Slashdot Mirror
"Free Wi-Fi" Scam In the Wild
DeadlyBattleRobot writes in with a story from Computerworld about a rather simple scam that has been observed in the wild in several US airports. Bad guys set up a computer-to-computer (ad hoc) network and name it "Free Wi-Fi." You join it and, if you have file sharing enabled, your computer becomes a zombie. The perp has set up Internet sharing so you actually get the connectivity you expected, and you are none the wiser. Of course no one reading this would fall for such an elementary con. The article gives detailed instructions on how to make sure your computer doesn't connect automatically to any offered network, and how to tell if an access point is really an ad hoc network (it's harder on Vista).
Well, they would have a really difficult time turning my linux based portable into a zombie. I guess that would be risk free wifi for me, Yeah! Oh, and while in public, I use stunnel to a secure server. Sniff all of the data you want while I use your free wireless.
Kindness is the language which the deaf can hear and the blind can see. - Mark Twain
To avoid this, just avoid ad-hoc connections. That will work until the perps start using Infrastructure (Access Point) connections with a bridge to the real one. You can even set up Windows XP so that it won't allow you to make ad-hoc connections.
GreyPoopon
--
Why is it I can write insightful comments but can't come up with a clever signature?
Now I can take a well-configured Linux lappy to the airport, hook up through these bad guys, and make extra sure to do everything illegal, immoral, and dangerous I can think of over their pipe without a smidgen of guilt. Woo and yay!
Slashdot Burying Stories About Slashdot Media Owned
Does anyone in here remember when airports used to usually have free wireless internet access? In 2001, it seemed like most of the nice airports offered free wireless access as a courtesy to customers, but now the only one I see doing that is my local airport (bluegrass int'l). Now every other airport seems to have some silly $15 wireless internet access service. Even expensive hotels now are starting to charge for wireless access, though they usually still have free wired access.
That's it, I'm sick of all this mother fucking nickel and dimeing in these motherfucking airports.
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0 is the magic number.
said it best: "A sucker is born every minute".
'Loose' is when your pants are three sizes too big. 'Lose' is when you misuse 'loose'.
I've seen this in the B terminal of Dulles Airport, everytime I fly out. I guess it could be someone who works there or something. But since it was ad-hoc I never connected.
Kilroy was here.
When you connect to a network, a little wizard pops up asking you if it's "Home", "Work", or "Public Location". Choose Public Location and sharing will be disabled automatically.
I'm not going to bother reading the whole thing because the first page was so bad.
1) They'll be able to read your user names and passwords for financial web sites
Only if you're dumb enough to not use SSL.
2) Having file-sharing on will allow them to make you into a zombie
Only if you have your shares horribly misconfigured.
3) The hacker will change your wi-fi settings
Again, only if you have your shares horribly configured.
*Maybe* Windows is broken enough to allow someone to do this just based on a single wi-fi connection, but I doubt it.
-Andrew
I've never seen anything pernicious and accidental* come into a corporate network except through the marketing folks. They always seem to be the ones who like the use gadgets they don't understand, leave extraneous services on because they seem kinda neat and so on. They're exactly the sort of people who connect to ad-hocs all day long. After all, if their computer is compromised, it's IT's problem.
/. isn't the sort of person the perpetrators are looking for.
The summary is right - anyone who is a big enough geek to read
*Pissed off IT guys have occasionally been foolish enough to actually sabotage their employers. This is pure shitting where you eat, no matter how big an asshole your CEO is (or whatever).
I am the one true god. However, as an atheist, I don't believe in myself. I guess I have a self-esteem problem.
If you have a box that's permanently on the net, a machine at home that's always on, a web server, etc, set your laptop up to always tunnel its connections through it. That way, even if someone 0wnz the connection you're on, so long as your software firewall is good, you're set.
But because you're using his connection, all your traffic goes through his PC, so he can see everything you do online, including all the usernames and passwords you enter for financial and other Web sites.
While this is true for HTTP, which is in the clear, banking, financial, and e-commerce websites use SSL (or should, anyhow), which makes man-in-the-middle attacks impractical (though not impossible). I have seen these "hotspots" myself, in areas of Boston near hotels, and I've connected to them via my BSD laptop. I wasn't able to actually get any connectivity through them. I've been wondering if these were set up by someone maliciously, or if these are pwned machines. Kinda makes me want to walk around with netstumbler until I find these guys.
I saw this in November in Heathrow airport in London, England - an ad hoc wireless network called "Free Wi-Fi". Obviously I wasn't stupid enough to connect to it.
siener's youtube channel
And when wi-fi becomes a universally available free commodity (who else is betting on it?) what trickery will we see then?
Or the bad guy could set a relay with the real internet and get all your passwords, that's why I use SSL in public APs. But even worse, he could emulate (and forward data to) popular sites like Gmail, Yahoo, Ebay and Paypal but without any SSL. Like, a site that looks and acts like Gmail and even has your messages but is in reality a non-encrypted site that acts as a proxy.
If you're somehow connected to this ad hoc network, but use encrypted access to other computers, are you still ok? eg. if I ssh to my home computer, or use access an https site am I still ok?
It seems to a non issue if you don't have open shares and you don't have have blank or simple passwords along with default user names.
-- if you mod me down, I will become more powerful than you can possibly imagine
I was there when he said it. Wikipedia doesnt know everything.
Stinkhead
As I travel, I see this appearing at more and more airports. I am curious if they are changing the zombie computers to offer their own ad-hoc "Free WIFI" and send the sniffed information to a central collection point. I have also seen this in hotels in major cities. It's a boon for more identity theft.
Connecting to the "Free Wi-Fi" and having your passwords and data sniffed is one thing, but how easy is it for the attacker to turn a Windows XP system into a zombie, merely by connecting to an attacker's wireless network?
Assumption #1. You run Windows XP, SP2, up to date with security patches
Assumption #2. You have Windows Firewall installed and configured for maximum security
Assumption #3. You are not sharing your folders on the network, or if you are, you're not allowing guest write access
(Now, I know how many Windows users do not follow #1,#2,#3 above..) but assuming they do, is a zero-day exploit required in order to zombify their PC?
