View Full Version : What a eavesdropper sees when you use an unsecured WiFi.
Here's what an eavesdropper sees when you use an unsecured Wi-Fi hotspot (http://www.pcworld.com/article/2043095/heres-what-an-eavesdropper-sees-when-you-use-an-unsecured-wi-fi-hotspot.html)
Well for any of you that have never heard of warnings about using unsecure public Wi-Fi hotspots like at your local coffee shop. Then you should know that eavesdroppers can capture information traveling over those access points you log onto. But nothing gets the point across as effectively as seeing the snooping in action. So read this article and think about you parking yourself at a local coffee shop to read a paper and get some free WiFi.
Got to love the free downloadable smart phone app
WoW don't know why that doubled posted.
35NCO Thanks for bring up the software defined radio (SDR) and the links. Forgot about the whole signal side.. Haha. Nothing really new with shopping at your local Radio Shack.
Indy - 14 letters, numbers, symbols, etc maybe hard to remember but with these apps and other things make no need to write passwords down. Software saves it on your laptop or smartphone.
Any packet analyzer will capture the POST and GET requests that send your username and pword in the clear for any website.
Wireshark & Aircrack are very effective tools for analysis and breaking simple passwords. 14 characters, upper and lower case, numbers, symbols, etc are a pain to remember but they do work...or actually just make it more difficult (require more time and resources) to crack.
With some of the FREE software defined radio (SDR) out there right now and the right digital TV OTA USB dongle and the right combo of FREE demodulation software, anyone (Whom understands signals and modulation well enough) can demodulate and listen in to your cell phone calls GSM or CDMA, home phone wireless, CB, ham, aircraft,HF, OTA data, and police signals. OTA dongles do 25mhz to 9ghz with the right antenna. Oh and if you know what you are looking for you can intercept and download on demand up to date weather satellite images which includes general telemetry data. The right setup would allow direction finding as well. :eek:
The private open source market will one day soon outpace the government.
Nothing in the air is EVER safe 100%.
Here are a few links to try if you ever need an easy project. I have tried it with 9dbi and 20 dbi 5ghz WIFI antennas with an adapter to the dongle and have had some excellent results. Setup takes around 15 minutes if you are computer savy.
http://www.instructables.com/id/24Mhz-1800Mhz-SDR-Radio-receiver-for-15-Digital-1/
http://www.instructables.com/id/How-to-download-satellite-pictures-of-earth-for-un/
https://sites.google.com/site/policescannerhowto/
...the right combo of FREE demodulation software, anyone can demodulate and listen in to your cell phone calls GSM or CDMA,..
Yes, BUT you're talking about a laptop with 1T of RAM to conduct a brute force attack on the A5/1 encryption (64 bits). CDMA2000 (e.g. Verizon) uses spread spectrum so, while possible, it IS difficult.
The encryption CAN be broken but the real meat and potatoes of the task is finding the RIGHT device to monitor. Not easy at all.
Your right to call me out on the "anyone". I edited it to be more accurate. My point just is, the capability is out there and cheap enough now that it is more accessible to the average Joe then it ever has been.
Factor in all those 12-35ish somethings still living with their parents and nothing better to do then write code; and then you have a very interesting problem.
While I applaud their intelligence and creativity, I just wish they would not post all their great ideas open source. Then again, it does level the playing field and perhaps does add more freedom to those whom feel suppressed under the current system. It is about the point of view.
WIFI falls in the signals spectrum and is just as vulnerable than any other signal. As long as there are clever people, the spectrum will never be secure. Just as computers, banks, safes, ...ext.
You'd be best to social engineer people for a bit and just start guessing their passwords when they use special characters. :D
Some people are dumb when it comes to these. I'm a fan of the "forgot password" button. Becomes a fun way to just answer what you know about them and change their passwords for them. Good for teaching the wife a lesson when she ignores me and doesn't change her passwords when I prompt her too. Ok, the wife is easy, I know her. But how hard is it to find out what your mom's maiden name is, name of your first pet......etc....etc? Not hard. Think about how you answer them and then lie. Makes it harder to socially hack you.
You'd be best to social engineer people for a bit and just start guessing their passwords when they use special characters. :D
Some people are dumb when it comes to these. I'm a fan of the "forgot password" button. Becomes a fun way to just answer what you know about them and change their passwords for them. Good for teaching the wife a lesson when she ignores me and doesn't change her passwords when I prompt her too. Ok, the wife is easy, I know her. But how hard is it to find out what your mom's maiden name is, name of your first pet......etc....etc? Not hard. Think about how you answer them and then lie. Makes it harder to socially hack you.
No Jbour you bring up a great point. I have brought up the whole social engineering on people subject. But as someone told me, some people don't think it can work. Well next time your in a bar try it. Make sure you have a BS Facebook and Twitter account, they help for some (younger) people if you want to dig down on some back ground. But go look or set up a yahoo or gmail account and write down the reset your password questions. Heck I bet you could google them. These are great bar questions to ask people once you "built a friendship". With or without alcohol, people typically love talking about themselves. Also I'm not saying go and log onto someone's email by the security question, you would be at the minimum committing a misdemeanor in most states by being charged with unauthorized access to a computer.
If you don't believe what Jbour is talking about, just go check out Sarah Palin. (http://en.wikipedia.org/wiki/Sarah_Palin_email_hack)