Hacker News Reader

Comment by noselasd | Hacker News Reader

And it's even very easy to exploit. You connected your phone/whatever to an open wifi network once ?

Well, now it'll probably go looking for that network wherever you go, since the device will basically go and broadcast "Where is SSID XYZ ?". Making it easy for anyone to switch the SSID on their AP, turn off authentication , and your phone connects to it - and probably starts pulling updates from your services. Just hope that's done over SSL/HTTPS and that the app validates the certificates.

View on HN

Not only that but also, as SSIDs are often unique, it's possible to completely passively track all the locations your device has been. More info in this talk: https://www.youtube.com/watch?v=03iEaKPRb9A

If you're trusting the network you've already lost. It's not like the open internet is safe.

If we assume all connections are over SSL/SSH with certificate checking, what can a malicious AP do to you? (Another comment points out your location can be tracked by your device's radio; anything else?)

So with this technique, would someone be able to change the SSID of their router to match that of another nearby router where devices are likely to be attempting to connect in an effort to intercept the passwords being supplied to establish the connection to the router originally using that SSID?

Yes, doesn't have to be a nearby router though. The point is: your device broadcasts the names of all routers it's connected to. You just need to listen, then spoof the name, then the device will connect to you.

If the target device is already connected, you just need to DoS the router it's connected to and the device will reset the connection and start looking again. There are probably more elegant ways to force a reconnect than a simple DoS attack too.

repledit to mention that this only works for open routers.

The WPA handshake is such that the password won't be leaked to an imposter router.

Why wouldn't the default behavior be to not connect with the AP if the required authentication doesn't match the stored one?

Then the attacker would at least have to try different auth modes until the device connects.

It normally is. I mentioned open wifi networks specifically - i.e. the ones with no authentication, one you consciously connected to last year at a party/conference/bus stop/... and forgot about. Your device is still looking for its SSID.

Reply on news.ycombinator.com