Using free Wi-Fi hotspots poses a data risk to users, the boss of European police agency Europol warns. Troels Oerting, head of Europol's cybercrime centre, told BBC Click that growing number of attacks are being carried out via public Wi-Fi and that people should send personal data only across trusted networks. "We have seen …

COMMENTS

House rules Send corrections

This topic is closed for new posts.

Monday 10th March 2014 11:01 GMT SMabille

SSL Man in middle attack

In the same BBC click, there was a demonstration of an SSL man in the middle attack towards Amazon (but stating they can impersonate any/other sites)

Except for unpatched iOS device not checking that the certificate actually match the URL (but it was demonstrated on Android), how would that attack works without pre-installing a new trusted root cert on the device?

Also the comment at the end, from TrendMicro representative (i believe) that hotel type Wi-Fi requesting a one-off password are far more secure is absolutely BS, nothing prevent to do a fake login page accepting any "password", can't actually believe they diffused that comment!

0 0
1. Tuesday 11th March 2014 21:02 GMT Michael Wojcik
  
  Re: SSL Man in middle attack
  
  Except for unpatched iOS device not checking that the certificate actually match the URL
  
  That's not how the iOS SSL/TLS bug works.¹
  
  how would that attack works without pre-installing a new trusted root cert on the device?
  
  I can't be bothered to watch the video, but the SSL/TLS X.509 PKI is leakier than a sieve.
  
  Have you seen how many trusted roots the typical device has? Froyo comes with, like, 57, according to one dump I found online. Do you trust all of the organizations that hold the private keys for those roots to perform due diligence when they receive a CSR?
  
  Or maybe they mean "a MITM attack if the user clicks through a warning".
  
  I suspect they were talking about Why Eve and Mallory Love Android, though. That paper identifies a host of Android apps that misuse the SSL/TLS APIs and consequently have all sorts of vulnerabilities.
  
  SSL/TLS is only as secure its implementations, applications, and PKI. And none of those are in good shape, generally speaking. About the best you can hope for with SSL/TLS is that it increases the work factor enough to make adversaries look elsewhere.
  
  ¹And I've never seen a certificate specify a URL as a component of the DN or subjectAltName, though it's certainly possible; but in any case, that's not what SSL/TLS check the certificate against. They check it against the FQDN.
  
  1 0
Monday 10th March 2014 11:28 GMT shaolin cookie

Smartphones

At least for me the issue comes with the phone when travelling -- it's always checking for email when there is a network connection, so ends up doing so also on wi-fi hotspots even if the idea was only to read the news at the airport. There really ought to be a setting for the trust level to the network.

6 0
1. Monday 10th March 2014 11:51 GMT Charles 9
  
  Re: Smartphones
  
  As for a VPN connection, I'm seeing more home-grade routers support the ability... EXCEPT...they only work in Bridge Mode (TAP). Wouldn't you know it? Most smartphones and the only ONLY accept VPNs in Tunnel Mode (TUN). Make routers take Tunnels or smartphones accept bridges and perhaps more people will be inclined to use them by default.
  
  1 0
  1. Monday 10th March 2014 12:00 GMT TRT
    
    Re: Smartphones
    
    So, are there any reasonably priced VPN boxes people would recommend?
    
    0 0
    1. Monday 10th March 2014 12:10 GMT Anonymous Coward
      
      Re: Smartphones
      
      I use a synology NAS Box which also does good VPN
      
      0 0
    2. Tuesday 11th March 2014 11:49 GMT Anonymous Coward
      
      Re: Smartphones
      
      CitizenVPN.com works great for me. It's not the cheapest out there, but very fast and seems more secure (i.e. no logging of your actions). It's danish.
      
      0 0
2. Monday 10th March 2014 12:02 GMT dervheid
  
  Re: Smartphones
  
  In Android settings; WiFi; Advanced: turn off Auto network switch, Scanning always available.
  
  my 'Droid will still auto connect to known & trusted WiFi (like my home network) but not to anything else (it will ask)
  
  If anyone's too dumb to sort out their settings, just turn the frigging wifi OFF when you're not actually using it (saves battery life a little too)
  
  And if they're dumb enough to connect to "Free WiFi Here", then hell mend 'em.
  
