Slashdot Mirror
Beware the Airport Wireless
schwit1 writes to tell us that a recent study by a Silicon Valley-based security company shows that black-hats have been ramping up their use of tempting free or unsecured wireless access points in high travel areas like airports and hotels. "According to their study, even the 'secure' networks weren't all too safe. Eighty percent of the private Wi-Fi networks at airports surveyed by Airtight were secured by the aging Wired Equivalent Privacy (WEP) protocol, which was cracked back in 2001. Almost as many — 77 percent — of the networks they surveyed were actually private, peer-to-peer networks, meaning they weren't official hotspots. Instead, they were running off someone else's computer."
In every wifi GUI tool I've used, ad-hoc networks show up with a special icon. I don't know about the public in general, but any decent Slashdot reader should know better than to connect to one!
Ever notice an SSID for "Free Public WiFi" just pop up while you're at your place of work?
When I first saw these, I assumed "someone got infected with some trojan which sets them up to pretend to be an open WiFi either to do a man-in-the-middle attack, or to infect my system with some kind of worm."
After a bit of digging, I discovered that this was actually not malicious, but was a viral-like spread due to some strange way that one of the MS Operating systems was handling ad-hoc wireless connections.
Here's a 2006 advisory on the issue
http://www.nmrc.org/pub/advise/20060114.txt
Here's a less technical explanation (in case you have to convert it to "boss speak")
http://erratasec.blogspot.com/2007/01/ad-hoc-wifi-virus.html
So, pretty much everyone says it's harmless.
However, my initial suspicians (about MitM or worm infections) could easily be made to come true, and anyone who google'd it would say "oh, I guess it's that 2006 thing, no worries"
Of course, being an ad-hoc node, it'll be kinda obvious to most geeks... and of course, most geeks would probably make sure they were tunneling or otherwise using the network safely anyhow.
John Q. Public on the other hand? hoo boy. ... AND it doesn't help that so many products, in the name of making things easier on John Q. Public, will just auto-associate when they see an available connection.
I don't really know where I'm going with all this except to say "Never trust any network outside your own, never EVER trust the Interwebs, and only trust your own network as far as you have to in order to make things work... especially if you're not the only one using it.", but you knew that already.
The Digital Sorceress
I was in an airport a couple of weeks ago (Denver?) The WiFi was "free", but they proxied all of your traffic through their servers and used that to encapsulate all web sites into a frame with advertisements above. They did allow SSH, so I just bypassed them by proxying my traffic through an SSH tunnel to my home machine.
While I was at University, there was often someone broadcasting the SSID "UNH-Wireless" in their Memorial Building. The official SSID was just unhwireless. UNH required you to register your MAC before they would forward your packets to the Internet, but the rogue SSID was open. Since the Memorial Building was where all the visitors ended up for lunch after tours, I wonder how many delicious things were intercepted.
(New Hampshire is the one that touches the ocean. The other one is Vermont, which is the one that touches Canadia.)
slashdot: where everyone yells sarcastic metaphors to themselves to understand the issue
Sure if the network is truly adhoc, but these aren't, the hacker needs to get the wifi from somewhere, and more often than not it is the official airport/coffeeshop wifi.
This is someone connecting to a wireless access point with their laptop, running the sniffing suite on the laptop, and running a portable access point out another ethernet jack or through USB. I have a great USB based access point that is able to repeat and share any signal I can get, I use it to route wifi over great distance over a cantenna and repeat it to all my devices, it will not show up as an ad hoc network. Mine is old they make them even better, smaller and cheaper now. Nobody is going to bat an eye at the hacker with a usb cable running into his laptop bag.
PS: Firefox with a proxy including DNS + Putty running a dynamic proxy + A linux box at home (such as a low power tomato router) with SSH access + Priv/Pub ssh keys + DynDNS static IPs = 3 second complete encryption of everything no matter how sketchy the access point.
PSS: People saying this isn't a problem, so much webmail is unsecured by default, so many passwords are emailed to users. Please just trust the security geeks, you are really really vulnerable to deep packet inspection and transparent proxies. Secondly you are trusting the blackhat's DNS, are you really going to notice when you go to paypal/etc and the HTTPS is missing just one time?
Web Developers: Celebrate to our roots! Animated Gifs and Tiled Backgrounds, dont let our history die!
If your system hasn't been compromised, it doesn't matter.
You could do your banking on an open, unsecured network, no WEP, no WPA, etc because your traffic between you and your banking institution has been encrypted from point to point.
That said, if I were you, I wouldn't do it.