The article says that if you connect to another host via an ad-hoc network, you somehow turn on filesharing in Windows (presumably to your entire HD). I wasn't aware of this feature in Windows. Can someone confirm it and provide some references, because the last people I'll trust to get the facts straight are journalists.
AccountKiller
linux laptop advertising as a wifi hot spot.
It runs it's own DNS and httpd.
you connect, it looks real. Log into your yahoo account with a legit looking cert, hmmm yahoo is having trouble, I'll try ebay. I logged in but it also has trouble, I'll try again.. oh it works!
Really easy, thwarts all the "this certificate does not match as you control everything the client side sees, then dump them off to your link to wifi or your cellular net connection.
you can probably get tons of real logins you are ready for collecting.
Moral of this? do not trust open accesspoints, they might not be legit.
Do not look at laser with remaining good eye.
Doesn't running Windows already turn your computer into a zombie?
Erm... and how exactly will someone turn p2p client into a zombie? I mean you can access shared volume if it is not password protected, but run anything?
Or was this dude letting share his entire HD including OS?
Trying not to be the arrogant Mac user my friends kid me about being (at least I think they're kidding), I've gotta ask:
Is Mac OS X at risk to these kinds of attacks?
hoser: Slashdot reader since 1987.
Free access point connections aren't secure either as what you're sending isn't (usually) encrypted it can easily be picked up by someone nearby sniffing your packets
They charged me 8$ for internet access, but never gave me connection to the internet. Stupid Boston Airport(Logan)
God spoke to me.
Vista disables file sharing by default unless you tell it the current network connection is a home or work network.
I saw exactly this at the National Archives in College Park, MD. I told the local IT bubbas, but they just gave me blank stares. It was particularly disturbing because the average researcher at the archives won't have the technical sophistication to realize what's going on, and will then take their zombified system back to a university network.
I've seen connections like these available in airports and hotels. I actually tried to connect but my crappy 802.11b NIC wouldn't let me.
WinXP makes it very obvious that it's an ad-hoc network and not a WAP. The icon is completely different. I guess I'll be avoiding those connections from now on.
> Of course no one reading this would fall for such an elementary con.
./! No way we'd fall for something like that.
Too right! This is Slashdot! The big
Not like we're n00bs! ha ha.
> The article gives detailed instructions on how to make sure your
> computer doesn't connect automatically to any offered network,
{Sound of frantic typing, hyperventilating and weeping}
I see those ad hoc computer connections on airplanes all the time (I fly the friendly skies about every two weeks). I thought they might be the airline offering a way to connect to the internet while in the air. Fortunately for me I never allow ad hoc connections on my computers and always have file sharing turned off except for when I'm specifically transferring data. Maybe I'll try to locate the computer offering the connection the next time I see it in the list.
The NSA: The only part of the US government that actually listens.
Help other folks out. Set yourself up as a proxy, advertise yourself as "Free Wi-Fi" too, and let everyone else (at least, everyone who connects through you) safely use the scumbag's paid wi-fi connection for free.
But if you must have some innocent fun, you really should have your machine mirror images so that they're returned upside-down. Not all of them, just a very few that meet some criteria based on a hash of the user's MAC address or something. Imagine their confusion when their buddy's laptop shows the picture normally and they're sitting there thinking, "What the...!!?"
Personally, I'd try to gather evidence and report it to the police if I felt they'd do anything worthwhile. The fact that this person's behaviour happens to be driving people towards my OSs of choice is purely incidental. You probably realise this, and I doubt that you were serious about thanking the guy, but I bet that your f****d up zealotry, morality and ideology are genuine; you really would place a microscopic (and questionable) "blow" against Microsoft over thieving scum like this escaping justice. You really think that MS-enabled crime (let alone this particular scam) is the only crime they're going to commit?
"Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
Good thing I have a mac...
With Linux and the hostap driver I can set up a legitimate access point. Ad hoc isn't a necessary part of this scam, and I don't see how avoiding ad hoc networks will prevent anything.
what you see are fellow client nodes, like yerself.
It's hard for an article to explain anything if you don't read it.
From TFA:
In addition, because you've directly connected to the attack PC on a peer-to-peer basis, if you've set up your PC to allow file sharing [emphasis mine], the attacker can have complete run of your PC, stealing files and data and planting malware on it.
You can't actually see any of this happening, so you'd be none the wiser. The hacker steals what he wants to or plants malware, such as zombie software, then leaves, and you have no way of tracking him down.
Reid
The Right Reverend K. Reid Wightman,
Besides the possible risk from malware infection if you have enabled file sharing, this really is the same man-in-the-middle attack that was so prominant in the 80's and early 90's. A problem which has been mostly fixed by the adoption of SSH over telnet. And is practically non-existant over HTTP today beacuse of the use of SSL on servers. And with regards to malware, how does this differ from picking up some spyware from the pr0n site you "accidently" visited?
I see no problem here that cannot be solved by adopting the same principles that you would use for ordinary domestic internet access:
1) Turn on your firewall and close all open ports.
2) Don't send sensitive data over an unsecured network.
Nothing sucks like a Vax, nothing blows like a PowerMac G4
The network isn't the problem here, your computer's configuration is. All of my machines can safely connect to an untrusted network (and they do---my non-firewalled, non-NATted internet feed) without being turned into zombies.
The message here shouldn't be "don't connect to untrusted networks," it should be "secure your machine."
Once you do that, these guys are just being nice and giving you a free connection!
-rsw
Going for spotty wireless access in my dorm room, I click on my airport icon and there's usually 2 or 3 computer-to-computer networks named "free wi-fi" or "free high speed." Yay for making making it easy to tell that's bogus. I turned off my sharing and put up all my firewalls once, and got on just long enough to find out they're not even smart enough to give the promised internet access to keep you busy. It's just a flat-out, try and screw you scam.
I have been to a few airports in Chicago and Dallas recently and scanned those. Never stupid enough to connect to them, (ad-hoc mode is off) but enough to be curious.
How sure are you that you can prove that you're not involved, especially when you've been arrested and subject to police questioning? Under ideal circumstances If you were in control of things, you could probably put together a good case, but fancy playing against a prosecutor and police who genuinely believe that you were involved and want to make you look bad?
