Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Wi-Fi Woes Continue To Plague Infosec
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Ninja
4/30/2015 | 11:29:23 PM
Re: Wi-Fi Woes
At the same time, there's no denying that many people rely upon these free and open Wi-Fi spots.

In Bermuda, for instance, many of the locals don't have a home Internet connection -- and instead rely upon public Wi-Fi spots.

And even here in the US, I know a number of people who forgo Internet at home and save money by going to Starbucks or McDonald's or the like with their laptops or tablets.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
4/30/2015 | 11:27:16 PM
Re: Should Mobile Phones Act Like Personal Computers?
Of course, to be fair, most major tech products were not originally designed for security and privacy.  Things like mobile phones and Wi-Fi are, simply, lagging in these respects...
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
4/30/2015 | 10:16:27 PM
Re: Should Mobile Phones Act Like Personal Computers?
After rolling around this discussion on Hacker News, I realized I should clarify:

I'm referring to stacks and protocols and function in the PC-phone comparison, not usability. From the perspective of having an OS, TCP/IP stack, wireless connectivity and access to the Internet via a web browser, you'd be hard-pressed to identify the PC from the phone in a functional diagram from which the label for the device was removed. Here is where the "mimic" of PC architecture comes in, not so much in how easy it is to access the file system, so forth. Sure, I realize even if there is an argument here, it's loose at first. I do believe there needs to be more separation, however, between how "we do" PC and how we do phone.

It's been noted that to change phone architecture, to write new protocols and new software and somehow still get users to the Internet, it would either cost a ton of money, or be wrought with security holes due to integrating such a brand-new ecosystem into our current one.  Perhaps, but without taking risks on new tech...
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
4/30/2015 | 5:18:45 PM
Should Mobile Phones Act Like Personal Computers?
The Electronic Frontier Foundation (EFF) notes on their report The Problem With Mobile Phones "mobile phones were not designed for privacy and security".  While the report is mostly focused on the wide varieties of mobile phone tracking (from GPS to wireless access), it illuminates perhaps the root of the issue noted in this DarkReading article:  Mobile phones now mimic personal computers, and it begs the question: Why?

For such a ubiquitous device that holds so much personal data and is portable in ways laptops will never be, one wonders why we are designing mobiles to be just like tiny laptops with all the same protocols, applications and OS APIs.  First, sure, it's easy, but who ever heard of an old-school phone dying from a DDoS attack?  Or, being taken over by malware and every contact, password and account login sent to the Maldives for quick smash-and-grab sessions against bank accounts and so forth?

Maybe the intrinsic issue is really that we are still doing the "make it smaller" thing with tech and calling that innovation instead of "make it different" which out of the box often comes with intrinsic security of its own for actually being different.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
4/30/2015 | 12:49:10 PM
Re: Trust and Paying Attention to the Signs
Have you never seen a commercial whether it be optimum, verizon, etc advertising mobile hotspots? I see them all the time. Also, maybe not as prevalent in airports as I pointed out earlier but many places advertise in the stores the availability of wifi. Unfortunately, unlike the ISP mobile spots these are normally not authenticated against.... I think this is where the majority of change needs to take place. Easily correlated SSIDs coupled with authentication.
tekedge
50%
50%
tekedge,
User Rank: Apprentice
4/30/2015 | 12:03:24 PM
Wi-Fi Woes
It is really a nightmare to think about the havoc such a breach can cross. There are signs of a secure wifi network that the users can be aware of ! But many publicly open wifi hot spots are still danger zones and we have to beware. 
Broadway0474
50%
50%
Broadway0474,
User Rank: Apprentice
4/30/2015 | 12:00:55 PM
Re: Trust and Paying Attention to the Signs
Ryan, I would be interested to see any statistics out there on how many airport hotspots and other such public Wi-Fis have the positive signs that you so rightly point out. I would assume that most do not. I just came from an airport (no need to name names) where no password was required. I work at an employer where the whole campus is wireless, and I am not sure I feel 100% safe there either, considering that 20,000+ people on said campus can access it.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
4/30/2015 | 9:05:22 AM
Trust and Paying Attention to the Signs
Like many things this instance comes back to trust. You need to trust the initiate of your wifi connection and pay attention to the signs. The signs piece is two-fold. Negative signs be wary of non-password protected hotspots with indecipherable SSID's. Positive signs could in this case be literal signs. An airport posting free-wifi with passcode, tv commercial stating that wireless hotspots are all over the city for x customers. These customers would need to authenticate. Places like airports and ISP's among other places that genuinely want customer business are trusted initiates and this trust should be considered when connecting wirelessly.


COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/14/2020
Lock-Pickers Face an Uncertain Future Online
Seth Rosenblatt, Contributing Writer,  8/10/2020
Hacking It as a CISO: Advice for Security Leadership
Kelly Sheridan, Staff Editor, Dark Reading,  8/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 New Cybersecurity Vulnerabilities That Could Put Your Enterprise at Risk
In this Dark Reading Tech Digest, we look at the ways security researchers and ethical hackers find critical vulnerabilities and offer insights into how you can fix them before attackers can exploit them.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7700
PUBLISHED: 2020-08-14
All versions of phpjs are vulnerable to Prototype Pollution via parse_str.
CVE-2020-7701
PUBLISHED: 2020-08-14
madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.
CVE-2020-9228
PUBLISHED: 2020-08-14
FusionCompute 8.0.0 has an information disclosure vulnerability. Due to the properly protection of certain information, attackers may exploit this vulnerability to obtain certain information.
CVE-2020-9229
PUBLISHED: 2020-08-14
FusionCompute 8.0.0 has an information disclosure vulnerability. Due to the properly protection of certain information, attackers may exploit this vulnerability to obtain certain information.
CVE-2019-19643
PUBLISHED: 2020-08-14
ise smart connect KNX Vaillant 1.2.839 contain a Denial of Service.