My dad sent me this video asking if he should be worried about this?
The video shows:
- a wifi AP broadcasting an airport's wifi name
- security researcher seeing the sites the victim browses
- security researcher viewing files accessed by victim on cloud storage
- victim installing attacker's "free wifi" app
- the app giving the security researcher full control over the device
Obviously most folks should be wary of untrusted WiFi networks, but there’s a couple of strange things occurring that makes me wonder if this is just an over-hyped hacker story.
First, the Google search he performs seems to be protected by TLS, how is that possible with just MitM?
Then he does some truly mind-blowing stuff like being able to access the microphone, record audio and send it to himself. No way that’s done via just an MitM over WiFi.
Am I missing something, or does this community concur that this video is either over-simplified or just plain deceitful?
Connecting to a strange WiFi might get you into trouble, but it alone cannot cause this level of compromise... can it?