7 ms·
What we give away when we log on to a public Wi-Fi network
- ColinWright 12y agohttps://news.ycombinator.com/item?id=8461206 https://news.ycombinator.com/item?id=8461206
- yuhong 12y agoI wonder if anyone has tried to use CloudCracker to sniff MS-CHAPv2 VPN traffic.
- fredsted 12y agoAre my devices really broadcasting the SSIDs they have been connecting to?
- tcdent 12y agoYou could brute force it by using common network names and seeing which ones get bites. Take it a step further and generate expected patterns ie. "2WIRE123". I'd expect "linksys" alone would grab a surprising amount to start, though.
- lucb1e 12y ago> using common network names Exactly, even if it's not broadcasting network names, almost every student in the Netherlands will have the train's WiFi hotspot in their list of networks. One thing I still want to check out is whether the laptop will connect to an open network with the same name as a known network that was password protected.
- bluerobotcat 12y agoOn OS X it will not. OS X will also alert you when you try to connect manually.
- gamed 12y agoYes. They are called probe requests, and can be easily intercepted and viewed. Multiple programs exist to grab these requests off the air and stand up wireless networks with that SSID.[1] [1]http://digi.ninja/jasager/ http://digi.ninja/jasager/
- victorvation 12y agoYep. Whenever wifi is enabled, your device is sending out probe request frames, which includes your list of preferred networks/networks you've connected to before.
- bdg 12y agoWow... And I was thinking that using my phone to hotspot in cafes was mitigating things like that. Thanks for sharing!
- A1kmm 12y agoTo an extent it is; if your phone never connects to any WiFi device (and instead uses GPRS / EDGE / LTE etc... to a mobile carrier), and your laptop only ever connects to your phone, then the probes the attacker will see are for your laptop probing for the SSID of your phone. Given an appropriately vague SSID, this doesn't give the attacker much information (c.f. connecting to access points everywhere and giving away that list of SSIDs). If you use WPA2 PSK and choose a long, random password (you want enough entropy that brute forcing it is impossible - for example, 20 completely random and independent characters taken from a dictionary of 62 characters gives you ~105 bits of entropy, which should be enough, while 8 characters or a few dictionary words might not cut it) impersonating your phone is not feasible if your laptop is configured to only ever connect using the saved pre-shared key.
- RexRollman 12y agoWhat's the point of that? To speed up reconnection?
- victorvation 12y agoYes, and also so that you can go between two access points for the same network without having to reconnect.
- keeperofdakeys 12y agoIt also allows APs to be "hidden", by not broadcasting its own SSID, but relying on devices to send out a probe to ask if it's there. Of course, it's not hidden from packet sniffers if it's talking to someone.
- cbsmith 12y agoYes, but that shouldn't be of much of a privacy concern. Keep in mind that your devices are also broadcasting a variety of globally unique identifiers everywhere you go.
- zobzu 12y agounless you got an iphone/ipad ;)
- sktrdie 12y agoHow was the hacker able to get Facebook credentials? Facebook uses HTTPS and so does Live.com. Even if I'm connected to a malicious router, only me and Facebook know about the data we're sending each other. Am I missing something or should the author of this article provide more evidence on the type of attack?
- zokier 12y agosslstrip might explain that, but don't most major sites use HSTS these days?
- xamolxix 12y agoI suspect it's not plain old sniffing. He might give fake DNS records to point to his own phishing site (facebook clone). It's trivial to re-post the credentials to the real facebook check the password and then actually log them in. curl can be used to do this, as I am sure many others. Edit: SSL does not have to be used on the clone. Most people will not notice/care.
