Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was recently at a village hall (in the UK), some distance from where I live, for a party. I noticed that they had unsecured wi-fi with an SSID of NETGEAR. I assumed it was free wi-fi for users of the hall so I connected with my phone (now I think about it, I don't recall seeing the free wi-fi logo). The fact that the SSID of NETGEAR was the default that many routers are shipped with didn't go unnoticed by me, so I found the gateway IP, connected with safari, and out of curiosity, tried the default username and password for the majority of netgear routers - it let me in to the admin console.

I guess I shouldn't have tried to log in to the admin console without the owner's permission, but I feel I should let them know that they are vulnerable, and should change the password from default. I could perhaps make up a story that I thought I was connected via VPN to my router at home, but the connection had failed, or some such rubbish, but I'd rather not lie.

What should I do? Should I just forget it because I shouldn't have tried to gain access? Should I tell them the truth because I didn't do anything malicious?

share|improve this question
1  
Interesting question. I'd be interested in any opinions you get on this one. –  Grezzo Jul 9 '12 at 15:32
2  
Are you sure it was the Wi-Fi of the village hall? Could have been a neighbouring house? The village halls I've been to have been surrounded with residential places. I would be sure who it was before you start thinking about informing anyone. –  SomethingSmithe Jul 9 '12 at 15:51
2  
I would just leave it alone. –  Ramhound Jul 9 '12 at 15:57
    
First sentence of your second paragraph pretty much covers it. Don't mess wit' networks you ain't s'posed to be messin' wit'. –  Iszi Jul 9 '12 at 16:38
    
Let this be a lesson to you, no finger poken among der blinken lights lest der bolts of electricity rise out and smite thyne asse. Same goes with networks, back off, forget it and never return. This is one of those situations where no good deed goes unpunished, no harm, no foul and keep your fingers crossed. –  Fiasco Labs Jul 10 '12 at 0:28

4 Answers 4

Send them an anonymous email/snailmail. What they do with it is their responsibility. Your conscience will be clear.

share|improve this answer
    
That's what I would do too. +1 –  Cyril N. Jul 10 '12 at 8:18

Honestly, I wouldn't do anything (including ever connecting to their network again).

Someone set up the router and left the default password on the admin account. This same person configured it so the wifi router has no security for connections.

It seems to me either the person setting it up doesn't care at all about security of that network, or purposely left it as insecure as possible -- e.g., for plausible deniability of actions a government could make illegal.

People have a history of acting badly to reports of these things. My guess is that informing them of their bad decisions will only direct ire towards you; and that they are likely to leave it weakly configured in some other way. You could attempt to report it to them anonymously; but personally I wouldn't bother.

share|improve this answer

Report it to a CSIRT anonymously and don't test things you are not meant to! It can easily get you into big troubles depending where you live!

share|improve this answer

Just tell them, if this neatgear is theirs and if so, tell them it's unsecure. Simple. What's the problem. Nobody says actually that you will start using or hacking thru it.

share|improve this answer
5  
Yes, but the problem is that by using the WiFi without permission, OP already trespassed. The fact that the WiFi was completely unsecured does not matter in this regard. –  tdammers Jul 9 '12 at 21:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.