Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Given that it's very easy set up a rogue access point and MITM that connection, is a VPN to a trusted host the only real way to secure my browsing and other TCP/UDP actions?

This question relates to the recent FBI and IC3 announcement regarding hotel Wifi connections:

The FBI today warned travelers there has been an uptick in malicious software infecting laptops and other devices linked to hotel Internet connections. The FBI wasn't specific about any particular hotel chain, nor the software involved but stated: "Recent analysis from the FBI and other government agencies demonstrates that malicious actors are targeting travelers abroad through pop-up windows while they are establishing an Internet connection in their hotel rooms.

The FBI recommends that all government, private industry, and academic personnel who travel abroad take extra caution before updating software products through their hotel Internet connection. Checking the author or digital certificate of any prompted update to see if it corresponds to the software vendor may reveal an attempted attack. The FBI also recommends that travelers perform software updates on laptops immediately before traveling, and that they download software updates directly from the software vendor's website if updates are necessary while abroad."

The FBI said typically travelers attempting to set up a hotel room Internet connection were presented with a pop-up window notifying the user to update a widely used software product. If the user clicked to accept and install the update, malicious software was installed on the laptop. The pop-up window appeared to be offering a routine update to a legitimate software product for which updates are frequently available.

share|improve this question
1  
"Given that it's very easy to MITM a Wifi connection" - I wouldn't agree with this statement in the slighest. Furthermore a VPN isn't going to protect you from other MITM attacks. This would only prevent that MITM directed towards the access point your actually using which is only made possible when not encryption is being used. Furthermore even if a VPN connection is used the authentication information to the VPN itself is at risk, since your still connected to the fake access point, much easier to just not connect to the rogue access point. –  Ramhound Oct 4 '12 at 15:25
    
@Ramhound - I clarified the question with a link. –  makerofthings7 Oct 4 '12 at 16:01
    
Your link offers no additional clarification. The link clearly does not ever state it is "very easy" to setup a rogue access point. Even if it is, the steps you do to prevent from falling victim to a rogue access point, are even simplier. –  Ramhound Oct 5 '12 at 16:45

2 Answers 2

Connecting to a WiFi hotspot is no worse than connecting to the Internet in general. The error would be to assume that local communications (between two machines which are bound to the same hotspot) would benefit from protection from eavesdroppers. It is only in that sense that WiFi is "weak": it does not offer the kind of physical protection that we took for granted with wired ethernet (and, even then, thinking of wired ethernet as protected is a bit of wishful thinking).

The most glaring targets are local file sharing and printer access; these are features commonly activated in enterprise and home network, and for which some level of protection is clearly needed. But Web surfing ? No, nothing special with WiFi here. Regardless of WiFi, the Internet is a harsh place, and HTTPS will protect you (if you do not disregard the certificate warnings, of course).

share|improve this answer
    
I clarified the question to focus on Rogue WiFi APs –  makerofthings7 Oct 4 '12 at 16:02

A gateway can protect itself from MITM and so can a client. However, not while allowing GARP and dynamic ARP. You should set your gateway statically and make sure you don't use any cleartext protocols, or easily subvert-able encrypted traffic. Set your SSH keys up ahead of time.

Trusting TLS, even the latest versions, is sort of an exercise in disaster lately. Having a good setup and pen-testing your own client-side is usually on the list of "good ideas". Pen-test yourself secure!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.