Maurits Martijn, writing for Medium:
In his backpack, Wouter Slotboom, 34, carries around a small black device, slightly larger than a pack of cigarettes, with an antenna on it…Wouter removes his laptop from his backpack, puts the black device on the table, and hides it under a menu. A waitress passes by and we ask for two coffees and the password for the WiFi network. Meanwhile, Wouter switches on his laptop and device, launches some programs, and soon the screen starts to fill with green text lines. It gradually becomes clear that Wouter’s device is connecting to the laptops, smartphones, and tablets of cafe visitors.
On his screen, phrases like “iPhone Joris” and “Simone’s MacBook” start to appear. The device’s antenna is intercepting the signals that are being sent from the laptops, smartphones, and tablets around us.
Part of this is an education problem, teaching people how to be careful. But it’s foolish to think that any public WiFi connection is safe. It’s just far too easy to spoof trusted networks.
More text starts to appear on the screen. We are able to see which WiFi networks the devices were previously connected to. Sometimes the names of the networks are composed of mostly numbers and random letters, making it hard to trace them to a definite location, but more often than not, these WiFi networks give away the place they belong to.
We learn that Joris had previously visited McDonald’s, probably spent his vacation in Spain (lots of Spanish-language network names), and had been kart-racing (he had connected to a network belonging to a well-known local kart-racing center). Martin, another café visitor, had been logged on to the network of Heathrow airport and the American airline Southwest. In Amsterdam, he’s probably staying at the White Tulip Hostel. He had also paid a visit to a coffee shop called The Bulldog.
Recently, Starbucks changed the process by which you access their network. Now, with their Google partnership in place, you must log in to your Google account to access Starbuck’s Google wireless. This means sending out your Google credentials in a public space.
It’s one thing to provide a free WiFi connection, but another to require you to submit important trusted credentials over the public airwaves in order to get in. There are any number of ways for this to go wrong, including Wouter Slotboom’s black box spoofing a Google wireless hot spot, ready to harvest.
We recently had a presentation of a white hat hacker in our office. The most frightening things he showed (besides hacking Android devices by swiping an NFC card near them) was using a certain wifi access point device that could pretend to be every other access point you’d ever connected to.
Apparently wifi radios on our devices continuously ask access points if they are any of their known networks. If it’s a secured network than our malicious access point can’t complete the security handshake, but if it’s a non-secured network than your device thinks it’s connected to a known network. Chances that your device picks that network are high, since it has an extra high powered signal.
At this point all network traffic goes through the malicious device. This device can than make your browser believe your connecting over secure https connections, but on the background route everything over regular non-encrypted http connections. This makes it very easy to get all the usernames, passwords and data you enter.
Scary stuff. I removed every non-secure network I ever connected to from my devices.
Unless something changed in the last week, I’m pretty sure that the Google/Starbucks partnership doesn’t require Google credentials to actually use. During the captive portal, it offers for you to log in with your Google ones (and Starbucks one to see your card info), but you simply have to Agree and then are connected.
Not trying to sound glib here, but this sloves most of your problems:
http://getcloak.com
Since iOS 7 they have an auto-connect feature for any untrusted networks.
It’s a life saver and worth so much more than the few bucks I pay for it every month.
I intentionally keep the the list of trusted networks low. Only three networks are on that list; networks I set up and secured myself. The rest, even my university’s certificate-enabled, protected network isn’t on that list, because I don’t trust the university’s IT department.
It gets even scarier when you see cell signals intercepted and analysed.
I’m not at a Starbucks to try this out, but even if that is the case, this is not made obvious, and that implicit presentation of two login requests will drive people to provide those credentials. My response was to open my iPad’s hot spot and login through that. Obviously, that option isn’t always (or even mostly) available.
Read Paul Spranger’s comment and the original article. These are the real issues.
As long as your device has not been compromised with malware, then https (a.k.a. SSL) is always secure. You can access your bank account, shop online, use your web-based e-mail, search the web with DuckDuckGo, and do anything else that uses https, and nobody can watch what you’re doing, even if they’re spoofing the local WiFi so you’re really surfing through their computer. That the whole purpose of https.
Many apps (e.g. the iOS App Store) also use SSL or some equivalent, and are similarly invulnerable.
The real problem this reveals is that apps and sites are still not universally requiring encrypted passwords and sessions.
It doesn’t matter much if Mr. Hacker can “see you’re connecting to a site”, if he can’t see what you’re doing, or see your credentials.
(Yes, you should turn off auto-connect, at least for non-WPA2 networks, if the option exists.
But a properly designed service in 2014 should be reasonably secure even on a hostile network.
The only vaguely scary thing in the article was the scanning for OS holes – which means you should keep current. God help you if you run Android.)
Hey kids, don’t forget to turn your bluetooth off when you’re in a public space like that.
Dave, I did check our Paul’s comment and the original article before posting, and fully agree that those are the real issues—especially for users who just jump on any network they see (It amazes me the amount of people that think anything “linksys” is fine) – glad you did share this, since a lot of folks have no idea about security and this gets a conversation started (or continues one for those of us who have been keeping an eye on it for awhile).
“Recently, Starbucks changed the process by which you access their network. Now, with their Google partnership in place, you must log in to your Google account to access Starbuck’s Google wireless. “
I’ve not had to do this in any of the three Google enabled Starbucks in my area. Just an Accept and continue. Same as it ever was.
AS wifi access becomes more insecure, we will need to beef up security to those access points. Since this usually required money, I don’t see public access points changing swiftly.
There will always be those who want to find the weak point in any system. It’s been true as long as I have participated in networks. So, the rule is,
“don’t be trusting. Everyone is out to get you.”
Oh, and make sure you educate yourself on the right security protocol to use when in a situation where you don’t control the network.