The Wi-Fi Hacking Neighbor From Hell 584
Hugh Pickens writes "Barry Ardolf, a Minnesota hacker prosecutors described as a 'depraved criminal,' has been handed an 18-year prison term for unleashing a vendetta of cyberterror that turned his neighbors' lives into a living nightmare. Ardolf hacked into his next-door neighbors' Wi-Fi network and used it to try and frame them for child pornography, sexual harassment, various kinds of professional misconduct, and to send threatening e-mail to politicians, including Vice President Joe Biden. The bizarre tale began in 2009 when Matt and Bethany Kostolnik moved into the house next door to Ardolf. On their first day at their new home, the Kostolnik's then-4-year-old son wandered near Ardolf's house. While carrying him back next door, Ardolf allegedly kissed the boy on the lips. 'We've just moved next door to a pedophile,' Mrs. Kostolnik told her husband. The couple reported Ardolf to the police, angering their creepy new neighbor (PDF). 'I decided to "get even" by launching computer attacks against him,' said Ardolf, who downloaded Wi-Fi hacking software and spent two weeks cracking the Kostolnik's WEP encryption. Then he used their own Wi-Fi network to create a fake MySpace page for the husband, where he posted a picture of a pubescent girl having sex with two young boys. Ardolf turned down a 2-year plea agreement last year to charges related to the Biden e-mail. After that, the authorities piled on more charges, including identity theft and two kiddie-porn accusations carrying lifetime sex-offender registration requirements."
2 weeks for a WEP? (Score:5, Insightful)
Noob! :)
Re: (Score:3)
He obviously is, encase there is anyone on this site who knows little about wireless security it only takes a few minutes to crack WEP and it is extremely easy to do.
Re: (Score:2)
Re: (Score:3)
I still have a WiSIP phone that only does WEP in use (and works like a champ!), although I keep it on a separate AP.
Re:2 weeks for a WEP? (Score:4, Informative)
It only takes a few minutes IF:
A) there is a decent amoiunt of traffic going on.
B) You do active cracking, sending all sorts of bogus traffic and making the router light up like a christmas tree, as well as causing suspicious disconnections
C) Corollary to B, you have a wifi card capable of injection
Otherwise, you need to do passive sniffing to get enough IVs to actually crack it, and that really depends on whether you are sniffing when their primary usage times are, and how much data they regularly pull over wifi.
Re: (Score:3)
Was he using a Hermes I card?
If so, injection does not work out-of-the-box.
It could well take 2 weeks to learn to use the tools and then gather sufficient data.
BTW does anyone have an angle on patching a Hermes card for injection?
Kernel 2.6.18 on Debian
Re: (Score:3)
Presuming he didn't know anything about cracking WEP before he started, two weeks seems about right to get to grips with the tools and technology required.
Re: (Score:2)
Re: (Score:3, Interesting)
WPA on the otherhand can be performed offline once the 4 way handshake as been captured.... (Which can be optained by waiting for a valid client to connect or by de-authing the clients and then capturing the handshake once they reconnect)
Re: (Score:2)
WEP is worthless. If your password is random characters, you could likely crack it faster than you can type it in.
Re: (Score:3)
Given there's a passive attack against WEP the router can't possibly block you. Heck there's an active attack that just replays packets so you'll have to block yourself...
Even the brute force key guessing technique is done offline on a single captured packet. Your router is magic!
Re: (Score:3)
That's the only interesting part though, the rest can be summed up as "Complete asshole behaves like complete asshole". There was nothing technical clever or new about what he did, although he went further than most such incidents I've heard of, but few slashdotters will be at all surprised that that kind of thing is possible. The only surprise is that it doesn't happen more often, more subtly ... or does it?
Re:2 weeks for a WEP? (Score:4, Insightful)
That's the only interesting part though, the rest can be summed up as "Complete asshole behaves like complete asshole". There was nothing technical clever or new about what he did, although he went further than most such incidents I've heard of, but few slashdotters will be at all surprised that that kind of thing is possible. The only surprise is that it doesn't happen more often, more subtly ... or does it?
Reading the TFA from ars [arstechnica.com], the reason why he was caught was because he wasn't clever at all:
1) The only reason why he was caught is because his malicious actions were intertwined with his normal web traffic (his name in plain text and Comcast packets). He could have used a clean purpose-built computer for his torture, like a laptop, that wasn't configured for his own network at all, and hid it in a safe deposit box or something and they never would have figured out where it's coming from without a long and arduous task with a spectrum analyzer.
