Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What we give away when we log on to a public Wi-Fi network

decorrespondent.nl

Post reply on HN
Print view View original

51–60 of 112 posts

Re: What we give away when we log on to a public Wi-Fi network

#51

Post by [deleted] »

goblin89 wrote: post #39
MisterNegative wrote: post #24

Earlier quoted context omitted.

If you don't type the https url, you start by visiting the http website. Normally the http version will redirect to https, but a man in the middle can easily prevent this.

> If you don't type the https url, you start by visiting the http website. Normally the http version will redirect to https, but a man in the middle can easily prevent this. This is not entirely correct. HSTS[0] was designed to protect against such attacks. It's true, however, that not every browser out there supports it yet, and you must visit the website at least once without MITM for the server to successfully com…

[deleted]

Re: What we give away when we log on to a public Wi-Fi network

#52

Post by bluerobotcat »

lucb1e wrote: post #29
tcdent wrote: post #5

Earlier quoted context omitted.

You could brute force it by using common network names and seeing which ones get bites. Take it a step further and generate expected patterns ie. "2WIRE123". I'd expect "linksys" alone would grab a surprising amount to start, though.

> using common network names Exactly, even if it's not broadcasting network names, almost every student in the Netherlands will have the train's WiFi hotspot in their list of networks. One thing I still want to check out is whether the laptop will connect to an open network with the same name as a known network that was password protected.

On OS X it will not. OS X will also alert you when you try to connect manually.

Re: What we give away when we log on to a public Wi-Fi network

#53

Post by A1kmm »

bdg wrote: post #22
victorvation wrote: post #15

Earlier quoted context omitted.

Yep. Whenever wifi is enabled, your device is sending out probe request frames, which includes your list of preferred networks/networks you've connected to before.

Wow... And I was thinking that using my phone to hotspot in cafes was mitigating things like that. Thanks for sharing!

To an extent it is; if your phone never connects to any WiFi device (and instead uses GPRS / EDGE / LTE etc... to a mobile carrier), and your laptop only ever connects to your phone, then the probes the attacker will see are for your laptop probing for the SSID of your phone. Given an appropriately vague SSID, this doesn't give the attacker much information (c.f. connecting to access points everywhere and giving away that list of SSIDs).

If you use WPA2 PSK and choose a long, random password (you want enough entropy that brute forcing it is impossible - for example, 20 completely random and independent characters taken from a dictionary of 62 characters gives you ~105 bits of entropy, which should be enough, while 8 characters or a few dictionary words might not cut it) impersonating your phone is not feasible if your laptop is configured to only ever connect using the saved pre-shared key.

Re: What we give away when we log on to a public Wi-Fi network

#54

Post by MichaelGG »

leepowers wrote: post #44
sktrdie wrote: post #6

How was the hacker able to get Facebook credentials? Facebook uses HTTPS and so does Live.com. Even if I'm connected to a malicious router, only me and Facebook know about the data we're sending each other. Am I missing something or should the author of this article provide more evidence on the type of attack?

If an attacker controls the access point he could do the following: * Redirect all HTTPS traffic to an HTTP spoof site. Many users probably wouldn't notice. * If the attacker has access to a short, 2-3 character domain, they could redirect to a wildcard HTTPS connection like, https://facebook.aa.com/ - again, many users wouldn't notice. They'd see "facebook" and the lock icon and assume they're ok. * In either case t…

Probably don't even need a short domain. Facebook.login.secureauthredirectsystem.moregibberish.com probably would seem sorta legit. After all, Microsoft's auth systems do crazy stuff like that. So does the moronic Verified by Visa system - it's something like "ww2.secpayment.com" and looks totally sketchy but it's legit.

Re: What we give away when we log on to a public Wi-Fi network

#55

Post by MichaelGG »

chimeracoder wrote: post #41
poopchute wrote: post #26

Earlier quoted context omitted.

I use that on my desktop and laptop but trying to get it to connect on my nexus 5 was a nightmare - I eventually gave up.

Both Private Internet Access[0] and VyprVPN[1] have apps on the Play store, which are completely plug-and-play. [0] https://play.google.com/store/apps/details?id=com.privateint... [1] https://play.google.com/store/apps/details?id=com.goldenfrog...