  5 1
3. Monday 10th March 2014 12:03 GMT Anonymous Coward
  
  Re: Smartphones
  
  "At least for me the issue comes with the phone when travelling -- it's always checking for email when there is a network connection, so ends up doing so also on wi-fi hotspots even if the idea was only to read the news at the airport. There really ought to be a setting for the trust level to the network."
  
  Its also probably broadcasting your name all over the place too regardless. The smartphones I can see while doing a packet dump on wifi's in most hotels I've visited certainly do.
  
  1 0
Monday 10th March 2014 11:56 GMT ISYS

No shit Sherlock

I agree - don't go spraying all your sensitive data over a public Wi-Fi connection that you have no control over.

On a slightly related subject it seems a lot of people are getting lazy over data protection when in public places, especially on public transport. Many a time on my train journey I am sat next to somebody in their mobile office and can see who they work for, what they are working on, who they are communicating with, their username and password (I can see what you are typing - those asterisks do not fool me) besides a lot more.

1 1
1. Monday 10th March 2014 12:51 GMT VinceH
  
  Re: No shit Sherlock
  
  " (I can see what you are typing - those asterisks do not fool me)"
  
  I fool everyone.
  
  Everybody thinks my passwords are long and complicated to remember - but the truth is the only thing I have to remember is just how many times to press Shift-8.
  
  6 0
  1. Monday 10th March 2014 15:36 GMT ISYS
    
    Re: No shit Sherlock
    
    Haha :-)
    
    however if you were sat next to me on the train I would see you typing Shift-8 x number of times ;-)
    
    0 0
2. Monday 10th March 2014 15:34 GMT Richard Taylor 2
  
  Re: No shit Sherlock
  
  I sat behind two Sun sales people (hey this is a little while back) on a flight across the pond. It was very revealing. Company ethics were firm and I did talk to someone from our legal team in Palo Alto. Result - I had to be very quiet and very careful. They did take it seriously.
  
  0 0
Monday 10th March 2014 12:02 GMT Anonymous Coward

The more the clueless get hacked...

... the more they'll stay off the net leaving it to those of us who know what we're doing. Seems like a win-win to me.

2 1
Monday 10th March 2014 12:09 GMT Robert Grant

SSL?

I don't understand - what can they do if I go to natwest.com and hit log in? Doesn't that keep me on SSL the whole time?

0 1
1. Monday 10th March 2014 12:20 GMT Anonymous Coward
  
  Re: SSL?
  
  http://codebutler.com/firesheep/
  
  1 0
2. Monday 10th March 2014 12:50 GMT Anonymous Coward
  
  Re: SSL?
  
  "I don't understand - what can they do if I go to natwest.com and hit log in? Doesn't that keep me on SSL the whole time?"
  
  SSL is only secure if someone is trying to listen in to your data sent to another party on an already established connection. Its of no use if someone *pretends to be* that party when you initiate the connection.
  
  1 0
  1. Monday 10th March 2014 14:03 GMT rh587
    
    Re: SSL?
    
    That would be where you need HTTPS Strict Transport Security which was developed specifically to prevent SSL-stripping MITM attacks.
    
    It's not a silver bullet, but it does at least make your browser shout at you if Facebook or gmail are trying to present as plain http when they should be defaulting to https, and protects against sidejacking and cookie theft. It won't protect against advanced attacks but it bumps off the trivial likes of Firesheep and Idiocy (which hijacks twitter accounts and sends a tweet in less than 130 lines of python).
    
    1 0
  2. Monday 10th March 2014 14:51 GMT DropBear
    
    Re: SSL?
    
    Fine, I still don't get it (either): one of the most ubiquitous ways to check for mail - the official Gmail Android app - is apparently using SSL. How exactly does that become insecure over any kind of WiFi? It's an honest question, I'm not a crypto boffin...
    
    1 0
    1. Monday 10th March 2014 16:58 GMT Destroy All Monsters
      
      Re: SSL?
      
      It should be secure enough.
      
      0 0
    2. Monday 10th March 2014 18:17 GMT Anonymous Coward
      
      Re: SSL?
      
      > How exactly does that become insecure over any kind of WiFi?
      
