Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
DEAL: For $25 - Add A Second Phone Number To Your Smartphone for life! Use promo code SLASHDOT25. Also, Slashdot's Facebook page has a chat bot now. Message it for stories and more. Check out the new SourceForge HTML5 Internet speed test! ×
Security Privacy Wireless Networking

RSA Conference Attendees Get Hacked (esecurityplanet.com) 54

The RSA Conference "is perhaps the world's largest security event, but that doesn't mean that it's necessarily a secure event," reports eSecurityPlanet. Scanning the conference floor revealed rogue access points posing as known and trusted networks, according to security testing vendor Pwnie Express. storagedude writes: What's worse, several attendees fell for these dummy Wi-Fi services that spoof well-known brands like Starbucks. The company also found a number of access points using outdated WEP encryption. So much for security pros...
At least two people stayed connected to a rogue network for more than a day, according to the article, and Pownie Express is reminding these security pros that connecting to a rogue network means "the attacker has full control of all information going into and out of the device, and can deploy various tools to modify or monitor the victim's communication."
This discussion has been archived. No new comments can be posted.

RSA Conference Attendees Get Hacked

Comments Filter:
  • So what? (Score:5, Insightful)

    by thegarbz ( 1787294 ) on Saturday February 18, 2017 @07:41PM (#53893661)

    So a few people ran WEP encryption on their networks, and a few others used rogue access points.

    You want to talk about getting "hacked" let's talk about what was found. Did anyone give up credentials or sensitive details? Did anyone have something important revealed in a MITM attack? Did someone find something on those WEP networks? Just because we connect to something doesn't mean we trust it or aren't taking precautions. If you're rogue and providing me internet access, and all I'm doing is routing through your access via VPN that doesn't mean I got hacked.

    The devil is in the details, at least it would be if we had any.

    • Exactly. No ssl/https or other keys seemed to have been compromised by this 'hack' so it was basically as safe as connecting to any other public WiFi.
    • by Minupla ( 62455 )

      If you're interested, most people would agree that when you connect to a defcon wifi network you should probably be... cautious. Let's face it, Defcon is to RSA from an info-risk pov as walking in downtown NY at 1am is to walking around the North/South Korean DMZ at 1am. Both are hazardous, but one of them is just plain insane.

      Now watch this: https://www.youtube.com/watch?... [youtube.com]

      That's the 'so what'.

      And keep in mind that most ppl are still using the same passwords on multiple sites.

      Oops.

      Min

      • If you're interested, most people would agree that when you connect to a defcon wifi network you should probably be... cautious.

        Well if you have any evidence that they weren't I'm all ears. But right now we're criticising them for practising unsafe sex without every asking or checking if they used a condom and we've based this all on "those other people had unsafe sex here years ago".

        Until there's any actual details about what went on on these networks it is sensational hyperbole.

        • Well, not really. The first mistake is in assuming that everyone attending the conference is actually a master at security verses someone who is trying to network for whatever reasons or trying to just get more information about it to see if it is a direction he wants his career to go.

          So to be more accurate, your statement should read a little more like this. "But right now we're criticizing them for practicing unsafe sex without ever asking or checking if they used a condom or even finding out if they have

          • Yeah I agree. Let's just go with making assumptions with no evidence so we can get outraged at a clickbait headline. It was silly to give people benefit of being innocent until there's evidence against them.

            Now where were we. Oh right. OUTRAGEOUS. THIS IS A SECURITY EVENT. HOW COULD THEY!!!!!1111

  • Seriously? Hacked is hardly what happened here. There's quite a large gap between hacked and *possible* eavesdropping. Did they get into their computer? Compromise their bank account? Did they get anything at all? Where exactly is the news in this again?

  • how "rogue"? (Score:5, Insightful)

    by KiloByte ( 825081 ) on Saturday February 18, 2017 @07:48PM (#53893683)

    Why would a "rogue" access point that actually delivers your packets be bad? A non-moron already treats all networks more exposed than your cluster's interconnects as untrusted, this goes for granted for any public network you connect to -- especially at a security conference where there will be some attacks (even if not malicious).

    • Why would a "rogue" access point that actually delivers your packets be bad?

      Because unfortunately not everything is hardened against MitM attacks yet. Everything should be, but not everything is.

      • by ixidor ( 996844 )
        if you connected to the rouge AP, and have VPN to corp office turned on, what traffic/data would not be protected?
        • VPN protects against MitM. Are we assuming everyone was using that for some reason?

          • What we are assuming is that:

            a) people who attend the RSA conference are professionals who we can shame for poor security.
            b) that purely based on the fact that they connected to an access point they are idiots and thus deserving of a shaming.

            If this were Comicon we would have a point. The odds of good security practices would be lower, but then it's hardly fun to try and shame a bunch of Comicon nerds. Extraordinary claims require extraordinary proof, and so far we have none.

        • There are a number of common vulnerabilities in corporate VPNs. The newest major ones, which came out in the last few months, are Sweet32 and a certificate validation bug. Aggressive mode IKE is also still quite common, though it's long been known to be less secure than desired. Just thinking about my recent experience testing corporate VPNs, without actually querying my database for exact numbers, I'd say around 50% of corporate VPNs are insecure to varying degrees.

