Police allege 'evil twin' of in-flight Wi-Fi used to steal passenger's credentials Australia's Federal Police (AFP) has charged a man with running a fake Wi-Fi network on at least one commercial flight and using it to harvest flier credentials for email and social media services. The man was investigated after an airline "reported concerns about a suspicious Wi-Fi network identified by its employees during a …
How naive. Really ? Go back home and be nice is all he gets ?
He knows how to set up this stuff, he will do it again. How is the police going to monitor his connection to be sure he plays nice ? They won't. They don't have the means and, frankly, they have more important criminals to catch - and I'm furious that I have to acknowledge that.
I mean the number of times that the Ayatollah Khomeni, living at SW1A 1AA * logs in, you have to conclude there is zero checking of these details.... Mind you a little salting and pollution of their mailing lists is always a good thing. If they are harvesting valuable data, then it is not a "free" WiFi is it - so I give them non valuable data so they don't get nabbed for telling porkies.
* Buckingham Palace to save you looking it up
They generally ask for your email address (but can't confirm it, because you don't have internet access at that point) - they never need your email password.
I've always assumed that the "log in with $social" was an IQ test to determine what speed you should be permitted to use. I may be overthinking that though.
Pretty much every free WIFI offering asks for these details
.. and usually breaks GDPR compliance in the process.
I'm not bored enough yet, but I can ship enough breaches to the EU to keep them busy for a year. Unless there are big fines, everyone continues as is, only it's now called 'legitimate interest'.
Which was, of course, totally unexpected when they came up with that daft idea.
So charged with unauthorized access to devices and dishonest dealings.- Unless I am missing something, users voluntarily gave up details to access his AP and network services and he stored them like many ISPs do, so what crime was committed, unless he deliberately tried to imitate an airline free wi-fi to get credentials, if he just put up a page saying free wi-fi, then that's the users own fault?
However three charges of “possession or control of data with the intent to commit a serious offence” suggest the alleged perp was alive to the possibilities of using the data for nefarious purposes. - So just because he had the data freely given and that he "could" use it for naughty means, is now a crime, smells like he cops are desperate to pin something on him?
"unless he deliberately tried to imitate an airline free wi-fi to get credentials"
The article says he did exactly that:-
"It’s alleged the accused’s collection of kit was used to create Wi-Fi hotspots with SSIDs confusingly similar to those airlines operate for in-flight access to the internet or streamed entertainment."
Still though. Unless they used those credentials I can't see how unauthorised access to a computer system occurred.
Maybe some kind of fraud, copyright theft on the captive portal page maybe, and a beach of terms presumably as they were probably funneling victim traffic through the actual WiFi.
But I don't see the unauthorised access in these particular cases until the credentials are tested on something else.
I'd argue all the people above using fake emails to access a WiFi provider are closer to breaching that particular law
I guess when it actually goes to court we'll find out won't we? At the moment all that's happened is that the Magistrate agreed that there's enough evidence to send him before the courts - if there's enough evidence to prove beyond reasonable doubt that he was planning on using it for nefarious ends, then he'll be found guilty.
Charged + Released on Bail =/= Found Guilty and Convicted.
There seem to be two different attacks talked about here - not sure if both were actually used in this case:
The first is to ask for an email address on the Welcome page for the WiFi - which most public/free WiFi do - and then ask them for the password as well, which unsophisticated users will provide without thinking because they are so used to providing both together to access their email. Simple attack, works with about 2/3 of people I would guess, VPN makes no difference.
The second attack is to intercept traffic through your fake AP. This is where a VPN can make a difference. Although it is also enough to be sure you are using SSL connections and are not connecting to a spoofed domain - but, again, unsophisticated users are unlikely to notice. This attack could expose all passwords, not just the email account. It is rendered ineffective by 2FA.
"users of public Wi-Fi should 'install a reputable virtual private network (VPN) on your devices to encrypt and secure your data when using the internet.'”
I see this sort of comment all the time - who is reputable? How is the average Joe supposed to assess the security of a web company? Perhaps Margaret on social media can recommend a good one, or a google review by greatVPNs recommending greatVPN.com will be a safe bet?
Hell, I was nearly scammed by a web site that looked and felt like a big UK store ... the web address didn't feel right. In the end I phoned them and they suggested that people had lost their money on such sites and I should only use the *correct* company address ... What is the correct address, .com, .co.uk, .shop, .peanuts? They refused to understand the fundamental problem that a web site that looked and smelled correct actually had the wrong tld and refused to quote the correct one to me! If you don't know, how can you find out?