- lucb1e 12y agoYou can't spoof a certificate with DNS. Even if you spoofed a DNS response and made facebook.com point to 192.168.1.2 then the server at 192.168.1.2 (which could be yours) would still need a valid certificate for facebook.com. The only way to have done this is by having the user click "continue" or "ignore" or something on an ssl error page. I know from experience that a company full of programmers will happily do that. Only a few percent would go "wait a minute, this is Facebook. That certificate should be valid." Some people here might reply "no way", but HN generally contains the one percent. Edit: This is almost correct. You can actually prevent being redirected from http to https when typing in "facebook.com" without https:// https:// in front. My bad. Still though, the attentive user would notice the missing padlock. I check it 3/4 times, and 4/4 times when using a public network. I also refrain from using http sites where I log in (some forums I visit do that). But again, probably less than one percent of the tech people do that.
- 12y ago
- tcdent 12y agoHow is he able to get them to trust the network? Is it common for software to connect to known SSIDs without verifying any other information?
- zokier 12y agoWhat "other information" is there to verify?
- tcdent 12y agoHardware ID/MAC address, for example.
- nandhp 12y agoAnd how would you verify the MAC address of the router at the coffeeshop/train station/bus?
- johnthedebs 12y agoYou would have it stored from a prior connection to the network. Of course, it's trivial to spoof that too so the additional check doesn't do any good.
- lucb1e 12y agoYou can't, of course. But even if you could, many networks allow for ARP spoofing so connecting to the right access point is not really the solution. And if ARP spoofing is not possible then you run airmon-ng and wireshark.
- xamolxix 12y agoWLAN only cares about SSID. This is how you get roaming mode where you move between access points without losing connectivity (most Universities, company campuses, etc will have this setup)
- victorvation 12y ago
- xamolxix 12y agoConsidering how ridiculously cheap an anonymous VPN service is these days I am surprised how many people do not use them.
- HorizonXP 12y agoBecause it's difficult to setup and configure for most people? People struggle with connecting their laptops/tablets to WiFi. Expecting them to configure a VPN on their own is a stretch. You could start a small SaaS business that could make "lifestyle business" type money if you did this well.
- colinbartlett 12y agoPrivateInternetAccess.com gives you an installer with all the credentials in it ready to go. It was so easy my dad could do it. I don't think ease is a barrier anymore. I think it's just lack of education about how necessary these measures are.
- xtian 12y agoPIA gets a lot of recommendations but no one ever mentions that a great number of sites prevent you from using them from the PIA addresses. I've had a lot of trouble with financial and e-commerce sites in particular (which are also the situations I really care about using a VPN). I think it might be that PIA is frequently used for DDOS and abuse since it's so inexpensive. Just something I wish I had known before signing up.
- collyw 12y agoAs a developer, I would actually have to read up to know exactly what a VPN is and what I can do with it. I have a rough idea, but as it has never been something I have worked with, I have little knowledge of them. Now how would you expect the general public to manage, without someone giving them a decent explanation of them.
- xamolxix 12y agoPrivate internet access (dot com) provide a point and click interface for windows and mac os x. On linux one has to manually config but it's not that hard. I have had non-technical people use it with no issues. I am sure there are others out there. I am not associated with them in any way.
- byoung2 12y agoAll names in this article are fictitious, except for Wouter Slotboom’s I thought for sure that name was fake!
- tim333 12y agoWouter is easy to google. You can see him and his black box here (although the sound is in Dutch) http://www.rtlnieuws.nl/editienl/betrapt-door-wifi-ik-ga-vreemd http://www.rtlnieuws.nl/editienl/betrapt-door-wifi-ik-ga-vre...
- goblin89 12y agoI wonder if it's true that iOS 8 only randomizes device's MAC when the SIM cart is not installed[0]. Was stoked to learn about this feature, too bad it apparently doesn't work as you'd expect it to. [0] http://9to5mac.com/2014/09/26/more-details-on-how-ios-8s-mac-address-randomization-feature-works-and-when-it-doesnt/ http://9to5mac.com/2014/09/26/more-details-on-how-ios-8s-mac...