And (so the police will want to know) since you obviously knew this guy was up to no good, why didn't you report it?
Doesn't sound such a good idea now.
"Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
How about instead just recording the stream of data as the laptop user connects to his email or surfs (assuming he doesn't use a secure vpn). Grab copies of all his company email, files, browsing habits etc. Laptop-wireless-tapping like phone-tapping.
The YRT regional bus service is trying to make wi-fi access from their buses work. (Last time I checked, the AP was answering but not connecting to anything. They claim some buses are working.)
Once people get into the habit of using it, it should be easy to board the bus with a laptop and create a bandit AP that looks like the real one. (A working bandit since it could just proxy to the real AP for internet access.) A fine man-in-the-middle only "visible" to the riders, and easy to shutdown and swap buses if there's any sign someone has spotted the bandit.
Oh yes... Their standard name for the bus AP is .. default.
One line blog. I hear that they're called Twitters now.
I've seen this several times before, and the best article I've seen on it is here. That's a lot more level headed, and it refers to the "Free Public WiFi" SSID as a virally spreading phenomena, but most likely not a virus or honeypot.
The problem is that Windows handles Ad Hoc WLAN networks in a rather bizarre way.. once you've connected to the Ad Hoc network, your computer will likely become *part* of the Ad Hoc network and will consequently rebroadcast the SSID, advertising to others. This means that the SSID slowly spreads out just like a biological virus.
Yes - it *could* be used as a man-in-the-middle attack or some sort of botnet, so the advice to steer clear of Ad Hoc networks you don't know about it very sound indeed. My experience of seeing the "Free Public WiFi" SSID definitely fits in with that theory.
Never email donotemail@WeAreSpammers.com
... at a doctor's office a couple days ago. I thought I'd see if the office had a Wi-Fi connection I could use for the 3 hours I would be there with my MacBook and saw "Free Wi-Fi" listed. I was a little curious why it was listed under computer-computer networks, but tried connecting. Didn't seem to get me an external connection so I gave up. Fortunately I 1) have a Mac, and 2) only have remote login (SSH) enabled with a good password. But thanks for the warning!
Stuart
I just moved into a new office and I was checking the ports to see which were live. I hit a dead one and my laptop automagically tried to connect via WiFi. I saw a bunch of unsecured access points, and a couple of ad-hoc networks. One was hpsetup (a wireless print server maybe?), and one was Free Public WiFi. This is in downtown Lincoln, NE (yes, they have computers here).
Disturbingly, one of the unsecured wireless networks is labelled Itgadmin's PowerBook G4 17". More disturbingly, another is labelled WF Conf Room. I'm across the street from the main Wells Fargo branch...
Just junk food for thought...
It's an American obsession to nickel and dime the world. Every airport I've been to in the EU has had free wifi, usually it's extremely fast too.
Um, this doesn't just apply to ad-hoc networks... Any monkey running linux with Hostapd can set up an full Access Point that your laptop will happily connect to even when ad-hoc networking is turned off. If this monkey is clever, he'll use the same open SSID the airport/coffee house/hotel is using. You can go on and on about SSL and vpns and so on, but the bottom line is the attacker has control of the WLAN you are connected to at the very lowest levels. The attacker has complete freedom to record and/or tamper with anything you send or receive while in transit.
...newbie.
Besides his computer savvy, he's the only known slashdotter to actually have a sex life.
Now, if you'll excuse me, I need to don my asbestos underwear.
A goal is a dream with a deadline
Just how does the hacker get the malware file to run on your computer... it seems there must be another step here... TFA was vague on this point. I'm not an expert.
I don't read your sig. Why are you reading mine?
Wireless network cards can be set up as access points to. So just looking for if it's an ad-hoc network does not protect you. Turn off all sharing when connecting through public access points and use encryption.
There you go - free wi-fi!
Opinions expressed above are mine, and not my employees'.
Hmmm C: drive icon... right click... sharing... read-write... anyone... anytime... anywhere...
There, that should save me having to bother sharing out individual folders on my home network - far too fiddly...
I read TFA including that section. Unfortunately without benefit of your [emphasis], I ended up thinking "there must be more to it than that." Thanks for the response. Perhaps next time you can try a constructive reply without the sarcasm.
The whole thing boils down to:
1) Clueless user connects to "Free Wifi" and has filesharing enabled with guest write access
2) Attacker uses file sharing to put malware on PC
3) Clueless user proceeds to run the malware and gets zombified.
All in all a time consuming, inefficient way to amass a zombie network. If you're just looking to phish a (presumably well heeled) businessperson, then maybe it's worthwhile.
This still doesn't explain about the zombification process. First of all, most file sharing is read only unless you have a password used, most home users don't really do much filesharing, but generally it's a read only thing, but second of all even if you have your entire folders mounted as read/write, how exactly does that allow this machine to turn you into a zombie? Last I heard writing files to your my documents folder (it's really difficult to share other folders than this) can not actually execute code.
I guess if your entire hard drive was shared, there is a possibility that they could write the file to a startup directory on it that automatically launches it on your next reboot . . .
This article really read as a lot of FUD to me. Possibly unpatched machines are affected, but they give a solution of disconnecting from the net. I just don't get it, the solution, it appears to me would be to oh, I don't know, patch your computer and use sane practices (like not sharing your whole hard drive as read/write/execute (apparently) with anonymous access).
Now the problem of them being able to steal credit card numbers and such is an issue. This is an issue that effects all OSes, so everyone should think bout it. however, if you check that the ssl keys you accept are valid for the site in question, then you should be alright. While they can perform a man-in-the-middle attack, that does require changing what keys a website uses (or possibly disabling encryption). As far as aim passwords and such go, well if you don't use it for important stuff, what are they going to do with it?
I read this entire article and really just want to read something from someone who knows anything about security, and not some idiot who read about something like this and proposes an even more idiotic solution. There is truth that you must be careful connecting to any wireless network that you don't know, also your machine needs to be patched etc. a little common sense goes a long way in this matter.
