ブログはじめました。日本語だと不便です。機能も少ないです。 なのでそのうち他のサービスを探します。ここはとりあえず実験的に。

水曜日, 1月 24, 2024

Mythbusters: Is An Open (Unencrypted) WiFi More Dangerous Than A WPA2-PSK? Actually, It Is Not.

Introduction


Whenever security professionals recommend the 5 most important IT security practices to average users, one of the items is usually something like: "Avoid using open Wifi" or "Always use VPN while using open WiFi" or "Avoid sensitive websites (e.g. online banking) while using open WiFI", etc.

What I think about this? It is bullshit. But let's not jump to the conclusions. Let's analyze all risks and factors here.


During the following analysis, I made two assumptions. The first one is that we are comparing public WiFi hotspots with no encryption at all (referred to as Open), and we compare this to public WiFi hotspots with WPA2-PSK (and just hope WEP died years before). The other assumption is there are people who are security-aware, and those who just don't care. They just want to browse the web, access Facebook, write e-mails, etc.

The risks


Let's discuss the different threats people face using public hotspots, compared to home/work internet usage:
1. Where the website session data is not protected with SSL/TLS (and the cookie is not protected with secure flag), attackers on the same hotspot can obtain the session data and use it in session/login credentials stealing. Typical protocols affected:

  • HTTP sites
  • HTTPS sites but unsecured cookie
  • FTP without encryption
  • IMAP/SMTP/POP3 without SSL/TLS or STARTTLS

2. Attackers can inject extra data into the HTTP traffic, which can be used for exploits, or social engineer attacks (e.g. update Flash player with our malware) – see the Dark Hotel campaign

3. Attackers can use tools like SSLStrip to keep the user's traffic on clear text HTTP and steal password/session data/personal information

4. Attackers can monitor and track user activity

5. Attackers can directly attack the user's machine (e.g. SMB service)

WPA2-PSK security


So, why is a public WPA2-PSK WiFi safer than an open WiFi? Spoiler alert: it is not!

In a generic public WPA2-PSK scenario, all users share the same password. And guess what, the whole traffic can be decrypted with the following information: SSID + shared password + information from the 4-way handshake. https://wiki.wireshark.org/HowToDecrypt802.11
If you want to see it in action, here is a nice tutorial for you
Decrypted WPA2-PSK traffic

Any user having access to the same WPA2-PSK network knows this information. So they can instantly decrypt your traffic. Or the attackers can just set up an access point with the same SSID, same password, and stronger signal. And now, the attacker can instantly launch active man-in-the-middle attacks. It is a common belief (even among ITSEC experts) that WPA2-PSK is not vulnerable to this attack. I am not sure why this vulnerability was left in the protocol, if you have the answer, let me know. Edit (2015-08-03): I think the key message here is that without server authentication (e.g. via PKI), it is not possible to solve this.
Let me link here one of my previous posts here with a great skiddie tool:

To sum up, attackers on a WPA2-PSK network can:

  • Decrypt all HTTP/FTP/IMAP/SMTP/POP3 passwords or other sensitive information
  • Can launch active attacks like SSLStrip, or modify HTTP traffic to include exploit/social engineer attacks
  • Can monitor/track user activity

The only difference between open and WPA2-PSK networks is that an open network can be hacked with an attacker of the skill level of 1 from 10, while the WPA2-PSK network needs and an attacker with a skill level of 1.5. That is the difference.

The real solutions



1. Website owners, service providers should deploy proper (trusted) SSL/TLS infrastructure, protect session cookies, etc. Whenever a user (or security professional) notices a problem with the quality of the service (e.g. missing SSL/TLS), the service provider has to be notified. If no change is made, it is recommended to drop the service provider and choose a more secure one. Users have to use HTTPS Everywhere plugin.

2. Protect the device against exploits by patching the software on it, use a secure browser (Chrome, IE11 + enhanced protection), disable unnecessary plugins (Java, Flash, Silverlight), or at least use it via click-to-play. Also, the use of exploit mitigations tools (EMET, HitmanPro Alert, Malwarebytes AntiExploit) and a good internet security suite is a good idea.

