Slashdot Mirror
Why You See 'Free Public WiFi' In So Many Places
An anonymous reader writes "Almost anywhere you go these days (particularly at airports), if you check for available WiFi settings, you have a pretty good chance of seeing an ad hoc network for 'Free Public WiFi.' Of course, since it's ad hoc (computer to computer) it's not actually access to the internet. So why is this in so many places? Turns out it's due to a bug in Windows XP. Apparently, the way XP works is that if it can't find a 'favorite' WiFi hotspot, it automatically sets up the computer to broadcast itself as an ad hoc network point, using the name of the last connection the computer attempted. So... people see 'Free Public WiFi' and they try to log on. Then their own computer starts broadcasting the same thing, because it can't find a network it knows. And, like a virus, the 'Free Public WiFi' that doesn't work lives on and on and on."
Windows really *is* a virus!
Ah!
Have you heard about SoylentNews?
but at least linksys gets you a internet connection 99% of the time. BTW this story is a dupe from last year.
Is that why I also see dozens of "hpsetup" Ad-hoc SSID's from nearby laptops?
That's the SSID for my home wi-fi :-D.
I guess I am not the only one that is thinking that "Free Internet" SSID is a perfect vector for a MIM attack. Has anyone heard of any cases where it has already been exploited?
http://hardware.slashdot.org/article.pl?sid=07/01/26/1420202, among others.
Best Slashdot Co
Steve Gibson covered this over 3 years ago. https://www.grc.com/sn/sn-082.htm
You found me out... I was using it to make a chain of roaming broadcast nodes to beam PETA propaganda directly to your fillings. I guess now I'll have to use twitter.
Common Sense isn't as Common as people think...
Queue the picture featuring a pair of laughing girls.
At my old school which I left earlier this year, I remember setting up my laptop as an ad-hoc access point to test some music streaming with VLC.
I have no idea why, but someone must have tried to connect to it. Now, almost a year after leaving that school, people still tell me that the 'ghost' of my laptop broadcasting can still be seen.
There are 2 ad-hoc networks out there that are 'ghosts' now, the first is my nickname (yeah, bad choice for a perpetuating network, I know) and the second is named after the university network, which is accessible on clear days.
Sounds like something that could be exploited...
Of course, since it's ad hoc (computer to computer) it's not actually access to the internet.
Regarding ad-hoc WIFI networks, that's not true. One node on the network needs to act as a proxy.
This is the case if you share an internet connection on a Mac laptop, such as sharing a 3G dongle over WIFI, or sharing a wired internet connection over WIFI. The network will be ad-hoc and will have access to the internet. The same thing applies with the MiWi application on jailbroken iPhones. It creates an ad-hoc network for accessing the internet through the iPhone.
The point of ad-hoc networks is to save battery and CPU resources and be more responsive at the expense of some reliability. In a normal WIFI network, computer-to-computer connections always go through the router. In ad ad-hoc network, computer-to-computer connections go directly between the computers, creating a strange reliability situation when two computers on the network are far away from each other. Of course, if all you're doing is getting on the internet, it's kind of a wash.
No, I will not work for your startup
This is just more evidence (As if you needed any...) that Apple products are overhyped, underpowered, overpriced pieces of... Wait.... Nevermind.
Which would surely be touted in a similar article as a positive world changer if only a proper non-microsoft OS was involved.
Almost anywhere you go these days (particularly at airports), if you check for available WiFi settings, you have a pretty good chance of seeing an ad hoc network for 'Free Public WiFi.'
Doesn't match my experience. I have done a fair bit of flying lately - and always needing at least one connection each time because my closest airport sucks - and haven't seen it at the airports I've been to. I have checked for WiFi at coffee shops and restaurants and haven't seen that SSID there either. Lately I have been connecting through some of the busiest airports in the country (O'Hare and Newark Liberty in particular) and haven't seen this.
In fact, I can't think of the last time I did see it. I often use my blackberry to access open WiFi spots, and I don't have a record of a network that I have connected to called 'Free Public WiFi'.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
I was wondering this myself. Thanks trisexual poppy
Cue the picture featuring a pair of laughing girls.
to be affected. This was fixed in XP SP3. Love lines like "When a computer running an older version of XP ...." without further explanation. Haters gonna hate!
I recently Traveled to Italy from Portland and saw it at most airports
PDX -> Atlanta[saw it] -> Rome[saw it]
Venice[saw it] -> JFK[saw it] -> PDX
Oops. Turned the WEP off and set this as the SSID on my MiFi. Maybe this explains the overages!
