Theft of Fixed Wireless Internet Service

Members of the ISP-Wireless list discuss a basic problem: preventing users from sharing wireless service. Unlike Napster, damage from this sharing is immediate and real; it causes bandwidth problems and IP conflicts.

[October 24, 2000]

On the ISP-Wireless list in October, IV queried,

"What are people using to authenticate their wireless users? I want to stop people from asking a friend for their ESSID, purchasing a WLAN PC card, and tapping in and getting free service. Any suggestions on how to prevent this?"

BL agreed that this is a major concern for wireless providers:

"With an ESSID and a valid IP address (which wouldn't be too difficult to guess) they're in. All you'll see at your end is complaints from your customers about switching their machine on and getting an IP conflict (which in turn will also warn whoever's stealing service that they just need to guess another one). Security is a major issue with Breezecom; it was never designed or intended for ISPs, hence the lack of any authentication. I believe the newer BreezeAccess gear has authentication capabilities. What I'd love to see is some method of tying MAC addresses to IP addresses."

A couple of respondents put forward some defense plans:

[AM suggested] "I don't know if IOS can bind specific IPs to specific MAC addresses or not, but I think you can filter based on MAC address. Then the thief would need all three valid items (ESSID, IP, MAC) to get access."

[JD offered] "Make sure you have one machine on your network with every unassigned IP address bound to itself. Then any attempt to use unused IPs would result in a conflict. You may also be able to have that machine log any IP conflicts that come up and then just keep an eye on things. If you get ten IP conflicts in one hour, especially if sequential, odds are that someone is trying to find a usable IP."

JS noted that a stern warning might also do the trick:

"Will Buddy 'A' be willing to risk it? Especially if he has shelled out $500+ for the hardware? If you sell your service to a someone who is willing to do this, then you and they assume the risk. Carry a big stick. Let them know in no uncertain terms that you will be looking at their traffic, and you will revoke their service permanently if they violate the terms of use."

—End