Piggybacking

There's an article in today's Sun about a bloke in Cornwall who had his laptop confiscated by the police for sitting outside someone's house and using their unsecured network. I know this issue has been aired many times here, but I was wondering if anything on the laptop would reveal which network had been connected.
Presumably anyone in the know would disable all logs etc. which could give the game away.

>>anything on the laptop would reveal which network had been connected.

I expect that the MAC of the laptop was logged by the router through which he was connecting. Plenty of evidence for that on the laptop even if the chap did change the laptop wireless MAC in software.

S.

Why would you want to know?

The only cases I've seen convicted have relied on the accused admitting the offence and entering a guilty plea. No doubt after some pressure from the authorities.

I would like to see someone actually fight one of these cases. It would then be up to the prosecution to prove the access was unauthorised.

More disturbing is the idea that you can be arrested for suspiciously using a laptop in a car.

Edited by deleted (Sat 21-Jul-07 14:33:21)

Do you mean would the Police be able to work out which web-pages had been accessed?

Presumably the network's IP address would be recorded, so any suspicious use would be tracked to that, not the unauthorised user.

Yes the routers WAN IP address would be recorded, together with the browser used, page accessed, and time. The totality of information might prove it wasn't the router's owner.

edited to add:

The above information would be stored in the logs of the web-sites visited, not the ISPs.

Edited by deleted (Sat 21-Jul-07 15:20:29)

In reply to:

---

but I was wondering if anything on the laptop would reveal which network had been connected.

---

/Dons forensic investigator hat

You'd be surprised what we can find out!!

/puts hat back down

It's a heavy burden and a bit boring sometimes if you ask me!

personally i think its lies. there is no way of knowing (assuming the AP doesnt keep decent logs itself) if it was connected to or not.

wouldnt the AP record the wrong MAC though?

you cant get done just for having some mac spoofing software on the node. if you did, i would be charged for using my laptop in a car while using backtrack to surf the web as backtrack would be "suspicious activity" as it is a network security suite.

innocent untill proven guilty!

Edited by deleted (Sun 22-Jul-07 02:53:13)

In reply to:

---

There's an article in today's Sun about a bloke in Cornwall who had his laptop confiscated by the police for sitting outside someone's house and using their unsecured network.

---

I think it may transpire that he was doing rather more than that. There are other reasons for hijacking a network, other than getting free access. The guy may have been accessing illegal websites, or using the victim's network to send out illegal material. I doubt whether the police would go to such lengths over a first-offence of broadband theft.

It's easy to determine if the laptop had been connected, the router should have a log of the laptops MAC address in its routing table. The MAC address is a unique identifier (no other network device will have the same MAC) that all network devices must have. Of course this can be spoofed to make it look different. but if the guy got caught then chances are he didn't do that.

Unless the piggbacker ruses a Locally Administered Address - easily done to.

Or the router is switched off.

No I think that the worse bit (assuming that the Sun have been quoted correctly) is that the Police seized the alleged perp's laptop. Under what statute I wonder.

In reply to:

---

No I think that the worse bit (assuming that the Sun have been quoted correctly) is that the Police seized the alleged perp's laptop. Under what statute I wonder.

---

Almost certainly as evidence of the alleged crime.

I hope that was the case because he original piece didn't quite put it that way.

>>Under what statute I wonder.

Preservation of evidence, sorry I can't remember what section but it is probably covered by PACE somewhere.

S.

absoloutely, and for prevention of any further offences for good measure