2) Ardolf did so much stuff on the target network that it raised suspicion. It's the same thing that happens to regular criminals: they get greedy and keep coming back for more. If he just went right for the terrorist threats and never ever connected again, his neighbors would never have had any reason to suspect external hacking. Even then, his prank emails to coworkers and social network profiles were so out there that they were obvious. There must have been many more subtle ways to do damage that aren't immediately obvious.
3) The neighbor works for a law firm and they were willing to spend the resources to check out his home network and find the unknown device as well as install a sniffer. I don't see a middle-manager working for a sub Fortune-500 company getting that same kind of help, they'd probably sooner call him a schizoid and fire him instead of dealing with that.
If he was a little smarter, I think he very well could have gotten away with it framing the innocent.
Re:2 weeks for a WEP? (Score:5, Funny)
It's OK! (Score:2)
They had nothing to hide anyway...
Would MAC address filtering counter this problem? (Score:3)
What additional security measures can be taken to thwart script kiddies like this guy? Is MAC address filtering + WEP/WPA encryption (or one of those) sufficient security. At this point I want to shut the fucking WiFi off, but there are others in the household who wouldn't go for that.
Re: (Score:2, Informative)
What additional security measures can be taken to thwart script kiddies like this guy?
Well, there's always physical security. You catch someone doing something like this, and you put them under arrest yourself and then hope they resist, at which point you may use necessary force to subdue them. In California, anyway. Bring a witness with a camera.
Re: (Score:2)
Some nodes can change their MAC address, so you just need to monitor the network for a while and spoof a good MAC address which is not in use.
Re: (Score:2)
Consider the Wifi network as "open" and use it only to connect VPN nodes (such as OpenVPN, for example.) This does require that you use a PC as the Internet gateway/NAT/VPN server.
Re: (Score:2)
The neighbor would have been able to use him as a source address for traffic -- but *not* to steal his usernames and passwords out of the air.
Re: (Score:2)
Re: (Score:2)
Hmm -- I didn't catch that it was new accounts. Depending on how his corporate email system was secured, it may or may not have been necessary to steal username/password credentials to send messages appearing to be from the intended target.
Re: (Score:3)
Re:Would MAC address filtering counter this proble (Score:5, Insightful)
Most NICs support either intentional or "back-door" MAC address cloning. Cloud-computing resources can crack your WEP (trivial), WPA (harder/slower), and WPA2 (much harder and slower, but still doable, unless you rotate them daily).
Then, if you have implemented some reasonable level of security, when the jackboots kick in your door, you'll have a much harder time defending yourself during the pre-trial investigation, and, then, assuming you live long enough, in court, due to the security you put into place, obviously trying to hide your evil actions.
At best, you can discourage casual (mis-)use of your WiFi, but that wouldn't help against a long-term attack like this one.
If you're worried about it, shut it off, and run the cable, as I have.
Re: (Score:2)
WPA2 is probably adequate, MAC address filtering would probably stop only very incompetent hackers, it's pretty useless in my understanding (correct me if I'm wrong)
Re: (Score:2)
WPA2 is probably adequate, MAC address filtering would probably stop only very incompetent hackers, it's pretty useless in my understanding (correct me if I'm wrong)
You may be right about that. Can you find the MAC addresses of systems connected to a network you are passively sniffing? Then it is a matter of waiting for that system to go offline (such as the case for a laptop or phone), then steal its MAC. In this case the hard part is getting past the WPA2.
Re: (Score:2)
If you use WPA2 and a strong WPA password that is 18+ characters long you don't have much to worry about. MAC filtering is easy to bypass and WEP is a joke.
Re: (Score:2)
MAC address filtering is useless against a determined attacker. Your best bet is a WPA2 PSK with a long key, unless you fancy setting up WPA2 Enterprise.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
Why not use WPA2-AES, rather than WPA-TKIP/AES? The latter has only the minimum strength of WPA-TKIP (which isn't terribly strong).
No sense in exposing your network needlessly.
Re: (Score:2)
http://www.random.org/passwords/ [random.org] has a fairly good pw generator. Make a bunch and pick 2 strung together.
Re: (Score:2)
Or it could be the author of the article has his head up his ass and just calls all wireless security WEP.
Re:Would MAC address filtering counter this proble (Score:5, Funny)
Yeah, Mac filtering is pretty useless. I mean, what's the chances of a leet hacker using a Mac?
Steven Seagal's Apple Newton notwithstanding.
Re: (Score:2)
1. spoofing an IP will not get you past MAC address filtering
So you just spoof your MAC address as well. It's not as if this was rocket science (... as anybody would know who ever sat in a boring airport lounge..)
