Forgot your password?
typodupeerror
Security Wireless Networking Hardware IT

"Free Wi-Fi" Scam In the Wild 332

Posted by kdawson
from the click-to-get-pwned dept.
DeadlyBattleRobot writes in with a story from Computerworld about a rather simple scam that has been observed in the wild in several US airports. Bad guys set up a computer-to-computer (ad hoc) network and name it "Free Wi-Fi." You join it and, if you have file sharing enabled, your computer becomes a zombie. The perp has set up Internet sharing so you actually get the connectivity you expected, and you are none the wiser. Of course no one reading this would fall for such an elementary con. The article gives detailed instructions on how to make sure your computer doesn't connect automatically to any offered network, and how to tell if an access point is really an ad hoc network (it's harder on Vista).
This discussion has been archived. No new comments can be posted.

"Free Wi-Fi" Scam In the Wild

Comments Filter:
  • by LinuxGeek (6139) <djand.nc@gmOPENBSDail.com minus bsd> on Friday January 26, 2007 @11:04AM (#17769636)
    Well, they would have a really difficult time turning my linux based portable into a zombie. I guess that would be risk free wifi for me, Yeah! Oh, and while in public, I use stunnel to a secure server. Sniff all of the data you want while I use your free wireless.
    • by SuperKendall (25149) on Friday January 26, 2007 @11:12AM (#17769806)
      Well, they would have a really difficult time turning my linux based portable into a zombie.

      No kidding - is this article really an ad for Linix and/or MacOS X?

      The next time I see a "FreeWiFi" I'll jump on and thank them hardily for moving yet another Windows user even closer to an alternate choice.

      • Tosser... (Score:5, Insightful)

        by Dogtanian (588974) on Friday January 26, 2007 @11:36AM (#17770256) Homepage

        The next time I see a "FreeWiFi" I'll jump on and thank them hardily for moving yet another Windows user even closer to an alternate choice.
        And people wonder why some Linux and Apple supporters have a bad reputation for being fanatical.

        Personally, I'd try to gather evidence and report it to the police if I felt they'd do anything worthwhile. The fact that this person's behaviour happens to be driving people towards my OSs of choice is purely incidental. You probably realise this, and I doubt that you were serious about thanking the guy, but I bet that your f****d up zealotry, morality and ideology are genuine; you really would place a microscopic (and questionable) "blow" against Microsoft over thieving scum like this escaping justice. You really think that MS-enabled crime (let alone this particular scam) is the only crime they're going to commit?
        • Re: (Score:3, Insightful)

          by El Torico (732160) *
          Personally, I'd try to gather evidence and report it to the police if I felt they'd do anything worthwhile.

          Right. Call me cynical, but I don't think that the police would be interested or even capable of doing anything.

          • by Dogtanian (588974)

            Right. Call me cynical, but I don't think that the police would be interested or even capable of doing anything.
            Which was precisely why I said "if I felt they'd do anything worthwhile". And either way, it still doesn't excuse "Super Kendall" treating low-life thieves/conmen (who'll probably be stealing from someone's granny next week- sans laptop) as some sort of open-source heroes...
        • Re:Tosser... (Score:4, Interesting)

          by SuperKendall (25149) on Friday January 26, 2007 @12:47PM (#17771488)
          Personally, I'd try to gather evidence and report it to the police if I felt they'd do anything worthwhile. The fact that this person's behaviour happens to be driving people towards my OSs of choice is purely incidental. You probably realise this, and I doubt that you were serious about thanking the guy, but I bet that your f****d up zealotry, morality and ideology are genuine; you really would place a microscopic (and questionable) "blow" against Microsoft over thieving scum like this escaping justice.

          As noted, reporting to the police would be ineffectual.

          I'm not looking for a "blow" against Microsoft as much as something that moves people to more secure systems, whatever those happen to be. And unfortunately it happens to be true that people only seem to care about things like that when bad things happen to them - as with backups.

