Someone in my neighborhood is using a WEP encrypted wifi router. I am not sure who they are yet, but if I find out, should I inform them of the security risks which that poses or are there any legal ramifications to doing so?
To be honest, I find that most people don't / won't care.
Unless they are running a business or similar functionality over the network I wouldn't bother explaining the difference between WEP and WPA2 to them, especially since they might not be tech savvy and just get more confused or worried about it.
At least they are using SOME security. I have been to many stores where they just plug in their router (Linksys for example) and don't secure it at all. THAT would be something worth bringing up, especially if that's the network they use for their POS system (like a card reader)!
I doubt there is anything illegal about telling someone their security isn't the best. Unless you broke into their system to find that out :P
TL;DR: If it's a home router for a private network it isn't worth the effort.
I think this might be a good example for something I heard quite a lot in my Net Sec Classes:
Time & Money vs. Risk Factor
In bigger companies these type of decisions have to be made every day, and there are always two groups.
Us, the Security people. Of course in our perspective this Wifi should be made as secure as possible because 'technically' someone could easily breach it and use the internet access to blame any illegal activity on the owner of that network. We should always keep such a 'worst case scenario' in mind.
People like 'Upper Management', or in this case the owner of the WiFi. They probably aren't very involved with Cyber Security and don't care much for it as long as their internet is working.
Our job is to compromise and figure out if it's worth it to 'invest' into this security issue. At a bigger company this investment would mean Time & Money and the required manpower. You might need to take some time to explain and demonstrate the security risk of having a low security protocol to your neighbors. This could range from a quick 5 minute conversation up to 2 hours of you trying to explain networking terms to someone who has not much of an IT background.
One way to find out if this investment is worth it is deciding the Risk Factor.
How likely are your neighbors to be victims of a network breach?
If you live in a crowded place like Manhattan NYC for example, you should most definitely secure your WiFi as much as possible, the risk of someone scanning the area for easy-to-breach targets is higher in such a populated area. If you live in a suburban area, far from downtown, the risk is relatively low.
Now this might seem a bit overkill for such a simple problem, but try to relate it to a company deciding weather or not they need another piece of software which could be thousands of dollars in license fees and hundreds of man-hours for installation & support.
I don't believe there are legal ramifications in advising someone about security, but you may want to approach it cautiously. You'll definitely want to explain in a way that fits the user's ability level as far as tech is concerned, and if they're using WEP they may not be very well versed. They may ask for your help in setting up a stronger encryption as well, so be prepared for that.
Imagine your neighbor came up to you and told you that he was looking at the locks on your house and noticed they were really easy to pick with a simple and cheap pick gun, available on the internet. With such a tool someone could get in your house in 5 minutes. He then said you should upgrade to hard to pick Medeco locks.
Would you think your neighbor is:
- A. Helpful.
- B. A little crazy, but harmless. Best left ignored.
- C. Knows waaay to much about locks and lock picking, and might want to break into your house.
Most people would pick B or C, not A.