Dangers of using public hotspots

C

CeD

Limp Gawd
Joined
Feb 10, 2003
Messages
182
Hey all,

Are there any potential dangers with using public hotspots in the airport, etc? Can passwords used to connect to POP and SMTP servers be sniffed?

If so, any other issues of this nature?
 
Depends on if it will let you use WEP or WPA. I know that you can use Linux to easily snatch passords and such out of the air if good encryption is not in place. If you do encrypt...then it all depends on how much time/interest the hacker has.
 
Gotcha, I am assuming that most public hotspots do not offer encryption?

So, it is possible to sniff passwords transmited to connect to SMTP and POP3.
:mad:
 
Not only possible, but very likely. You could always have a VPN server somewhere and connect to that for security purposes.

//edit: POP and many other passwords are clear-text, in case you weren't aware.
 
MiXdNuTs said:
I know that you can use Linux to easily snatch passords and such out of the air if good encryption is not in place.
Click to expand...
[off topic rant]
ok, linux is *just* an os. yes, there is software available for people to obtain passwords in this situation. and yes, some of it even runs on linux os's. but funnily enough, there is also similar software available for windows/unix/mac/whatever-os-you-may-use.

i'm not a pro-linux zealot, nor am i an anti-linux nut, but it fustrates me when i see things like this...
[/off topic rant]

in answer to your question: it really depends on what encryption is being used. since most hotspots are not run by hard core system admins, then wep would be a common one to look for.

while wep is by no means completely secure, it at least makes a hacker *try* to get your information from you, which will be sufficient to deter most pople from bothering.

i guess that it once again comes down to the risk and reward trade off of security. *if* someone gets all your passwords, how much will you lose. if your work is particularly sensitive, then perhaps a hotspot is not the best place to go. if you're checking your hotmail account for mesages from a friend, then i wouldn't be too worried.
 
sparkles said:
while wep is by no means completely secure, it at least makes a hacker *try* to get your information from you, which will be sufficient to deter most pople from bothering.
Click to expand...
I would say that, for a public hotspot (easy access plus low detection risk plus lots of users == high profile target), WEP should be considered worthless. It's too easy for a hacker to invest the ~4 hours of WEP cracking time and have that much opportunity to grab data.

You're dead on about the "linux" bit, though. Even if it were software for linux only, snooping is not at all computationally intensive, and emulation software would pick up the slack just fine.

Also remember that, even if you only check hotmail, many people use the same password lots of places -- for instance, someone who snoops my lomn75@hardforum account would be stupid not to try lomn75@yahoo or lomn75@ebay or lomn75@paypal or what have you with the snooped password. Not that I'm saying it would help in my case, but you get the point.

//edit: This is why I mentioned VPN earlier. Once you have a VPN tunnel in place, your whole connection is secure from a wireless standpoint. I think it should mandatory for any wireless connection used for non-trivial purposes.
 
Ethereal is multiplatformal, I use it in both windows and linux, and I have used it to sniff traffic on wirless before. NEVER use public hotspots unless you tunnel through it, say using ssh with port forwarding, and even then, I would say just don't do it.


//edit: This is why I mentioned VPN earlier. Once you have a VPN tunnel in place, your whole connection is secure from a wireless standpoint. I think it should mandatory for any wireless connection used for non-trivial purposes.
Click to expand...
although VPN does add to security, it still can be defeted. There are a few tools for Linux that I have seen specificly for high-jacking a vpn connection in progress. Its still better then nothing, but I wouldn't trust it with any sensitive information.
 
Xipher said:
although VPN does add to security, it still can be defeted. There are a few tools for Linux that I have seen specificly for high-jacking a vpn connection in progress. Its still better then nothing, but I wouldn't trust it with any sensitive information.
Click to expand...
Good point. I think, thought, that here we're back to "too complicated to mess with." The gain of breaking a single user's VPN (with content of unknown value) versus the rest of the unsecure users at a hotspot is probably sufficient protection in and of itself.
 
lomn75 said:
Good point. I think, thought, that here we're back to "too complicated to mess with." The gain of breaking a single user's VPN (with content of unknown value) versus the rest of the unsecure users at a hotspot is probably sufficient protection in and of itself.
Click to expand...
Actually, the fact they are using VPN tends to mean they have something worth value to hide.
 
Well, I would say it is dependent on the info your retrieving, if its urgent you get it, but doesn't really have any other impact then on you, I think it could be ok. but if its very sensitive information, then wait till you have a little more secure connection that you can use.
 
You must log in or register to reply here.
Back
Top