Tag Info

Hot answers tagged

117

Yes, you should be worried. You should contact the hotel staff, and you should not use the network any more. It is likely the router’s DNS is manipulated. It is possible that the hotel wants to make some money on the side by injecting ads. However, this script looks evil. It tries to open a dialog that tricks you into installing a trojan by displaying a ...


54

Unprotected Wifi networks, particularly in public places, are most certainly a threat. This is because you are connecting to a network without knowing who else could be on the network. 'Free Wifi' provided by cafes, restaurants, etc serve as excellent places for harvesting passwords. The attacker will perform a Man in the Middle attack, typically by ...


50

Yes they can but unless your neighbor has the required technical expertise, its highly doubtful. To view incoming and outgoing traffic you need specific software to monitor network packets and the tech knowledge to actually do it. Most routers only keep a syslog and unless they are using software like wireshark to monitor/capture your packets, they cannot ...


44

Something left unsaid, Why is the user wanting a WiFi? As long as the user feels they have a legitimate need they will continue to find workarounds to any of your attempts at blocking it. Discuss with the users what they are trying to accomplish. Perhaps create an official wifi network ( use all the security methods you wish - it will be 'yours' ). Or, ...


39

The risk here is in believing that a "hidden SSID" changes anything to the security. A non-hidden SSID means that the router will shout at regular intervals "hello everybody, I am Joe the Router, you may talk to me !". A hidden SSID means that the client machine (not the attacker's machine) will shout at regular intervals "Hey, Joe, where are you ? Please ...


38

If you get a VPN and use that for browsing, that will hide all your traffic from both your neighbour and their ISP.


37

Most probably the blocker is designed to let images through, maybe because they are hotlinking some images on the page where they ask for you to login. Appending ?.jpg to the URL makes the blocker think that the URL is an image. On the other hand, anything after the ? doesn't change the actual webpage requested, it only changes the GET headers. (so ...


36

First of all that would entirely depend on the encryption used by the access point. There are several types of possible encryption. Mostly on consumer wireless access points these are: WEP WPA WPA2 WPS WEP Let's first dive into WEP. WEP was the first algorithm used to secure wireless access points. Unfortunately it was discovered that WEP had some ...


36

If you're using a machine controlled by the LAN administrator, then you have to assume they can read anything you do on it. They could have software to log your activity, they could have installed extra SSL certificates that allow them to MITM your connection to GMail. If you believe your computer has not been tampered with and is not under the control of ...


34

You can't allow customers to be on the same network as your own computers. A lot of new WiFi access-points take care of this for you, by creating two wifi networks, where the "guest" network does not have access to internal computers. The Cisco/Linksys 4200 is what I have at home for guests, and it's easy to setup, but there are many other systems that have ...


34

The schemes you mention are protocols for securing 802.11x traffic over wireless networks. They don't mandate how the AP password is encrypted or hashed during storage. However, the security of the protocol does rely on making the key secure. WEP relies on a broken RC4 implementation and has severe flaws in various aspects of its protocol which make ...


30

HTTPS is secure over public hotspots. Only a public key and encrypted messages are transmitted (and these too are signed by root certificates) during the setup of TLS, the security layer used by HTTPS. The client uses the public key to encrypt a master secret, which the server then decrypts with its private key. All data is encrypted with a function that ...


29

What about using tor? Keep in mind that your speed will be affected*. As other people said, using any private mode in your browser is not going to be of any help. *EDIT: The slowdown heavily depends on the network topology, the number of nodes, how much traffic the nodes are handling and what you are downloading. Here you can find some explanations about ...


25

After some discussion with @epeleg in chat, I think I may have a more thorough and (hopefully) clear answer. TL;DR: The protection afforded to a Wi-Fi network by encryption with a PSK is directly proportional to the complexity of the PSK, and the effort taken to safeguard that PSK. For any environment, this requires striking a careful balance between ...


25

Yes they can actually. What it boils down to is that they can see which websites you are running by looking at: Clear HTTP traffic DNS requests sent One thing you could do is purchase an encrypted VPN and run all your internet traffic through the VPN. This way your neighbours will not be able to see what you are doing.


