Re: Strange SSID in the air...



Jeff Liebermann wrote:
Aloke Prasad <aprasad123@xxxxxxxxxxxxxxxxxxxxxxx> hath wroth:

How would one get a boatfull of viruses simply by using an unsecured network?

Sigh. If I tell you how it can be done, everyone and his brother, the
script kiddie, is going to be doing the same thing. I really don't
want to be responsible for all the damage that can be done and this is
not the proper place to be discussing exploits in detail.

However, I'll give you a general clue. Think about URL redirection
(splash page) in the router pointing to a rouge web site or server.
Also, open shares. Remember, that since *YOUR* router is now owned by
the evil hacker, there's much more than can be done than on some
random web site on the internet. In effect, the evil router is the
"man in the middle".

URL redirection: will some of the anti-phishing features in Firefox or IE7 help in this case? This is a serious problem if people are unable to detect this on public network.

How can I verify if any of this is happening on my home network (with the cable modem assigning Gateway+DNS to the Linksys router etc.)?

....
If I disable file and printer sharing, enable Windows firewall, and use an updated antivirus, will I be safe when using public Wi-Fi networks?

That covers about 80% of the possible attacks. It will not protect
you against phishing (counterfeit web sites), password sniffing (in
the router), simple trickery, DNS redirection, or a few other things I
don't wanna get into. Again, remember that the evil hacker owns
*YOUR* router (or rather the router that you're using). That opens up
many possibilities.

Is the "Evil hacker owning the router" scenario applicable for public routers at airports, Starbucks etc?While those are administered by professionals (I hope), I suppose it is safest to assume that they could be compromised.

How do I detect password sniffing in the (public) router? I'm assuming that this will not happen on my home router (WRT54GS). What about my ISP's router? How do I detect password sniffing in general?

My question is basically: If I simply connect to such a network, will my laptop automatically get filled with virus/spyware etc? or do I have to do something stupid while using the network to allow this occur?

You are probably safe with the security measures mentioned against
everything except password sniffing and faked web sites. In the case
of password sniffing, you don't have to do anything. In the case of
fake web sites, you have to click on something. I don't really want
to describe what my customer did to get a bunch of viruses (actually a
downloader) installed. I'm afraid many of us would have done the same
thing.

What If I save a bunch of bookmarks (like the bank's login page) with IP addresses instead of domain names. I bet the IP addresses of commercial pages don't change that often.

Password sniffing has me worried, though. How to detect/deal with that?

Aloke
--
remove the numbers and invalid to e-mail me
.

Relevant Pages

  • Re: Strange SSID in the air...
    ... in the router pointing to a rouge web site or server. ... do something stupid while using the network to allow this occur? ... everything except password sniffing and faked web sites. ...
    (alt.internet.wireless)
  • ~~~~~~~~~~~~~~ IP ADDRESS ~~~~~~~~~~~~~~
    ... block my ip address vista windows ... change public ip address linksys router ... setting up a network ip address ... warcraft server ip address ...
    (sci.misc)
  • Re: Using Remote Desktop From an SBS Domain
    ... After I thought about needing 3389 forwarded on my router to allow me to ... Remote Desktop "out" from a workstation on my SBS network to a host XP ... Hopefully next week I can attempt a connection while my ISP watches the ...
    (microsoft.public.windows.server.sbs)
  • Re: Linksys NAS200 Network Storage adapter
    ... The only two wireless network settings that are of any consequence are the SSID and the encryption method and password. ... either click the "Print Network Settings" button on the final screen of the Wizard or simply access the appropriate XML file and get at them that way and then use the information to configure the router manually as I explained earlier. ... I've read thru some of the MS web site on that product and it appears to do everything a NAS will do plus other cool features, such as, with an xbox360 with the wireless adapter, I can stream my video/pics to my TV for family viewing. ...
    (microsoft.public.windowsxp.network_web)
  • Re: OSPF routes not in routing table
    ... Here's the output of "sh ip ospf database router", ... "(Link Data) Router Interface address: ... Link connected to: a Stub Network ... Number of TOS metrics: 0 ...
    (comp.dcom.sys.cisco)