- jMyles 12y agoHere's what I wrote last time this was posted (https://news.ycombinator.com/item?id=8457167 https://news.ycombinator.com/item?id=8457167), with some edits to respond to other comments made in this thread: An interesting read, but sparse enough on details to be basically useless. Additionally, there's nothing that I can discern to be new here. The following is demonstrated, all of which are known (and in fact obvious) to people with even an elementary understanding of how wifi and TLS work: * That wifi probes are public * That wifi devices, by default, expose reasonably reliable evidence about their type and origin via their MAC address * That many OS's automatically connect to 'trusted' wifi networks, regardless of their apparent physical location * That many websites don't have TLS by default (or at all) * That, if a user connects to a network you control and requests a URL not beginning with "https," it is trivial to present them with a fake page looking like the one to which they thought they were browsing (of course they won't see a lock) --(note: if the website has HTTP Strict Transport Security enabled and the user has previous visited that website with a supporting browser, then this part is non-trivial) * That, if a user transmits unencrypted plain text over a wifi network to which you have access, it's trivial to glean the content of their transmission. None of this is news, and it's all that this article seems to point out. Even more bizarre is that, almost without exception, it merely leaves these items implied, failing to describe the mechanism of action.
- pornel 12y agoGood list. To that I'd add: * DNS and TLS (SNI) don't hide domain names, so you can't hide the fact that you're using certain sites/apps, even if they're HTTPS-only. * If the OS doesn't require NTP encryption, HSTS can be bypassed: https://www.blackhat.com/docs/eu-14/materials/eu-14-Selvi-Bypassing-HTTP-Strict-Transport-Security-wp.pdf https://www.blackhat.com/docs/eu-14/materials/eu-14-Selvi-By...
- voltagex_ 12y agoWithout setting up an evil-twin network, if the wifi network has client isolation turned on (i.e clients are only able to speak to the router), is it possible to perform ARP spoofing still?
- 12y ago
- JoshGlazebrook 12y agoI've read about this kind of thing before, so when I'm in public, or even at school I prefer to fire up my phone's personal hotspot instead of using any public wifi available.
- cbsmith 12y agoThat's good, because now you are just broadcasting your phone's SSID & MAC everywhere. ;-) Seriously, just VPN over the hotspot.
- tunap 12y agoInteresting but dated info for techies. I was hoping for something more along the lines of how retailers triangulate & track your movements inside their brick & mortar sites. Or how public providers scrape your browsing habits whilst on their net. I was even more interested in learning what other tricks they employ that I am not yet aware of. With the ubiquity of broadband mobile I recommend avoiding public wifi whenever possible because the items listed in TFA are ubiquitous at most Starbucks, airports and other hi-profile public spots. I also highly recommend disabling any equipments' wifi by default, the world is full of liars, cheats & thieves smarter than myself. When you go for "free", what you get never is.
- Retric 12y agoRetailers can use video footage + motion capture software to track you which works much better as not everyone has active wifi.
- ambrop7 12y agoMost people don't understand the WPA PSK security model and its insufficiency for anything but private networks where every device is trusted. When you give someone the PSK, you give them the capability to impersonate the access point. That being said, is there any better solution for public networks? One where giving someone a password doesn't let them impersonate you. I'm not sure how good support for EAP-TLS is on common client devices. To actually make it secure the device would not only need to support it but also validate the AP's public key some way.
- zobzu 12y agosince theres no url associated any trusted ca-signed cert is valid (for example a cert from startssl). if you use self signed that actually protects you since then the client complains. SOME clients pin the certs (thus you cant impersonate the AP even with a trusted CA-signed cert) but its still quite rare.
- ambrop7 12y agoBut in theory the same CA infrastructure as used for the web could be used. The SSID of the network would be interpreted as the "domain". So if I try to connect to SSID example.com securely, I would verify that the AP can identify itself as example.com (based on the CA roots which I trust) - exactly the same way as a web browser would if I tried to connect to https://example.com https://example.com. Or is this already supported but nobody uses it?
