Cybersecurity

5618 readers

191 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Be respectful. Everyone should feel welcome here.
No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
No Ads / Spamming.
No pornography.

Community Rules

Idk, keep it semi-professional?
Nothing illegal. We're all ethical here.
Rules will be added/redefined as necessary.

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !cybersecurity@lemmy.capebreton.social !securitynews@infosec.pub !netsec@links.hackliberty.org !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub

Notable mention to !cybersecuritymemes@lemmy.world

founded 1 year ago

MODERATORS

kid@sh.itjust.works

Lanky_Pomegranate530@midwest.social

Police allege ‘evil twin’ in-flight Wi-Fi used to steal info (www.theregister.com)

submitted 4 months ago by kid@sh.itjust.works to c/cybersecurity@sh.itjust.works

11 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] cheese_greater@lemmy.world 10 points 4 months ago (3 children)

Use a VPN mitigates this doesn't it?

[–] jvilhuber@feddit.de 7 points 4 months ago

From the article:

Perhaps curiously, she advocated users of public Wi-Fi should “install a reputable virtual private network (VPN) on your devices to encrypt and secure your data when using the internet.”

Though I'm not sure why "curiously".

[–] where_am_i@sh.itjust.works 2 points 4 months ago (2 children)

This would only be an interim solution. The attacker here sets up a fake github.com and collects credentials. So, VPN would be first trying to route over some internal hostname/IP address and probably just fail.

However, if everyone uses some VPN, the attacker can start imitating the VPN server. Or all the common ones. Redirect all traffic to a fake myvpnname.com/login with a message "you're using your device from a suspicious location, please confirm your credentials". You're on a plane, so you think this makes sense, punch in your password and it's gone!

[–] Socsa@sh.itjust.works 6 points 4 months ago* (last edited 4 months ago)

With a VPN, the only real attack vector here is to block the VPN traffic and hope the user disables it or doesn't notice it didn't connect. No modern VPN will handshake with a spoofed server so it will just never connect. In some cases, the connection might fail silently enough to fool someone like this, but basically every mainstream app these days is pretty vocal about that for exactly this reason. As of Android 13, the default behavior is never to pass traffic outside the VPN unless the user explicitly turns it off. On other platforms this is dependent on the specific app.

[–] WolfLink@sh.itjust.works 1 points 4 months ago

This wouldn’t work. Your VPN would fail to connect because the attacker wouldn’t have the right encryption key. The only way to successfully mimic the VPN provider would be to be there the first time the user installed the VPN software.

[–] kid@sh.itjust.works 2 points 4 months ago

Well, depends. If the user go to a captive portal to "authenticate" before the VPN could closes, than no. But, if the VPN can "pierce" through it (without any intervention from the AP), than yes. Anyways, If the user is willing to provide authentication data (like social media accounts, etc), nothing matters.