Re: (Score:2)
1. spoofing an IP will not get you past MAC address filtering
So you just spoof your MAC address as well. It's not as if this was rocket science (... as anybody would know who ever sat in a boring airport lounge..)
You don't have to spoof your IP address at all. Just spoof the MAC address and let DHCP take care of the IP address.
Re: (Score:2)
Re: (Score:2)
There are plenty of WPA and WPA2 cracking services online, pretty much just a click away. These services rely on their "rainbow tables" for WPA/WPA2, which if you use a non-standard SSID and a long (18+ character), strong password are pretty much useless. Once the WPA password passes about 14 characters the table generation time starts running into years.
Re: (Score:2)
Not broadcasting the SSID is a pretty worthless security measure. If you have a wireless client connected I can see your SSID.
Re: (Score:3)
True, but make them go through the effort.
It is one more step, which when revealed in court, will help hang them.
Good riddance (Score:2, Insightful)
I often balk at the sentences our judicial system hands down (too much punishment for minor offenses, too little for major offenses), but in this case I think the punishment fits the crime.
Re: (Score:2)
the only fitting punishment for a pedophile is execution, for me
Re: (Score:3)
Assuming there is NO DOUBT at all, like the accused actually performed the act in the courtroom.
I'm against the death penalty, only because I see how the rest of government performs and can't believe the judicial system is any better.
Re: (Score:2)
Re: (Score:3)
I have to disagree. Generally speaking, the source/cause of paedophilia is mental and/or emotional immaturity. There are other causes, of course, but "loving children" as it were is a rather misunderstood problem often accompanied by the very same witch hunt mentality you exhibit.
And the problems we see these days are only made worse by current marketing and advertising trends, increased paranoia and a general failure to address causes and sources.
Death is not a punishment. It is a remedy for society. D
Re: (Score:3)
Re: (Score:3)
pedophiloe appears to be a red herring.
I am a parent. I also know a lot of other parents. It would not be unusual fro a 4 year old to random kiss someone who was carrying them, yes even on the lips.
Read the PDF: It happened when she wasn't looking. Why the hell would she suddenly turn around when a stranger was holding her child?
The child said it happened, but only after more then enough time for the memory to be implanted from hearing speculation from it's parents.
Saying this incidence is pedophile is li
Re: (Score:2)
I suppose he doesn't have to worry about them if he's dead.
Re: (Score:2)
perceived sleights (Score:4, Interesting)
turned into byzantine obsession is a sign of a person who will do nothing but bring grief to anyone who ever touches his or her life
if you ever meet this type, back off slowly smiling, then run like hell
their feeling of disempowerment and helplessness (self-learned) and the eternal fight against that (fruitlessly projected outwards) is all they know, it defines their entire existence
Re: (Score:2)
that is the grim calculus isn't it?
there is no easy answer here
Re: (Score:2)
If it's the grim calculus, then just differentiate with respect to their ever changing mood, and slowly slowly back away on a tangent.
Re: (Score:2)
If they come after you, make sure you're living in a state with a good castle doctrine, and have a firearm?
Oh, wait, that's death.
Why the sex offenders registration? (Score:5, Insightful)
That register is for people who have a proven (and acted upon) attraction to minors; Those who are a danger to children. Adding him to the list dilutes it and mitigates its usefulness. What he did should be covered by libel / defamation laws. He deserves to be taken out of society for what he did to that family, but there's nothing in there which supports the idea that he's dangerous sexual offender.
Re: (Score:2)
Yes but... that is "justice" for you. He committed the worst, most heinous crime in our court system... he refused the plea deal.
Seriously... 2 years to 18... he is quite litterally getting 16 more years and a lifelong sex offender registration... because the prosecutor was insulted and wanted to become the persecutor.
That said, no defense of this guys actions, he is clearly off his rocker. That still doesn't make this response appropriate
Re:Why the sex offenders registration? (Score:4, Informative)
but there's nothing in there which supports the idea that he's dangerous sexual offender.
uh, so kissing their ten year old son on the lips against his will doesn't qualify?
Re: (Score:2)
Read the PDF document linked in the stub. There's no mention of a conviction. It'd be classed as "soft evidence" on any Enhanced CRB check in the UK (which is essentially another word for hearsay).
By the way, you should consider what I say in my sig when I comment on subjects like this.
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
It doesn't matter. He was in possession of, and *distributed* child pornography. It is against the law to be in possession of, and to distribute, child pornography, and if you break that law, you are a sexual offender.
This person sexually exploited children (indirectly) by obtaining child pornography. Everyone who seeks out child pornography is participating in the exploitation of children. It doesn't matter what his reason for exploiting them is - he still exploited them.