          So I feel empathetic, but not sympathetic, towards people affected by things like this - and while I don't condone the actions of those engaging in this behavior I do at least recognize that some good can come from even criminal activity such as this.

          What I feel is really poor is your apologetic stance, basically playing whack-a-mole with security issues by trying to stomp down every security breach as it pops up without considering the broader picture and how to reduce the fundamental security problems instead of blaming only the people who take advantage of security flaws like this while doing nothing to advance a cure to the deeper problem. I think you need to reexamine what is zealotry and what is a healing approach for the industry as a whole.
        • Re: (Score:3, Interesting)

          by Zanthor (12084)
          What I find amusing is that you think most computer users have a "Choice" in which OS they run... my shop runs Windows XP, that means all 250 of my supported users run Windows XP, they don't get to choose.

          Unfortunately I can also say without a doubt that wireless connectivity is so convoluted that the average user would fall for this. Explaining to Joe Salesman to view wireless networks and trying to explain to him the different types of authentication he may run into while traveling from Iowa to Texas (I
        • Easy Countermeasure (Score:3, Interesting)

          by bughunter (10093)

          I'd try to gather evidence and report it to the police if I felt they'd do anything worthwhile.

          Someone in the vicinity of my office (in a Chatsworth CA industrial park) was broadcasting a wireless network titled "Free Public WiFi" for the past couple of weeks, and since I'm using OS X, it appeared under my AirPort status menu as a peer-to-peer network. These come and go, and I routinely ignore them. That is -- until I saw this ComputerWorld article on Slashdot.

          It could have been a coworker, or someone in an adjacent building, or someone parked on the street... the signal strength was 5 bars o

      • by Intron (870560) on Friday January 26, 2007 @01:48PM (#17772672)
        This isn't a Win vs. Lin issue. Stunnel is available for Windows, too. What happens when you think you are on a free network, you try to Stunnel to your server, and you get the error:

        WARNING: DSA key found for host ftp.initech.org
        in /home/intron/.ssh/known_hosts:35
        DSA key fingerprint 67:12:6f:2c:cd:a1:67:8b:ea:86:c8:b8:8b:c3:9d:34.
            The authenticity of host 'ftp.initech.org (206.246.226.45)' can't be established,
        but keys of different type are already known for this host.
        RSA key fingerprint is 02:a9:63:fe:6f:2e:ae:f4:53:4c:9c:8b:8b:7d:5c:8e.
            Are you sure you want to continue connecting (yes/no)?
        Do you say "I must be the victim of a man-in-the-middle attack?" or do you say "Someone must have updated the key on the server"

        Lots of people will hit yes and continue, cause they really need to log in and download that confidential financial report with all of the account numbers and passwords in it. Then they're hosed.
    • Re: (Score:3, Interesting)

      I agree, I use these all the time at airports (pay for WiFi in an airport with $2 waters and $1.50 small bags of chips? nfw). I know they're up to no good, but good luck trying.

    • by spellraiser (764337) on Friday January 26, 2007 @11:22AM (#17770010) Journal

      The lesson: Don't f*ck with someone who has a four-digit userid on slashdot.

    • by Nutty_Irishman (729030) on Friday January 26, 2007 @11:39AM (#17770314)
      I know what you mean, I use that "Free Wi-Fi" every time I'm in the airport with no problems. Now I have freewifi.exe process running all the time, even when I'm not in the airport! Haha, take that, suckers!
    • Re: (Score:3, Funny)

      I think I saw this in Portland while looking for a MetroFi link at the Hilton during the Microsoft Vista Launch. I couldn't get it to connect to my Windows Mobile phone- and now I know why. The OLAP processor probably rejected the ActiveX.
  • by GreyPoopon (411036) <gpoopon@NosPaM.gmail.com> on Friday January 26, 2007 @11:07AM (#17769704)
    To avoid this, just avoid ad-hoc connections. That will work until the perps start using Infrastructure (Access Point) connections with a bridge to the real one. You can even set up Windows XP so that it won't allow you to make ad-hoc connections.
    • by Wanker (17907) * on Friday January 26, 2007 @11:14AM (#17769832)
      Uh, they already use Infrastructure connections. Bummer, eh?

