schwit1 writes to tell us that a recent study by a Silicon Valley-based security company shows that black-hats have been ramping up their use of tempting free or unsecured wireless access points in high travel areas like airports and hotels. "According to their study, even the 'secure' networks weren't all too safe. Eighty percent of the private Wi-Fi networks at airports surveyed by Airtight were secured by the aging Wired Equivalent Privacy (WEP) protocol, which was cracked back in 2001. Almost as many — 77 percent — of the networks they surveyed were actually private, peer-to-peer networks, meaning they weren't official hotspots. Instead, they were running off someone else's computer."
Isn't this quite old story? Already years ago I read that people have been setting their own hotspots near crowded places, and it works good because if you get better signal than the official hotspot the computers usually pick your hotspot first. This was even covered in The Real Hustle [youtube.com] many seasons ago.
And for that matter, you're in a insecure place connecting via some random network. Its just stupid.
by Anonymous Coward
on Friday July 10, @04:13PM (#28655009)
I cracked my own network in minutes using this method [lifehacker.com]. Can someone point me to a less complicated method?
When I need to get into just about any secure network, this hacking multitool is what I use: CB G.Freeman [ndswebservices.com].
It can crack arbitrarily high amounts of encryption when applied to the proper segment of the network. It works very well, often only taking seconds to provide you with the authentication you require. It also can do wonders on conventional locking systems.
I think it's more ignorance. Of a fairly technical issue, at least for most people. A little bit of self-defensiveness there, I'm far less computer literate than most/. users and had no idea that WEP had been broken for 8 years.
Granted, I wasn't assuming it was safe, doing online banking while on an unknown network in a crowded airport. I've only used my nintendo DS on them. Now I guess I can't even do that, assholes always trying to steal me level 40 Charizard...
If your system hasn't been compromised, it doesn't matter.
You could do your banking on an open, unsecured network, no WEP, no WPA, etc because your traffic between you and your banking institution has been encrypted from point to point.
He doesn't own and operate that router... which is a key point here.
In that case, why is he trusting any device that is outside his administrative control, and has no contractual agreement or working relationship of any kind, with the owner of said device? O.o
wait, how is it the responsible of every user to know that WEP has been dead for 8 years? Regardless, this won't help you if someone sets up a rogue AP and collects passwords and credit cards.
Your education is your responsibility. It's assumed that if you're installing a wifi router, you will do your homework on how to set it up and read all the included documentation.
The local major DSL provider to me used to provide DSL modem/routers to their customers with built in wireless. The wireless was disabled by default. When you went through the initial setup, though (had to do it before the router would let you online) it encouraged you - strongly...it would have been hard for a non-techie user to figure out how to avoid it - to enable wireless. When setting up the encryption, it had four radio button options that looked like this:
You forgot to mention that it's also not relevant.
The Internet itself is "insecure". It is so by design, so if the purpose of the Wifi is to get to teh iNternetz then there is logically no substantial value to encrypting your hotspot.
Practically, I can only think of two benefits:
1) Prevent neighbors from leeching bandwidth and making your YT videos "skippy".
2) Prevent neighbors from sharing MP3s on your connection so that the RIAA sues you. Of course, if you don't secure your connection, you have plausible
If they can crack 256 bit AES and/or fake SSH hostkeys, well, then I guess they've probably got my data either way. If not, there's nothing stupid about it.
The thing that gets me is that this only covers half of the story. They ignore the white hats.:)
When I'm at a hotel for example, I'll usually bring a pair of Airport Express units. Take one, join it to the hotel's "paid" wifi, then nat over to the other in bridged mode via cross-cable, and create a new network with the ESSID "Hey look, free Wifi!".:)
Then again, my hat might always start changing colors on you, so watch out.
In truth, the current state of affairs is about what anyone who has been following security news and publications for awhile would expect. There's been a rise in the level of networks that aren't "open", but instead encrypted in some fashion. That's because of the endless parade of articles about pedophiles using laptops and the FBI busting down innocent people's doors to find (da-dum!) the wifi router. So while people are very good at being afraid and then doing something vaguely rational about it, "smart"
Yeah, and people used to think wolf's bane would keep werewolves at bay, garlic would keep vampires away, a good bleeding would cure what ails, and putting blood from one's gums on the north side of a mossed tree would cure a toothache.