Phil
I was stuck in Dallas Ft. Worth because of a delay on a connecting flight. When I was near my gate, I noticed a few ad-hoc networks, one labeled "Free Internet" and another one labeled "BFW" (I guess they didn't know the correct airport code) :)
I was surprised no one tried to use "T-Mobile" as their SSID (since DFW has a Starbucks Wi-Fi point).
Kormac
During the major wind storm that hit the Northwest before Christmas and knocked out a lot of power, I went searching for net access and finally found a Panera Bread Co. that had power (and free wifi). Everything was good for a bit... Then the access point went down. A minute later a new "Free wifi" connection showed up and sure enough it was an ad-hoc connection... Needless to say I left and went to another place.
Where I am currently staying there is a similar network for free wi-fi at my hotel. Which is nice, because the hotel charges for their internet service (bastards).
:)
Sadly, my Mac can't seem to respond to the netbios requests... At least I have lots of fun with kismac around here.
Try to hack my 31337 firewall!
Should have had at least a brief discussion, as any laptop with business uses ought to have a way to do secure transmissions.
It would be pretty funny if they were running this scam in Portland, because Portland's airport actually *has* free Wifi throughout the airport. (Lousy cell phone service though).
- A Portlander
Um, problem solved?
(Hint: Win+R)
are you saying that Mac users are unemployed? and thus crave employment the way zombies in the movies crave brains? i mean, most Mac users i know have jobs, usually pretty good ones.
/.ers seem to use macs.
or maybe it's the stereotype of the mac user as the artsy humanities student who has no job prospects. but, so many
i guess there's some geeky reference in there that i just don't see...
my pet machine
I saw this in the St Louis, MO airport a few weeks ago. Luckily I use a Mac Book. :)
In Soviet Russia, WIFI free you!
One of the reasons I've resisted wireless for so long (apart from the fact that by the time I've even unwrapped my first wireless router, there will be a whole new standard out running at ten times the speed and the kit will be twenty pounds cheaper) is that you don't know what's on the end of it. A cable can be followed. RF can't. If someone wants to play silly buggers with a wired network, they've got to get physical access to your cables. But no wires means no traceability!
With a bit of readily available software, such as Linux and hostap, you can turn a laptop (or SFF mobo plus suitable battery; a 12V/8AH lead-acid is about the right size for a good day's phun while you're away doing other things) into a great wireless hacking tool (that looks just like a real live wireless router, not an ad-hoc connection). You can snarf logins, passwords and credit card details on their way to the real website without even having to stop with a fake error message. This works even if they're using SSL; you just have to accept incoming SSL requests, let them get decrypted on your machine, and pass them on to the real internet via SSL (classic MITM hack; Bob thinks you're Alice and Alice thinks you're Bob). Your certificate probably won't be recognised by their browser; but if you put in the name of the place where you're working your scam, they might just think it's perfectly normal because they're going through that place's gateway and accept it anyway. Other people's ignorance can be your best friend.
One last word: Don't rush it. Leave awhile between snarfing the data and making use of it. That way, they're less likely to suspect you. If someone connected through a "free wi-fi" network one morning and got stuff bought on their card the same afternoon, they might remember the "free wi-fi" when trying to think what they'd done. If a couple of weeks elapse before you make your hit, it's less likely to come back on you. Oh, and getting stuff delivered to your own address is even stupider than answering the telephone in a house you're burgling!
Je fume. Tu fumes. Nous fûmes!
How are these malicious networks getting into the airports? People aren't allowed in the waiting areas unless they have a ticket for a flight. So where are these wi-fi signals coming from???
Nick
"A plan fiendishly clever in its intricacies"- Homer Simpson
I wonder when we will see a liability case where, a user connects to a free wifi, but insteads connects to another one the maliciously setup to trick users (i.e. a name that sounds similar "Starbuks"). Then that user user tries to sue the establishment/collect damages for not ensuring the establishment has secure .
-- if you mod me down, I will become more powerful than you can possibly imagine
It's now a question of what would happen in an ideal world, where everyone tries to keep their systems secure. It's a question of what happens in the real world, where not everyone tries to keep their systems secure.
Do you really think it significantly matters whose machine you're taking over, if you just want a zombie?
You join a network, and it forces you to run a p2p program or something ? How does that work then ?
My Mac doesn't seem to have these issues.
I had much the same thoughts on ad-hoc networking enabling file-sharing of an entire directory. I've yet to hear anyone say anything intelligent on the subject yet.
While they can perform a man-in-the-middle attack, that does require changing what keys a website uses (or possibly disabling encryption).
Well, the more troubling attack is disabling encryption. Most sites start out in HTTPS, and then have a link to the secure sight. If there's a man-in-the-middle, he can change all the links that send you to https://website.com/ to http://website.com./ Then just continue acting as a proxy and figure out which URLs should really be contacting the HTTPS sight, while continuing to talk to the client/victim in http. Sure, the victim could look down at what's supposed to be a "secure" website, but how often do you do that? I haven't in the past.. but I'll certainly try to more now.
AccountKiller
I'd highly prefer MS wise up and fix their OS, but they won't. Ever. They're just not that kind of company, never have been, never will be. On this, I would *love* to be proven wrong by MS's future actions.
I don't see how it's "fucked up zealotry, morality and ideology" to hope people will switch away from such a dreadful and dangerous product. I hope people will stop eating products with high fructose corn syrup and trans-fats. How is there anything wrong with such a position, *whatsoever*?
I saw this at the airport in Columbus, OH. I guessed at the time that it was some kind of scam, but I was confident in my computer's security so (since the airport's wifi wasn't working) I just used the scam network.
If you believe this article I have a bridge to sell you...
It isn't inconceivable that someone could redirect these sites to their own "special" versions in order to get the username and password for a banking or other login, then display another page that the login didn't work or to come back later due to maintenance. Then the perp can go in and do the damage.
Just connect to https://gmail.google.com As far as I can tell it keeps everything in the SSL session as long as you use it. Of course everything you sent and received went through the public Internet at one point anyway...
2) Yes.
3) The user need do nothing. If you have read/write access to C:, you can install anything you want and have it run automatically.