22

To complement @David's and @Steve's answers: If the attacker ("Adam", in your case) has administrative access to your machine, then he can learn all your secrets. Installing an extra root CA, under his control, to run routine MitM interception on your SSL connections is a popular tools for honest (but nosy) sysadmins: it is a one-time installation which ...


21

They're stumbling blocks, but not insurmountable. SSID hiding can provide some protection from people looking for any SSID they can get their hands on, and MAC filtering can keep casual riffraff out. As the only methods of protecting a WLAN they're pretty weak. For someone who wants your network specifically encryption (most especially un-broken encryption) ...


21

MAC address filtering is a very weak form of wifi protection: the MAC addresses of your devices can be easily eavesdropped with tools like wireshark the MAC addresses of their devices can be easily changed (OS dependent, but typically an option in Network Settings). MAC address filtering is annoying to maintain. You have to login to your router ...


20

An attacker can always determine the client's MAC address if they can sniff packets to or from the client. This is true regardless of whether encryption is used or not. The MAC address is in the outer encapsulation layer of the 802.11 packet, and there is no encryption applied to that level. Here's a good link at Microsoft that lays out the packet ...


18

Yes and no. They may not have your password in plaintext, but they have enough to potentially guess it and verify that guess (i.e. offline brute forcing). WPA2 authentication is performed through a four-way handshake. Instead of just sending your password in plaintext to any access point you connect to, this handshake ensures that unless both parties ...


18

Is it safe for a small business to let customers use their wifi while waiting? No. Even if no customer intentionally attacks his WiFi network they could be carrying some type of malware on their laptop/smart phone/portable device that might spread. Additionally the WiFi signal doesn't end at the front door. You have probably connected to a WiFi some ...


18

If someone knows my wifi password (be it WEP or WPA) what can they see on my screen? Do they just see URLs I visit, or can they see everything in my browser,....or can they see everything I do on my computer? Does using HTTPS make any difference? They can't see anything on your screen (unless you've enabled some sort of unencrypted remote desktop screen ...


17

You can't. It doesn't matter whether the wifi is encrypted or not: you can't know whether the access point is trustworthy. A WPA2 access point with a strong password doesn't help when the access point itself is a rogue access point put up by someone who may or may not be the café or hotel owner. And yes, it happens — people put up open access points with ...


17

As David says, the provider of your network usually can't see data passed over https connections. However, your Gmail address is not necessarily passed only over https connections. For example, if you log into StackExchange using your secret Gmail account and visit the http (not https) version of your user profile page, then your Gmail address is sent to ...


16

Was prompted by conversation with @Iszi on chat to make things much clearer - to just highlight the main increased risks. An attacker could reroute every request sent by users of the network leading to: Phishing attack - for example the normal guidance for users is to never click on untrusted links for things like online banking, but to always type in the ...


15

Using valid SSL/TLS connection by making sure you're always connecting to the https:// version of the website and that the browser isn't giving you any warnings or errors, is your first line of defence. An addon called HTTPS Everywhere can be very helpful here. The approach you're proposing (SSH to your trusted network) is a very standard approach. I use it ...


15

WPA2 is NOT protected against ARP poisoning. When you perform ARP poisoning, you announce that your MAC address is responsible for a given IP address. All of this happens at a layer higher than WPA2 is aware of. Let's say layer 3. Because the WPA2 encryption link is down on layer 2, and packets destined for the attacked IP are now addressed to the ...


15

Regardless of what you do at the AP, I believe I can say with a fair amount of certainty that you will at some point find that your wireless data is being broadcast "outside the walls". First, you must understand that your AP is not the only wireless transmitter on your home network. All of your wireless clients that connect to the AP are also ...


15

Anyone who witnesses the association process of a new client can eavesdrop on their connection. As reassociations can be forced by a rogue host that sends a forged disassociation packet in the name of the target, it is practically always possible to listen in on all connections on a WPA(2) network with a preshared key. You can even try it for yourself in ...


15

No, neither of these are worthwhile measures against an attacker. Unless you have an easy to guess password you need to assume anyone who might realistically try to gain access to your network has software to help or a little knowledge of how to get around such techniques. SSID hiding doesn't improve security since it is trivial to identify the SSID of a ...



Only top voted, non community-wiki answers of a minimum length are eligible