- cross-posted to:
- privacy@lemmy.world
- cross-posted to:
- privacy@lemmy.world
You must log in or # to comment.
My solution to this problem is to not have WiFi for a few hours.
Not using http sites on free/accessible wifi is something we should all do
Use a VPN mitigates this doesn’t it?
From the article:
Perhaps curiously, she advocated users of public Wi-Fi should “install a reputable virtual private network (VPN) on your devices to encrypt and secure your data when using the internet.”
Though I’m not sure why “curiously”.
This would only be an interim solution. The attacker here sets up a fake github.com and collects credentials. So, VPN would be first trying to route over some internal hostname/IP address and probably just fail.
However, if everyone uses some VPN, the attacker can start imitating the VPN server. Or all the common ones. Redirect all traffic to a fake myvpnname.com/login with a message “you’re using your device from a suspicious location, please confirm your credentials”. You’re on a plane, so you think this makes sense, punch in your password and it’s gone!
With a VPN, the only real attack vector here is to block the VPN traffic and hope the user disables it or doesn’t notice it didn’t connect. No modern VPN will handshake with a spoofed server so it will just never connect. In some cases, the connection might fail silently enough to fool someone like this, but basically every mainstream app these days is pretty vocal about that for exactly this reason. As of Android 13, the default behavior is never to pass traffic outside the VPN unless the user explicitly turns it off. On other platforms this is dependent on the specific app.
This wouldn’t work. Your VPN would fail to connect because the attacker wouldn’t have the right encryption key. The only way to successfully mimic the VPN provider would be to be there the first time the user installed the VPN software.
Well, depends. If the user go to a captive portal to “authenticate” before the VPN could closes, than no. But, if the VPN can “pierce” through it (without any intervention from the AP), than yes. Anyways, If the user is willing to provide authentication data (like social media accounts, etc), nothing matters.
Oh boy does this mean my ability to get free flight wifi by MAC spoofing is about to go away?
This is the best summary I could come up with:
Australia’s Federal Police (AFP) has charged a man with running a fake Wi-Fi networks on at least one commercial flight and using it to harvest fliers’ credentials for email and social media services.
The man was investigated after an airline “reported concerns about a suspicious Wi-Fi network identified by its employees during a domestic flight.”
The AFP subsequently arrested a man who was found with “a portable wireless access device, a laptop and a mobile phone” in his hand luggage.
It’s alleged the accused’s collection of kit was used to create Wi-Fi hotspots with SSIDs confusingly similar to those airlines operate for in-flight access to the internet or streamed entertainment.
Airport Wi-Fi was also targeted, and the AFP also found evidence of similar activities “at locations linked to the man’s previous employment.”
AFP Western Command Cybercrime detective inspector Andrea Coleman pointed out that free Wi-Fi services should not require logging in through an email or social media account.
The original article contains 364 words, the summary contains 158 words. Saved 57%. I’m a bot and I’m open source!
this is why you absolutely must use a VPN on all wifi hotspots all the time. even in your own home
