Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Nearest Neighbor Attack

volexity.com

Post reply on HN
Print view View original

61–70 of 73 posts

Re: The Nearest Neighbor Attack

#61

Post by eru »

Spivak wrote: post #33
eru wrote: post #7

Earlier quoted context omitted.

> A network is as strong as the weakest link. Depends on how you look at it. We have end-to-end security with things like https, so we don't need to worry about the links in the middle.

The BeyondCorp strategy. It also means that network and endpoints can be off the shelf. Big fan of this strategy.

Yes, and it's already the default in consumer electronics.

That's also why I don't get all the pearl clutching over dodgy unencrypted wifi: if your security relies on your wifi operator being nice, you are doing it wrong.

The main thing encrypting wifi does (or rather should do..) for you is keeping your neighbours from stealing all your bandwidth.

Re: The Nearest Neighbor Attack

#62

Post by eru »

akaiser wrote: post #19
_nalply wrote: post #4

Earlier quoted context omitted.

They are exploiting that Wifi didn't have 2fa, because they couldn't overcome 2fa. A company accross the street had a machine that both was accessible by ethernet and wifi and they used that as a bridge. Conclusions: 1. Anything that doesn't have 2fa is leaking like a sieve. 2. The targeted company needs to implement 2fa for their Wifi as well. Not mentioned, but I assume that their 2fa is using specialised hardware…

Eludes me why they didn't have device-certificate-based auth for their Enterprise WiFi in addition to the username+password. Basically comes for free with AD and NPS.

'Free' still means you need some expertise in setting it up and running it.

Re: The Nearest Neighbor Attack

#63

Post by rocqua »

cortesoft wrote: post #41
_nalply wrote: post #4

Earlier quoted context omitted.

They are exploiting that Wifi didn't have 2fa, because they couldn't overcome 2fa. A company accross the street had a machine that both was accessible by ethernet and wifi and they used that as a bridge. Conclusions: 1. Anything that doesn't have 2fa is leaking like a sieve. 2. The targeted company needs to implement 2fa for their Wifi as well. Not mentioned, but I assume that their 2fa is using specialised hardware…

My conclusion is that being on the corporate Wi-Fi should not give you access to anything. There should not have been any advantage to getting on the Wi-Fi, it should be treated like the public internet. A separate VPN, with MFA, should be required to access anything.

Corporate WiFi based on a password and a device certificate is fine. For BYO devices, you have a separate WiFi network that does require a VPN to reach the corporate network.

Re: The Nearest Neighbor Attack

#64

Post by rocqua »

cesarb wrote: post #46
sleepybrett wrote: post #44

Earlier quoted context omitted.

This is a little different. What he was doing is essentially setting up proxies all over the world. These guys hacked into a machine connected by ethernet with an idle wifi adapter, then used that idle wifi adapter to connect to the wifi of a company nearby.

> These guys hacked into a machine connected by ethernet with an idle wifi adapter And having an idle wifi adapter like that is common nowadays. For some reason, many desktop PCs intended to stay in a single fixed place come from factory with a built-in wifi card and built-in antennas. You'd think that would make these PCs more expensive, but apparently wifi cards are cheap nowadays?

WiFi and Bluetooth are usually provided by the same device, and it makes sense to want Bluetooth on a desktop. So you get WiFi essentially for free if you get Bluetooth.

Re: The Nearest Neighbor Attack

#65

Post by legulere »

cortesoft wrote: post #41
_nalply wrote: post #4

Earlier quoted context omitted.

They are exploiting that Wifi didn't have 2fa, because they couldn't overcome 2fa. A company accross the street had a machine that both was accessible by ethernet and wifi and they used that as a bridge. Conclusions: 1. Anything that doesn't have 2fa is leaking like a sieve. 2. The targeted company needs to implement 2fa for their Wifi as well. Not mentioned, but I assume that their 2fa is using specialised hardware…

My conclusion is that being on the corporate Wi-Fi should not give you access to anything. There should not have been any advantage to getting on the Wi-Fi, it should be treated like the public internet. A separate VPN, with MFA, should be required to access anything.

Also a VPN is just another perimeter. You wouldn't want a single device like a printer getting successfully attacked leading to everything in your network getting compromised. The real solution is to use a zero trust architecture

Re: The Nearest Neighbor Attack

#66

Post by DyslexicAtheist »

EvanAnderson wrote: post #34
coldpie wrote: post #30

Earlier quoted context omitted.

Final, final conclusion: if a computer is networked, consider it and the data on it to be semi-public. Make decisions about what to do and store on that computer with that assumption in mind.

Final, final, final conclusion: Interacting with a computer makes it networked even if you're not intentionally using traditional networking technologies (TEMPEST attacks, arbitrary code execution through direct user input, etc).

Final, final, final, final conclusion: due to the complexity of computers, the only reliable way to achieve a moderate security in a system is to prevent it from being powered on.

Re: The Nearest Neighbor Attack

#67

Post by coldpie »

EvanAnderson wrote: post #54
coldpie wrote: post #36

Earlier quoted context omitted.

Physical access has always been game over. Having a networked computer means your threat model is literally everyone on the planet, which is a much bigger problem than keeping people from physically getting access.

Direct physical access by the attacker isn't strictly necessary (i.e. operation Olympic Games) to "network" a computer you otherwise believe isn't networked. Unless you're bootstrapping from nothing attackers have tons of potential "ins" (firmware, the operating system, application software) to introduce backdoors or side-channels. I've very nearly reached the point of just assuming all "modern" computers are effecti…

Ooh! This is a fascinating approach. I'm still skeptical that this is widespread enough of an issue to warrant the same level of caution as connecting a computer to the Internet, but I'd love to read more about examples of this actually happening in the real world (ie not researchers with full control of the environment) if you have any.

Re: The Nearest Neighbor Attack

#68

Post by dotancohen »

DyslexicAtheist wrote: post #66
EvanAnderson wrote: post #34

Earlier quoted context omitted.

Final, final, final conclusion: Interacting with a computer makes it networked even if you're not intentionally using traditional networking technologies (TEMPEST attacks, arbitrary code execution through direct user input, etc).

Final, final, final, final conclusion: due to the complexity of computers, the only reliable way to achieve a moderate security in a system is to prevent it from being powered on.

The concept of C-I-A addresses this. Confidentiality, Integrity, Availability. If a system is not available for use then all the confidentiality of communications and integrity of data is useless.

Re: The Nearest Neighbor Attack

#70

Post by __MatrixMan__ »

_hl_ wrote: post #14
voidUpdate wrote: post #13

Earlier quoted context omitted.

Russia is quite far away to send a plane small enough to fly low over the building and drop a device onto the roof, and I don't think you're allowed to throw things out of an airliner window anyway

I mean a normal passenger on a normal plane making a normal trip to an office building and finding a hidden location where to tape a small box with an arduino in it. Maybe even on the outside so you can use solar power? Though it only needs to last long enough to compromise a machine inside the network. This would be nothing new, I remember ages ago in the days of WEP that you could buy a small box that would collect…

It was pretty easy to do without buying the box if you had a network card you could put into monitor mode. Fun thing was that you only needed one handshake initially, then you could replay it and collect the responses which were each initialized differently.

I've tried the WPA equivalent attack (capture handshake, crack offline...) against targets with physical security that extended beyond their wifi. It was a bit arduous and fiddly and expensive and risky. If I could've compromised a neighbor and gotten the handshakes without traveling for them I'd definitely have preferred that option.

Post reply on HN