      Even worse, their 200mW cards will out-power the real 40mW access points so Windows will prefer to use the attacker's "closer" "access point".

      http://www.remote-exploit.org/backtrack.html [remote-exploit.org]
    • by drinkypoo (153816)
      And also note that Windows XP doesn't even let you BE an Access Point unless you use one of the like two wireless chipsets for which there is still a management utility (i.e. you're not forced to use the Windows XP wireless networking.) I was somewhat dismayed when I ugpraded my laptop from win2k to winxp and found that I could no longer be an access point. Then I went to linux, and now my nic doesn't work at all! Now that's progress. (Someday I'll see if ndiswrapper will do the job, but I am using a centri
    • by bfields (66644)

      To avoid this, just avoid ad-hoc connections.

      Only connect to networks you can trust, right? Because school and office networks are never hacked....

      No thanks. I'd rather connect to whatever network I like, and rely on end-to-end authentication; all the convenience of being able to use any network, and *more* secure. What a deal.

  • Great! (Score:4, Funny)

    by Rob T Firefly (844560) on Friday January 26, 2007 @11:07AM (#17769720) Homepage Journal
    Now I can take a well-configured Linux lappy to the airport, hook up through these bad guys, and make extra sure to do everything illegal, immoral, and dangerous I can think of over their pipe without a smidgen of guilt. Woo and yay!
    • by KingSkippus (799657) * on Friday January 26, 2007 @11:34AM (#17770238) Homepage Journal

      Help other folks out. Set yourself up as a proxy, advertise yourself as "Free Wi-Fi" too, and let everyone else (at least, everyone who connects through you) safely use the scumbag's paid wi-fi connection for free.

      But if you must have some innocent fun, you really should have your machine mirror images so that they're returned upside-down. Not all of them, just a very few that meet some criteria based on a hash of the user's MAC address or something. Imagine their confusion when their buddy's laptop shows the picture normally and they're sitting there thinking, "What the...!!?"

      • Stupid idea (Score:5, Insightful)

        by Dogtanian (588974) on Friday January 26, 2007 @11:49AM (#17770518) Homepage

        Help other folks out. Set yourself up as a proxy, advertise yourself as "Free Wi-Fi" too, and let everyone else (at least, everyone who connects through you) safely use the scumbag's paid wi-fi connection for free.
        That's the kind of geeky too-clever-for-your-own-good thing that will get you into trouble if the real criminal ever gets caught... or even if he doesn't. Suppose the police (or whoever) at the airport know about this scam and are investigating, and pick up *your* connection. Now you're messed up with this thing; you might know that you're innocent, but they don't, and explanations like "But... but... I was just having some fun at the guy's expense and making it safe for everyone" won't go down well.

        How sure are you that you can prove that you're not involved, especially when you've been arrested and subject to police questioning? Under ideal circumstances If you were in control of things, you could probably put together a good case, but fancy playing against a prosecutor and police who genuinely believe that you were involved and want to make you look bad?

        And (so the police will want to know) since you obviously knew this guy was up to no good, why didn't you report it?

        Doesn't sound such a good idea now.
        • How sure are you that you can prove that you're not involved, especially when you've been arrested and subject to police questioning?

          You have nothing to worry about, since the judge will throw out the case as soon as you get your hearing (habeas corpus... oh crap.

