Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Wi-Fi Woes Continue To Plague Infosec
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
4/30/2015 | 11:29:23 PM
Re: Wi-Fi Woes
At the same time, there's no denying that many people rely upon these free and open Wi-Fi spots.

In Bermuda, for instance, many of the locals don't have a home Internet connection -- and instead rely upon public Wi-Fi spots.

And even here in the US, I know a number of people who forgo Internet at home and save money by going to Starbucks or McDonald's or the like with their laptops or tablets.
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
4/30/2015 | 11:27:16 PM
Re: Should Mobile Phones Act Like Personal Computers?
Of course, to be fair, most major tech products were not originally designed for security and privacy.  Things like mobile phones and Wi-Fi are, simply, lagging in these respects...
RetiredUser
RetiredUser,
User Rank: Ninja
4/30/2015 | 10:16:27 PM
Re: Should Mobile Phones Act Like Personal Computers?
After rolling around this discussion on Hacker News, I realized I should clarify:

I'm referring to stacks and protocols and function in the PC-phone comparison, not usability. From the perspective of having an OS, TCP/IP stack, wireless connectivity and access to the Internet via a web browser, you'd be hard-pressed to identify the PC from the phone in a functional diagram from which the label for the device was removed. Here is where the "mimic" of PC architecture comes in, not so much in how easy it is to access the file system, so forth. Sure, I realize even if there is an argument here, it's loose at first. I do believe there needs to be more separation, however, between how "we do" PC and how we do phone.

It's been noted that to change phone architecture, to write new protocols and new software and somehow still get users to the Internet, it would either cost a ton of money, or be wrought with security holes due to integrating such a brand-new ecosystem into our current one.  Perhaps, but without taking risks on new tech...
RetiredUser
RetiredUser,
User Rank: Ninja
4/30/2015 | 5:18:45 PM
Should Mobile Phones Act Like Personal Computers?
The Electronic Frontier Foundation (EFF) notes on their report The Problem With Mobile Phones "mobile phones were not designed for privacy and security".  While the report is mostly focused on the wide varieties of mobile phone tracking (from GPS to wireless access), it illuminates perhaps the root of the issue noted in this DarkReading article:  Mobile phones now mimic personal computers, and it begs the question: Why?

For such a ubiquitous device that holds so much personal data and is portable in ways laptops will never be, one wonders why we are designing mobiles to be just like tiny laptops with all the same protocols, applications and OS APIs.  First, sure, it's easy, but who ever heard of an old-school phone dying from a DDoS attack?  Or, being taken over by malware and every contact, password and account login sent to the Maldives for quick smash-and-grab sessions against bank accounts and so forth?

Maybe the intrinsic issue is really that we are still doing the "make it smaller" thing with tech and calling that innovation instead of "make it different" which out of the box often comes with intrinsic security of its own for actually being different.
RyanSepe
RyanSepe,
User Rank: Ninja
4/30/2015 | 12:49:10 PM
Re: Trust and Paying Attention to the Signs
Have you never seen a commercial whether it be optimum, verizon, etc advertising mobile hotspots? I see them all the time. Also, maybe not as prevalent in airports as I pointed out earlier but many places advertise in the stores the availability of wifi. Unfortunately, unlike the ISP mobile spots these are normally not authenticated against.... I think this is where the majority of change needs to take place. Easily correlated SSIDs coupled with authentication.
tekedge
tekedge,
User Rank: Apprentice
4/30/2015 | 12:03:24 PM
Wi-Fi Woes
It is really a nightmare to think about the havoc such a breach can cross. There are signs of a secure wifi network that the users can be aware of ! But many publicly open wifi hot spots are still danger zones and we have to beware. 
Broadway0474
Broadway0474,
User Rank: Apprentice
4/30/2015 | 12:00:55 PM
Re: Trust and Paying Attention to the Signs
Ryan, I would be interested to see any statistics out there on how many airport hotspots and other such public Wi-Fis have the positive signs that you so rightly point out. I would assume that most do not. I just came from an airport (no need to name names) where no password was required. I work at an employer where the whole campus is wireless, and I am not sure I feel 100% safe there either, considering that 20,000+ people on said campus can access it.
RyanSepe
RyanSepe,
User Rank: Ninja
4/30/2015 | 9:05:22 AM
Trust and Paying Attention to the Signs
Like many things this instance comes back to trust. You need to trust the initiate of your wifi connection and pay attention to the signs. The signs piece is two-fold. Negative signs be wary of non-password protected hotspots with indecipherable SSID's. Positive signs could in this case be literal signs. An airport posting free-wifi with passcode, tv commercial stating that wireless hotspots are all over the city for x customers. These customers would need to authenticate. Places like airports and ISP's among other places that genuinely want customer business are trusted initiates and this trust should be considered when connecting wirelessly.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Incorporating a Prevention Mindset into Threat Detection and Response
Threat detection and response systems, by definition, are reactive because they have to wait for damage to be done before finding the attack. With a prevention-mindset, security teams can proactively anticipate the attacker's next move, rather than reacting to specific threats or trying to detect the latest techniques in real-time. The report covers areas enterprises should focus on: What positive response looks like. Improving security hygiene. Combining preventive actions with red team efforts.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-1268
PUBLISHED: 2022-05-23
The Donate Extra WordPress plugin through 2.02 does not sanitise and escape a parameter before outputting it back in the response, leading to a Reflected cross-Site Scripting
CVE-2022-1298
PUBLISHED: 2022-05-23
The Tabs WordPress plugin before 2.2.8 does not sanitise and escape Tab descriptions, which could allow high privileged users with a role as low as editor to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVE-2022-1320
PUBLISHED: 2022-05-23
The Sliderby10Web WordPress plugin before 1.2.52 does not properly sanitize and escape some of its settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVE-2022-1547
PUBLISHED: 2022-05-23
The Check & Log Email WordPress plugin before 1.0.6 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
CVE-2022-1558
PUBLISHED: 2022-05-23
The Curtain WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed