Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Wi-Fi Woes Continue To Plague Infosec
Threaded  |  Newest First  |  Oldest First
RyanSepe
RyanSepe,
User Rank: Ninja
4/30/2015 | 9:05:22 AM
Trust and Paying Attention to the Signs
Like many things this instance comes back to trust. You need to trust the initiate of your wifi connection and pay attention to the signs. The signs piece is two-fold. Negative signs be wary of non-password protected hotspots with indecipherable SSID's. Positive signs could in this case be literal signs. An airport posting free-wifi with passcode, tv commercial stating that wireless hotspots are all over the city for x customers. These customers would need to authenticate. Places like airports and ISP's among other places that genuinely want customer business are trusted initiates and this trust should be considered when connecting wirelessly.
Broadway0474
Broadway0474,
User Rank: Apprentice
4/30/2015 | 12:00:55 PM
Re: Trust and Paying Attention to the Signs
Ryan, I would be interested to see any statistics out there on how many airport hotspots and other such public Wi-Fis have the positive signs that you so rightly point out. I would assume that most do not. I just came from an airport (no need to name names) where no password was required. I work at an employer where the whole campus is wireless, and I am not sure I feel 100% safe there either, considering that 20,000+ people on said campus can access it.
RyanSepe
RyanSepe,
User Rank: Ninja
4/30/2015 | 12:49:10 PM
Re: Trust and Paying Attention to the Signs
Have you never seen a commercial whether it be optimum, verizon, etc advertising mobile hotspots? I see them all the time. Also, maybe not as prevalent in airports as I pointed out earlier but many places advertise in the stores the availability of wifi. Unfortunately, unlike the ISP mobile spots these are normally not authenticated against.... I think this is where the majority of change needs to take place. Easily correlated SSIDs coupled with authentication.
tekedge
tekedge,
User Rank: Apprentice
4/30/2015 | 12:03:24 PM
Wi-Fi Woes
It is really a nightmare to think about the havoc such a breach can cross. There are signs of a secure wifi network that the users can be aware of ! But many publicly open wifi hot spots are still danger zones and we have to beware. 
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
4/30/2015 | 11:29:23 PM
Re: Wi-Fi Woes
At the same time, there's no denying that many people rely upon these free and open Wi-Fi spots.

In Bermuda, for instance, many of the locals don't have a home Internet connection -- and instead rely upon public Wi-Fi spots.

And even here in the US, I know a number of people who forgo Internet at home and save money by going to Starbucks or McDonald's or the like with their laptops or tablets.
RetiredUser
RetiredUser,
User Rank: Ninja
4/30/2015 | 5:18:45 PM
Should Mobile Phones Act Like Personal Computers?
The Electronic Frontier Foundation (EFF) notes on their report The Problem With Mobile Phones "mobile phones were not designed for privacy and security".  While the report is mostly focused on the wide varieties of mobile phone tracking (from GPS to wireless access), it illuminates perhaps the root of the issue noted in this DarkReading article:  Mobile phones now mimic personal computers, and it begs the question: Why?

For such a ubiquitous device that holds so much personal data and is portable in ways laptops will never be, one wonders why we are designing mobiles to be just like tiny laptops with all the same protocols, applications and OS APIs.  First, sure, it's easy, but who ever heard of an old-school phone dying from a DDoS attack?  Or, being taken over by malware and every contact, password and account login sent to the Maldives for quick smash-and-grab sessions against bank accounts and so forth?

Maybe the intrinsic issue is really that we are still doing the "make it smaller" thing with tech and calling that innovation instead of "make it different" which out of the box often comes with intrinsic security of its own for actually being different.
RetiredUser
RetiredUser,
User Rank: Ninja
4/30/2015 | 10:16:27 PM
Re: Should Mobile Phones Act Like Personal Computers?
After rolling around this discussion on Hacker News, I realized I should clarify:

I'm referring to stacks and protocols and function in the PC-phone comparison, not usability. From the perspective of having an OS, TCP/IP stack, wireless connectivity and access to the Internet via a web browser, you'd be hard-pressed to identify the PC from the phone in a functional diagram from which the label for the device was removed. Here is where the "mimic" of PC architecture comes in, not so much in how easy it is to access the file system, so forth. Sure, I realize even if there is an argument here, it's loose at first. I do believe there needs to be more separation, however, between how "we do" PC and how we do phone.

It's been noted that to change phone architecture, to write new protocols and new software and somehow still get users to the Internet, it would either cost a ton of money, or be wrought with security holes due to integrating such a brand-new ecosystem into our current one.  Perhaps, but without taking risks on new tech...
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
4/30/2015 | 11:27:16 PM
Re: Should Mobile Phones Act Like Personal Computers?
Of course, to be fair, most major tech products were not originally designed for security and privacy.  Things like mobile phones and Wi-Fi are, simply, lagging in these respects...


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Practical Network Security Approaches for a Multicloud, Hybrid IT World
The report covers areas enterprises should focus on for their multicloud/hybrid cloud security strategy: -increase visibility over the environment -learning cloud-specific skills -relying on established security frameworks -re-architecting the network
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-30333
PUBLISHED: 2022-05-09
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.
CVE-2022-23066
PUBLISHED: 2022-05-09
In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the result of a sdiv instruction may decide whether to tra...
CVE-2022-28463
PUBLISHED: 2022-05-08
ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
CVE-2022-28470
PUBLISHED: 2022-05-08
marcador package in PyPI 0.1 through 0.13 included a code-execution backdoor.
CVE-2022-1620
PUBLISHED: 2022-05-08
NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 allows attackers to cause a denial of service (application crash) via a crafted input.