      • Re: (Score:2, Informative)

        by ajs318 (655362)
        Someone's been reading this [ex-parrot.com], haven't they? :)

        If / when I ever get any wireless kit, I will change the name of my neighbours' unprotected router (currently set to the make and model name; a quick Google search revealed the default password) to "pWn3d", have my router emulate theirs but with suitably distorted graphics, and see what happens. Jut a shame I can't listen in on their call to tech support ..... but I could, if I had what fone phreaks once referred to as a "Sky Blue Pink Box with Yellow Spots
    • Re: (Score:3, Funny)

      by LinuxGeek (6139)

      Now I can take a well-configured Linux lappy to the airport, hook up through these bad guys, and make extra sure to do everything illegal, immoral, and dangerous I can think of over their pipe without a smidgen of guilt. Woo and yay!
      Sounds like a great idea. If you have enough time between flights you may want to fire up nmap and nessus against *.fbi.gov and *.cia.gov and just wait... and watch...
  • by jfurdell (574363) on Friday January 26, 2007 @11:12AM (#17769784) Homepage
    When you connect to a network, a little wizard pops up asking you if it's "Home", "Work", or "Public Location". Choose Public Location and sharing will be disabled automatically.
    • by Llywelyn (531070)
      ...just what I need, another pop-up to deal with when I start up the computer.
  • I've never seen anything pernicious and accidental* come into a corporate network except through the marketing folks. They always seem to be the ones who like the use gadgets they don't understand, leave extraneous services on because they seem kinda neat and so on. They're exactly the sort of people who connect to ad-hocs all day long. After all, if their computer is compromised, it's IT's problem.

    The summary is right - anyone who is a big enough geek to read /. isn't the sort of person the perpetrators
  • remote host (Score:3, Interesting)

    by TheSHAD0W (258774) on Friday January 26, 2007 @11:14AM (#17769830) Homepage
    If you have a box that's permanently on the net, a machine at home that's always on, a web server, etc, set your laptop up to always tunnel its connections through it. That way, even if someone 0wnz the connection you're on, so long as your software firewall is good, you're set.
  • But because you're using his connection, all your traffic goes through his PC, so he can see everything you do online, including all the usernames and passwords you enter for financial and other Web sites.

    While this is true for HTTP, which is in the clear, banking, financial, and e-commerce websites use SSL (or should, anyhow), which makes man-in-the-middle attacks impractical (though not impossible). I have seen these "hotspots" myself, in areas of Boston near hotels, and I've connected to them via my
  • I saw this in November in Heathrow airport in London, England - an ad hoc wireless network called "Free Wi-Fi". Obviously I wasn't stupid enough to connect to it.
  • Universal free wi-fi (Score:2, Interesting)

    by adambha (1048538)

    And when wi-fi becomes a universally available free commodity (who else is betting on it?) what trickery will we see then?

  • Relay? (Score:4, Insightful)

    by zlogic (892404) on Friday January 26, 2007 @11:15AM (#17769882)
    Or the bad guy could set a relay with the real internet and get all your passwords, that's why I use SSL in public APs. But even worse, he could emulate (and forward data to) popular sites like Gmail, Yahoo, Ebay and Paypal but without any SSL. Like, a site that looks and acts like Gmail and even has your messages but is in reality a non-encrypted site that acts as a proxy.
    • Re: (Score:3, Interesting)

      by Vellmont (569020)

      But even worse, he could emulate (and forward data to) popular sites like Gmail, Yahoo, Ebay and Paypal but without any SSL. Like, a site that looks and acts like Gmail and even has your messages but is in reality a non-encrypted site that acts as a proxy.

      I never thought about that, but that's an excellent point. It's a good reason not to trust web based mail sites.

      In fact, it calls into question the security of all websites, since they start out in unencrypted mode. How often do you check when logging in
  • If you're somehow connected to this ad hoc network, but use encrypted access to other computers, are you still ok? eg. if I ssh to my home computer, or use access an https site am I still ok?
    • Re:Quick question (Score:4, Informative)

      by Vellmont (569020) on Friday January 26, 2007 @11:30AM (#17770166) Homepage

      eg. if I ssh to my home computer, or use access an https site am I still ok?

      As long as you exchange keys with the actual end host, and not the man-in-the-middle, you're fine.

      If the Man-in-the-middle tries to give you his own SSL key, your browser will throw up an error message that the key is invalid. If you click "accept key", then you're hosed and the attacker can read all your traffic.

