Skip to main content
Information Security

Return to Answer

added 294 characters in body
Source Link
Questor
Questor
  • 299
  • 1
  • 4

One thing you never address in your question/answer to comments is:

Where this SSL certificate comes from.

There are 2 possibilities that I see.

  1. You got this from your schools It department.

If that is the case, its probably safe to use (if you trust your school) though it is a bit odd that they would do this.

  1. The "school" wifi told you that you need to download their this SSL certificate for "security".

This sounds a lot like something I might do. Put a router in a spot where a lot people tend to gather and have it strong enough to override the school's wifi with my wifi that has the same name. I might even connect it to the school's internet.

Then provide a fake SSL certificate and tell students they need to download it so that I can fake google. Gmail access lets me reset bank passwords/a lot of people use gmail for 2FA as well. It's stupid, and why I don't think much of 2FA.. On the otherhand this is a school, so its possible someone is trying to steal professors passwords/usernames.

ItsAll in all given its not a bad plan. This kind of attack is extremely simple to pull off if your school doesn't scan for it.

Edit: Realized I didn't give actionable advice on what to do. I am going to assume that it is the WIFI that told you to download the SSL certificate. In which case as Nosajimiki suggested in a comment. Report this to your school's IT department. Someone is stealing passwords/usernames.

One thing you never address in your question/answer to comments is:

Where this SSL certificate comes from.

There are 2 possibilities that I see.

  1. You got this from your schools It department.

If that is the case, its probably safe to use (if you trust your school) though it is a bit odd that they would do this.

  1. The "school" wifi told you that you need to download their this SSL certificate for "security".

This sounds a lot like something I might do. Put a router in a spot where a lot people tend to gather and have it strong enough to override the school's wifi with my wifi that has the same name. I might even connect it to the school's internet.

Then provide a fake SSL certificate and tell students they need to download it so that I can fake google. Gmail access lets me reset bank passwords/a lot of people use gmail for 2FA as well. It's stupid, and why I don't think much of 2FA...

Its not a bad plan

One thing you never address in your question/answer to comments is:

Where this SSL certificate comes from.

There are 2 possibilities that I see.

  1. You got this from your schools It department.

If that is the case, its probably safe to use (if you trust your school) though it is a bit odd that they would do this.

  1. The "school" wifi told you that you need to download their this SSL certificate for "security".

This sounds a lot like something I might do. Put a router in a spot where a lot people tend to gather and have it strong enough to override the school's wifi with my wifi that has the same name. I might even connect it to the school's internet.

Then provide a fake SSL certificate and tell students they need to download it so that I can fake google. Gmail access lets me reset bank passwords/a lot of people use gmail for 2FA as well. It's stupid, and why I don't think much of 2FA. On the otherhand this is a school, so its possible someone is trying to steal professors passwords/usernames.

All in all given its not a bad plan. This kind of attack is extremely simple to pull off if your school doesn't scan for it.

Edit: Realized I didn't give actionable advice on what to do. I am going to assume that it is the WIFI that told you to download the SSL certificate. In which case as Nosajimiki suggested in a comment. Report this to your school's IT department. Someone is stealing passwords/usernames.

Source Link
Questor
Questor
  • 299
  • 1
  • 4

One thing you never address in your question/answer to comments is:

Where this SSL certificate comes from.

There are 2 possibilities that I see.

  1. You got this from your schools It department.

If that is the case, its probably safe to use (if you trust your school) though it is a bit odd that they would do this.

  1. The "school" wifi told you that you need to download their this SSL certificate for "security".

This sounds a lot like something I might do. Put a router in a spot where a lot people tend to gather and have it strong enough to override the school's wifi with my wifi that has the same name. I might even connect it to the school's internet.

Then provide a fake SSL certificate and tell students they need to download it so that I can fake google. Gmail access lets me reset bank passwords/a lot of people use gmail for 2FA as well. It's stupid, and why I don't think much of 2FA...

Its not a bad plan