RSA Conference Attendees Get Hacked (esecurityplanet.com)

The RSA Conference "is perhaps the world's largest security event, but that doesn't mean that it's necessarily a secure event," reports eSecurityPlanet. Scanning the conference floor revealed rogue access points posing as known and trusted networks, according to security testing vendor Pwnie Express. storagedude writes: What's worse, several attendees fell for these dummy Wi-Fi services that spoof well-known brands like Starbucks. The company also found a number of access points using outdated WEP encryption. So much for security pros...
At least two people stayed connected to a rogue network for more than a day, according to the article, and Pownie Express is reminding these security pros that connecting to a rogue network means "the attacker has full control of all information going into and out of the device, and can deploy various tools to modify or monitor the victim's communication."

Comments

So what?

[thegarbz]

So a few people ran WEP encryption on their networks, and a few others used rogue access points.

You want to talk about getting "hacked" let's talk about what was found. Did anyone give up credentials or sensitive details? Did anyone have something important revealed in a MITM attack? Did someone find something on those WEP networks? Just because we connect to something doesn't mean we trust it or aren't taking precautions. If you're rogue and providing me internet access, and all I'm doing is routing through your access via VPN that doesn't mean I got hacked.

The devil is in the details, at least it would be if we had any.

how "rogue"?

[KiloByte]

Why would a "rogue" access point that actually delivers your packets be bad? A non-moron already treats all networks more exposed than your cluster's interconnects as untrusted, this goes for granted for any public network you connect to -- especially at a security conference where there will be some attacks (even if not malicious).

Re:how "rogue"?

[ixidor]

if you connected to the rouge AP, and have VPN to corp office turned on, what traffic/data would not be protected?

Researchers

[darkain]

And how many of those people who connected to these access points were doing the same type of monitoring, in reverse. Such as testing to see how exploitable these fake APs are!?

Why use untrusted wi-fi?

[140Mandak262Jamuna]

The data plans have become very affordable. I don't find the need to ever use "free" wi-fi. I use wi-fi at home, and then it is the standard data plan from t-mobile. I don't even use the free wi-fi provided by my employer at work. ( No, no, I am not Visvesvaraya, the legendary minister of Maharajah of Mysore who kept two sets of candles and made sure he did not use the government issued candles while attending to personal work. Just simply privacy concerns, why even let the employer know my browsing habits? )

Re:Why use untrusted wi-fi?

[Karlt1]

As of this week, all of the four major carriers are offering unlimited data that is not "deprioritized"* until you go over 22GB - 28GB.

When we were living in an apartment where wifi interference was horrible. We typically just turned off wifi and used cellular from our phones. (We also had 100 foot cords running to all three bedrooms from the router but that's a different story....)

I pay $200 on T-Mobile for 5 lines unlimited data with 14GB of tethering on each line.

Depriorotized -- your data is slowed down temporarily in congested areas to allow others to go at full speed when you go over the cap.

Throttled -- your speed is slowed down permanently to 2G speeds for the rest of the billing cycle when you go over the cap.

that's why VPN or equivalent is needed in public

[MarcAuslander]

I use a homebrew equivalent of VPN whenever I'm in public. Started when I realized a hotel was messing with my HTTP traffic! Crucial of course is reliable access to DNS - if that's broken then even connecting HTTPS can get you in trouble if someone has gotten hold of a signing certificate and does man in the middle.

This stuff is just to hard for the average user.

These two may have been least at risk

[gweihir]

Use a VPN, use SSH for remote logins and you basically do not care about the security of the access-point. If it wants a browser-based sign-up, just do that from a VM. You would think that you can find people that know how to do that at the RSA conference....

Re:DNC?

[eric_harris_76]

So, the Russians manipulated US voters by discovering and revealing awful truths about a candidate for president?

Suppose this dastardly deed has been done by -- and I'm being deliberately zany here -- the news media doing their damn job?

Would it have been a bad thing then?

How about if it had happened before that nominee had won the nomination? Would that have been a bad thing or a good thing?

Let's hope next time, the Russians (or whoever does it next time) does it before the nomination.

And they do it to all the despicable candidates of the statutory duopoly parties, rather than just the one.