      As far as ssh goes, if you've connected to the host before, SSH will (or at least on the clients I've used) throw up a big warning message that someone is trying to hack you. If you haven't connected, no such warning will appear and if you type in your password the attacker will get your password, and everything you type in your ssh session.
  • by dudeman2 (88399) on Friday January 26, 2007 @11:20AM (#17769972) Homepage
    Connecting to the "Free Wi-Fi" and having your passwords and data sniffed is one thing, but how easy is it for the attacker to turn a Windows XP system into a zombie, merely by connecting to an attacker's wireless network?

    Assumption #1. You run Windows XP, SP2, up to date with security patches
    Assumption #2. You have Windows Firewall installed and configured for maximum security
    Assumption #3. You are not sharing your folders on the network, or if you are, you're not allowing guest write access

    (Now, I know how many Windows users do not follow #1,#2,#3 above..) but assuming they do, is a zero-day exploit required in order to zombify their PC?
    • It's hard for an article to explain anything if you don't read it.

      From TFA:

      In addition, because you've directly connected to the attack PC on a peer-to-peer basis, if you've set up your PC to allow file sharing [emphasis mine], the attacker can have complete run of your PC, stealing files and data and planting malware on it.

      You can't actually see any of this happening, so you'd be none the wiser. The hacker steals what he wants to or plants malware, such as zombie software, then leaves, and you have no way
      • by mspohr (589790)
        OK, so the hacker can "plant malware" and files...

        Just how does the hacker get the malware file to run on your computer... it seems there must be another step here... TFA was vague on this point. I'm not an expert.

        • by Bazman (4849)
          Hmmm C: drive icon... right click... sharing... read-write... anyone... anytime... anywhere...

          There, that should save me having to bother sharing out individual folders on my home network - far too fiddly...

      • by dudeman2 (88399)
        I read TFA including that section. Unfortunately without benefit of your [emphasis], I ended up thinking "there must be more to it than that." Thanks for the response. Perhaps next time you can try a constructive reply without the sarcasm.

        The whole thing boils down to:

        1) Clueless user connects to "Free Wifi" and has filesharing enabled with guest write access
        2) Attacker uses file sharing to put malware on PC
        3) Clueless user proceeds to run the malware and gets zombified.

        All in all a time consuming, ineffic
        • Re: (Score:3, Insightful)

          by node 3 (115640)

          The whole thing boils down to:

          1) Clueless user connects to "Free Wifi" and has filesharing enabled with guest write access
          2) Attacker uses file sharing to put malware on PC
          3) Clueless user proceeds to run the malware and gets zombified.

          1) "Clueless" implies fault of the user. It's unreasonable to expect your average user to have the technical acumen of your average geek. Given that other OSs do not have these issues, I am more inclined to blame Windows for being so easily made insecure by a "clueless" (rea

      • This still doesn't explain about the zombification process. First of all, most file sharing is read only unless you have a password used, most home users don't really do much filesharing, but generally it's a read only thing, but second of all even if you have your entire folders mounted as read/write, how exactly does that allow this machine to turn you into a zombie? Last I heard writing files to your my documents folder (it's really difficult to share other folders than this) can not actually execute code.

        I guess if your entire hard drive was shared, there is a possibility that they could write the file to a startup directory on it that automatically launches it on your next reboot . . .

        This article really read as a lot of FUD to me. Possibly unpatched machines are affected, but they give a solution of disconnecting from the net. I just don't get it, the solution, it appears to me would be to oh, I don't know, patch your computer and use sane practices (like not sharing your whole hard drive as read/write/execute (apparently) with anonymous access).

        Now the problem of them being able to steal credit card numbers and such is an issue. This is an issue that effects all OSes, so everyone should think bout it. however, if you check that the ssl keys you accept are valid for the site in question, then you should be alright. While they can perform a man-in-the-middle attack, that does require changing what keys a website uses (or possibly disabling encryption). As far as aim passwords and such go, well if you don't use it for important stuff, what are they going to do with it?