      You're right, the promise of SSL is exactly that it *will* keep you secure over any kind of network. However, SSL is going to protect you only if
      
      - (as mentioned above) no-one other than NatWest has been able to get an SSL-certificate issued for NatWest otherwise a man-in-the-middle-attack is easy for those with said certificate
      
      - the SSL implementation on your phone/laptop doesn't have a security issue. Apple e.g. recently had an issue that meant iOS/OS X could be tricked into accepting a certificate that wasn't valid. Everything using GnuTLS has been found to have a similar issue. Tricking the implementations on the basis of these bugs does mean making considerable effort to specifically exploit those issues.
      
      - However, IIRC, some org recently tested a selection of Android apps that do use SSL, presented self-signed certificates and found that some 50% or so of apps didn't actually check the certificate status, so accepted them, allowing for a truly trivial MITM attack. They haven't tested iOS apps AFAIK but the situation there may well be similar.
      
      Also while performing normal browsing via http others connected to the same network can manage to deliver the page to you first instead of you getting the one the router meant for you. So under the assumption that none of the issues mentioned above is going on, you also have to make sure that the page that appears to be, say, gmail.com, is delivered via https and not http. Normally when you go to http://gmail.com, you'll be redirected to https but if someone manages to get in there before that happens you'll see a gmail.com page delivered from someone else, not ever going to https. Which is, of course, a problem when you enter your pwd on it.
      
      You're quite possibly ok with your banking app and with a competently written mail app from one of the big ones (or decent open-source alternatives) but regardless you're well advised to not rely on that. I admit, I occasionally do, though, and I'll be in serious trouble if that goes wrong at some point.
      
      Also, I'm not a security expert either, this is "to the best of my knowledge". Corrections welcome.
      
      0 0
      1. Tuesday 11th March 2014 21:15 GMT Michael Wojcik
        
        Re: SSL?
        
        no-one other than NatWest has been able to get an SSL-certificate issued for NatWest
        
        Anyone can get a certificate with any subject name they want - just create it yourself and sign it with a root you create yourself. The key is whether it's signed by a root (or a chain of intermediaries terminating in a root) that the peer trusts. The X.509 PKI hinges on the use of trusted root certificates (with various horrible kluges on top, such as CRLs and OCSP).
        
        Fortunately (for attackers), most OSes come with a wealth of trusted roots, many of whom are as trustworthy as that nice trenchcoat-wearing fellow lurking about in the alley.
        
        Apple e.g. recently had an issue that meant iOS/OS X could be tricked into accepting a certificate that wasn't valid
        
        Nope (though clearly I'm rowing against the current here, as this error is widely reported). The iOS bug let someone acting as a MITM change the ephemeral key for the session and sign it with a private key that doesn't match the server's public key. That lets the MITM intercept and decode traffic between the peers, but the server certificate still has to be valid. The bug doesn't affect certificate handling at all.
        
        Everything using GnuTLS has been found to have a similar issue
        
        More precisely, the GnuTLS bug was a bug in certificate verification, as you erroneously described the iOS bug. So yes on that one.
        
        some org recently tested a selection of Android apps that do use SSL, presented self-signed certificates and found that some 50% or so of apps didn't actually check the certificate status
        
        Try 8%. Though that's still pretty bad. And this basically comes down to developers deciding they need to do something other than what the Android SSL/TLS APIs do by default (e.g. bypass the normal certificate processing because they can't be bothered to get a server cert signed by a well-known CA) and fucking it up. Developers trying to write SSL/TLS code is nearly as bad as developers trying to roll their own security systems.
        
        1 0
3. Monday 10th March 2014 13:21 GMT jonathanb
  
  Re: SSL?
  
  You have to assume it is possible for someone other than The Royal Bank of Scotland to get an SSL certificate for natwest.com. That sort of thing has happened in the past.
  
  0 0
Monday 10th March 2014 12:14 GMT Miek

"Troels Oerting, head of Europol's cybercrime centre, told BBC Click that growing number of attacks are being carried out via public Wi-Fi and that people should send personal data only across trusted networks." -- So, in other words, we should not send any data across any networks at all then?