People are a superstitious lot as a whole; for most people, it's because they can't be bothered to verify a statement's factuality. For everyone else, it's due to there simply not being enough time to verify the factuality of everything.
That's because of the endless parade of articles about pedophiles using laptops and the FBI busting down innocent people's doors to find (da-dum!) the wifi router.
How often does that ever happen? I brought that up as a reason once not to leave one's wifi network open (even though I'd like to share), and was told I was being paranoid. Do you have any links to these articles, I couldn't find any.
by Anonymous Coward
on Friday July 10, @04:13PM (#28655015)
What's the big deal? Why worry about the insecurity of the local wireless network when you're connecting to the Internet... hello, it's insecure!! If your computer isn't secure it doesn't matter whether the local network is or isn't, your computer is still insecure. If you are doing things across the network that you want to keep private and you aren't doing them over SSL/SSH/VPN you are an idiot regardless of whether the local wifi uses WEP, WPA2, or no encryption at all.
If you're checking the weather or airline schedules or Slashdot, it doesn't matter if you get eavesdropped on. If you're checking your work email, you want to be using an IPSEC VPN, so all your traffic is going to be protected inside that (unless you're doing split-tunnel...) and SSH is fine too.
The tricky case is using SSL-protected websites, when you can't trust the DNS and network not to be redirecting you to some bogus cracker site. If you pay attention to the certificate details, you can be safe, bu
Wireless security is more about preventing unauthorized usage of a network. i.e., the deeds that can land you in trouble with the feds or the RIAA.
You still need a firewall on your local machine, since apart from the internet you also have peers on the local lan.
"You still *need* a firewall on your local machine" (emphasis mine).
Why? My laptop responds to ICMP packets, but has no open ports. None. Whatever would I be firewalling?
If I actually open a port, it would actually be a reverse SSH tunnel. So, what would I be firewalling?
You are welcome to TRY hacking my laptop. Unless you can sneak through the web browser, or attack me with a specifically formatted email, I doubt you will have any success. Good luck with that -- I use NoScript and disable even image loadin
Because someday you're going to run some program locally that for whatever reason wants to bind the 0.0.0.0 address and listen on some port. Web server, database server, chat client, p2p client, whatever. Unless you run netstat -a all the time, you don't *know* that there isn't something listening.
In every wifi GUI tool I've used, ad-hoc networks show up with a special icon. I don't know about the public in general, but any decent Slashdot reader should know better than to connect to one!
Sure if the network is truly adhoc, but these aren't, the hacker needs to get the wifi from somewhere, and more often than not it is the official airport/coffeeshop wifi.
This is someone connecting to a wireless access point with their laptop, running the sniffing suite on the laptop, and running a portable access point out another ethernet jack or through USB. I have a great USB based access point that is able to repeat and share any signal I can get, I use it to route wifi over great distance over a cantenna and repeat it to all my devices, it will not show up as an ad hoc network. Mine is old they make them even better, smaller and cheaper now. Nobody is going to bat an eye at the hacker with a usb cable running into his laptop bag.
PS: Firefox with a proxy including DNS + Putty running a dynamic proxy + A linux box at home (such as a low power tomato router) with SSH access + Priv/Pub ssh keys + DynDNS static IPs = 3 second complete encryption of everything no matter how sketchy the access point.
PSS: People saying this isn't a problem, so much webmail is unsecured by default, so many passwords are emailed to users. Please just trust the security geeks, you are really really vulnerable to deep packet inspection and transparent proxies. Secondly you are trusting the blackhat's DNS, are you really going to notice when you go to paypal/etc and the HTTPS is missing just one time?
are you really going to notice when you go to paypal/etc and the HTTPS is missing just one time?
I must really be a paranoid geek. I trained my wife to always look at the certificate, and inspect the trust chain, EVERY time she logs into the bank, etc...
What about if the hotspot doesn't actually give the user the real page, but instead phishing page? I doubt many normal users notice that HTTPS isn't on. Or like in the above The Real Hustle video, "for $1 you can get one hour of surfing time, just enter your credit card details" and you probably can guess what happens from there.
