Recently one of my friend said that he can hack anyone's Facebook or email account. I don't believe such talks because as a computer science student I know how hard it is to break encrypted data that sends and receive from a client in a network. But I was so curious to find out if there is any way of accessing encrypted data and what I was found was a web page which describes how does an unprotected WiFi network can use to capture your data. And it said

This app can be used to gain access to private accounts on popular Web services, such as Gmail, LinkedIn, Yahoo, and Facebook.

But how? As an example, when I access to google sign in page, it establishes a encrypted line between client and server. So even after I sign in it uses https protocol. So how can that app can access such sensitive information? whether that network is unprotected or protected, data are still encrypted according to my knowledge. So please explain me how is that possible.

Here is the link to that page: http://www.pcworld.com/article/2043095/heres-what-an-eavesdropper-sees-when-you-use-an-unsecured-wi-fi-hotspot.html

  • That's from 2013. It's not up to date regarding websites you have mentioned. – Aria Aug 4 '16 at 17:24
  • But 2013 had encrypting right? in google and other famous sites? – User9125 Aug 4 '16 at 17:28
  • Hello. Thank you. I want to know whether can someone get sensitive data which I send to the server over an unprotected wifi network. But the server provides encrypt secured network? – User9125 Aug 4 '16 at 18:18
  • The question assumes that the encryption is being broken. The attack here is to access the unencrypted data before or after it is encrypted. – schroeder Aug 4 '16 at 20:46

Your question is a bit vague, but I'll give it a shot. Public WiFi networks are known to be dangerous spots from which to access any private account on any web service. There are a few common attacks, like man-in-the-middle attacks in which an attacker intercepts unencrypted (http) connects and can take data, or dns redirects, in which an attacker either hacks the router and changes the dns to redirect to his malicious page, or spoofs the router and makes you connect directly to him. There are also extensions for browsers like firesheep for firefox which works by intercepting unencrypted cookies for popular websites and thus faking credentials to hijack a user's session.

Still, if you're accessing webpages via https and they have valid security certificates, you can mitigate some if not most of these threats. And in 2016, https is pretty widespread.

As far as using them to steal login info, there are more effective ways to get login passwords, especially if you have physical access to a victim's computer. As far as Google or Facebook, you can pretty much assume that their encryption algorithms are up to snuff (aside from NSA backdoors). The issue almost always lies with the end user or the way with which the user communicates with otherwise secure services.

And as far as physical access goes, there's always Lan Turtles https://lanturtle.com/ and Wif Pineapples https://www.wifipineapple.com/ Point is, you can't trust the infrastructure you use to access the internet, so every bit of info you send is encrypted between you and the sites you want to access, or at least that's the idea. You never know when you have government agencies like the NSA wiretapping the entire backbone of the internet for unencrypted data.

To my knowledge, it is not possible/practical for an attacker that intercepts encrypted data to decrypt it. However, this alone does not make your computer or online activity safe over public wifi. An outdated/unpatched operating system or browser security hole could let an attacker into your system, where they could do all sorts of nefarious things like install keyloggers, getting your information in other ways.


Of course you can steal the data!

Steal all the things meme

This becomes apparent when you consider how a network works and the attacks that you could perform within a network. The following are two very basic examples:

  1. ARP Poisoning/Spoofing
  2. Simply control the physical network infrastructure (router)

With ARP Poisoning/Spoofing, you basically broadcast a message to the network saying "I am the router!" and the other devices on the network reply "Yes, master, I shall send all of my data to you." Then all the devices on the network will route any kind of web request they make through you. Thus, this allows you to take control of the network and intercept data. (MiTM Attack. Note: nowadays there are protections in place to prevent this kind of attack, but it can still be done.)

Controlling the Physical Network: If you control the physical network infrastructure, then it is basically game over for anyone on the network. This is achieved by bringing a router with you, making a network called "Totally fun, safe, and free wifi network with no data logging or hacking...", and then leaching all data, probably via routing the data through a device you have connected to the router. (Again, this is a MiTM attack.)

But how do I get the encrypted data? you ask. Well, that isn't too hard actually. First, we will need to forge a certificate. Okay, that part might be a bit hard, but as it turns out, there are a couple ways we can do this:

  1. Convince the user to install a custom SSL/TLS Root Certificate, thus allowing your MiTM system to act as a certificate authority to issue certificates for any website the user visits. (Kind of messy and requires the user to install the vulnerability.);
  2. Many browsers, especially older browsers, are vulnerable to a null-byte exploit that I first heard about in a presentation given by a researcher/hacker who goes by Moxie Marlinspike. Essentially, a lot of Certificate Authorities use Pascal-style strings (fixed-width) in their systems, but most browsers use C-style strings (null-termianted). So, a certificate like *\0.a-domain-name-you-own.com would actually allow you to match any website. (In many browsers * says "match anything" and \0 says "matching ends here".) So, good game, a certificate for this domain would match literally any website and it could be handed out to any client on the network that you are performing a MiTM with; or
  3. Attempt to do SSL-Stripping. (Does not work on most modern websites, so I won't bother discussing this one. Also does not require certificate forging.)

Option 1 is pretty self explanatory, so I'll go into option 2 a bit more. Browsers use a protocol called OCSP to determine if a certificate is still valid or not. So, this is a major problem if the certificate authority revokes the certificate you created for *\0.a-domain-name-you-own.com. Interestingly enough, though, the response from the OCSP protocol will return a message containing a byte indicating the certificates status, and an optional signed message describing the status code. Options 0-2 require the signed message describing the status code, where option 0 is "Success" (certificate is still valid), option 1 is "Malformed Request", and option 2 is "Internal Error". Status code 3, however, does not require a signed message describing it, and a status code of 3 actually means "Try Later." Many older browsers (with old implementations of SSL) will interpret this as basically being equivalent to "Success", and the certificate will be treated as valid. Thus, you can MiTM the HTTPS (SSL/TLS) encrypted content being transmitted between the client on the browser for ANY website.

For more details on that, I would recommend watching the following talk by Moxie Marlynspike at DEFCON 17: https://www.youtube.com/watch?v=ibF36Yyeehw

It is important to note that the method described for Option 2 (Asteriks and null-terminator exploit) is a somewhat old method now which might not work any more for most browsers. However, this should still give you an interesting study into how HTTPS and SSL/TLS can be exploited, decrypted, modified, and monitored.

It is also worth mentioning that you could use other attack vectors to get the data. One that comes to mind immediately, if you're on the same network, is the option to scan the other devices on the network for vulnerabilities and then hack them to execute some code on the device. (E.g., create a reverse shell.) I would recommend looking into Metasploit if you want to learn more about that, as it is out of the scope of this answer, and this answer is long enough as is ;-)

Disclaimer: I am also a Computer Science student, so I am by no means a professional in the field. As such, there could be a few incorrect details above. Regardless, hopefully this will help to answer your questions, and it might even spark some interest in you to research a few things mentioned.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.