Slashdot Log In
"Free Wi-Fi" Scam In the Wild
Posted by
kdawson
on Fri Jan 26, 2007 11:02 AM
from the click-to-get-pwned dept.
from the click-to-get-pwned dept.
DeadlyBattleRobot writes in with a story from Computerworld about a rather simple scam that has been observed in the wild in several US airports. Bad guys set up a computer-to-computer (ad hoc) network and name it "Free Wi-Fi." You join it and, if you have file sharing enabled, your computer becomes a zombie. The perp has set up Internet sharing so you actually get the connectivity you expected, and you are none the wiser. Of course no one reading this would fall for such an elementary con. The article gives detailed instructions on how to make sure your computer doesn't connect automatically to any offered network, and how to tell if an access point is really an ad hoc network (it's harder on Vista).
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Free is still free for me (Score:5, Funny)
Re:Free is still free for me (Score:5, Insightful)
No kidding - is this article really an ad for Linix and/or MacOS X?
The next time I see a "FreeWiFi" I'll jump on and thank them hardily for moving yet another Windows user even closer to an alternate choice.
Parent
Tosser... (Score:5, Insightful)
Personally, I'd try to gather evidence and report it to the police if I felt they'd do anything worthwhile. The fact that this person's behaviour happens to be driving people towards my OSs of choice is purely incidental. You probably realise this, and I doubt that you were serious about thanking the guy, but I bet that your f****d up zealotry, morality and ideology are genuine; you really would place a microscopic (and questionable) "blow" against Microsoft over thieving scum like this escaping justice. You really think that MS-enabled crime (let alone this particular scam) is the only crime they're going to commit?
Parent
Re: (Score:3, Insightful)
Right. Call me cynical, but I don't think that the police would be interested or even capable of doing anything.
Re:Tosser... (Score:4, Interesting)
As noted, reporting to the police would be ineffectual.
I'm not looking for a "blow" against Microsoft as much as something that moves people to more secure systems, whatever those happen to be. And unfortunately it happens to be true that people only seem to care about things like that when bad things happen to them - as with backups.
So I feel empathetic, but not sympathetic, towards people affected by things like this - and while I don't condone the actions of those engaging in this behavior I do at least recognize that some good can come from even criminal activity such as this.
What I feel is really poor is your apologetic stance, basically playing whack-a-mole with security issues by trying to stomp down every security breach as it pops up without considering the broader picture and how to reduce the fundamental security problems instead of blaming only the people who take advantage of security flaws like this while doing nothing to advance a cure to the deeper problem. I think you need to reexamine what is zealotry and what is a healing approach for the industry as a whole.
Parent
Re: (Score:3, Interesting)
Unfortunately I can also say without a doubt that wireless connectivity is so convoluted that the average user would fall for this. Explaining to Joe Salesman to view wireless networks and trying to explain to him the different types of authentication he may run into while traveling from Iowa to Texas (I
Easy Countermeasure (Score:3, Interesting)
I'd try to gather evidence and report it to the police if I felt they'd do anything worthwhile.
Someone in the vicinity of my office (in a Chatsworth CA industrial park) was broadcasting a wireless network titled "Free Public WiFi" for the past couple of weeks, and since I'm using OS X, it appeared under my AirPort status menu as a peer-to-peer network. These come and go, and I routinely ignore them. That is -- until I saw this ComputerWorld article on Slashdot.
It could have been a coworker, or someone in an adjacent building, or someone parked on the street... the signal strength was 5 bars o
Re:Free is still free for me (Score:4, Insightful)
Lots of people will hit yes and continue, cause they really need to log in and download that confidential financial report with all of the account numbers and passwords in it. Then they're hosed.
Parent
Re: (Score:3, Interesting)
Re:Free is still free for me (Score:5, Funny)
The lesson: Don't f*ck with someone who has a four-digit userid on slashdot.
Parent
Re:Free is still free for me (Score:4, Informative)
Then I read this thread.
And pointed out my UserID to the same friend.