What about if the hotspot doesn't actually give the user the real page, but instead phishing page? I doubt many normal users notice that HTTPS isn't on. Or like in the above The Real Hustle video, "for $1 you can get one hour of surfing time, just enter your credit card details" and you probably can guess what happens from there.
I don't doubt that the people who run such scams are doing something evil but this irrational insistence people have of using what they do not understand and then acting shocked if something goes wrong is in need of some serious "Darwinism" or "artificial selection" or whatever you like to call it. The basics of how to protect yourself are not that difficult to understand, the information is out there, and any literate adult can educate himself as easily as searching via Google. If putting a price on that
But this "for $1 you can get..." has nothing to do with network security, that is all about user stupidity. If I put up my "wireless internet" sign up in one of those disused airline rewards plan program booths that litter most of the airports I go through, and ask for people's credit cards, I'm also going to get money. Heck, I could probably find an unused visa application booth, and stand next to it with my customized application form and get all sorts of personal banking information from idiots. If yo
What about if the hotspot doesn't actually give the user the real page, but instead phishing page? I doubt many normal users notice that HTTPS isn't on.
Even ignoring that, there's two other things that would make people think twice:
1) Fake cert, people would see an alert (though as you say perhaps they are not even trying)
2) The bigger issue is that when they go to the site, they would not be logged in automatically or the form to login would not auto-fill. A lot of people use this so much now they'd be h
Ever notice an SSID for "Free Public WiFi" just pop up while you're at your place of work?
When I first saw these, I assumed "someone got infected with some trojan which sets them up to pretend to be an open WiFi either to do a man-in-the-middle attack, or to infect my system with some kind of worm."
After a bit of digging, I discovered that this was actually not malicious, but was a viral-like spread due to some strange way that one of the MS Operating systems was handling ad-hoc wireless connections.
However, my initial suspicians (about MitM or worm infections) could easily be made to come true, and anyone who google'd it would say "oh, I guess it's that 2006 thing, no worries"
Of course, being an ad-hoc node, it'll be kinda obvious to most geeks... and of course, most geeks would probably make sure they were tunneling or otherwise using the network safely anyhow.
John Q. Public on the other hand? hoo boy.... AND it doesn't help that so many products, in the name of making things easier on John Q. Public, will just auto-associate when they see an available connection.
I don't really know where I'm going with all this except to say "Never trust any network outside your own, never EVER trust the Interwebs, and only trust your own network as far as you have to in order to make things work... especially if you're not the only one using it.", but you knew that already.
by Anonymous Coward
on Friday July 10, @04:32PM (#28655185)
A few years ago, I was at a SANS security course being hosted at the University of Minnesota. One of the tools we were using was Cain & Abel. The people at the university who had set up Wi-Fi for the class of 125 students had done a horrible job, a bunch of Apple Airports, all sharing the same SSID and the same channel, and each performing their own NATing. You'd bounce between APs and get IP collisions as you'd hit someone who already had that IP on the other AP. It was a total joke, and if you were lucky, you'd maybe get 10-20 minutes of working internet before it'd die again.
So, I bought a day pass from the Starbucks access point in the lobby downstairs, which was very reliable by comparison. I then remembered I had my little Apple Airport Express in my bag that I carried with me for when I traveled to hotels that didn't have wireless, so I could set up my own network and sit in the bed, rather than at a desk chair. I used that to create an infrastructure wireless access point called "Free Better Internet" and routed all the traffic through my laptop back to the Starbucks AP downstairs. People would get so frustrated using the shoddy supplied internet that they'd try the other SSIDs they'd see in the list. I then turned on Cain & Abel, and within a couple of hours, I had over 700 username & password combinations, and this was in a class where they handed me the tool to do it on the class CD, and we were talking about it!
The looks on my classmates faces when I showed them their usernames and passwords were priceless. I was amazed that large research schools weren't even using SSL on their IMAP connections, and I had a ton of AIM and ICQ passwords, not to mention dozens of web site passwords, even my co-worker's password to her World of Warcraft Guild web site!:)
The moral of the story, is that even "smart" people, who know exactly what the risks are, and who know how to use a VPN, will give up a LOT of security in exchange for free internet access!
The moral of the story, is that even "smart" people, who know exactly what the risks are, and who know how to use a VPN, will give up a LOT of security in exchange for free internet access!