Plus, by making possession of child
Re: (Score:2)
The guy didn't download the CP for sexual purposes. He's not a paedophile, just a warped anti-social individual.
That register is for people who have a proven (and acted upon) attraction to minors;...
All of this supposedly started because the parents claimed he kissed their child on the lips. If the kid acknowledged that happened, then combined with all of the picture / net stuff he did then getting on the registration isn't exactly "out there."
Heck, a minor can be charged with a sex crime for taking a naked photo of themselves and texting it to their other minor friends... ridiculous but it still happens.
An adult male doing stuff with pictures of minors will land him in hot water... whether it was for
Re: (Score:2)
You know how I know you didn't even read the summary...?
Re: (Score:3)
Re: (Score:2, Insightful)
I think you are mistaken about the purpose of the sex offender registry. It is not for people with a proven attraction to minors (which is not a crime by the way, just saying). It is for criminals whose crime is sexual in nature, regardless of whether the victims were minors or not. So you will find everyone from rapists to flashers on the registry.
Claims he is not a "dangerous sexual offender" does reconcile with his behavior. In this case, the individual attempted to frame his neighbors as child pornograp
Re: (Score:2)
Err: does NOT reconcile with his behavior.
Re:Why the sex offenders registration? (Score:4, Interesting)
It doesn't matter. If I obtain some heroin and plant it on you to frame you, I am still guilty of a drug offense.
Re:Why the sex offenders registration? (Score:5, Insightful)
Unless you're a cop.
Re: (Score:3)
Including a cop. Cops just get away with it, which is entirely different problem.
Re: (Score:3)
While carrying him back next door, Ardolf allegedly kissed the boy on the lips.
You know what that word means, right?
WEP (Score:5, Informative)
Re:WEP (Score:5, Funny)
What was he doing all that time?
Reading the man pages for aircrack-ng?
Re: (Score:2)
Re: (Score:2)
So how do you monitor your home wifi? (Score:2)
Re: (Score:2)
most WLAN routers are used also as DHCP hosts. a simple solution would be a script that gets regularly the DHCP leases page and generates a warning when a new MAC/address combination is found.
Re: (Score:2)
Well, the Airport Extreme I use logs all of its various activities, including connection attempts (successful or otherwise) as well as access to the disk that is hooked up to it and I view it on the device itself or export the logs for more thorough review. I'm sure it's far from the only consumer grade AP to do this.
Now, I don't think it can go beyond simply letting me know that someone is trying to get in (beyond MAC filtering which is like trying to block a burglar by putting up a sign that says "do not
Re:So how do you monitor your home wifi? (Score:4, Informative)
Don't trust your Wifi router to secure your internet connection, is the answer. WEP was built for wireless, and cracked. WPA was built for wireless, and cracked. Bluetooth was built for wireless, and cracked. It's only a matter of time before WPA2 and everything else goes the same way.
Plug a *real* router in there somewhere so that such things can be monitored and logged and/or you can VPN over your own internal Wifi link so that even someone having complete access to your wireless isn't a problem at all. Then you don't even *need* wifi encryption turned on at all (but it's a good hindrance to any intruders) and you can play games like upside-down-ternet with people who try to get a free ride on your connection.
That's the setup I had - just had a WPA network (WPA2 wasn't around at the time) and didn't trust WEP or (correctly, it seems now) WPA to secure my network. So I just made the wireless access point be an "untrusted" network, as it should be, on my main Linux router - which did the actual connection to the Internet and offering IP's etc.
Whenever I connected to wifi in the home, I ran OpenVPN over the top (so the only traffic you could sniff would be my already-encrypted OpenVPN traffic) - which was transparent and automatic and simple and could use per-client keys. I surfed, and my guests minds were blown that even after I'd told them the WPA password and they'd joined the wireless network they couldn't "see" anything at all.
This also lets you block EVERYTHING coming in via wifi to your laptop except for that OpenVPN port with a decent software firewall, which means you don't have to worry about something accessing filesharing ports, or tapping into whatever junk services your PC's are exposing to the whole wifi network (which, incidentally, can save a lot of bandwidth).
You're seriously relying on a piece of £30 Taiwanese crap to secure your entire Internet connection being broadcast over a radio sphere that could be kilometres wide if you have the right reception equipment? Nope. Treat it like an unsecured Internet connection - tunnel into a known-good server which has a wired connection to the Internet.