Too bad - I have actually seen that "Free Wi-Fi" ad-hoc network in a few airports in the last month or so (I think in Midway airport in Chicago). I did not join it, since I knew the SSID of the official wireless service (and knew that it was paid access)
In interesting thing to do is to join the network, fire up a Bonjour Browser (or your other favorite ZeroConf browser) and see available services. If people are sharing their iTunes libraries, if they have a ZerConf chat program, and so on...
Parent
Re:Free is still free for me (Score:5, Funny)
Parent
Re:Free is still free for me (Score:5, Funny)
Out of a set of 2030 possible people, right?
Parent
Re:Free is still free for me (Score:5, Funny)
Parent
Re: (Score:3, Funny)
Re:Free is still free for me (Score:5, Funny)
Parent
Re:Free is still free for me (Score:5, Funny)
{
FuckWith($user) = false;
}
There, now we can all agree!
Parent
Gimme your lunch money (Score:3, Funny)
Re:Free is still free for me (Score:5, Funny)
Parent
Re: (Score:3, Funny)
Re: (Score:3, Interesting)
1. Portland Airport Free WiFi, ssid "flypdx"
2. Personal Telco Underground WiFi Group, ssid "www.personaltelco.com".
3. Independant coffee shops, hotels, and internet cafes, various ssids
4. Metro-Fi, the new downtown and expanding out towards all of Metro area wifi cloud, ssid "MetroFi-Free". If you see "MetroFi-TestFree" this indicates an access point that isn't connected to the Internet yet but will be coming soon.
Re: (Score:3, Informative)
Avoid ad-hoc connections (Score:4, Informative)
Re:Avoid ad-hoc connections (Score:5, Informative)
Even worse, their 200mW cards will out-power the real 40mW access points so Windows will prefer to use the attacker's "closer" "access point".
http://www.remote-exploit.org/backtrack.html [remote-exploit.org]
Parent
Re: (Score:2)
Great! (Score:4, Funny)
Better yet... (Score:4, Funny)
Help other folks out. Set yourself up as a proxy, advertise yourself as "Free Wi-Fi" too, and let everyone else (at least, everyone who connects through you) safely use the scumbag's paid wi-fi connection for free.
But if you must have some innocent fun, you really should have your machine mirror images so that they're returned upside-down. Not all of them, just a very few that meet some criteria based on a hash of the user's MAC address or something. Imagine their confusion when their buddy's laptop shows the picture normally and they're sitting there thinking, "What the...!!?"
Parent
Stupid idea (Score:5, Insightful)
How sure are you that you can prove that you're not involved, especially when you've been arrested and subject to police questioning? Under ideal circumstances If you were in control of things, you could probably put together a good case, but fancy playing against a prosecutor and police who genuinely believe that you were involved and want to make you look bad?
And (so the police will want to know) since you obviously knew this guy was up to no good, why didn't you report it?
Doesn't sound such a good idea now.
Parent
Re: (Score:3, Funny)
Not that hard in Vista (Score:5, Informative)
A marketing exploit. Sorta (Score:2)
The summary is right - anyone who is a big enough geek to read
remote host (Score:3, Interesting)
Relay? (Score:4, Insightful)
Re: (Score:3, Interesting)
But even worse, he could emulate (and forward data to) popular sites like Gmail, Yahoo, Ebay and Paypal but without any SSL. Like, a site that looks and acts like Gmail and even has your messages but is in reality a non-encrypted site that acts as a proxy.
I never thought about that, but that's an excellent point. It's a good reason not to trust web based mail sites.
In fact, it calls into question the security of all websites, since they start out in unencrypted mode. How often do you check when logging in
Article does not explain the zombification process (Score:5, Interesting)
Assumption #1. You run Windows XP, SP2, up to date with security patches
Assumption #2. You have Windows Firewall installed and configured for maximum security
Assumption #3. You are not sharing your folders on the network, or if you are, you're not allowing guest write access
(Now, I know how many Windows users do not follow #1,#2,#3 above..) but assuming they do, is a zero-day exploit required in order to zombify their PC?
Re:Article does not explain the zombification proc (Score:5, Insightful)
I guess if your entire hard drive was shared, there is a possibility that they could write the file to a startup directory on it that automatically launches it on your next reboot . . .