GoldenFrog has publicly stated that they are very much in favour of logging things.

Re: What we give away when we log on to a public Wi-Fi network

#56

Post by keeperofdakeys »

RexRollman wrote: post #34
victorvation wrote: post #15

Earlier quoted context omitted.

Yep. Whenever wifi is enabled, your device is sending out probe request frames, which includes your list of preferred networks/networks you've connected to before.

What's the point of that? To speed up reconnection?

It also allows APs to be "hidden", by not broadcasting its own SSID, but relying on devices to send out a probe to ask if it's there. Of course, it's not hidden from packet sniffers if it's talking to someone.

Re: What we give away when we log on to a public Wi-Fi network

#57

Post by huntaub »

leepowers wrote: post #44
sktrdie wrote: post #6

How was the hacker able to get Facebook credentials? Facebook uses HTTPS and so does Live.com. Even if I'm connected to a malicious router, only me and Facebook know about the data we're sending each other. Am I missing something or should the author of this article provide more evidence on the type of attack?

If an attacker controls the access point he could do the following: * Redirect all HTTPS traffic to an HTTP spoof site. Many users probably wouldn't notice. * If the attacker has access to a short, 2-3 character domain, they could redirect to a wildcard HTTPS connection like, https://facebook.aa.com/ - again, many users wouldn't notice. They'd see "facebook" and the lock icon and assume they're ok. * In either case t…

Can you clarify the first point more? I would assume that if the user is able to connect to "facebook.com", then the connection would immediately go to HTTPS and the router could not "forcefully redirect" or do anything to the connection.

Alternatively, I could imagine a situation where the router hijacks the _DNS_ request for Facebook to a malicious site. Is that what you were referring to?

Re: What we give away when we log on to a public Wi-Fi network

#58

Post by smtddr »

huntaub wrote: post #57
leepowers wrote: post #44

Earlier quoted context omitted.

If an attacker controls the access point he could do the following: * Redirect all HTTPS traffic to an HTTP spoof site. Many users probably wouldn't notice. * If the attacker has access to a short, 2-3 character domain, they could redirect to a wildcard HTTPS connection like, https://facebook.aa.com/ - again, many users wouldn't notice. They'd see "facebook" and the lock icon and assume they're ok. * In either case t…

Can you clarify the first point more? I would assume that if the user is able to connect to "facebook.com", then the connection would immediately go to HTTPS and the router could not "forcefully redirect" or do anything to the connection. Alternatively, I could imagine a situation where the router hijacks the _DNS_ request for Facebook to a malicious site. Is that what you were referring to?

Don't know if this works still today... but I've definitely used it before: http://www.thoughtcrime.org/software/sslstrip/

Re: What we give away when we log on to a public Wi-Fi network

#59

Post by tunap »

Interesting but dated info for techies. I was hoping for something more along the lines of how retailers triangulate & track your movements inside their brick & mortar sites. Or how public providers scrape your browsing habits whilst on their net. I was even more interested in learning what other tricks they employ that I am not yet aware of.

With the ubiquity of broadband mobile I recommend avoiding public wifi whenever possible because the items listed in TFA are ubiquitous at most Starbucks, airports and other hi-profile public spots. I also highly recommend disabling any equipments' wifi by default, the world is full of liars, cheats & thieves smarter than myself. When you go for "free", what you get never is.

Re: What we give away when we log on to a public Wi-Fi network

#60

Post by domenicd »

smtddr wrote: post #58
huntaub wrote: post #57

Earlier quoted context omitted.

Can you clarify the first point more? I would assume that if the user is able to connect to "facebook.com", then the connection would immediately go to HTTPS and the router could not "forcefully redirect" or do anything to the connection. Alternatively, I could imagine a situation where the router hijacks the _DNS_ request for Facebook to a malicious site. Is that what you were referring to?

Don't know if this works still today... but I've definitely used it before: http://www.thoughtcrime.org/software/sslstrip/

I think that attack is exactly what HSTS (https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) is meant to solve.
Post reply on HN