WiFi-WPA2 security issue. Kinda important.

[Wabbit]

Tons of articles on this, just linking this one. This is a pretty big deal, especially for mobile users.

https://www.wired.com/story/krack-wi-fi-wpa2-vulnerability/

From the article...

"A flaw in WPA2's cryptographic protocols could be exploited to read and steal data that would otherwise be protected, according to new research from security researcher Mathy Vanhoef of KU Leuven in Belgium. In some situations, the vulnerability even leaves room for an attacker to manipulate data on a Wi-Fi network, or inject new data in. In practice, that means hackers could steal your passwords, intercept your financial data, or even manipulate commands to, say, send your money to themselves."

My thoughts, first one to say, "oh this is no big deal, ignore the fear mongering", gets the label of ignoramus and 42 lashes with a wet noodle. Look into it and get your devices patched. Read the article and maybe a few more on this specific issue.

 

[RVTravel]

"Now for some somewhat settling news: Iron Group CTO Alex Hudson says an attacker needs to be on the same Wi-Fi network as you in order to carry out any nefarious plans with KRACK. “You’re not suddenly vulnerable to everyone on the internet,” he says."

 

[SoulRaven]

Thanks,  Wabbit,  for bringing this up.

I still want to do more research. 


Pat

 

[frater secessus]

The article overstates the danger, which is to say it fearmongers.  Financial data and stuff like that is encrypted end-to-end from your browser to the server, quite unrelated to anything happening on the wifi network.

For onlookers:

1. treat all wifi networks as if they are open (not encrypted)
2. see my previous posts about open wifi points as being a non-issue when connecting to https sites
3. see my previous warnings against believing your cellphone data is magically secure
4. read level-headed and informed analysis

I admit the possibility that I'm an ignoramus.  It's also a possibility that I am well-informed and have relevant experience in crypto and wifi pentesting.  For context:  I  have (deprecated) keypairs and CYPHERPUNKS posts older than some forum members.  I'm connected to the 'net through an encrypted tunnel right now.

 

[Wabbit]

...  I'm connected to the 'net through an encrypted tunnel right now...

I don't know if you think this is the "norm", but many people prob don't even know what that means. Great for you, but what about everyone else. VPN's are not the norm for most mobile users.

 

[tx2sturgis]

Ok...then I guess we don't even wanna talk about the Tor browser....

:dodgy:

But...hey if anyone (frater maybe?) knows how to make the Tor browser show a selected destination point (like a certain country) rather than a RANDOM destination point, let me know...

 

[frater secessus]

I don't know if you think this is the "norm", but many people prob don't even know what that means. Great for you, but what about everyone else. VPN's are not the norm for most mobile users.

I don't think it's the norm, which is why it was in the "I know what I'm talking about" section, not the "why the article was fearmongering section".

 

[frater secessus]

But...hey if anyone (frater maybe?) knows how to make the Tor browser show a selected destination point (like a certain country) rather than a RANDOM destination point, let me know...

Edit the torrc with the country code of the exit node location you want:

ExitNodes {ca},{cn},{fr},{whatever}

I don't think it's a great idea.  If you are on the The List, dramatically limiting your exit points could make network analysis easier.  

Might be a better idea to exclude countries known to collude with Three Letter Agencies:

ExcludeExitNodes {us},{uk},{gb},{whatever}

Those are examples only, not my opinion on who's doing what and where.

 

[blars]

IMHO the main problem is someone could use your access point without you knowing, racking up overage charges or running out your limited "unlimited" cell bandwidth. Illegal activity traced back to your AP is also a possibility.

 

[frater secessus]

Depending on some esoteric details, the attacker can decrypt encrypted traffic and, in some cases, inject traffic onto the network.

But in none of these cases can the attacker join the network completely.

...from the Shneier article I linked to earlier.  Bruce is the globally recognized authority on cryptosystem security.

 

[Wabbit]

I don't think it's the norm, which is why it was in the "I know what I'm talking about" section, not the "why the article was fearmongering section".

Was hungover, read it wrong, i didn't mean to be so grumpy. I'll give myself 42 lashes with a wet noodle. I'm sorry for being like that with you.

 

[MikeRuth]

personally and as a person who makes their living repairing PC's I don't see this as much of a problem as it's made out to be. Not saying it isn't but for me and a lot of folks it takes someone who wants to get on your network to exploit this.
Now as I still live in Sticks and bricks I only need to look at 1, my neighbors and 2, who's sitting in that car, truck etc in front of my house?
I know my neighbors are not savy enough to even have the slightest clue as to go about hacking my wifi. And as for the person in front of my home> Like anyone if some stranger is hanging out your going to investigate or call the cops.

As for public places, I know for Windows PC's you can tell the PC that your on a public network and this really does toughen things up, and of course the hacker needs sometime to get in and or on. Not sure about Apple as I don't support them. Due prudence on a public network is advised irregardless. I personally wouldn't be doing my on line banking on a public network.

Mike R

 

[shadowmoss]

With our mobile hotspots this is a bigger issue. I had a 'buddy' in the last place I parked. It was in an RV park near local and county government offices. Either the person wanted some free wifi, or thought I had government access or something else. Whenever I turned one hotspot on, within 2 minutes there was 1 more device connected, and android, than I personally had on at the time. My main issue was that I had forgotten my admin password. I wanted to track them down to ask them what the heck my pw was. With insight from jimindenver, I was able to get into admin and found I couldn't lock it down to only 1 connection at a time (the Verizon 3g hotspot). Luckily I also have the mobley and it does let me lock it down, so I quit using that hotspot.