As Inigo would say: You keep using that word. I do not think it means what you think it means.
Now that this information is public, we're going to start seeing networks called "Free Public Wifi - eatatjoes.com". Good job. Should have just kept quiet about it.
This is a really bad case of FUD. And it's just as bad when someone other than MS does it.
The first, last, and only tech news site on the net
Naturally, the hipster connects and begins surfing and checking e-mail. MITM gets to read his e-mail and his web reading habits (organic hipster porn).
If they are dumb enough to setup their account whithout encryption, they deserve whatever happens to them.
SSL protected connection is a damn strict minimum when you're on a public network.
End-2-end encryption is a must if you have any confidential information.
Non-encrypted data on a public wifi network, is like shouting with a megaphone in the middle of a busy town center.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
It 'seems lately that lots of HAD articles are popping up automatically on slashdot. If you watch the RSS feeds out there of the tech sites you can watch the wave of stories copy from site to site.. It used to be that slashdot had them first or did not cover what was already copied all over the place...
Has slashdot ran out of good submissions and is not simply posting what pops up out of other sites RSS feeds?
Do not look at laser with remaining good eye.
At a university I attended, I noticed that, year after year, I would keep seeing the same ad-hoc name, across many different dorms on the same, big campus. The university had wireless in most of its academic buildings and some parts of the dorms, but most people in dorm rooms couldn't get it (we were encouraged to use the provided wired connection instead). Someone must have made an ad-hoc who knows how long ago (it was called "{university name} wireless", which is nothing like what the actual university's SSID was called), and people must have just kept connecting to the spreading and persisting ad-hoc name, hoping they'd get wireless internet access.
The GP is correct - the only real way to 'secure' a public internet connection like a WiFi hotspot is with a VPN that also secures your DNS traffic so that all name lookups are served from a 'trusted' DNS Server. (This doesn't apply so much to SSH/SFTP, where you have, presumably, already cached the fingerprint of the server's Public Key, so if you get back the wrong key, you know someone's trying to attack you, and the client will warn you).
It all depends on how paranoid you are - generally, SSL Certs are *supposed* to protect you from someone impersonating an https request. However, I remember reading somewhere (might've been a story Slashdot covered), about someone successfully getting an SSL Cert signed by a registrar somewhere in the world, that they shouldn't have had, which allowed them to impersonate some site. I don't remember the exact details, but it had something to do with wildcard certs, IIRC.
In practice, I suspect most people setting up a 'phishing hole' WiFi hotspot, probably don't even worry about trying to attack the SSL connections, because that requires too much foreknowledge of what sites your targets would be visiting - just grab whatever plaintext you can - ought to be something interesting in it, sooner or later. Well, there's also the issue that someone could setup a phishing site and direct you to it with their poisoned DNS, and they just don't use any SSL at all, so the browser never gives a certificate complaint, and if the user isn't paying attention and verifying that encryption is in use, they'd maybe not realize they were connecting to the wrong server.
What is this "Paint" thing you refer to? Is it like The GIMP or ImageMagick, just less useful?
ED's article claims that the program has become somewhat more useful in Windows 7.
Windows 7 is bloatware that doesn't run a lot of the software I already own. I either have to buy updates to everything I run now (if it is still available) or stay with XP. Hmmm...
If you buy a new PC with a new warranty, and it isn't from Apple, System76, or some other specialty vendor, it will come with Windows 7. To use non-game apps that require Windows XP and don't work with Program Compatibility Wizard, you can Anytime Upgrade to Windows 7 Professional and then install XP Mode.
Some times at hotels you see nameX and X can be 1-9 but ones seem to come and go from time to time so likely that goes on there as well even more so when you have like 3-6 AP at the same place and people change to the one with the best single from time to time.
Up until a month or so ago, there was always someone advertising as "Free Pubic WiFi". Always made us wonder...
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
While most people use the term "SSL" to refer to "secure internet" most https connections today use TLS.
TLS uses pseudo random element in the handshake which prevents the MITM scenario you described.
Sadly Google Chrome doesn't support TLS (no friggin idea why) so server will negotitate down to the less secure SSL v2 or SSL v1 standard.
IE 8 or later, Firefox 2.0 or later. and Safari (no idea what version) all support TLS but obviously google thinks security is over-rated.
duh.
I was once called out for an emergency network repair at a local country club. A company had hired out the banquet room for a large business meeting, and could not get the wireless to work. When I arrived on site, I found that everyone in the room was connected to Free Public Wifi, being broadcast by one of the company owners' laptops. Turned out, the golf course did not have a wireless access point at all.