4 0
1. Monday 10th March 2014 17:39 GMT Charles 9
  
  I would ordinarily say if you limit your use of public WiFi points to basic web surfing (news sites and the like), there would be little to worry about, but then you hear those stories about hotspots being hijacked and any new connections being probed by malcontents for direct penetration points (since by logging in you obtain an IP hackers can use to probe your device directly---part of the spec).
  
  0 0
Monday 10th March 2014 12:30 GMT Gordon 10

But but but

"According to a recent Kaspersky Lab survey, 34 per cent of people using a PC admitted to taking no special measures to protect their online activity when using a Wi-Fi hotspot."

The key point is - THEY SHOULDNT HAVE TO. To the occasional elitist commentard posting on here - ask yourself - should your granny care whether her phone connection is on public or private wifi when she's checking facebook or email for the young 'uns?

The technology used should be secure by default, be that improved SSL or something else.

BTW was I the only one who though the Europol statement straight from the department of the blindingly obvious. Ok - which methods of public wifi access are at risk? Vanila uncrypted connections, SSL connentions, VPN's - what - give us consumers some useful info that we can take some action with.

13 2
1. Monday 10th March 2014 13:02 GMT proto-robbie
  
  Re: But but but
  
  Agree absolutely.
  
  Networking is ubiquitous and crucial, so why isn't it secure? Joe Public doesn't need qualifications in aircraft maintenance to get to New York, so why can't our profession just make things safe for the users, rather than looking down our noses at them?
  
  9 2
  1. Monday 10th March 2014 14:05 GMT Anonymous Coward
    
    Re: But but but
    
    >Joe Public doesn't need qualifications in aircraft maintenance to get to New York, so why can't our
    
    >profession just make things safe for the users
    
    Joe Public isn't flying the plane. However if they want to hire someone to operate their computer or smartphone for them while they watch that would solve the problem.
    
    1 4
  2. Tuesday 11th March 2014 21:17 GMT Michael Wojcik
    
    Re: But but but
    
    Networking is ubiquitous and crucial, so why isn't it secure?
    
    Because of the massive explosion in computing and network resource requirements? The complete loss of edge caching?
    
    J Random Jackass's streaming video does not need to be encrypted. My Register reading does not need to be encrypted.
    
    Use tools where they're appropriate.
    
    1 0
Monday 10th March 2014 12:48 GMT Anonymous Coward

"The key point is - THEY SHOULDNT HAVE TO. To the occasional elitist commentard posting on here - ask yourself - should your granny care whether her phone connection is on public or private wifi when she's checking facebook or email for the young 'uns"

Thats a bit like saying a car driver shouldn't have to know about basic car maintenance and safe driving style. If you use a device you should know how to use it properly - end of. I'm sick of idiots whining and bitching about "Well , I didn't like know, did I. Init?". If they spent 0.01% of the time they spent on Farcebook actually learning the basics about web security they issue wouldn't occur. But they can't be arsed so frankly they deserve what they get.

2 10
1. Monday 10th March 2014 13:29 GMT Pascal Monett
  
  Actually no, a driver has no need to know about basic car maintenance. The only thing he's going to want to know is how to fill the wiper fluid. The rest is handled by his mechanic, unless he doesn't have the means to pay for one. If that is the case, then he'll learn to do everything he can on his own, forced to do so by his own budget. That will be his deciding criteria. As for driving safely, you're likely to get as many opinions on that as people you ask. In the end, people drive the way they want until one day something bad happens and a judge tells them they were wrong.
  
  People act the same with computers, because computers are tools, nothing more. And when you know how to hammer a nail, you know enough about hammers. That is how people think.
  
  Using a computer is not like driving a car, computers are way more complex - but the computer industry as a whole (with Microsoft proudly leading the way) has been trying for decades to make people forget that they are using a complex bit of kit. They have largely succeeded, which is why Joe User knows nothing about computers in general, or his smartphone in particular.
  
  Joe User just fires up his personal computing platform, goes to his trusted social site and TRUSTS THEM to manage stuff properly. I know, it's unbelievable that anyone would actually trust The Zuck (bitch!), but there you have it, people do that.
  
  As for your "they deserve" comment, I am quite sure that if you ever need a lawyer and get one with that attitude, you'll be part of the whiners and bitchers as well.
  