Flying home for thanksgiving I was sitting out Regan National Airport for a few hours. I pulled out my MBP to see if i could get a signal anywhere. There were a free wifi's ad-hoc, only they didn't offer any net access. And had no itunes for me to listen too. I turned off my wireless at that point.
- DenialX
true! excellent point!
Ad Hoc nets are displayed as three little computers in a triangle, accesspointed nets are a single large computer Icon. Futher hoveing over your netowrk connection Icon will tell you exactly what sorts of networks you see and are/can connect to.
Power Corrupts,Absolute Power Corrupts Absolutely, leaving one person(group)in charge is absolutely corrupt.
try this: https://mail.google.com/mail/ (gmail) It starts a secured connection, and stays secure. I use it at work - since stupid WebSense blocks all webmail accounts that don't start with a secured connection.
My Slashdot Journal! YAY!
i seriously doubt they care about the computer as a zombie there are much better ways to get that... but what is dangerous is you get the ceo's and the people who don't know the difference on here and they go in and they send they check their email... that gives the attacker the login and password to email. that also gives them domain info. this then leads to where they now have a login and password to the server somewhere and from that you now can start to work on the box... so the real key is the info being gained from it. if nothing else you start to spy on the ceo's email of company x and you start finding out LOTS of information about what happens.
that is the bigger danger than a zombie machine.
People who willingly hide the file extensions from their display deserve what they get! :)
-Clio
Karma: Bad (mostly from not giving a fuck)
Blog: http://clintjcl.wordpress.com
Connect to the free wifi, read a few extremists websites, post jihadist hatred, say something bad about the US president, and then search for some kiddie porn (think of the children!) In the US, the guy connecting to the real network connection will be shot on sight within minutes.
Dekker Dreyer
How about triangulation the wireless connection offering Free Wifi with signal strength as a guide.. it would seem possible to narrow down the AP to a Radius of Meters (50 or so?) and the people with the laptops in that area could be talked to...?
No, I've seen people do that and they give up as soon as Windows says "Applying this to folders and files..." and the progress bar crawls along as it touches each file on their HDD. Due to their impatience, they realize sharing one folder is a much better idea. Security through laziness ... I like it!
Gamingmuseum.com: Give your 3D accelerator a rest.
Your original message, spoke of your desire to "thank [the thief] hardily for moving yet another Windows user even closer to an alternate choice".
I criticised you (and your zealotry and screwed-up moral priorities) for glamourising a lowlife conman and applauding his (totally incidental and minor) blow against MS, disregarding the more serious aspects of the crime. That's it.
MS's security model may be broken, it may be inexcusable, but this absolutely does *not* justify your highly dubious glamourisation of a thief simply because they make MS look bad. As noted, reporting to the police would be ineffectual. As I acknowledged when I said "if I felt they'd do anything worthwhile".
I think you need to reexamine what is zealotry and what is a healing approach for the industry as a whole. Either your misrepresentations (both of the basis of the argument of and what I said) were quite deliberate, or you need to stop your quite incredible kneejerk assumptions about the other person thinks.
Since you bring the issue up, I'll give you my true opinion. I'm a Linux user (and would appreciate more people moving to Linux, as I implied in my original message). I also dislike the amount of security holes in Windows XP, and (as I said) if this moves people to more secure OSs, reducing the monoculture and forcing MS to clean up its act, that's good.
However, it doesn't excuse, let alone justify the thief's behaviour.
I do at least recognize that some good can come from even criminal activity such as this. As I already said myself... the difference being that whether or not something good came out of it, it wasn't thanks to the intentions of the thief; and I didn't imply that (on-balance) this was a good thing. You did just that when said you wanted to thank the thief, and when you omitted any consideration of the negative aspects of his actions whatoever. So I feel empathetic, but not sympathetic, towards people affected by things like this - and while I don't condone the actions of those engaging in this behavior. (My emphasis above). Your original quote: "The next time I see a "FreeWiFi" I'll jump on and thank them hardily for moving yet another Windows user even closer to an alternate choice." That sounds like condoning it to me.
You're backpedalling now. You blatantly lied about what I'd said, and you're trying to distract attention from what *you* originally said. Go to hell.
"Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
I'm far from the worlds #1 expert in wifi sec... but I am CISSP and GSEC certified.
... and running linux is hardly a end-of-all-problems security solution, sorry linux geeks. (Of which I am one.. well more of a BSD geek really.)
Wireless security 101 ->
If you are doing anything that requires security, don't use wireless.
Public access points are foolish to even connect to , and using them to access/transmit any confidential info is twice as bad. (.. and as such should be against most corporate IS policies, if wireless itself is not completely banned.)
If the face of OSS people is "ha ha, sux0r, you got r0bb3d ya lus3r n00b", people are not going to have a very positive impression of the kinds of people who are Linux proponents. And, they're going to be less likely to listen to any of the rational arguments about why Windows might not be all that it's cracked up to be.
I call to your attention yesterday's Dilbert Cartoon to bolster my point. =)
Cheers
Lost at C:>. Found at C.
I was on a plane to england, and i saw this once we were @ 40000ft.
so it was a 1 in 300 odds that someone on the plane was broadcasting this.
also it might have been the originator
I've seen these scam networks on trains and subways in the Boston. And I'm sure it's happening elsewhere. Think of all the good stuff you could get if you were to compromise every computer on the Long Island Railroad going home from NYC. I'd imagine you'll see this exploit on express buses on routes to/from financial centers, and the potential for industrial espionage is quite high as well.
Nothing great was ever achieved without enthusiasm
A man-in-the-middle attack which changes https:/// URLs to http:/// and proxies them is only trivially different from one which proxies https on the inbound and outbound side.
That said, creating the key required to re-encrypt would be quite difficult, as it would
a) have to be signed by an appropriate CA
and
b) reference the proper domain
Do daemons dream of electric sleep()?
Ohh.. one more thing.
Wireless NICs can be setup to look like APs.
Not connecting to ad hoc networks is *not* a way to secure yourself from this.
Ignoring the fact that this was never their intention, merely a side-effect. Ignoring the other consequences of the theft, and the fact that the thief will be free to offend again, possibly not conning/stealing info via Windows insecurities next time. (Oh NOES!!!!!! Is conning some old lady out of her life savings still acceptable if it doesn't involve striking a blow against MS).
