161–170 of 204 posts
Earlier quoted context omitted.
Directed by Francis Ford Coppola, Palme d'Or at Cannes, three Oscar nominations including Best Picture (which, amusingly, it lost to The Godfather Part II ). Great movie.
… also starring Harrison ford…
It also has Frodo from Godfather.
Earlier quoted context omitted.
People who use or rely on client isolation want to prevent inter-client attacks, for whatever reason. We show that this can often be broken. This can be problematic when you have older hardware in your network that is rarely updated, and many then rely on client isolation to mitigate attacks. If everything is encrypted and properly patched, then our attack indeed has less impact, but then there also wouldn't have bee…
Disagree with your final statement. There's good security (and performance) reason to use any/all viable network isolation/segmentation/separation, etc., whenever/wherever possible. So-called Wi-Fi 'client isolation' is but a single network security strategy. No single strategy should be relied upon exclusively, nor avoided for that matter. But it seems we otherwise agree on the overall impact of this vector. My poin…
This is a big deal: it means a client on one wifi network can MITM anything on any other wifi network hosted on the same AP, even if the other wifi network has different credentials. Pretty much every enterprise wifi deployment I've ever seen relies on that isolation for security. These attacks are not new: the shocking thing here that apparently a lot of enterprise hardware doesn't do anything to mitigate these triv…
I have some of those wifi APs that do not even provide any sort of isolation besides just implementing multiple SSID on the same wifi radio aka Guest SSID. No guarantee, no isolation.
Earlier quoted context omitted.
In all fairness, Part II is absolutely incredible storytelling . Are you suggesting The Conversation is even better ?! So excited for tonight's showtime — I'll make an updated reply here, tomorrow morning (with my viewreport).
I think they were simply musing as to how one Coppola film lost to another.
----
Just finished The Conversation (Godfather II rightly won best film); although it features a neat plot twist, I cannot imagine this film being re-watchable.
Gene Hackman definitely acts his paranoid heart out, but his relationships with other characters are stuffy/forced. Too much dead air whenever he gets frustrated, almost as if there wasn't time to reshoot any scenes.
The cinematography/editing is fine, but the sound quality is terrible (presume it only won best soundtrack due to new sound warping/garbling techniques — to a modern listener, it's also sort of a cheap schtick). Particularly with female speakers, subtitles are necessary; but then certain dramatic points are wayyyy too loud.
----
Thanks again for the rec — actually makes me less paranoid about the modern world... just gonna play some sax uncaringly =P
Other members of my household frequently invite people to my own place that have malicious intent against me. They don't like me for reasons like not being a fan of Trump, Drake, or N3on. Unfortunately, this is a risk that many people other than me have to face. This is an eye-opening article as I do provide my guest password to them. I plan on disabling the guest network entirely and utilizing a completely different…
Are you being abused or something? This sounds ridiculous
Earlier quoted context omitted.
I would guess that the VLAN separation should prevent it, but perhaps there are implementation errors on the VLAN implementation inside of individual brands of routers? Inter-VLAN routing shouldn't be done at the wifi access point, packets would need to be tagged coming out of the wifi AP and switched upstream, unless I'm mistaken about this.
Access points by their very definition are not capable of inter-VLAN routing.
But yeah I agree, generally it would be receive traffic on a bssid, tag it, and send it out the wire upstream and let the switch deal with sending it back if its allowed by whatever VLANing policy you have.
Earlier quoted context omitted.
The attacker doesn't need to be connected to the victim's network, only to the same hardware, the hardware's loss of isolation is the unexpected problem. Their University example is pertinent. The victim is an Eduroam user, and the attacker never has any Eduroam credentials, but the same WiFi hardware is serving both eduroam and the local guest provision which will be pretty bare bones, so the attacker uses the means…
Yeah, that commercial-grade hardware didn't actually isolate at the PHY-MAC layer is a bit surprising. How would they have working VLANs at the AP?
As far as I can tell, all of these attacks require the attacker to already be associated to a victim's network. Most of these attacks seem similar to ones expected on shared wifi (airports, cafes) that have been known about for a while. The novel attacks seem to exploit weaknesses in particular router implementations that didn't actually segregate traffic between guest and normal networks. I'm curious if I missed som…
I'm a co-author on the paper: I would personally indeed not use the phrase "we can break Wi-Fi encryption", because that might be misinterpreated that we can break any Wi-Fi network. What we can do is that, when an adversary is connected to a co-located open network, or is a malicious insider, they can attack other clients. More technically, that we can bypass client isolation. We encountered one interesting case whe…
To clarify, the passphrase for each SSID is different, and the question is whether, first, an client that doesn't know any of the passphrases can somehow attack other clients who do, and second, whether a client that knows the passphrase for one SSID can attack clients connected to the other SSID (which has a different passphrase)?
Earlier quoted context omitted.
Hostapd now has support for multi pass SAE /WPA3 password as well. We have an implementation of dynamic VLAN+per device PSK with WPA3 ( https://github.com/spr-networks/super ) we've been using for a few years now. Ironically one of the main pain points is Apple. keychain sync means all the apple devices on the same sync account should share a password for wireless. Secondly the MAC randomization timeouts require reas…
Is that the same feature as vlanid= in openwrt's wpa_psk_file? https://openwrt.org/docs/guide-user/network/wifi/basic#wpa_p... I was leaning towards using this configuration for splitting devices into VLANs while using one SSID. Yeah, dynamic VLAN+per device PSK would be best, but I'm probably happy enough with a shared PSK per VLAN to isolate a guest or IoT network. Would this VLAN isolation have prevented this atta…