I had a friend a few years ago who bragged that he and his boating friends would jump on shore wifi spots. There is hacking software that intercepts the handshake signals. This is when the devices send info back and forth to verify who it is. I have not gotten up to date on current devices, but it seems that these handshakes are not encrypted in most instances? So all someone has to do is monitor this traffice between devices, grab the pw, and they can jump on your local network. The only way I could come up with to foil it was a hardwired connection, but I was in my sticks and bricks at the time with a router I could plug my devices into.

I keep an eye on how many connections are on my hotspots. Especially if I'm parked around others.

 

[sreesekelley]

Maybe it's changed but computers used to put out rf that could be used to see every keystroke you made without being physically attached to you network. I've seen computers with metal cages around them to prevent this in top secret locations. In my experience people hack computers for money or the way to make money, (blackmail or stealing corporate or government secrets). malicious use involved using another's data stream for illegal purposes like pornography or setting up malicious denial of service attacks. The only hard and fast rule is if you connect to the internet you could have problems. the more unsecure the connection the greater the risk. Ransomware is now a common thing and a big headache for corporate or government networks. I always advised folks to think like they already had an intruder and monitor their behavior accordingly. use very strong phrase based passwords for anything financial related. On a government network I worked on once the password was 'overworkedandunderpaid'. easy to remember but hard to pick out of a data stream and difficult to crack. personally I use a password word manager that creates and stores my passwords encrypted and if I forget the master password even I can't get them back. I also use programs like scotty the watchdog that prevent any changes to my registry that I don't personally approve.. Microsoft still hasn't been able to installed onedrive on my machine computer security is a constantly changing field and even large companies with big IT departments and big budgets have trouble staying on top. Just think back to how many stores you know of that have reported hacks of sensitive customer data in the past few years. target, home depot, equifax etc etc. If my bank doesn't recognize my IP address it sends me a pin number in a text msg that has to be entered along with the correct password. I could go on and on but I won't

 

[SoulRaven]

 I could go on and on but I won't

Ah, heck. ... dont be shy!

Go ahead. 



Pat

 

[sreesekelley]

Ah, heck. ... dont be shy!

Go ahead. 



Pat

ask me about computer security at the rtr.  I'll tell you every lie I know

 

[blmkid]

T"A flaw in WPA2's cryptographic protocols could be exploited to read and steal data that would otherwise be protected, according to new research from security researcher Mathy Vanhoef of KU Leuven in Belgium. In some situations, the vulnerability even leaves room for an attacker to manipulate data on a Wi-Fi network, or inject new data in. In practice, that means hackers could steal your passwords, intercept your financial data, or even manipulate commands to, say, send your money to themselves."

The article overstates the danger, which is to say it fearmongers.  Financial data and stuff like that is encrypted end-to-end from your browser to the server, quite unrelated to anything happening on the wifi network.

For onlookers:

1. treat all wifi networks as if they are open (not encrypted)
2. see my previous posts about open wifi points as being a non-issue when connecting to https sites
3. see my previous warnings against believing your cellphone data is magically secure
4. read level-headed and informed analysis

I admit the possibility that I'm an ignoramus.  It's also a possibility that I am well-informed and have relevant experience in crypto and wifi pentesting.  For context:  I  have (deprecated) keypairs and CYPHERPUNKS posts older than some forum members.  I'm connected to the 'net through an encrypted tunnel right now.

I don't know if you think this is the "norm", but many people prob don't even know what that means. Great for you, but what about everyone else. VPN's are not the norm for most mobile users.

Ok...then I guess we don't even wanna talk about the Tor browser....

:dodgy:

But...hey if anyone (frater maybe?) knows how to make the Tor browser show a selected destination point (like a certain country) rather than a RANDOM destination point, let me know...

Edit the torrc with the country code of the exit node location you want:

ExitNodes {ca},{cn},{fr},{whatever}

I don't think it's a great idea.  If you are on the The List, dramatically limiting your exit points could make network analysis easier.  

Might be a better idea to exclude countries known to collude with Three Letter Agencies:

ExcludeExitNodes {us},{uk},{gb},{whatever}

Those are examples only, not my opinion on who's doing what and where.

ask me about computer security at the rtr.  I'll tell you every lie I know

Huh? Okay. So I'm a dumb
http://www.donkeyheaven.org/uploads/images/Gallery/donkeys/clive.jpg
Can you give me simple english? Shirely, I'm not the only one. So beware of using Mickey D's and other places for wi-fi? Home Depot even?

 

[blmkid]

ask me about computer security at the rtr.  I'll tell you every lie I know

I definitely need some Education on this sreesekelly. What time will class be @ RTR? Should I bring breakfast or lunch?

 

[sreesekelley]

I definitely need some Education on this sreesekelly. What time will class be @ RTR? Should I bring breakfast or lunch?

sorry, a class would imply a schedule for me and even I don't know what my schedule will be.  Casual conversation is a much better venue.  Just look for the white van

 

[blmkid]

a schedule ...

I completely understand that. I try not to make commitment's any more. Only if it's a doctor's appointment.