  Or are you going to say that you know your Civil Law code down to the last article ?
  
  10 3
  1. Monday 10th March 2014 14:00 GMT Anonymous Coward
    
    >Actually no, a driver has no need to know about basic car maintenance. The only thing he's going
    
    >to want to know is how to fill the wiper fluid. The rest is handled by his mechanic
    
    Bollocks. If a driver has a blowout or some other mechanical failure related to skipped maintenance and causes a bad accident it won't be the mechanic hauled up in court.
    
    >As for driving safely, you're likely to get as many opinions on that as people you ask
    
    No, sorry, there are a few cast in stone no-nos. Pulling out in front of oncoming traffic , cutting people up, sitting 10 cm from someones back bumper on the motorway etc etc. People should know all this just like they should know not to use a public wifi network for anything they want to keep secure.
    
    >Using a computer is not like driving a car, computers are way more complex
    
    Not these days - cars are just computers on wheels now.
    
    >Joe User just fires up his personal computing platform, goes to his trusted social site and
    
    >TRUSTS THEM to manage stuff properly"
    
    Thats because Joe User is an idiot.
    
    >As for your "they deserve" comment, I am quite sure that if you ever need a lawyer and get one
    
    >with that attitude, you'll be part of the whiners and bitchers as well.
    
    >Or are you going to say that you know your Civil Law code down to the last article ?
    
    Nice fail with the analogy there. I wouldn't attempt to undertake a legal proceeding myself - thats why I would hire a lawyer. However people expect to be able to operate a complex device themselves without having bothered to train themselves properly then complain when it all goes pear shaped. Well tough luck.
    
    2 9
    1. Monday 10th March 2014 16:34 GMT Anonymous Coward
      
      @boltar
      
      You really wish it were the 80s again so people would hold a guru like yourself in awe, don't you?
      
      3 3
      1. Monday 10th March 2014 16:50 GMT Anonymous Coward
        
        Re: @boltar
        
        "You really wish it were the 80s again so people would hold a guru like yourself in awe, don't you?"
        
        If you think it takes a guru to learn basic online security principals then you should perhaps head off down to Bebo where you'll feel more at home.
        
        Tw@t.
        
        2 4
Monday 10th March 2014 13:37 GMT chris 17

IPv6 should sort a lot of this out.

Privacy concerns about IPv6 aside, the spec mandates all connections should be capable of using encryption. No more unencrypted connections to email or other systems that smartphones automagically do these days.

Could be fun to review logs later and track people as they journey around!

0 0
1. Tuesday 11th March 2014 21:20 GMT Michael Wojcik
  
  IPv6 should sort a lot of this out.
  
  You forgot the joke icon.
  
  IPv6 doesn't appear likely to sort much of anything out in my lifetime, but even if it does achieve significant penetration, it most certainly will not solve confidentiality, authentication, or non-repudiation issues with Internet use. I suppose it'll help a bit with integrity.
  
  1 0
Monday 10th March 2014 14:27 GMT pacman7de

Privacy for anyone anywhere ..

'Tails is a live operating system, that you can start on almost any computer from a DVD, USB stick, or SD card. It aims at preserving your privacy and anonymity`

0 0
1. Monday 10th March 2014 14:43 GMT Anonymous Coward
  
  Re: Privacy for anyone anywhere ..
  
  Using TOR makes it more likely that your connections will be intercepted, not less. Anyone can run a TOR endpoint.
  
  There's a fascinating talk on YouTube about using SSLStrip to intercept connections. The speaker tested his examples on a TOR endpoint. https://www.youtube.com/watch?v=MFol6IMbZ7Y
  
  0 0
Monday 10th March 2014 17:23 GMT Anonymous Coward

open/captive insecurity

open wifi networks and captive portal networks are insecure - yes. been known for ages. Sniffable..yes, been known for ages. the thing is theres 2 parts to this..the PHY security in WiFi and the actual media access after authentication.

in the academic world they've got eduroam - which is a federated 802.1X system - you log into the network using 802.1X and EAP - all proxied back to your home site with a RADIUS server your client is configured to trust, you never need to trust a local server or anything else. After you have securely authenticated to the network (no dodgy captive portal that you put your details randomly into) your traffic is protected with 802.1X - so your wireless unicast traffic cannot be sniffed by someone else (all clients have their own cipher key for their session). the commercial hotspot world is coming around to 802.1X - several WiSPrs are starting to do it... HotSpotS2.0/PassPoint is helping.

