactions of some local
members. Not surprisingly, almost all of the "IT professionals" thought
it was a given that access is denied until granted. What did surprise
me was the number of the [younger] 31337 h4x0rz who see nothing out of
line about just plugging in, _anywhere_. A few were quite shocked to
learn that there are laws against it.
Bah! Maybe I really am an intransigient old barstid. If so, at
least I'm in good company here....
Doc
12:43 p.m.
I'm still pretty much floored by the reactions of some local
members. Not surprisingly, almost all of the "IT professionals" thought
it was a given that access is denied until granted. What did surprise
me was the number of the [younger] 31337 h4x0rz who see nothing out of
line about just plugging in, _anywhere_. A few were quite shocked to
learn that there are laws against it.
Well, once you start noticing students running network snoopers on
your networks, and capturing all sorts of account passwords, it sort
of makes it imperative to prevent someone from just plugging in
an unauthorized computer. Having an separate network for people to
plug in, that you can keep isolated, is ok. But the non IT professionals
dont realize the difference, or why it is necessary.
-Lawrence LeMay
3:03 p.m.
Bah! Maybe I really am an intransigient old
barstid. If so, at
least I'm in good company here....
Doc
Yeah...
One of the thing's I'm considering is using the switch that feeds the
conference rooms to only allow connections to our jet direct printers and
proxy servers external IP address.
Bill
--
d|i|g|i|t|a|l had it THEN. Don't you wish you could still buy it now!
bpechter@shell.monmouth.com|pechter@ureach.com
10:38 p.m.
Bah! Maybe
I really am an intransigient old barstid. If so, at
least I'm in good company here....
Doc
Yeah...
One of the thing's I'm considering is using the switch that feeds the
conference rooms to only allow connections to our jet direct printers and
proxy servers external IP address.
8199
days inactive
8201
days old
14 comments
10 participants
participants (10)
-
ard＠p850ug1.demon.co.uk -
doc＠mdrconsult.com -
jhellige＠earthlink.net -
jss＠subatomix.com -
lemay＠cs.umn.edu -
mikeford＠socal.rr.com -
pechter＠bg-tc-ppp894.monmouth.com -
tothwolf＠concentric.net -
vance＠ikickass.org -
vaxman＠earthlink.net