Slashdot Mirror
RSA Conference Attendees Get Hacked (esecurityplanet.com)
The RSA Conference "is perhaps the world's largest security event, but that doesn't mean that it's necessarily a secure event," reports eSecurityPlanet. Scanning the conference floor revealed rogue access points posing as known and trusted networks, according to security testing vendor Pwnie Express. storagedude writes:
What's worse, several attendees fell for these dummy Wi-Fi services that spoof well-known brands like Starbucks. The company also found a number of access points using outdated WEP encryption. So much for security pros...
At least two people stayed connected to a rogue network for more than a day, according to the article, and Pownie Express is reminding these security pros that connecting to a rogue network means "the attacker has full control of all information going into and out of the device, and can deploy various tools to modify or monitor the victim's communication."
At least two people stayed connected to a rogue network for more than a day, according to the article, and Pownie Express is reminding these security pros that connecting to a rogue network means "the attacker has full control of all information going into and out of the device, and can deploy various tools to modify or monitor the victim's communication."
So a few people ran WEP encryption on their networks, and a few others used rogue access points.
You want to talk about getting "hacked" let's talk about what was found. Did anyone give up credentials or sensitive details? Did anyone have something important revealed in a MITM attack? Did someone find something on those WEP networks? Just because we connect to something doesn't mean we trust it or aren't taking precautions. If you're rogue and providing me internet access, and all I'm doing is routing through your access via VPN that doesn't mean I got hacked.
The devil is in the details, at least it would be if we had any.
Seriously? Hacked is hardly what happened here. There's quite a large gap between hacked and *possible* eavesdropping. Did they get into their computer? Compromise their bank account? Did they get anything at all? Where exactly is the news in this again?
Mike @ The Geek Pub. Let's Make Stuff!
Why would a "rogue" access point that actually delivers your packets be bad? A non-moron already treats all networks more exposed than your cluster's interconnects as untrusted, this goes for granted for any public network you connect to -- especially at a security conference where there will be some attacks (even if not malicious).
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
And how many of those people who connected to these access points were doing the same type of monitoring, in reverse. Such as testing to see how exploitable these fake APs are!?
It's A Trap!
The data plans have become very affordable. I don't find the need to ever use "free" wi-fi. I use wi-fi at home, and then it is the standard data plan from t-mobile. I don't even use the free wi-fi provided by my employer at work. ( No, no, I am not Visvesvaraya, the legendary minister of Maharajah of Mysore who kept two sets of candles and made sure he did not use the government issued candles while attending to personal work. Just simply privacy concerns, why even let the employer know my browsing habits? )
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Even the experts don't always practice safe computing when they're excited to get it on.
I use a homebrew equivalent of VPN whenever I'm in public. Started when I realized a hotel was messing with my HTTP traffic! Crucial of course is reliable access to DNS - if that's broken then even connecting HTTPS can get you in trouble if someone has gotten hold of a signing certificate and does man in the middle.
This stuff is just to hard for the average user.
Hackers switched signs on some of the bathroom doors and attendees accidentally became transgender bathroom users. Guys, it is important to remember that if you don't see a urinal, you're in the wrong place.
Click on this link for details.
>Pownie Express is reminding these security pros that connecting to a rogue network means "the attacker has full control of all information going into and out of the device, and can deploy various tools to modify or monitor the victim's communication."
Next year they'll MITM the hotel's wired ethernet and warn people to think before you snap in.
A large number of vulnerabilities require MITM as prerequisite. These are also the vulnerabilities most likely to go unpatched, as people think the requirement for mitm makes the attack much less likely.
In the last few years, just against https alone, and only considering high-profile, named vulnerabilities, we have BEAST, CRIME, and BREACH off the top of my head. There are twice as many that don't have cool names, they're known as CVE-2016-xxxx.
Perhaps you'll use a VPN. Some common VPN configurations are vulnerable to an attack called Sweet32.
In theory, using encryption you can communicate securely across an untrusted network. In practice, a man-in-the-middle makes securing the communication quite difficult.
There are a number of common vulnerabilities in corporate VPNs. The newest major ones, which came out in the last few months, are Sweet32 and a certificate validation bug. Aggressive mode IKE is also still quite common, though it's long been known to be less secure than desired. Just thinking about my recent experience testing corporate VPNs, without actually querying my database for exact numbers, I'd say around 50% of corporate VPNs are insecure to varying degrees.
The worst are the certificate validation issues - you can be using strong AES encryption, but talking to my spoofed endpoint and I don't even have to use a lot of CPU cracking the encryption.
Because that is what is most important in America today. Fugk that security stuff, someone saw a woman with a dress 4.00001 inches above the knee. To the safe room people, we are uncomfortable!
But we have great wireless coverage there!
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
If you are running a homebrew VPN then you should be able to configure your VPN server to supply all DNS.
You can never know everything, and part of what you do know will always be wrong. Perhaps even the most important part.
They keep popping up!
Ha ha. Remember Bluecoat? Symantec granted them enough authority to make any number of fake certificates.
Or any of the trusted certificate authorities around the world, already trusted by your browser can issue fake certs.
Did you miss China's WoSign, issuing certs for fake GitHub sites,?
And that's before the deceptive websites used in common attacks.
These are supposed to be security professionals and yet they're sloppy.
You sweet, precious snowflake!
There's a Russian puppet in the White House?
Use a VPN, use SSH for remote logins and you basically do not care about the security of the access-point. If it wants a browser-based sign-up, just do that from a VM. You would think that you can find people that know how to do that at the RSA conference....
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Yep, it is on the credenza next to the statue of MLK when it got moved.. I'm told it an old man with a bit nose and other exaggerated facial features but I have never seen it personally.
So, the Russians manipulated US voters by discovering and revealing awful truths about a candidate for president?
Suppose this dastardly deed has been done by -- and I'm being deliberately zany here -- the news media doing their damn job?
Would it have been a bad thing then?
How about if it had happened before that nominee had won the nomination? Would that have been a bad thing or a good thing?
Let's hope next time, the Russians (or whoever does it next time) does it before the nomination.
And they do it to all the despicable candidates of the statutory duopoly parties, rather than just the one.
There's no time like the present. Well, the past used to be.
Prevention = best medicine (& what u can't touch can't hurt u) via NEW APK Hosts File Engine 9.0++ SR-7 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/
Ads & malware rob speed/security/privacy
Hosts add speed (via hardcodes/adblocks), security (vs. bad sites/malware/poisoned dns), reliability (vs. dns down), & anonymity (vs. dns requestlogs/trackers).
Less power/cpu/ram + IO use vs. DNS/routers/addons/antivirus + less security bugs/complexity & faster vs. addons/routers/remote dns!
Avoids DNSChangers in routers/IP settings & dns redirects (99.999% of ISP DNS != patched vs. it) + lightens DNS load & resolves faster from local system RAM!
* Via what u NATIVELY have built in IP stack in FASTER kernelmode!
APK
P.S. - Safe https://www.virustotal.com/en/file/e01211ca36aa02e923f20adee0a3c4f5d5187dc65bdf1c997b3da3c2b0745425/analysis/1433430542/
Please, SHUT THE FUCK UP.
Never fear. After the election you can be assured the press will relearn how to do investigative journalism. Had the election gone the other way, that might have never happened.