however, secure access is one thing - protection at the IP layer is then another thing - best practice would say things like client isolation (WLAN level or IP level ) helps here - as well as other tech like DHCP snooping/protection, ARP protection, Dynamic Arp Inspection and RA/ND guard (for IPv6) - many sites will dont have that stuff - so a bad person, if they can get onto the network, can then still poison other clients ARP tables, spoof being the router, take over the DHCP, pretend to be the authoritative DHCP/DNS/proxy server etc and get you that way - so thats when VPN still wins

(and obviously a bad guy with physical access can be sniffing the WAN link (or wired side of the wifi AP depending on the tech being used)

0 0
Tuesday 11th March 2014 10:39 GMT Kepler

How insecure is HTTPS over a public Wi-Fi hot spot?

The article itself makes it sound like VPN is the only possible way to make communications over a public Wi-Fi hot spot secure. For some reason it doesn't even mention SSL or HTTPS.*

Unlike the article, a number of the posts above discuss SSL. While it is by no means perfect — being subject to attacks such as man-in-the-middle, and to bugs such as OS X's and iOS's problem of potentially accepting bogus certificates — the bottom line seemed to be that (as Destroy All Monsters said) "It should be secure enough."

I have long had Facebook set to use HTTPS by default, and every e-mail service I know of also uses HTTPS by default — even (shudder) AOL. Just how vulnerable are communications via e-mail or Facebook made over a public Wi-Fi connection, if SSL/TSL and HTTPS are used, but VPN is not?**

Or shopping or on-line banking?

.

* I view SSL and HTTPS as essentially interchangeable for purposes of this discussion. Likewise, I have paid no attention to the different versions of SSL, or to SSL's having been succeeded by TLS. If anyone believes that is not accurate (SSL and HTTPS "essentially interchangeable for purposes of this discussion"), and that we need to be more specific, by all means set me straight.

http://en.wikipedia.org/wiki/HTTP_Secure

http://en.wikipedia.org/wiki/Transport_Layer_Security

.

** According to its creator's description, Firesheep does not appear to work where SSL and HTTPS are utilized.

http://codebutler.com/firesheep/

It does not appear to work on e-mail accounts, and appears to work on Facebook only in cases where the user has not already told Facebook to use HTTPS.

http://www.pcworld.com/article/209333/how_to_hijack_facebook_using_firesheep.html

http://en.wikipedia.org/wiki/Firesheep

1 0
1. Tuesday 11th March 2014 11:49 GMT JR555
  
  Re: How insecure is HTTPS over a public Wi-Fi hot spot?
  
  HTTPS is secure enough to guard against your average snoop, but not really if the snoops are the government.
  
  However, you have to be carefull, because a lot of HTTPS pages have content embedded that is NOT secured with HTTPS. You can spot this by looking at the padlock in the address bar.
  
  Also relying on HTTPS alone is dangerous because while surfing you might forget to check it and find yourself logged in someeher without https (and then it's too late).
  
  So your best bet is to ALWAYS use a VPN (especially when on a wifi hotspot).
  
  1 0
Tuesday 11th March 2014 12:29 GMT AOD

Home routers that offer VPN access

I'm doing this with my Asus RT-N16 which although only supporting 2.4Ghz Wireless N connections, allows me to VPN to the interwebs via my home connection.

I've got it setup on the iPhone, the W7 lappies and the Nexus 7 as well. A doddle to setup.

If I want to do anything like online banking over an untrusted wifi connection, on goes the VPN.

0 0
Wednesday 12th March 2014 09:24 GMT Anonymous Coward

Firesheep is so passé

All the cool kids use Interceptor-NG on android. That can hijack way more than Firesheep and probably serves as a better example of the problem here.

Why has nobody mentioned rogue hotspots. They are probably more common than skiddies running sniffers.

0 0
Monday 17th March 2014 17:57 GMT Acumen

Threatspike

Iv'e always used free VPN from Threatspike.

0 0