This article really read as a lot of FUD to me. Possibly unpatched machines are affected, but they give a solution of disconnecting from the net. I just don't get it, the solution, it appears to me would be to oh, I don't know, patch your computer and use sane practices (like not sharing your whole hard drive as read/write/execute (apparently) with anonymous access).
Now the problem of them being able to steal credit card numbers and such is an issue. This is an issue that effects all OSes, so everyone should think bout it. however, if you check that the ssl keys you accept are valid for the site in question, then you should be alright. While they can perform a man-in-the-middle attack, that does require changing what keys a website uses (or possibly disabling encryption). As far as aim passwords and such go, well if you don't use it for important stuff, what are they going to do with it?
I read this entire article and really just want to read something from someone who knows anything about security, and not some idiot who read about something like this and proposes an even more idiotic solution. There is truth that you must be careful connecting to any wireless network that you don't know, also your machine needs to be patched etc. a little common sense goes a long way in this matter.
Phil
Parent
Re: (Score:3, Insightful)
People who willingly hide the file extensions from their display deserve what they get! :)
Windows XP does this by default.
And no, they *don't* deserve it. If there was a warning dialog which said, "Doing this might cause you to get pwn3d", you might have a point. The problem is that there's no reason to expect your average user to understand the implications involved.
Every so often, bad weather during the winter leads to a few deaths due to people using charcoal barbecues in the house. It's not reasonable to suggest those people deserve what happened to them. If they didn't understand the risk
Re: (Score:3, Insightful)
1) "Clueless" implies fault of the user. It's unreasonable to expect your average user to have the technical acumen of your average geek. Given that other OSs do not have these issues, I am more inclined to blame Windows for being so easily made insecure by a "clueless" (rea
Far easier to get good scam info... (Score:3, Interesting)
It runs it's own DNS and httpd.
you connect, it looks real. Log into your yahoo account with a legit looking cert, hmmm yahoo is having trouble, I'll try ebay. I logged in but it also has trouble, I'll try again.. oh it works!
Really easy, thwarts all the "this certificate does not match as you control everything the client side sees, then dump them off to your link to wifi or your cellular net connection.
you can probably get tons of real logins you are ready for collecting.
Moral of this? do not trust open accesspoints, they might not be legit.
Re: (Score:3, Insightful)
When even Google AdSense [google.com] can't get the whole "do https properly so that people don't get trained to click past error messages" thing right (granted, it's a different error in google's case), how closely are people really going to look? Granted, they might get slightly suspicious the third of fourth
How would you tell? (Score:3, Funny)
Re:How would you tell? (Score:5, Funny)
Parent
Why just ad hoc? (Score:5, Informative)
Old problem, Old solutions (Score:3, Informative)
I see no problem here that cannot be solved by adopting the same principles that you would use for ordinary domestic internet access:
1) Turn on your firewall and close all open ports.
2) Don't send sensitive data over an unsecured network.
forget about the network (Score:4, Informative)
The message here shouldn't be "don't connect to untrusted networks," it should be "secure your machine."
Once you do that, these guys are just being nice and giving you a free connection!
-rsw
Re: (Score:2, Funny)
Re: (Score:2)
Re:Whatever happened to free airport Wi-Fi? (Score:5, Insightful)
It's that kind of juvenile behavior that kills off free wi-fi services. They are there for people to check itineraries, keep in touch with their friends/family/colleagues, and other minor conveniences. They don't exist for jackasses to park on for days to download movies.
"Free to use" does not mean "Free to abuse". If you want more bandwidth, pay for it yourself.
Parent
Re:Whatever happened to free airport Wi-Fi? (Score:4, Insightful)
Parent
Re:Quick question (Score:4, Informative)
eg. if I ssh to my home computer, or use access an https site am I still ok?
As long as you exchange keys with the actual end host, and not the man-in-the-middle, you're fine.
If the Man-in-the-middle tries to give you his own SSL key, your browser will throw up an error message that the key is invalid. If you click "accept key", then you're hosed and the attacker can read all your traffic.
As far as ssh goes, if you've connected to the host before, SSH will (or at least on the clients I've used) throw up a big warning message that someone is trying to hack you. If you haven't connected, no such warning will appear and if you type in your password the attacker will get your password, and everything you type in your ssh session.
Parent