        I read this entire article and really just want to read something from someone who knows anything about security, and not some idiot who read about something like this and proposes an even more idiotic solution. There is truth that you must be careful connecting to any wireless network that you don't know, also your machine needs to be patched etc. a little common sense goes a long way in this matter.

        Phil
  • The article says that if you connect to another host via an ad-hoc network, you somehow turn on filesharing in Windows (presumably to your entire HD). I wasn't aware of this feature in Windows. Can someone confirm it and provide some references, because the last people I'll trust to get the facts straight are journalists.
  • by Lumpy (12016) on Friday January 26, 2007 @11:22AM (#17770008) Homepage
    linux laptop advertising as a wifi hot spot.

    It runs it's own DNS and httpd.

    you connect, it looks real. Log into your yahoo account with a legit looking cert, hmmm yahoo is having trouble, I'll try ebay. I logged in but it also has trouble, I'll try again.. oh it works!

    Really easy, thwarts all the "this certificate does not match as you control everything the client side sees, then dump them off to your link to wifi or your cellular net connection.

    you can probably get tons of real logins you are ready for collecting.

    Moral of this? do not trust open accesspoints, they might not be legit.
  • by lwriemen (763666) on Friday January 26, 2007 @11:23AM (#17770034)
    Doesn't running Windows already turn your computer into a zombie?
  • Erm... and how exactly will someone turn p2p client into a zombie? I mean you can access shared volume if it is not password protected, but run anything?

    Or was this dude letting share his entire HD including OS?
  • Trying not to be the arrogant Mac user my friends kid me about being (at least I think they're kidding), I've gotta ask:

    Is Mac OS X at risk to these kinds of attacks?
    • by Vellmont (569020)

      Is Mac OS X at risk to these kinds of attacks?

      As far as a man-in-the-middle attack goes, of course. The attack is a property of the networking technology, not the OS. If you connect to a wireless network, then connect to your bank or whatever via SSL, then blindly accept the error message that's going to come up when the SSL certificate comes up (since the attacker is going to give you his own SSL cert, not the real one), the attacker can read anything you send to the other side, and anything that comes b
      • This is a question based on an utter lack of understanding of OS X, but i'm going to ask it anyway:

        Is the administrator password on an OS X machine non-trivial by default, and do most people set their passwords to be non-crackable by a short (say, 1-2 hr airport stay) session?

        Presuming that the password is trivial or insecure (play with me here), does the default (or common) setting on OS X allow a telnet session to be established over the wifi link?

        Now were getting deep, but hang with me...give the two abo
        • by Vellmont (569020)

          Is the administrator password on an OS X machine non-trivial by default

          I'm not a Mac guy, but I'm pretty sure the admin account is disabled by default. I'm also pretty certain that OS X doesn't accept telnet connections, nor is it running an ssh server.
  • They charged me 8$ for internet access, but never gave me connection to the internet. Stupid Boston Airport(Logan)
    • by skiflyer (716312)
      I had that happen at O'Hare not too long ago, wrote them a nice email on my phone, and had my $8 refunded to my credit card before I landed in NYC.
    • by Zadaz (950521)
      So someone running a local server at the airport just got your cc number and associated details...

      Sounds like a pretty good deal to me.
  • Vista disables file sharing by default unless you tell it the current network connection is a home or work network.
  • Not just airports (Score:2, Informative)

    by dropshot (646089)
    I saw exactly this at the National Archives in College Park, MD. I told the local IT bubbas, but they just gave me blank stares. It was particularly disturbing because the average researcher at the archives won't have the technical sophistication to realize what's going on, and will then take their zombified system back to a university network.
  • I've seen connections like these available in airports and hotels. I actually tried to connect but my crappy 802.11b NIC wouldn't let me.

    WinXP makes it very obvious that it's an ad-hoc network and not a WAP. The icon is completely different. I guess I'll be avoiding those connections from now on.
  • > Of course no one reading this would fall for such an elementary con.