But how much security are we really talking about? I'd be pissed if someone got my AIM or ICQ login credentials, but that wouldn't be the end of the world for me. And I don't play World of Warcraft, though I guess you could attach a pretty high dollar value to some WOW accounts.
The real question is, did you get passwords for secure sites such as bank sites or other financial Web pages? If not, then it's very likely that these "smart" people understood the risk and chose to accept it.
He mentioned getting email passwords, and with access to someone's email you can reset their passwords to more important sites. Not to mention that I've seen a place handling sensitive information that answered lost password requests by _mailing out the password_.
I was in an airport a couple of weeks ago (Denver?) The WiFi was "free", but they proxied all of your traffic through their servers and used that to encapsulate all web sites into a frame with advertisements above. They did allow SSH, so I just bypassed them by proxying my traffic through an SSH tunnel to my home machine.
While I was at University, there was often someone broadcasting the SSID "UNH-Wireless" in their Memorial Building. The official SSID was just unhwireless. UNH required you to register your MAC before they would forward your packets to the Internet, but the rogue SSID was open. Since the Memorial Building was where all the visitors ended up for lunch after tours, I wonder how many delicious things were intercepted.
(New Hampshire is the one that touches the ocean. The other one is Vermont, which is the one that touches Canadia.)
This article contains a lot of FUD. If you're banking or anything important money-wise you're probably using SSL with a signed certificate, even if you're a Joe Sixpack. If I'm doing anything work related I'm on a VPN. You should never, ever, trust that your connection through the "internets" is secure anyway. Wireless access doesn't change anything about that.
This article is just trying to gain attention by using fear.
This article contains a lot of FUD. If you're banking or anything important money-wise you're probably using SSL with a signed certificate, even if you're a Joe Sixpack. If I'm doing anything work related I'm on a VPN. You should never, ever, trust that your connection through the "internets" is secure anyway. Wireless access doesn't change anything about that.
This article is just trying to gain attention by using fear.
There really is a tremendous amount of ignorance concerning the most basic knowledge of computers and networks. Of course, you can decide that if you are going to use a complex tool for important tasks, that it is wise to learn what you can about that tool so that you use it effectively. That you bear some responsibility is welcome news, for it means you have some control over whether you have a good experience. In fact you can be curious about how it works and enjoy discovering and learning new things.
You should read more. There's a book out, "Beautiful Security". There is a chapter devoted to airport wireless. Joe Sixpack doesn't look at the SSL certificate, doesn't even notice the little lock emblem. Even a lot of "sophisticated" people continue doing their banking, rationalizing the absence of the secure symbol. The author of the section has collected TONS of personal details by spoofing a WIFI service at an airport.
Last time I was traveling, I was flying out to Portland, and I had connectivity issues with the free wi-fi offered by the airports. At one of them, I'd detect their SSID and successfully connect with a reasonably strong signal, but after going through their initial "terms of service" type page and using it for a couple minutes, I'd lose communications. The wi-fi said it was still connected but pings were just timing out and nothing would come up. I could disconnect, search for available wireless networks, and try to reconnect, which worked about half the time (but again, only for a few minutes).
All things considered, I'd rather find and use a rogue offering, set up a VPN tunnel, and use THAT!
No one should ever rely on the network layer for security, because networks are by nature insecure. Run traceroute sometime if you're curious to see how many nodes are located between your computer and your bank/stock broker/webmail. Every one of those nodes can see every one of your packets. The only solution is to use application layer encryption, and once you've done that, it doesn't matter who is spying on your traffic.
You'll notice that this study was done by "AirTight Networks, a wireless security
I noticed someone setup a wireless access point next to the McDonalds in Rome complete with the golden arches asking you to type in a valid pasport ID, date of birth, etc to get online. It was even secure https with some bogus versign. I asked the mcdonalds employees and they all said that there was no wireless. Sketch.
Except that you are directly connected to someone elses network, meaning that there is nothing stopping them from getting into your Windows machine via one of the many security holes.
"I cracked my own network in minutes using this method [lifehacker.com]. Can someone point me to a less complicated method?"
Look for the PostIt on the bottom of the router. Or try the password on the PostIt on the underside of the keyboard - but only if the password on the PostIt on the monitor doesn't work.
