Unencrypted public wifi should die

http://lcamtuf.blogspot.com/2010/12/unencrypted-public-wifi-should-die.html

by there • 16 years ago

18 24 16 years ago

lcamtuf.blogspot.com

juiceandjuice2• 16 years ago

Too bad all of these attacks can be carried out even with encrypted public wifi hotspots.

philipn• 16 years ago

Can they, though?

I was under the impression that sniffing WPA encrypted traffic was difficult even if you know the passphrase.

gst2• 16 years ago

Unless you're the operator of the access point. Are you really gonna trust each random access point that you find?

juiceandjuice2• 16 years ago

If you know the passphrase and you listen in when a client first connects, then you can extract all the data (easy to do in wireshark) However, if you joined/started sniffing for packets after the other client auth'd, than it's harder, at least in wireshark.

It's been a while since I did it, but I do remember you need to listen to the initial negotiation for WPA, but not for WEP.

drdaeman• 16 years ago

Too bad all of those attacks have nothing to do with 802.11 and, given the necessity and equipment, can be carried out with almost any connection medium. Public WiFi is just more popular and easier target.

Just don't think your colleague (who hates you) or nearest BOFH at the job, technically can't stealthly plug out your cable while you're out, hook up his router performing a MitM attack, and have his fun and profit. Yeah, that's childish, much less probable, and incomparably more risky than just sitting with laptop at cafe, but the point is that every one of said attacks can still be carried out.

Just because the whole world's relying on the obscurity as a primary security measure.

motters• 16 years ago

I'm no expert on security, but as far as I'm aware encrypted wifi is completely broken, and can be trivially unencrypted by someone with negligible knowledge using easily available software within a few minutes.

ComputerGuru• 16 years ago

Depends on the encryption. WEP is just as bad as public (though it'll keep Joe Somebody out, but that's about it). WPA1 is alright, and WPA2 w/ AES is a whole different ballgame.

scrod• 16 years ago

The gist of the article:

Security on the web is broken in many technical ways.

Therefore, we should strive to change social practices regarding the use of a technology that is completely independent of the web, instead of actually fixing the problem itself.

gst2• 16 years ago

If you are using a public wifi hotspot it's an untrusted network.

Even encryption does not solve this. How do you prevent someone from just setting up an accesspoint and then sniffing on all routed data?

In addition, for the operator of the wifi hotspot there is no incentive to setup a complicated encryption scheme: If you care about the security issues it's likely that you know how to solve them yourself (see below). If you don't care it's likely that you won't be able to setup a WPA password that is indicated in the SSID.

The only solutions for this are:

- Either you establish end-to-end security with each individual server you want to contact. Unfortunately this doesn't really work with HTTP today.

- You open a secure channel to a trusted entity (such as a VPN provider you trust) and then route all data over this channel. Such solutions are available for less than $10 a month.

If you think that option #2 is too hard for someone without any knowledge about security you've just identified a new business idea.

sbierwagen• 16 years ago

I operate a public WAP as part of the seattlewireless project. I do this for two reasons:

- Not being able to access the internet seriously sucks. It took a month to get DSL in my apartment, and every time I wanted to check my mail in that month, I had to go to a coffee shop, or to work. Nobody in my building had an open point.

- It's a legal hack: Since my ISP never sees the MAC addresses of the machines connected to my router, there's no way to prove what traffic came from what. This may prove handy if the government drops the hammer on people who accessed the wikileaks cables.

For these reasons, it would suck if public wifi was killed. A more elegant solution would be auto-negotiated SSL tunnel to the router, over which all traffic would be routed. Protection from eavesdropping, without denying access to users.

flawawa2• 16 years ago

I hope you do not really think that allowing others to use your internet connection will protect you from any problems arising from bad things being done with your internet connection. But please do run a Tor exit node.

andrewcooke2• 16 years ago

Aren't these two sentences contradictory? Why would someone who is so worried about liability that they do not open up their wifi run a Tor node?

Alternatively: are you implying that a Tor node is "more deniable" than an open wifi? If so, why?

andrewcooke2• 16 years ago

I do the same, if I understand correctly - my home wifi is open. For the same reasons.

I do watch the connection regularly, and I block the MAC addresses of people that appear to be downloading large amounts of data, running torrents, etc (so far MAC blocking has been sufficient - I haven't had a persistent user switching addresses or trying to use my own).

viraptor• 16 years ago

For those of us who have some vps / other server out there, there's always a vpn connection possibility. It will slow everything down, but at least you get the security in a public place as long as you tunnel everything through it.

rbanffy3• 16 years ago

And that's what VPNs are for.

When using an open, unencrypted wifi router, you should understand you are connecting your computer to a potentially hostile network with could be populated by lots of very bad computers.

jancona2• 16 years ago

Of course, most users have never even heard of VPNs. Does anyone offer easy-to-use VPN services to end users? If not, is that a potential business opportunity? (Not that I have a clue on how to make money at it. I can't imagine getting users to pay.)

rbanffy3• 16 years ago

Two simple ideas:

- VPN-as-a-service: a free-to-download client with access to a secure access point. You download it, install it and pay as you go. It could even stand guard preventing you from joining unsafe networks.

- Where-do-you-want-to-pretend-you-are: very useful for geo-restricted services

sp332• 16 years ago

Setting up a rogue AP and sniffing traffic is not a hypothetical attack, it's fairly easy and people really do it. Here's a nifty one: http://www.hak5.org/store/wifi-pineapple-version-2 (It's called the wifi "pineapple" because it fits into a novelty drink container, see http://www.hak5.org/store/wifi-pineapple )

alexeyklyukin• 16 years ago

I don't think killing public wireless is practical. Instead, owners could add a text note, warning new users against accessing their private data while connected to the public network.

Unencrypted public wifi should die

Related Stories