MAC address spoofing (Score:2)
It must have taken them a long time to figure out what happened unless he wasn't spoofing MAC addresses. It wouldn't occur to most people that their wifi was hacked. Most would assume someone had hacked their individual machines. Wonder if the target was technical, in which case the hacker would have been stupid to do what he did (not to mention evil).
Re: (Score:2)
Based on the 2 weeks to hack WEP, this guy wasn't too bright. It may never have occurred to him to make sure that they were home whenever he did something.
The REAL WTF... (Score:4, Insightful)
Is that prosecutors are allowed to offer plea deals.
If the prosecutor believes crimes were committed, then file charges. If not, don't.
If people are cowed into pleaing guilty (or no contest) to charges to which they believe they're innocent due to legal costs or fears of false conviction, the solution is radical reform of the legal system. NOT to create a gray area of semi-crime, semi-guilt, and semi-punishement. That is *not* innocence until proven guilty.
Re: (Score:2)
Re: (Score:3)
That should not be the accused's problem to solve. However, one might consider these options:
Re: (Score:2)
There is already a huge backlog of cases and trying a case is a huge cost to society. Without plea agreements it could take decades for some of these cases to come to trial.
Re: (Score:3)
Re: (Score:2)
The government had other options available in your case.
Given your circumstances, the prosecutor could have chosen to dismiss the case. Or the judge could have possibly updated your record with a mere warning or traditional ticket, and acquitted you of the criminal charges.
But I shouls also note that your situation is a little different. You weren't offered a plea when you were in fact innocent. You were offered a plea when you were certainly guilty (but with extenuating circumstances).
That being said, y
I've got it! (Score:2)
The obvious solution is to not piss off the creepy neighbor.
And if some stranger I just met kissed my kid on the lips I'd be doing a little hacking of my own, involving a Extra Heavy Duty Glad Bag and a large surgical skiving knife.
See, the trick is to cut the bags open so you can cover the furniture. It makes cleanup a snap.
Re: (Score:2)
PROTIP: when you unexpectedly walk into a room with every surface covered in plastic...
Re: (Score:2)
Plea Deal (Score:2)
Re: (Score:3, Informative)
He basically screwed around with the whole court system. Making a withdrawing pleas, coaching his family on what to say and notes they should write to the judge, making outrageous counter-claims, etc. Once he abandoned the plea they went after him for everything he had done. The 18 years is fair based on everything I read in that PDF.
This man is evil; score one for the good guys (Score:3)
This man is truly a depraved and evil person. Not only did he try to frame his current neighbors, he harassed and stole from his previous neighbors. When the Feds attempted to go easy on him, he fired the lawyer that scored this sweetheart deal and withdrew his plea. He then proceeded to blatantly violate the terms of his release from prison. Well after the trial had begun, he pled guilty a second time. Because this wasn't nearly enough fun, he tried to withdraw his plea AGAIN (that failed.) He also added attempted witness tampering to his list of crimes, because apparently he wasn't going to be locked away for enough time yet. (But he did it via mail sent from prison! I guess he didn't get the memo that except for mail to your lawyer, all letters to/from prison can be read. Whoops!)
He shows absolutely no remorse for his actions; to this day thinking this "revenge" was justified. (He even tried to get the victim's testimony disqualified because they failed to obtain a construction permit for work done on their basement and therefore they could not be trusted. Talk about the (cast iron) pot calling the stainless-steel kettle black.)
Was he TRYING to dig his hole as deep as possible? About the only thing that could have made him worse off would have been a pro se defense, followed by trying to attack the judge during the trial.
Locking guys like this away is what we have a justice system for. Good riddance.
Re: (Score:3, Informative)
From the summary:
'I decided to "get even" by launching computer attacks against him,' said Ardolf
Sounds like he confessed, so, um, yeah?
Re: (Score:2)
Tell that to the Norfolk Four [wikipedia.org], watch the PBS documentary [pbs.org].
While I'm not suggesting that's what happened here, I am saying that a confession isn't necessarily definitive evidence that anyone has done what they confessed too. The methods used to solicit the confession, the motivations of those involved, and the persons mental capacity (either at the time, or in general), need to be taken into account.
Hopefully they have substantially more evidence than just a confession. Especially if this person is "creepy",
Re: (Score:2)
Re: (Score:2)
if you read TFsentencingmemo, there's no doubt he did.
Re: (Score:2)
If you read that whole pdf you would see that the evidence against him is overwhelming. He'd be better off claiming he had an evil twin.
Re:are the police extra sure he did it? (Score:5, Interesting)
Re:are the police extra sure he did it? (Score:4, Funny)
You read the article! No fair!
Re: (Score:2)
Guess your dad was a made man with low friends in high places.
Re: (Score:3)