Another person in the public eye sponsored by N***VPN? Pointless if people have to connect to the WiFi first, and are conned into giving away their Office365 or Facebook credentials at the stage of logging into the WiFi. Also unnecessary if you don't accept man-in-the-middle certificates like *.airportwifi.net when you open Outlook.
I mean almost all phones can run a WiFi hotspot, which is renamable and can be made open to anyone if you like.
If the crime is using a certain name for your hotspot then that is an infinite list of potential letters and numbers. Boi g to be very hard to police that.
Similar to XKCDs Little Johnny Tables, at a certain point the onus falls on the people willing accepting what they see with no thought what so ever.
Not saying the guy is innocent, but it is certainly a horrific mess they are opening with this and will likely be seen by many as arbitrary rules on what they can do with their own devices.
"If the crime is using a certain name for your hotspot..."
It's not that, or at least, not just that, but his intentions when creating the hotspot. The article says the man was charged with "dishonest dealings" so it's about his motivations for providing the hotspot being different from what it would appear to someone connecting to it. Also, the article says the police searched his home and found some stuff. So again, there is more to this story than just using a certain hotspot name.
There are lots of offences that could individually cover a huge range of severities, that wouldn't be clear from just a simple reporting of the fact. For example, In the UK(other nations probably have their equivalent), the Computer Misuse Act makes it illegal to access data you are not authorised to. That could cover something as trivial as your other half's laptop to get the booking reference for a hotel you are both going to, or large scale accessing of a corporate system for espionage. Both the same technical offence but on very different scales and likely very different outcomes if you were caught.
It also said he did nothing with any of the information. So no malice committed and no evidence there was any ever intended.
Its getting silly, like saying because you have a car, you definitely intend to drive it into a crowd of people. You can twist any set of random happenings to be "malicious"
It also says he was charged following a search of his home under a warrant - which means that there may well have been enough corroborating evidence to support that theory.
At the end of the day, the burden of suspicion to make a charging decision is lower than the burden of a conviction - to charge someone needs sufficient level of suspicion to think that it's a strong possibility an offence was likely and that it needs to be proved out in court. To convict someone requires the prosecution to prove beyond reasonable doubt to the court that an offence took place by that person.
At least a decade ago we found several employee phones broadcasting SSIDs of "Free Internet Access"
The common thread was they'd all been on international flights recently and connected to that SSID thinking the obvious - and yes, they all had malware installed
Another staffer said he saw this (and realised it was fake) on a flight between USA and Australia - starting out with one phone broadcasting the SSID and several dozen doing it by the end of the flight
Criminals have been setting up lookalike connections to free WiFi for years for harvesting data. When found they should be put away, fined, and banned from using the net on their release, with exponentially increasing sentences for repeat offences. Usually it is cafe chains. It's only recently that most planes got WiFi. They should display the name visibly and ask people to report lookalikes over the PA. This is not something folk do by accident.
Reminds me of a time >20 years ago when I was staying in student digs out of term time for an academic conference (along with dozens of other academics). No WiFi, just plug-in internet in each room, but it was all very basic when it came to security. Out of sheer boredom (forgive me, I was young and naive, and I wouldn't do anything of the sort these days), I poisoned the DNS to route all the building's traffic via my laptop. A brief inspection of the (in those days largely non-encrypted) HTTP traffic told me that about a third of the requests were for exactly what you might think they were for. I quietly disconnected and let the DNS recover, and from that day forward I learned never to assume anything about an unknown network, other than that I shouldn't trust it to be free from eavesdropping. (AC for obvious reasons).
The guy's day job is advanced networking with a specialty in penetration testing of networks.
He knew what he was doing so I'm surprised he was so easily tracked down.
He was arrested by the Federal Police rather than State Police so there may be more to this story than is being reported
The AP hardware should be scanning for lookalikes but this requires more configuration and reconfiguration whenever an AP needs to be swapped so it doesn't trigger. Secondly, the standard should require host keys on connection, similar to ssh, although again this would likely lead to more headaches than most users are willing to put up with.
"AFP Western Command Cybercrime detective inspector Andrea Coleman pointed out that free Wi-Fi services should not require logging in through an email or social media account."
But they frequently do, even for the big players they want you to pass through a Facebook window to authenticate yourself against. And for good reason (so they can identify who's been slurping down the things they shouldn't) but this advice is just bonkers..
Or, maybe just don't use free wifi?
This reminds me that I still have WPA handshakes and other interesting packets to go through from my last visit to the airport :D
I always bring a Flipper, hackRF and ProxMark with me on vacations!
The guy was probably running a honeypot with "evilportal", you can easily find ready made captive portals but making a quick and dirty copy isn't all that difficult either.
I do tend to contact people when I've obtained credentials, to let them know to never trust open networks when they ask for credentials... Too many people fall for this simple trick!
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