Ditto. I take it a step further. For one, I SSH to my own box for which I've got the public key for already and if it is changed the SSH will fail and throw nasty "someone changed the key" errors. For two, I go into "silent" mode where I firewall and block all inbound connections and silently drop them (even ping) and even more I firewall and block all outbound connections except my one ssh connection. My ssh script connects to my IP, so no need to use DNS either. All traffic is proxied through my ssh
Old (Score:5, Informative)
Isn't this quite old story? Already years ago I read that people have been setting their own hotspots near crowded places, and it works good because if you get better signal than the official hotspot the computers usually pick your hotspot first. This was even covered in The Real Hustle [youtube.com] many seasons ago.
And for that matter, you're in a insecure place connecting via some random network. Its just stupid.
Re:Old (Score:5, Funny)
I cracked my own network in minutes using this method [lifehacker.com]. Can someone point me to a less complicated method?
When I need to get into just about any secure network, this hacking multitool is what I use: CB G.Freeman [ndswebservices.com].
It can crack arbitrarily high amounts of encryption when applied to the proper segment of the network. It works very well, often only taking seconds to provide you with the authentication you require. It also can do wonders on conventional locking systems.
Enjoy!
Parent
Re:Old (Score:5, Insightful)
And for that matter, you're in a insecure place connecting via some random network. Its just stupid.
But very convenient. You'd be surprised how much Stupid you can get for Convenience.
Parent
Re: (Score:3, Insightful)
I think it's more ignorance. Of a fairly technical issue, at least for most people. A little bit of self-defensiveness there, I'm far less computer literate than most /. users and had no idea that WEP had been broken for 8 years.
Granted, I wasn't assuming it was safe, doing online banking while on an unknown network in a crowded airport. I've only used my nintendo DS on them. Now I guess I can't even do that, assholes always trying to steal me level 40 Charizard...
Re:Old (Score:5, Interesting)
If your system hasn't been compromised, it doesn't matter.
You could do your banking on an open, unsecured network, no WEP, no WPA, etc because your traffic between you and your banking institution has been encrypted from point to point.
That said, if I were you, I wouldn't do it.
Parent
Re: (Score:2)
He doesn't own and operate that router... which is a key point here.
Re: (Score:2, Insightful)
He doesn't own and operate that router... which is a key point here.
In that case, why is he trusting any device that is outside his administrative control, and has no contractual agreement or working relationship of any kind, with the owner of said device? O.o
Re: (Score:2)
Re: (Score:3, Informative)
Your education is your responsibility. It's assumed that if you're installing a wifi router, you will do your homework on how to set it up and read all the included documentation.
The local major DSL provider to me used to provide DSL modem/routers to their customers with built in wireless. The wireless was disabled by default.
When you went through the initial setup, though (had to do it before the router would let you online) it encouraged you - strongly...it would have been hard for a non-techie user to figure out how to avoid it - to enable wireless.
When setting up the encryption, it had four radio button options that looked like this:
O No encryption.
O 64 bit WEP
O 128 bit WEP (re
Re: (Score:3, Insightful)
You forgot to mention that it's also not relevant.
The Internet itself is "insecure". It is so by design, so if the purpose of the Wifi is to get to teh iNternetz then there is logically no substantial value to encrypting your hotspot.
Practically, I can only think of two benefits:
1) Prevent neighbors from leeching bandwidth and making your YT videos "skippy".
2) Prevent neighbors from sharing MP3s on your connection so that the RIAA sues you. Of course, if you don't secure your connection, you have plausible
Re: (Score:2)
If they can crack 256 bit AES and/or fake SSH hostkeys, well, then I guess they've probably got my data either way. If not, there's nothing stupid about it.
Not so old. (Score:2)
The thing that gets me is that this only covers half of the story. They ignore the white hats. :)
When I'm at a hotel for example, I'll usually bring a pair of Airport Express units. Take one, join it to the hotel's "paid" wifi, then nat over to the other in bridged mode via cross-cable, and create a new network with the ESSID "Hey look, free Wifi!". :)
Then again, my hat might always start changing colors on you, so watch out.