3. Website owners have to deploy HSTS, and optionally include their site in an HSTS preload list

4. Don't click blindly on fake downloads (like fake Flash Player updates)


5. The benefits of a VPN is usually overestimated. A VPN provider is just another provider, like the hotspot provider, or the ISP. They can do the same malicious stuff (traffic injecting, traffic monitoring, user tracking). Especially when people use free VPNs. And "Average Joe" will choose a free VPN. Also, VPN connections tend to be disconnected, and almost none of the VPN providers provide fail secure VPNs. Also, for the price of a good VPN service you can buy a good data plan and use 4G/3G instead of low-quality public hotspots. But besides this, on mobile OSes (Android, iOS, etc.) I strongly recommend the use of VPN, because it is not practically feasible to know for users which app is using SSL/TLS and which is not.

6. Use a location-aware firewall, and whenever the network is not trusted, set it to a Public.

7. In a small-business/home environment, buy a WiFi router with guest WiFi access possibility, where the different passwords can be set to guest networks than used for the other.

Asking the question "Are you using open WiFi?", or "Do you do online banking on open WiFi?" are the wrong questions. The good questions are:
  • Do you trust the operator(s) of the network you are using?
  • Are the clients separated?
  • If clients are not separated, is it possible that there are people with malicious intent on the network?
  • Are you security-aware, and are you following the rules previously mentioned? If you do follow these rules, those will protect you on whatever network you are.

And call me an idiot, but I do online banking, e-shopping, and all the other sensitive stuff while I'm using open WiFi. And whenever I order pizza from an HTTP website, attackers can learn my address. Which is already in the phone book, on Facebook, and in every photo metadata I took with my smartphone about my cat and uploaded to the Internet (http://iknowwhereyourcatlives.com/).


Most articles and research publications are full of FUD about what people can learn from others. Maybe they are just outdated, maybe they are not. But it is totally safe to use Gmail on an open WiFi, no one will be able to read my e-mails.

PS: I know "Average Joe" won't find my blog post, won't start to read it, won't understand half I wrote. But even if they do, they won't patch their browser plugins, pay for a VPN, or check the session cookie. So they are doomed to fail. That's life. Deal with it.

