Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Wi-Fi Woes Continue To Plague Infosec
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
4/30/2015 | 11:29:23 PM
Re: Wi-Fi Woes
At the same time, there's no denying that many people rely upon these free and open Wi-Fi spots.

In Bermuda, for instance, many of the locals don't have a home Internet connection -- and instead rely upon public Wi-Fi spots.

And even here in the US, I know a number of people who forgo Internet at home and save money by going to Starbucks or McDonald's or the like with their laptops or tablets.
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
4/30/2015 | 11:27:16 PM
Re: Should Mobile Phones Act Like Personal Computers?
Of course, to be fair, most major tech products were not originally designed for security and privacy.  Things like mobile phones and Wi-Fi are, simply, lagging in these respects...
User Rank: Ninja
4/30/2015 | 10:16:27 PM
Re: Should Mobile Phones Act Like Personal Computers?
After rolling around this discussion on Hacker News, I realized I should clarify:

I'm referring to stacks and protocols and function in the PC-phone comparison, not usability. From the perspective of having an OS, TCP/IP stack, wireless connectivity and access to the Internet via a web browser, you'd be hard-pressed to identify the PC from the phone in a functional diagram from which the label for the device was removed. Here is where the "mimic" of PC architecture comes in, not so much in how easy it is to access the file system, so forth. Sure, I realize even if there is an argument here, it's loose at first. I do believe there needs to be more separation, however, between how "we do" PC and how we do phone.

It's been noted that to change phone architecture, to write new protocols and new software and somehow still get users to the Internet, it would either cost a ton of money, or be wrought with security holes due to integrating such a brand-new ecosystem into our current one.  Perhaps, but without taking risks on new tech...
User Rank: Ninja
4/30/2015 | 5:18:45 PM
Should Mobile Phones Act Like Personal Computers?
The Electronic Frontier Foundation (EFF) notes on their report The Problem With Mobile Phones "mobile phones were not designed for privacy and security".  While the report is mostly focused on the wide varieties of mobile phone tracking (from GPS to wireless access), it illuminates perhaps the root of the issue noted in this DarkReading article:  Mobile phones now mimic personal computers, and it begs the question: Why?

For such a ubiquitous device that holds so much personal data and is portable in ways laptops will never be, one wonders why we are designing mobiles to be just like tiny laptops with all the same protocols, applications and OS APIs.  First, sure, it's easy, but who ever heard of an old-school phone dying from a DDoS attack?  Or, being taken over by malware and every contact, password and account login sent to the Maldives for quick smash-and-grab sessions against bank accounts and so forth?

Maybe the intrinsic issue is really that we are still doing the "make it smaller" thing with tech and calling that innovation instead of "make it different" which out of the box often comes with intrinsic security of its own for actually being different.
User Rank: Ninja
4/30/2015 | 12:49:10 PM
Re: Trust and Paying Attention to the Signs
Have you never seen a commercial whether it be optimum, verizon, etc advertising mobile hotspots? I see them all the time. Also, maybe not as prevalent in airports as I pointed out earlier but many places advertise in the stores the availability of wifi. Unfortunately, unlike the ISP mobile spots these are normally not authenticated against.... I think this is where the majority of change needs to take place. Easily correlated SSIDs coupled with authentication.
User Rank: Apprentice
4/30/2015 | 12:03:24 PM
Wi-Fi Woes
It is really a nightmare to think about the havoc such a breach can cross. There are signs of a secure wifi network that the users can be aware of ! But many publicly open wifi hot spots are still danger zones and we have to beware. 
User Rank: Apprentice
4/30/2015 | 12:00:55 PM
Re: Trust and Paying Attention to the Signs
Ryan, I would be interested to see any statistics out there on how many airport hotspots and other such public Wi-Fis have the positive signs that you so rightly point out. I would assume that most do not. I just came from an airport (no need to name names) where no password was required. I work at an employer where the whole campus is wireless, and I am not sure I feel 100% safe there either, considering that 20,000+ people on said campus can access it.
User Rank: Ninja
4/30/2015 | 9:05:22 AM
Trust and Paying Attention to the Signs
Like many things this instance comes back to trust. You need to trust the initiate of your wifi connection and pay attention to the signs. The signs piece is two-fold. Negative signs be wary of non-password protected hotspots with indecipherable SSID's. Positive signs could in this case be literal signs. An airport posting free-wifi with passcode, tv commercial stating that wireless hotspots are all over the city for x customers. These customers would need to authenticate. Places like airports and ISP's among other places that genuinely want customer business are trusted initiates and this trust should be considered when connecting wirelessly.

I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
Black Hat USA 2022 Attendee Report
Black Hat attendees are not sleeping well. Between concerns about attacks against cloud services, ransomware, and the growing risks to the global supply chain, these security pros have a lot to be worried about. Read our 2022 report to hear what they're concerned about now.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2022-08-07
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set.
PUBLISHED: 2022-08-06
Foxit PDF Reader before 12.0.1 and PDF Editor before 12.0.1 allow a NULL pointer dereference when this.Span is used for oState of Collab.addStateModel, because this.Span.text can be NULL.
PUBLISHED: 2022-08-06
Foxit PDF Reader before 12.0.1 and PDF Editor before 12.0.1 allow an exportXFAData NULL pointer dereference.
PUBLISHED: 2022-08-06
A vulnerability was found in SourceCodester Expense Management System. It has been rated as critical. This issue affects the function fetch_report_credit of the file report.php of the component POST Parameter Handler. The manipulation of the argument from/to leads to sql injection. The attack may be...
PUBLISHED: 2022-08-06
A vulnerability classified as problematic has been found in SourceCodester Wedding Hall Booking System. Affected is an unknown function of the file /whbs/?page=contact_us of the component Contact Page. The manipulation of the argument Message leads to cross site scripting. It is possible to launch t...