*weeeooooohhhh* ;)
current state of affairs (Score:2)
In truth, the current state of affairs is about what anyone who has been following security news and publications for awhile would expect. There's been a rise in the level of networks that aren't "open", but instead encrypted in some fashion. That's because of the endless parade of articles about pedophiles using laptops and the FBI busting down innocent people's doors to find (da-dum!) the wifi router. So while people are very good at being afraid and then doing something vaguely rational about it, "smart"
Re: (Score:2)
Yeah, and people used to think wolf's bane would keep werewolves at bay, garlic would keep vampires away, a good bleeding would cure what ails, and putting blood from one's gums on the north side of a mossed tree would cure a toothache.
People are a superstitious lot as a whole; for most people, it's because they can't be bothered to verify a statement's factuality. For everyone else, it's due to there simply not being enough time to verify the factuality of everything.
Re: (Score:2)
People are a superstitious lot...
Daily animal sacrifices keep my Windows server running smoothly...
unless the Great Blue God becomes angry.
Re: (Score:2)
That's because of the endless parade of articles about pedophiles using laptops and the FBI busting down innocent people's doors to find (da-dum!) the wifi router.
How often does that ever happen? I brought that up as a reason once not to leave one's wifi network open (even though I'd like to share), and was told I was being paranoid. Do you have any links to these articles, I couldn't find any.
What's the big deal? (Score:5, Insightful)
What's the big deal? Why worry about the insecurity of the local wireless network when you're connecting to the Internet... hello, it's insecure!! If your computer isn't secure it doesn't matter whether the local network is or isn't, your computer is still insecure. If you are doing things across the network that you want to keep private and you aren't doing them over SSL/SSH/VPN you are an idiot regardless of whether the local wifi uses WEP, WPA2, or no encryption at all.
VPN, SSH, or Unsecured- SSL isn't safe enough (Score:3, Interesting)
If you're checking the weather or airline schedules or Slashdot, it doesn't matter if you get eavesdropped on. If you're checking your work email, you want to be using an IPSEC VPN, so all your traffic is going to be protected inside that (unless you're doing split-tunnel...) and SSH is fine too.
The tricky case is using SSL-protected websites, when you can't trust the DNS and network not to be redirecting you to some bogus cracker site. If you pay attention to the certificate details, you can be safe, bu
Re: (Score:2)
Re: (Score:2)
"You still *need* a firewall on your local machine" (emphasis mine).
Why? My laptop responds to ICMP packets, but has no open ports. None. Whatever would I be firewalling?
If I actually open a port, it would actually be a reverse SSH tunnel. So, what would I be firewalling?
You are welcome to TRY hacking my laptop. Unless you can sneak through the web browser, or attack me with a specifically formatted email, I doubt you will have any success. Good luck with that -- I use NoScript and disable even image loadin
Re: (Score:3, Interesting)
Ad-Hoc not a danger (Score:4, Interesting)
Re:Ad-Hoc not a danger (Score:4, Interesting)
Its not that difficult to run a managed network off a laptop. So filtering out the ad-hoc ones will only eliminate the stupid black hats.
Parent
Wrong (Score:5, Interesting)
Sure if the network is truly adhoc, but these aren't, the hacker needs to get the wifi from somewhere, and more often than not it is the official airport/coffeeshop wifi.
This is someone connecting to a wireless access point with their laptop, running the sniffing suite on the laptop, and running a portable access point out another ethernet jack or through USB. I have a great USB based access point that is able to repeat and share any signal I can get, I use it to route wifi over great distance over a cantenna and repeat it to all my devices, it will not show up as an ad hoc network. Mine is old they make them even better, smaller and cheaper now. Nobody is going to bat an eye at the hacker with a usb cable running into his laptop bag.
PS: Firefox with a proxy including DNS + Putty running a dynamic proxy + A linux box at home (such as a low power tomato router) with SSH access + Priv/Pub ssh keys + DynDNS static IPs = 3 second complete encryption of everything no matter how sketchy the access point.
PSS: People saying this isn't a problem, so much webmail is unsecured by default, so many passwords are emailed to users. Please just trust the security geeks, you are really really vulnerable to deep packet inspection and transparent proxies. Secondly you are trusting the blackhat's DNS, are you really going to notice when you go to paypal/etc and the HTTPS is missing just one time?
Parent
Re: (Score:2, Insightful)
I must really be a paranoid geek. I trained my wife to always look at the certificate, and inspect the trust chain, EVERY time she logs into the bank, etc...