That's what my original criticism was about, and I was very clear. You're an idiot if you think that it was a defence of MS or their products. So, are you really endorsing SuperKendall's position, or are you just stupid?
"Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
I actually agree with what you said :)
-Clio
Karma: Bad (mostly from not giving a fuck)
Blog: http://clintjcl.wordpress.com
Whenever out and about I use VPN to Netscreen at my house and surf from a terminal server there.
How about something for mobile? Neither https://m.gmail.com/ nor https://m.gmail.com/mail stays secure after the login.
Of course not. What he wrote is meant to convey, "I hope people learn from this just how awful Windows security is, and take appropriate action."
If he does mean what you inferred, then I'd agree with you (not nearly as strongly as you had put it, you make him sound like Hitler or something). That's what my original criticism was about, and I was very clear. You're an idiot if you think that it was a defence of MS or their products. So, are you really endorsing SuperKendall's position, or are you just stupid? So, to quote your subject, "My God... did you actually read what I said?"
Where, at all, did I say you were defending MS or their products? Where? Please, post it, make me look like a moron.
To answer your question, I am endorsing SK's position, his position is not what you think it is (although if he wishes to clear up the matter, I reserve the right to change my answer if I'm wrong about his position), and no, I'm not stupid.
I was flying from Santa Barbara to Seattle and found the same thing at LAX, a few days after Christmas.
But since I only wanted to play the Sims, I just turned off the wireless card on my laptop.
Had to save battery power as I was stuck there for three hours waiting for a flight that kept getting delayed.
-- Tigger warning: This post may contain tiggers! --
R-2, you know better than to trust a strange computer!
I see this every single time I am in Ft. Lauderdale airport. Which is once a month. The airport wireless sucks sooo bad, that users may try to connect to another one that says "free".
Ad eundum quo nemo ante iit!
I've seen this same thing in two coffee shops in the Minneapolis/Saint Paul area. They were both places which had free but non-open access. i.e. places where you have to log in or get some kind of code number or something. One was a Caribou in Roseville and the other was some restaurant in Minneapolis (I forget where)
In an area that small it might be possible to catch the perpetrator if one could target him/her narrowly enough. Does anyone have any suggestions on how to do that?
Saw this, this week, at Baltimore's BWI airport. Didn't log in, as I'm cynical enough to know what's going on. TAANSTAAFL.
Misrepresenting him does not help your point. He never said anything remotely like, "ha ha, sux0r, you got r0bb3d ya lus3r n00b".
That's like dismissing Al Gore's film by mockingly pretending he said, "we should all turn vegan and live in mud huts". I call to your attention yesterday's Dilbert Cartoon to bolster my point. =) Oh, well, if it was a punch-line in a comic... Surely I concede!
Certainly, nothing wrong with criticizing SuperKendall's choice of wording, but I was responding to the attack, "your fucked up zealotry, morality and ideology". Dogtanian seriously jumped the gun on that one.
If Userid.length = 4 Then
FuckWith(User) = False
Else
FuckWith(User) = True
End If
Or for older folks
If Len(Userid) = 4 Then
FuckWith(User) = 0
Else
FuckWIth(User) = 1
End If
or in the grand language
IF Lengthof User Is Less then 5 Then FuckOff
Else Perform 0500-FuckMe
Life is a great ride, the vehicle doesn't matter
I didn't mean to infer that the poster had said such things. But, it's a sentiment I see expressed here on Slashdot with great regularity. I suspect that Dogtanian was also reacting to that attitude which makes OSS people seem so unpalateable to many people.
The way it was expressed, it seemed like more of that "fucked up zealotry, morality and ideology" whereby anyone with the misfortune to get stung by the fact that MS is so damned insecure has clearly comitted a crime against human intellect and deserved what they got. Which doesn't really help anyone who is seriously trying to put forth the argument that Windows is lacking in a lot of areas.
Cheers
Lost at C:>. Found at C.
"but this absolutely does *not* justify your highly dubious glamourisation of a thief simply because they make MS look bad."
....oh... BTW , if you ever let the police know about this kind of scam, do as all a favor and tape the phone call. It will be absolutely freakin' hilarious.
They didn't glamorize the thief. They were just happy that Windows users were getting screwed. And they opined that if that's what it took to get them to switch away from a bad OS, then ultimately it was for the good.
I don't see anything wrong with the sentiment.
Now, there's a really high horse over there.... you might want to crawl up on it and ride away.
...not enabling file sharing? Or if it's a browser exploit, not using IE?
I don't know, I haven't used windows since 3.1, but this sounds kind of silly to me.
The way around this is to buy the salesmen an EVDO card and let them use that. That way you can control their access and you don't have to worry about some poor salesman endangering your network.
You were mistaken. Which is odd, since memory shouldn't be a problem for you
Seriously though, it's not hard for the service providers to prevent this happening. Scan for 'free' networks, connect to known site, detect which account is passing this information and disable it.
It's probably in their interest too.
Simon.
That said, creating the key required to re-encrypt would be quite difficult, as it would
a) have to be signed by an appropriate CA
and
b) reference the proper domain
You misunderstand. Since you start out at the site via http (I misstyped), the attacker only need change https:/// links to http://./ The victim goes to the website, and clicks on an http:/// link (which should have been https on the REAL non-proxied site). Thus the victim NEVER GOES TO THE SECURE SIGHT, so there's no need to spoof an SSL certificates. It still looks exactly like the real sight because it's proxied. The only difference is you're connecting to the attackers proxy via http, not https.
AccountKiller
This isn't a Win vs. Lin issue. Stunnel is available for Windows, too. What happens when you think you are on a free network, you try to Stunnel to your server, and you get the error: ...
That's why I don't connect to any services that use simple SSL or anything when on a public WiFi.
But for browsing Slashdot or other news sources - well, who cares who gets my Slashdot password? The problems caused by it leaking are too minuscule.