And as not-metaphorical cars at all, Google cars accidentally picked up quite a lot of un-encrypted confidential data, if you remember the recent scandal, so your ass might be right.
BTW: I do wear a helmet when biking.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
... that it is my understanding that this "contageous ad-hoc" SSID issue was fixed by Microsoft YEARS ago.
It just goes to show you that some Windows users never install updates -- and they not only do they not install updates, but they try to get something for nothing....
To those who say "This is an old bug", that doesn't mean we all got to laugh at it back when it was discovered. When it is posted to a popular site like this, it is bound to get a larger viewing audience. In short, the bug may be yesterday's news to you, but not to us.
And we demand... a shrubbery!
Ni!
Seeing that SSID in your client list is just Microsoft's subtle way of telling you to INSTALL XP SP3.
I like to make networks called "Free Pubic WiFi" in airports and especially on airplanes. Then I run a DNS server that answers all queries with my laptop's IP, which serves out a webpage with meatspin on it.
With all the overlapping WiFi routers, computers, phones, etc. out there, why not set all up for a mundane ad-hoc network? In time, could overtake wired networks; the consequences could be useful, fascinating, and perhaps staggering...
Can we get a "-1 Wrong" moderation option?
The defualt is to make your own network if you cannot join one.
So this would be like some pseudo-virus masquerading as an Easter egg of sorts, which in tern is masquerading as a software bug/glitch...? :p
I made Free Public WiFi at my school in like... 2004. Not sure who was ever the first to do this but when I suddenly started seeing these in major cities close to me I wondered if students from my city were going back home with it in their XP laptops.
I even wrote an article about it.
http://www.eanbowman.com/blog/2010/08/15/free-public-wifi/
I always thought it was some kind of supernatural haunted cursed phenomenon type thing but I never thought it would actually be something even this freaky and weird. At least other people were seeing it too! lol
Google's Super Secret Search Algorithm: SELECT @search_results FROM internet WHERE @search_results = 'good'
All the people you've described use Apple... Hence no Windows XP...
In France there's an ISP called Free that has wifi hotspots everywhere called "Free Wifi"--of course, it isn't actually free.
Every coffee shop and airport I go to has free Wi-Fi. (And a lot of bars too.) But it's in infrastructure mode and named after the establishment. I think the explanation is economic; that it's an incentive for you to come in and buy their stuff.
This is right up there with all those other "bugs" that allow third party linux boot disks to change the administrator password on a windows computer without disk encryption or rely on users to be stupid and install a virus on their own machines.
The key here is "adhoc" network which is a network of peers unlike "infustructure" mode where a device is dedicated to marshalling connectivity amoung many devices.
The label of the network *is* the network. If your computer was attached to the network when you turn it off then is it really a bug or surprising that when you turn it on in a new location your computer is still a peer in the network and anyone else who attaches to said network completes the network?
With the "bug" designation you are basically describing the entire point of adhoc mode in the first place.
this could help scientists anticipate/study how a world-wide epidemic like bird flu could/has spread.
Th subtle difference is that your house's front door doesn't automatically try to put a bullet-proof vest on you.
Whereas, most wizards (like the "add account" of latest serie of thunderbird), most FAQ/HOWTO (at least of the mail providers I've seen), and most of the webmail interfaces all try to provide encryption.
(Thunderbird automatically checks if frequent protection as IMAPS or STARTTLS, etc. are available, FAQ usually exhorts you to use STARTTLS, and few webmail feature plain HTTP access)
So if someone has a mail set up to use clear communication, it means the person has actively ignored all security suggestions.
It would be like leaving a car unlocked at night, even if the local police recommends to lock it and turn the alarm on.
From that point on, it's going to be difficult to do anything more to prevent problems.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
I see this access point name on Amtrak trains all the time between NYC and Washington. I thought there was some sort of coordinated honeypot password-grabbing hacker attempt going on. Turns out it's just Windows users' laptops trying to find a connection which does not exist on Northeast Regional trains (yet).
Very fascinating expose!!
Kriston
I'm too lazy to search for it but this was a /. story in the past, about 1-2 years ago I believe.
Old news day, huh?
I'd better start looking for these hotspots then.. finally getting my crappy ubuntu upgraded to XP.
But why hasn't this been noticed in the 8 years since Windows XP came out?
To have a right to do a thing is not at all the same as to be right in doing it
What the hell are you guys talking about?