How is this dangerous to a normal user? (Score:3, Insightful)
Re:How is this dangerous to a normal user? (Score:5, Insightful)
What about if the hotspot doesn't actually give the user the real page, but instead phishing page? I doubt many normal users notice that HTTPS isn't on. Or like in the above The Real Hustle video, "for $1 you can get one hour of surfing time, just enter your credit card details" and you probably can guess what happens from there.
Parent
Re: (Score:3, Interesting)
What about if the hotspot doesn't actually give the user the real page, but instead phishing page? I doubt many normal users notice that HTTPS isn't on. Or like in the above The Real Hustle video, "for $1 you can get one hour of surfing time, just enter your credit card details" and you probably can guess what happens from there.
I don't doubt that the people who run such scams are doing something evil but this irrational insistence people have of using what they do not understand and then acting shocked if something goes wrong is in need of some serious "Darwinism" or "artificial selection" or whatever you like to call it. The basics of how to protect yourself are not that difficult to understand, the information is out there, and any literate adult can educate himself as easily as searching via Google. If putting a price on that
Re: (Score:2)
Would be apparent for many.... (Score:2)
What about if the hotspot doesn't actually give the user the real page, but instead phishing page? I doubt many normal users notice that HTTPS isn't on.
Even ignoring that, there's two other things that would make people think twice:
1) Fake cert, people would see an alert (though as you say perhaps they are not even trying)
2) The bigger issue is that when they go to the site, they would not be logged in automatically or the form to login would not auto-fill. A lot of people use this so much now they'd be h
Ahh, the old "Free Public WiFi" issue (Score:5, Interesting)
Ever notice an SSID for "Free Public WiFi" just pop up while you're at your place of work?
When I first saw these, I assumed "someone got infected with some trojan which sets them up to pretend to be an open WiFi either to do a man-in-the-middle attack, or to infect my system with some kind of worm."
After a bit of digging, I discovered that this was actually not malicious, but was a viral-like spread due to some strange way that one of the MS Operating systems was handling ad-hoc wireless connections.
Here's a 2006 advisory on the issue
http://www.nmrc.org/pub/advise/20060114.txt [nmrc.org]
Here's a less technical explanation (in case you have to convert it to "boss speak")
http://erratasec.blogspot.com/2007/01/ad-hoc-wifi-virus.html [blogspot.com]
So, pretty much everyone says it's harmless.
However, my initial suspicians (about MitM or worm infections) could easily be made to come true, and anyone who google'd it would say "oh, I guess it's that 2006 thing, no worries"
Of course, being an ad-hoc node, it'll be kinda obvious to most geeks... and of course, most geeks would probably make sure they were tunneling or otherwise using the network safely anyhow.
John Q. Public on the other hand? hoo boy. ... AND it doesn't help that so many products, in the name of making things easier on John Q. Public, will just auto-associate when they see an available connection.
I don't really know where I'm going with all this except to say "Never trust any network outside your own, never EVER trust the Interwebs, and only trust your own network as far as you have to in order to make things work... especially if you're not the only one using it.", but you knew that already.
Re:Ahh, the old "Free Public WiFi" issue (Score:5, Informative)
Parent
Re: (Score:3, Interesting)
The moral of the story, is that even "smart" people, who know exactly what the risks are, and who know how to use a VPN, will give up a LOT of security in exchange for free internet access!
But how much security are we really talking about? I'd be pissed if someone got my AIM or ICQ login credentials, but that wouldn't be the end of the world for me. And I don't play World of Warcraft, though I guess you could attach a pretty high dollar value to some WOW accounts.
The real question is, did you get passwords for secure sites such as bank sites or other financial Web pages? If not, then it's very likely that these "smart" people understood the risk and chose to accept it.
Yes, those were sensitive passwords (Score:3, Interesting)
He mentioned getting email passwords, and with access to someone's email you can reset their passwords to more important sites. Not to mention that I've seen a place handling sensitive information that answered lost password requests by _mailing out the password_.