          The worst are the certificate validation

        • by AHuxley ( 892839 )
          The origin device and big brand destination would be interesting.
    • A large number of vulnerabilities require MITM as prerequisite. These are also the vulnerabilities most likely to go unpatched, as people think the requirement for mitm makes the attack much less likely.

      In the last few years, just against https alone, and only considering high-profile, named vulnerabilities, we have BEAST, CRIME, and BREACH off the top of my head. There are twice as many that don't have cool names, they're known as CVE-2016-xxxx.

      Perhaps you'll use a VPN. Some common VPN configurations ar

  • Researchers (Score:5, Interesting)

    by darkain ( 749283 ) on Saturday February 18, 2017 @07:48PM (#53893685) Homepage

    And how many of those people who connected to these access points were doing the same type of monitoring, in reverse. Such as testing to see how exploitable these fake APs are!?

  • It's A Trap!
  • by 140Mandak262Jamuna ( 970587 ) on Saturday February 18, 2017 @08:02PM (#53893727) Journal
    The data plans have become very affordable. I don't find the need to ever use "free" wi-fi. I use wi-fi at home, and then it is the standard data plan from t-mobile. I don't even use the free wi-fi provided by my employer at work. ( No, no, I am not Visvesvaraya, the legendary minister of Maharajah of Mysore who kept two sets of candles [firstpost.com] and made sure he did not use the government issued candles while attending to personal work. Just simply privacy concerns, why even let the employer know my browsing habits? )
    • by antdude ( 79039 )

      Cellular is usually expensive, slow, capped, and uses a lot of power compared to wifi. I don't do private stuff on unknown wifis.

      • by Anonymous Coward

        Cellular is usually expensive, slow, capped, and uses a lot of power compared to wifi.

        Yeah, no.

        Get a better service provider/plan/device. I have unlimited 4g/LTE -which has better throughput than a shared wi-fi resource, and I have not had battery issues on my mobile devices in the past year or so. That used to be the case, but it really is not a valid excuse anymore. Welcome to the modern age!

      • For 120$ a month, I get four lines with unlimited text, voice, and 2GB of "high speed" data. Then it gets throttled to 128 kbps. That speed is good enough to provide turn-by-turn driving instructions. I don't stream videos. So I don't even use this much of data. Anyway if I am a security professional, the company issued phone would come with some decent wireless data plan provided by the employer.
      • by Karlt1 ( 231423 ) on Saturday February 18, 2017 @11:18PM (#53894417)

        As of this week, all of the four major carriers are offering unlimited data that is not "deprioritized"* until you go over 22GB - 28GB.

        When we were living in an apartment where wifi interference was horrible. We typically just turned off wifi and used cellular from our phones. (We also had 100 foot cords running to all three bedrooms from the router but that's a different story....)

        I pay $200 on T-Mobile for 5 lines unlimited data with 14GB of tethering on each line.

        Depriorotized -- your data is slowed down temporarily in congested areas to allow others to go at full speed when you go over the cap.

        Throttled -- your speed is slowed down permanently to 2G speeds for the rest of the billing cycle when you go over the cap.

    • by Anonymous Coward

      I could write a long post hoping that you would realize that not everyone needs, can access, or can afford this kind of "solution", but hopefully the intent is sufficient for you to get a hint of a clue.

    • The data plans have become very affordable. I don't find the need to ever use "free" wi-fi.

      I have a better question for you. Why trust your data plan more than an untrusted WiFi point? There's only one thing that is certain, all your activity on your data plan is being monitored and logged for Uncle Sam. The same can not be said for the untrusted WiFi connection.

      I would approach either with the same caution.

  • Even the experts don't always practice safe computing when they're excited to get it on.
  • by MarcAuslander ( 517215 ) on Saturday February 18, 2017 @08:18PM (#53893767) Homepage

    I use a homebrew equivalent of VPN whenever I'm in public. Started when I realized a hotel was messing with my HTTP traffic! Crucial of course is reliable access to DNS - if that's broken then even connecting HTTPS can get you in trouble if someone has gotten hold of a signing certificate and does man in the middle.

    This stuff is just to hard for the average user.

  • by Anonymous Coward

    Hackers switched signs on some of the bathroom doors and attendees accidentally became transgender bathroom users. Guys, it is important to remember that if you don't see a urinal, you're in the wrong place.

  • not to worry (Score:2, Insightful)

    by Ol Olsoc ( 1175323 )
    It doesn't matter if they were hacked, because sexy booth babes have been banned.

    Because that is what is most important in America today. Fugk that security stuff, someone saw a woman with a dress 4.00001 inches above the knee. To the safe room people, we are uncomfortable!

    But we have great wireless coverage there!

  • by gweihir ( 88907 ) on Sunday February 19, 2017 @05:34AM (#53895219)

    Use a VPN, use SSH for remote logins and you basically do not care about the security of the access-point. If it wants a browser-based sign-up, just do that from a VM. You would think that you can find people that know how to do that at the RSA conference....

    • by plover ( 150551 )

      There are plenty of people I know who would fall for this, because they simply don't know. They were issued a laptop for work and were told it was secured through a VPN, but don't understand how networks or routing actually works. They think they're secure only because an expert told them that VPNs are secure.

      And not all VPNs are secure. Corporate VPN solutions are increasingly looking to split tunnelling to cut costs: internal corporate IP addresses are correctly routed to the VPN tunnel interface, so

What is worth doing is worth the trouble of asking somebody to do.

Working...