- wiml 12y agoI think there are a couple of things that would have to happen in order for that to work: 1, we would have to set up a global registry for SSIDs, like we have for domain names. (Otherwise, what's to keep someone else from using a colliding or misleading name and getting a certificate for it?) And even then you run into the problem that the CA infrastructure used for the web is pretty terrible. 2, clients would need some kind of policy database to know what kinds of traffic must go over a "secured" AP and what kinds, if any, can go over the local coffeeshop's or convention hotel's wifi. And all of this to secure just one link of the communication— all the rest remain vulnerable. Really what we want is end-to-end encryption, not link-by-link encryption. If you have #2, for example, you could instead use that policy database to implement mandatory IPsec (or equivalent end-to-end encryption; MinimaLT if you prefer) for all sensitive traffic, and bingo, you're secure against whole classes of attack even when you are using unknown APs.
- ris 12y agoHm. So are there any 802.11_ proposals for cryptographically "signed" SSIDs? Using public key cryptography, this is surely doable in a way that is "anonymous" too, right? (i.e. doesn't reveal the identity of the AP you're probing for)
- tiatia 12y agoDon't like your MAC? get a new one... import random import os mac='' # os.system('/etc/init.d/networking stop') os.system('ifconfig wlan1 down') os.system('ifconfig eth1 down') for i in range(0,3): r=random.randint(16, 256) mac=mac+":"+str(hex(r))[2:] mac="00:07:E9"+mac print mac os.system('ifconfig wlan1 hw ether '+mac) os.system('ifconfig eth1 hw ether '+mac) os.system('ifconfig wlan1 up') os.system('ifconfig eth1 up') # os.system('/etc/init.d/networking stop') os.system('/etc/init.d/networking start') os.system('ifconfig') print "echo 'MAC changed..." print "new random MAC "+mac
- tetraodonpuffer 12y agowhy aren't 'know networks' gps-geofenced on smartphones? You have GPS, if your previous 'known network' (say, home) was in location X, it should not automatically connect (or even try to connect) to it at X + 20 miles. This way you should be able to keep your phone from connecting automatically to (or even looking for) a network that shouldn't be there in that location in the first place, and if you always tether to it it would work for your laptop too...
- janinge 12y agoFor that to work the networks themselves would have to securely distribute a list of locations, or it would have to be configurable on the devices. Many business and educational networks (like eduroam) span multiple locations. Even my "home" network is available multiple places (home, cottage, boat...). Smartphones mostly use wireless networks and cell towers to determine their approximate location, which can be easily spoofed, except for the current active cell (which could be miles away). If devices had to acquire GPS fix every time they reconnected to a network, batteries would drain much faster. And satellite navigation doesn't work properly indoors. Civilian GPS can also be spoofed. Manufacturers would probably prioritize usability over rectifying such a "problem" which never had bothered anyone before, except maybe if there was PR involved. I think there's still no way to list all configured wireless networks on iOS devices? Fixing this would probably improve privacy more (if people cared) than this randomized MAC feature.
- tetraodonpuffer 12y agoI am not really sure why networks would have to distribute a list of locations: the default for connecting is simply 'do not autoconnect or look for any network I have not already connected previously in this location'. If the user does not want to incur the GPS battery impact triangulating with cell towers already should give you enough location information not to look for your home network at work, or the network you saw in Spain last month when you are in the Netherlands. And finally obviously everything can be spoofed, however I don't think it's reason enough not to have a minimal set of protections: the user can decide how much battery to dedicate to the task (i.e. no checking, cell tower checking, gps checking in increasing order of impact)
- VexXtreme 12y agoI see a lot of comments here presenting HSTS as some kind of silver bullet for preventing MITM attacks. While it does help, it's not impenetrable. If a website hasn't been preloaded into the STS preloaded list, then the HSTS header can be stripped on the first visit and the client will never upgrade to SSL. The only foolproof way to make sure you're not being MITMd is to visually verify that the domain checks out and that you are indeed connected using SSL.
- z92 12y agoLogin into a public WiFi and turn on your VPN. Problem solved. VPN accounts are cheaper than ever before. You can also install one on a cheap DO box.