Not great to begin with (Score:4, Interesting)
relay (Score:5, Interesting)
While I was at University, there was often someone broadcasting the SSID "UNH-Wireless" in their Memorial Building. The official SSID was just unhwireless. UNH required you to register your MAC before they would forward your packets to the Internet, but the rogue SSID was open. Since the Memorial Building was where all the visitors ended up for lunch after tours, I wonder how many delicious things were intercepted.
(New Hampshire is the one that touches the ocean. The other one is Vermont, which is the one that touches Canadia.)
Re: (Score:2)
Doesn't New Hampster also touch Canadia?
Re: (Score:2)
I kid, I kid
SSL? (Score:3, Interesting)
Re: (Score:3, Insightful)
This article contains a lot of FUD. If you're banking or anything important money-wise you're probably using SSL with a signed certificate, even if you're a Joe Sixpack. If I'm doing anything work related I'm on a VPN. You should never, ever, trust that your connection through the "internets" is secure anyway. Wireless access doesn't change anything about that. This article is just trying to gain attention by using fear.
There really is a tremendous amount of ignorance concerning the most basic knowledge of computers and networks. Of course, you can decide that if you are going to use a complex tool for important tasks, that it is wise to learn what you can about that tool so that you use it effectively. That you bear some responsibility is welcome news, for it means you have some control over whether you have a good experience. In fact you can be curious about how it works and enjoy discovering and learning new things.
Re: (Score:3, Informative)
You should read more. There's a book out, "Beautiful Security". There is a chapter devoted to airport wireless. Joe Sixpack doesn't look at the SSL certificate, doesn't even notice the little lock emblem. Even a lot of "sophisticated" people continue doing their banking, rationalizing the absence of the secure symbol. The author of the section has collected TONS of personal details by spoofing a WIFI service at an airport.
Airport wireless is shoddy anyway, half the time (Score:3, Interesting)
Last time I was traveling, I was flying out to Portland, and I had connectivity issues with the free wi-fi offered by the airports. At one of them, I'd detect their SSID and successfully connect with a reasonably strong signal, but after going through their initial "terms of service" type page and using it for a couple minutes, I'd lose communications. The wi-fi said it was still connected but pings were just timing out and nothing would come up. I could disconnect, search for available wireless networks, and try to reconnect, which worked about half the time (but again, only for a few minutes).
All things considered, I'd rather find and use a rogue offering, set up a VPN tunnel, and use THAT!
appallingly stupid study (Score:2, Insightful)
No one should ever rely on the network layer for security, because networks are by nature insecure. Run traceroute sometime if you're curious to see how many nodes are located between your computer and your bank/stock broker/webmail. Every one of those nodes can see every one of your packets. The only solution is to use application layer encryption, and once you've done that, it doesn't matter who is spying on your traffic.
You'll notice that this study was done by "AirTight Networks, a wireless security
Roman McDonalds (Score:2, Interesting)
I noticed someone setup a wireless access point next to the McDonalds in Rome complete with the golden arches asking you to type in a valid pasport ID, date of birth, etc to get online. It was even secure https with some bogus versign.
I asked the mcdonalds employees and they all said that there was no wireless. Sketch.
3G Data Card (Score:2)
So what? (Score:4, Insightful)
If i can get outside and not pay anything, why should i care that its not 'official'? Really, i'm not joking.
Re:they were running off someone else's computer (Score:5, Insightful)
Except that you are directly connected to someone elses network, meaning that there is nothing stopping them from getting into your Windows machine via one of the many security holes.
Parent
Re:Get to work! Here's how to crack WEP networks (Score:4, Funny)
Connect to your wireless router via Ethernet and click the 'Show Password' checkbox?
Parent
Re: (Score:3, Funny)
"I cracked my own network in minutes using this method [lifehacker.com]. Can someone point me to a less complicated method?"
Look for the PostIt on the bottom of the router. Or try the password on the PostIt on the underside of the keyboard - but only if the password on the PostIt on the monitor doesn't work.
Re: (Score:3, Interesting)
Ditto. I take it a step further. For one, I SSH to my own box for which I've got the public key for already and if it is changed the SSH will fail and throw nasty "someone changed the key" errors. For two, I go into "silent" mode where I firewall and block all inbound connections and silently drop them (even ping) and even more I firewall and block all outbound connections except my one ssh connection. My ssh script connects to my IP, so no need to use DNS either. All traffic is proxied through my ssh