It's the automated Zombification/infection that is the big problem I see, people do need to be warned to be careful about what they browse in public. But on a windows box connected to a "rogue" WiFi agent, anything you browse (with IE) or even just having open shares means you have problems.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Just FYI: when talking about web sites, it's "site", not "sight".
Please correct me if I got my facts wrong.
I actually saw this at Humboldt State University yesterday. Except the clowns didn't have the connection to the internet set up nor were they able to do much with a firewalled MacBook Pro. Scanning the area for WiFi I found "Free Public Wifi".
Si vis pacem, para bellum! For evil to succeed good men need only do nothing!
I think this type of argument stems from the attitude some people have regarding their operating system of choice. Some people believe their operating system is more secure and feel the need to belittle the security of other operating systems. Those of us with level heads know that all human designs are prone to error. Relying on others to take care of your own security is foolish. Be it Microsoft, Apple or anyone else.
I've seen several ad-hoc networks called "Free Public WiFi". I wondered about them and found this blog. It seems there is a "feature" in Windows where after you disconnect from a wireless network, it will continue broadcasting the SSID as an ad-hoc network. Other people then see it, try and connect, and then start broadcasting it themselves...
Ettercap will let you launch an MitM attack against HTTPS. Yes, the user's browser will throw warnings about invalid signatures, but in practice, 99% of people click "yes, go ahead anyway!" Even the ones that bother to check the certificate will see it's full of perfectly legitimate-looking information and assume "it's just a glitch." It's really scary, but that's what almost all non-IT people will do.
Yeah, that's where I do my bank transactions, the Airports and coffee shops. Because I would not want the police to know who transferred all that Nigerian money!!!
TFA is way over hyped. To be zombified you have to be stupid enough to give write access share to "Documents and setting \ [user name] \ Start Menu \ Programs \ Startup", or some similar "startup execution" location or file such as the registry database.
Windows does not let you do that easily be default (several "are you sure").
Do we really need to talk about people starting to execute unknown EXE found in a "write share" directories?
Basically, if it happens you deserve it.
A lot worst, making thousands of victims are the "Press Yes on the certificate dialog to install our Make Money Fast toolbar".
captcha 'exploits' - How a propos
Move along folks, nothing to see here.
Let me repharse that for ya: users who don't keep their systems up-to-date with the latest security patches and users who blindly accept invalid ssl certificates will get owned.
p.s. risk increased somewhat when wireless networks are involved.
why do articles written for complete newbies get posted here on slashdot?
This is supposed to be "news for nerds" not techno-fluff peices for CEOs and US senators.
TFA was not intended to be a HOWTO. Articles that come in glossy-coated magazines never are. The reason it was posted to slashdot was, I think that it garnered some big-time attention, and the particular attack hasn't been mentioned anywhere on slashdot before. I think the slashdot crowd can engineer ways to do the exploit, and defend against it, and we'll all get rich no matter which side of the fence we decide to play.
:).
As for a HOWTO, it depends on the situation. If we make the assumption that user file sharing is on, as TFA says (and you assumed away in your initial post), there are quite a few avenues.
I believe the implicit assumption from TFA is that "Filesharing enabled" means that some directory is read+write to the public. This isn't that uncommon for home computers. Users don't want their kids to have to remember passwords. "After all, we only use filesharing on the home network." Heck, the last time I installed Windows XP it created a password-less administrator accounts during the install process. Anyway, here's your howto:
1) Drop your payload in the shared folder.
There are a lot of ways to get the user to execute the payload:
2) a web proxy that does meta-refresh to file:///path/to/file might work (not 100% sure if that would work? I haven't actually used Windows for any great length of time in years).
2 [alternate 1]) Web proxy that says, "[path] is standard Windows software that allows you to use Free Wi-Fi service. Please run [path] in order to connect to the internet. [link]. [optional: As the software is already installed on your computer, security is guaranteed!]" 99% of the idiots that have filesharing on will do what the browser tells them in order to get their precious free Wi-Fi.
2 [alternate]) If that won't work, there are a lot of other ways to get a user to open something. Even just putting it there could be enough. Average user will see the file some day and say "hey, I haven't seen that before, I wonder what it does [double-click]." The payload doesn't have to deploy right away, perhaps it takes time.
3) ??? [alternate: make computer into a zombie]
4) Profit!
The interesting thing about using this method to deploy a zombie program is that it is very very very difficult to track down. If the initial injection of malware is done using a remote attack, forensics people have a reasonable shot at tracking the source (or at least tracking the next link in the chain, and eventually finding the source).
Assuming the attacker gets the zombie software on even 10 computers this way, (s)he now has 10 computers that can be used to launch zero-days against yet other PCs, remotely. Forensics folks won't have any meaningful logfiles to analyze to look back at the initial injection vector. Assuming the malware does nothing to clean its tracks and the computer logs everything, all they'll find is that the payload was put there by a wireless device with [forged mac address] at some date and time. Not much to go on when looking for a perp. I'm sure there were a lot of people at the airport that day, and a lot of people watching in the observation deck/waiting outside for a loved one/using a pringles can antenna in their car. The only other avenue they'll have for tracking is to find the controller. And if the controller uses TOR or something, good luck
There are probably better ways to get a user to execute an already-installed-executable that I don't know about. Others can probably chime in.
Reid
The Right Reverend K. Reid Wightman,
how do you find out whether it's an ad hoc if you're using linux? iwlist something... ? thanks
Wow. What a bunch of alarmist crap.
The "Free Wi-Fi" stuff you see in airports aren't all, or even mostly, scams. Whenever someone sees one of these ad hoc networks and attempts to connect to it with a Windows machine, the Windows machine then broadcasts out that as a possible ad hoc network. It then carries that ad hoc network name with itself as you move.
That's how the SSID has spread so far and wide, and why it is so prevalent.
You should be *ALWAYS* careful when using ANY public wifi hotspot. Your traffic can be easily monitored or hijacked with very simple tools, none of which require setting up your own rogue AP or a fake ad hoc network.
Computerworld got had by a security firm looking for some free advertising. Way to go!
> And people wonder why some Linux and Apple supporters have a bad reputation for being fanatical.
Really? Who are those people?
I have never seen anyone question the fact that some Linux and Apple supporters are fanatical. Not even the fanatical Linux and Apple supporters themselves.
