2

Context. I am moving in to a building where neighbors share WiFi. There are several routers connected with each other, and residents connect to one of the WiFi networks. I was told it's cheaper that way and the speeds are good.

Concerns. I don't know who set those routers up and with what settings (like isolation or logging). I also don't know my neighbors and what they're up to. I don't have any reason to distrust them, and in fact there are cameras in the building, but I'm trying to understand the attack surface.

Assumptions. It's my understanding that each WiFi network is a LAN where people can sniff each other's traffic and connect to each other's ports. For example, if I run a website on 0.0.0.0:3000, my neighbors will be able to visit it if they find out my local IP. (I already do this on my phone to test my websites on mobile, but I do it on my own LAN).

  • Is it true that a neighbor can see what websites I visit (DNS queries are usually sent in plaintext, plus source/destination IPs are unencrypted in the IP packets), but they won't be able to make sense of the data because the traffic is sent over HTTPS? For example, they can't see my password when I log in to online banking.

  • Also, is it possible that a neighbor could exploit open ports on my phone and/or laptop, potentially compromising my devices with remote control or malware?

Risk mitigation. Here is what I think I could do:

  1. Ask the landlord to set up a separate network just for me. I would be the only one that has the WiFi password. I don't know if this is enough considering the routers are interconnected. But I believe this will thwart nosy neighbors.
  2. Ask the landlord to connect my own internet service just for my household. This should be more secure because I'll have my own router that I can safeguard.
  3. Use a hotspot on my phone. However, I'm not sure how secure mobile data is, and I'm certain the speeds will be much lower.

Is there anything else I could do, and are there any other dangers I missed?

7
  • A warm welcome to the community. TLS solves most of your worries. VLANs if implemented correctly would also solve some more of your worries. Sep 19, 2023 at 17:38
  • @SirMuffington Thank you. Other than using DNS over HTTPS, is there anything else I can do as far as TLS is concerned, if I already visit only HTTPS-enabled websites?
    – Shelerra
    Sep 19, 2023 at 17:52
  • one danger you miss is that localhost:3000 may be available to any site on the internet. Though CORS would block responses, you might have POSTs which go through if it's not secured against CSRF. Sep 19, 2023 at 17:57
  • @pcalkins Wouldn't I first have to configure my router to forward port 80 to my computer's local IP? It's not configured by default.
    – Shelerra
    Sep 19, 2023 at 18:15
  • OP, see security.stackexchange.com/questions/257224/… and security.stackexchange.com/questions/245950/…. Although the context of your question is slightly different than that of the two above, the threat model is similar and thus the steps you would take to mitigate are similar.
    – mti2935
    Sep 19, 2023 at 18:16

1 Answer 1

0

After some more research, here's the answer I would give myself.

  1. Don't use insecure HTTP. There are browser settings and/or extensions that block HTTP or redirect it to HTTPS. If not, simply don't use websites over HTTP. This ensures your traffic is not sent in plaintext for anyone on the Internet to see.

  2. Don't use insecure DNS. Browsers have a setting to use secure DNS (DNS over HTTPS) - make sure it's on (for example, Cloudflare has a guide). It may be available system-wide in your network settings (if it's not, use dnscrypt-proxy). Don't forget to turn it on on your phone too. This way your DNS queries are encrypted.

  3. Don't open ports on 0.0.0.0. Open them on 127.0.0.1 instead. This answer explains the difference. This way, when you're developing a website, other devices on the LAN won't be able to connect to it.

  4. Use a VPN to mask your activity. Both your IP and the server IP are included in the network packets (otherwise they couldn't be delivered). This effectively reveals the websites you visit. You can get around this by routing the traffic through an intermediary, i.e. using a VPN. This answer explains it in more detail.

  5. Install updates on your devices regularly. This helps patch network vulnerabilities.

I didn't find other ideas useful. For example, I don't see how I could use a VLAN as suggested, because I don't have access to the router where it needs to be configured.

3
  • 1
    Regarding point #3, the linked answer doesn't mention the name localhost at all. I suspect that you have some misconceptions about how that name resolves. It is true that it isn't exactly the same as 127.0.0.1 (IPv4 loopback), since it also covers IPv6 loopback. But it does mean "only the loopback interface" unless you've modified /etc/hosts (which does also exist on Windows) to remap the name localhost.
    – Ben Voigt
    Sep 27, 2023 at 16:36
  • Thanks @BenVoigt, I meant 0.0.0.0. For example, it's the default for server.listen in Node.js: "If host is omitted, the server will accept connections on [...] the unspecified IPv4 address (0.0.0.0)".
    – Shelerra
    Sep 29, 2023 at 20:37
  • 1
    For 0.0.0.0 (aka INADDR_ANY) the concern is valid... although the question says localhost:3000. If you meant "local" rather than localhost there, you might edit the question to clarify.
    – Ben Voigt
    Sep 29, 2023 at 20:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .