In association with heise online

28 January 2007, 19:02

WLAN traps at US airports

  • Twitter
  • Facebook
  • submit to slashdot
  • StumbleUpon
  • submit to reddit

WLAN hot spots are popular. You can pass the time waiting at airports or train stations working off your backlog of emails. For some time, man-in-the-middle attacks via ad-hoc mode have been making the rounds at US airports, according to Computerworld, which advises users to shut off the ad-hoc mode in the WLAN settings under Windows. But now that attackers are pretending to be access points, that is not enough protection: they can configure a WLAN PC card as an unencrypted soft AP and name their bait something like "Free WiFi". They then use your notebook's integrated WLAN adapter to connect to a real hot spot and clear the connection via the soft AP by means of Internet Connection Sharing. They can even do so using a single WLAN card.

Attackers pretending to be an access point are not even limited to passive tapping; rather, they can filter their victims' entire data traffic, sift through shared files, and inject malicious code into Web sites visited by acting as a Web proxy for the victims. In other words, simply disabling file shares or activating your operating system's firewall will not do the trick, regardless of whether you are using Windows, Mac OS X, or Linux. If you want to take care of sensitive matters on the road, you will have to set up an encrypted VPN connection to a trusted network and route all traffic through that. And if your browser or e-mail client complains about an outdated or missing certificate when setting up a secure connection, don't ignore the warning - disconnect instead.


Print Version | Send by email | Permalink:

  • July's Community Calendar

The H Open

The H Security

The H Developer

The H Internet Toolkit