It may not immediately start up, but it could soon enough - next reboot. Next time a certain program is run (Word, Excel, IE, etc).
I saw this while at a meeting on Elliott Avenue West (around 351) on Tuesday 22jan2007 - ad hoc network showed up called Free Wifi. It disappeared in the space of 30 minutes while I was investigating further.
If you control the network, you could setup a transparent web proxy that pushes browser exploits with every page you view.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
There's software to rewrite web pages on the fly, which could be used to splice in an IE exploit (if, hypothetically, you knew of one that hadn't been patched :-)). Or just redirect to a site that does driveby downloads for your business associates.
Someone in the vicinity of my office (in a Chatsworth CA industrial park) was broadcasting a wireless network titled "Free Public WiFi" for the past couple of weeks, and since I'm using OS X, it appeared under my AirPort status menu as a peer-to-peer network. These come and go, and I routinely ignore them. That is -- until I saw this ComputerWorld article on Slashdot.
It could have been a coworker, or someone in an adjacent building, or someone parked on the street... the signal strength was 5 bars on a WinXP notebook one cubicle away. It could have been an intentional scammer, or a victim of a scammer's trojan, implanted via a public hotspot. So I forwarded the ComputerWorld URL to everyone in the office, summarized the scam and the risks, and asked folks to run their spyware/adware scrubbers if they had used a public hotspot recently.
And I created my own peer-to-peer network "Free Public WiFi is a CON!"
Within hours, the "Free Public WiFi" was gone. No telling who it was or what their intentions, but at least it's gone.
I can see the fnords!
. . . so they get people's credit card info and catch all those savvy travelers on the lookout for "free" APs.
You know, Microsoft's street address also says a lot about their mentality.
You called me out. I wanted to troll for C++/Ruby/PHP/Python/C#... oh hell the list is endless programmers who hate .net.
/. users that have numbers less then 4 digits. :-)
variation:
FuckWith(User) = IIf(Len(UserId)5,False,True)
No matter how you write it, the business spec is dont 'fuck with
Life is a great ride, the vehicle doesn't matter
I saw a cell today in Raleigh, NC (near Crabtree Valley Mall) labeled "Free WiFi" with no encryption. I thought that was ... odd.
I didn't join it, but even if I did, I use Linux (no Samba either) and I already had my iptables firewall configured.
Very interesting, tho, now that I come home and read this. Very curious...
Saw that I got no connection so I just disconnected.
/* FUCK - The F-word is here so that you can grep for it */
I've seen this scam in the wild at St Louis airport. I have screenshots if anyone wants them. I didn't even know that this was a current issue, (I haven't had internet access for a while because the hotel I was staying at charges extra), but when I fired up my computer, I saw "Free Airport wireless", and "Free Public Wifi", as peer to peer connections. It was weird, so of course I started taking screenshots. I didn't try to connect to them though since I had a customer computer that hadn't been patched in forever.
What does the code have to do with .net? It's just plain (horrible) VB, isn't it?
You know, Microsoft's street address also says a lot about their mentality.
Handily (and/or stupidly) disregarding the fact that the thief's behaviour/motives had nothing to do with this, happily disregarding the consequences of the theft on the victim and happily disregarding the fact that he has endorsed (if giving thanks isn't endorsement I don't know what is)- and by his previous actions and omissions glamorised- the behaviour of a petty lowlife thief. Certainly, nothing wrong with criticizing SuperKendall's choice of wording, but I was responding to the attack, "your fucked up zealotry, morality and ideology". Dogtanian seriously jumped the gun on that one. Jumped the gun? There was no gun to jump. SuperKendall said what he said; it was wrapped up in one stupid, narrow-minded sentence, but everything I said was fairly drawn from it.
I stand by what I said. SuperKendall didn't; in fact he avoided mentioning what he had said originally (and blatantly misrepresent what *I* said), and tried to re-paint the exchange as a discussion about MS's lousy security.
Either that or he was too stupid and obsessed with this issue to see that it transparently wasn't the point of my criticism; which is probably true- it would explain the messed-up ethics in his original comment.
"Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
True; it doesn't change the fact that Windows XP has some serious issues with security, however...
"Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
Real-life thieves and conmen aren't like those in "Hustle", the majority are morally bankrupt vermin who don't give a toss about anyone else. SuperKendall would like to "thank" them.
The unacceptable face of Linux zealotry.... these sorts of views make all of us Linux users look bad, unfortunately.
"Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
The original snippet was vb.net beacuse is uses the Length property, a feature not found in VB. As to horrible? Beauty is in the eye of the beholder. Having seen many a programming language in my career the horrible thing is missing the beauty in each language.
Anyway, way off topic and time by now.
Life is a great ride, the vehicle doesn't matter
As long as the network you're connecting to is named "linksys", it's OK, right? Right??
You know, Microsoft's street address also says a lot about their mentality.
I flew through DC and Logan this week and saw this a couple of times. I assumed it was some kind of scam. It's interesting to see it confirmed here though.
I do security
Couldn't you run a network in access point mode? If that would be too hard, just use a wireless router, with the WAN connected to a network bridge...
And I would like to know *why* simply connecting to a network allows others on the network to automatically read and change your files.
Wonder what the public key field is for?
for those who live in the city, it was around Denny & Aurora - I was stopped on a bus scanning for local networks and saw something that looked exactly like this - a "Free Wi-Fi" network that was peer-to-peer. I didn't connect to it, something seemed fishy, but they're out there, and not just in airports...
Windows users will become a computer that: first infect others, second share internet That's a hell of a nice choice!! I don't mean to enforce that practice, i consider that damn foul play, but... think about it, if i could give away 10% of my badnwith to wireless users... I would!! If everyone did that we could have free wireless all over the country and count of being able to connect from almost everywhere... So, if you happend to know how to do that the easy way (say a router that can broadcast 2 SSID's one private with password and 90% of the bandwith and another with a public, free, and 10% bandwith) hell, I'll do that!!!! and i'll even convice a lot of people to do it! Well, coming back to that, file sharing for all, writing permissions, loging into an ad-hoc network, really simple scam, isn't it?