More articles


  1. Hacking Tools For Games
  2. Hack Tools Download
  3. Hacking Tools For Pc
  4. Hacking Tools Free Download
  5. Pentest Tools Kali Linux
  6. Hacker Tools List
  7. Nsa Hack Tools
  8. Hacking Tools Windows
  9. Nsa Hack Tools Download
  10. Hacking App
  11. Hack Rom Tools
  12. Pentest Reporting Tools
  13. Pentest Tools For Android
  14. Hacking Tools Pc
  15. Hacking Tools Free Download
  16. Hack Tool Apk No Root
  17. Hacks And Tools
  18. Hacking Tools For Mac
  19. Pentest Tools Linux
  20. Termux Hacking Tools 2019
  21. Pentest Tools Online
  22. Hacking Tools 2019
  23. Wifi Hacker Tools For Windows
  24. Pentest Tools Website
  25. Hack Apps
  26. Kik Hack Tools
  27. Hacking App
  28. Hacking Tools
  29. Pentest Tools Online
  30. Hacker Tools Online
  31. Hacker Tools For Ios
  32. Hack Tools For Mac
  33. Hack Tools Github
  34. Pentest Tools Kali Linux
  35. Nsa Hack Tools
  36. Hacking Tools For Kali Linux
  37. Pentest Tools Online
  38. Hack Tools For Windows
  39. Hacking Tools Name
  40. Game Hacking
  41. Kik Hack Tools
  42. Hacker Tools 2019
  43. Hacking Apps
  44. Termux Hacking Tools 2019
  45. Hacking Tools Windows
  46. Hacker Tools For Pc
  47. Hack Tools Mac
  48. Hacker Tools Linux
  49. Pentest Tools Website Vulnerability
  50. Best Hacking Tools 2020
  51. Hack Tools
  52. Hacking Tools Name
  53. Hack Tools Pc
  54. Pentest Tools Find Subdomains
  55. Computer Hacker
  56. Hacking Tools Software
  57. Pentest Tools For Mac
  58. Hacker Tools Apk Download
  59. Nsa Hack Tools Download
  60. Top Pentest Tools
  61. Hacking Tools Name
  62. Hacker Tools Hardware
  63. Hack Tools For Mac
  64. Pentest Tools Subdomain
  65. Hack App
  66. Pentest Tools Online
  67. Kik Hack Tools
  68. Nsa Hack Tools
  69. Hack Tools Download
  70. Underground Hacker Sites
  71. Pentest Tools For Mac
  72. Hacker Tools Hardware
  73. Hacker Tools Free Download
  74. Pentest Tools Android
  75. Hacking Tools Hardware
  76. Hack App
  77. Pentest Tools Bluekeep
  78. Hacking Tools Windows
  79. Hacking Tools For Kali Linux
  80. What Is Hacking Tools
  81. Hack And Tools
  82. New Hack Tools
  83. Hack Tools Mac
  84. Hacking Tools Software
  85. Termux Hacking Tools 2019
  86. Hacker Tools Mac
  87. Pentest Tools For Windows
  88. Hacker Tools
  89. Nsa Hacker Tools
  90. Hack Tools Mac
  91. Pentest Tools Port Scanner
  92. Hacking Tools For Windows 7
  93. Hacker Tools Github
  94. Wifi Hacker Tools For Windows
  95. Hack Apps
  96. Hacking Tools Kit
  97. Hacker Search Tools
  98. Best Hacking Tools 2019
  99. Hack Tool Apk No Root
  100. Hacker Tools
  101. Hacker Tools Free
  102. Hacker Search Tools
  103. Pentest Tools Apk
  104. Hacker Security Tools
  105. Hacking Tools For Games
  106. Hack Tools Pc
  107. Black Hat Hacker Tools
  108. Hack Tools Mac
  109. Hack Tools Github
  110. Pentest Tools Website
  111. Hack Tool Apk No Root
  112. Hacking Tools For Beginners
  113. Hacker
  114. Pentest Tools Website
  115. Pentest Tools Nmap
  116. Hacker Tools
  117. What Is Hacking Tools
  118. Hacker Tools List
  119. Hacker Techniques Tools And Incident Handling
  120. Hacking Tools Free Download
  121. Pentest Tools Bluekeep
  122. New Hacker Tools
  123. Android Hack Tools Github
  124. Hacker Tools For Windows
  125. Wifi Hacker Tools For Windows
  126. Hacker Tools For Mac
  127. Hacking Tools Online
  128. Hacker Tools For Windows
  129. Hacking Tools For Mac
  130. World No 1 Hacker Software
  131. Hacking Tools For Windows Free Download
  132. Hacker Tools Github
  133. Free Pentest Tools For Windows
  134. Black Hat Hacker Tools
  135. Hack Tools
  136. Hacker Tools For Windows
  137. Hacker
  138. Hacker Tools For Pc
  139. Hacker Tools For Pc
  140. Pentest Tools List
  141. Hacking Tools Windows
  142. Pentest Box Tools Download
  143. Tools For Hacker
  144. Hacker Tools For Ios
  145. Hack Rom Tools
  146. Hacker Tools For Ios
  147. Tools 4 Hack
  148. Hacker Tools Mac
  149. Hacking Tools Kit
  150. Hacker Tools For Mac
  151. Pentest Tools Github
  152. Bluetooth Hacking Tools Kali
  153. Pentest Tools Framework
  154. Beginner Hacker Tools
  155. Pentest Tools Website Vulnerability
  156. Free Pentest Tools For Windows
  157. Hack Tools For Ubuntu
  158. Hack Tools Github
  159. Install Pentest Tools Ubuntu
  160. Hacking Tools Name
  161. Pentest Tools Windows
  162. Blackhat Hacker Tools
  163. Hack Tools Github