    Too right! This is Slashdot! The big ./! No way we'd fall for something like that.
    Not like we're n00bs! ha ha.

    > The article gives detailed instructions on how to make sure your
    > computer doesn't connect automatically to any offered network,

    {Sound of frantic typing, hyperventilating and weeping}
  • I see those ad hoc computer connections on airplanes all the time (I fly the friendly skies about every two weeks). I thought they might be the airline offering a way to connect to the internet while in the air. Fortunately for me I never allow ad hoc connections on my computers and always have file sharing turned off except for when I'm specifically transferring data. Maybe I'll try to locate the computer offering the connection the next time I see it in the list.
  • Why just ad hoc? (Score:5, Informative)

    by BubbaFett (47115) on Friday January 26, 2007 @11:39AM (#17770322)
    With Linux and the hostap driver I can set up a legitimate access point. Ad hoc isn't a necessary part of this scam, and I don't see how avoiding ad hoc networks will prevent anything.
  • by frostilicus2 (889524) on Friday January 26, 2007 @11:40AM (#17770356)
    Besides the possible risk from malware infection if you have enabled file sharing, this really is the same man-in-the-middle attack that was so prominant in the 80's and early 90's. A problem which has been mostly fixed by the adoption of SSH over telnet. And is practically non-existant over HTTP today beacuse of the use of SSL on servers. And with regards to malware, how does this differ from picking up some spyware from the pr0n site you "accidently" visited?

    I see no problem here that cannot be solved by adopting the same principles that you would use for ordinary domestic internet access:

    1) Turn on your firewall and close all open ports.
    2) Don't send sensitive data over an unsecured network.
  • by rsw (70577) on Friday January 26, 2007 @11:43AM (#17770400) Homepage
    The network isn't the problem here, your computer's configuration is. All of my machines can safely connect to an untrusted network (and they do---my non-firewalled, non-NATted internet feed) without being turned into zombies.

    The message here shouldn't be "don't connect to untrusted networks," it should be "secure your machine."

    Once you do that, these guys are just being nice and giving you a free connection!

    -rsw
  • I have been to a few airports in Chicago and Dallas recently and scanned those. Never stupid enough to connect to them, (ad-hoc mode is off) but enough to be curious.
  • The YRT regional bus service [wikipedia.org] is trying to make wi-fi access from their buses work. (Last time I checked, the AP was answering but not connecting to anything. They claim some buses are working.)

    Once people get into the habit of using it, it should be easy to board the bus with a laptop and create a bandit AP that looks like the real one. (A working bandit since it could just proxy to the real AP for internet access.) A fine man-in-the-middle only "visible" to the riders, and easy to shutdown and swap buses

  • The article is full of "could"s and "possibly"s. It's sheer speculation.. and indeed, scaremongering.

    I've seen this several times before, and the best article I've seen on it is here [chron.com]. That's a lot more level headed, and it refers to the "Free Public WiFi" SSID as a virally spreading phenomena, but most likely not a virus or honeypot.

    The problem is that Windows handles Ad Hoc WLAN networks in a rather bizarre way.. once you've connected to the Ad Hoc network, your computer will likely become *part* of th

  • I just moved into a new office and I was checking the ports to see which were live. I hit a dead one and my laptop automagically tried to connect via WiFi. I saw a bunch of unsecured access points, and a couple of ad-hoc networks. One was hpsetup (a wireless print server maybe?), and one was Free Public WiFi. This is in downtown Lincoln, NE (yes, they have computers here).

    Disturbingly, one of the unsecured wireless networks is labelled Itgadmin's PowerBook G4 17". More disturbingly, another is labelled
  • by norpan (50740)
    Wireless network cards can be set up as access points to. So just looking for if it's an ad-hoc network does not protect you. Turn off all sharing when connecting through public access points and use encryption.

    There you go - free wi-fi!

The reason that every major university maintains a department of mathematics is that it's cheaper than institutionalizing all those people.

Working...