Thursday, January 18, 2024

Mythbusters: Is An Open (Unencrypted) WiFi More Dangerous Than A WPA2-PSK? Actually, It Is Not.

Introduction


Whenever security professionals recommend the 5 most important IT security practices to average users, one of the items is usually something like: "Avoid using open Wifi" or "Always use VPN while using open WiFi" or "Avoid sensitive websites (e.g. online banking) while using open WiFI", etc.

What I think about this? It is bullshit. But let's not jump to the conclusions. Let's analyze all risks and factors here.


During the following analysis, I made two assumptions. The first one is that we are comparing public WiFi hotspots with no encryption at all (referred to as Open), and we compare this to public WiFi hotspots with WPA2-PSK (and just hope WEP died years before). The other assumption is there are people who are security-aware, and those who just don't care. They just want to browse the web, access Facebook, write e-mails, etc.

The risks


Let's discuss the different threats people face using public hotspots, compared to home/work internet usage:
1. Where the website session data is not protected with SSL/TLS (and the cookie is not protected with secure flag), attackers on the same hotspot can obtain the session data and use it in session/login credentials stealing. Typical protocols affected:

  • HTTP sites
  • HTTPS sites but unsecured cookie
  • FTP without encryption
  • IMAP/SMTP/POP3 without SSL/TLS or STARTTLS

2. Attackers can inject extra data into the HTTP traffic, which can be used for exploits, or social engineer attacks (e.g. update Flash player with our malware) – see the Dark Hotel campaign

3. Attackers can use tools like SSLStrip to keep the user's traffic on clear text HTTP and steal password/session data/personal information

4. Attackers can monitor and track user activity

5. Attackers can directly attack the user's machine (e.g. SMB service)

WPA2-PSK security


So, why is a public WPA2-PSK WiFi safer than an open WiFi? Spoiler alert: it is not!

In a generic public WPA2-PSK scenario, all users share the same password. And guess what, the whole traffic can be decrypted with the following information: SSID + shared password + information from the 4-way handshake. https://wiki.wireshark.org/HowToDecrypt802.11
If you want to see it in action, here is a nice tutorial for you
Decrypted WPA2-PSK traffic

Any user having access to the same WPA2-PSK network knows this information. So they can instantly decrypt your traffic. Or the attackers can just set up an access point with the same SSID, same password, and stronger signal. And now, the attacker can instantly launch active man-in-the-middle attacks. It is a common belief (even among ITSEC experts) that WPA2-PSK is not vulnerable to this attack. I am not sure why this vulnerability was left in the protocol, if you have the answer, let me know. Edit (2015-08-03): I think the key message here is that without server authentication (e.g. via PKI), it is not possible to solve this.
Let me link here one of my previous posts here with a great skiddie tool:

To sum up, attackers on a WPA2-PSK network can:

  • Decrypt all HTTP/FTP/IMAP/SMTP/POP3 passwords or other sensitive information
  • Can launch active attacks like SSLStrip, or modify HTTP traffic to include exploit/social engineer attacks
  • Can monitor/track user activity

The only difference between open and WPA2-PSK networks is that an open network can be hacked with an attacker of the skill level of 1 from 10, while the WPA2-PSK network needs and an attacker with a skill level of 1.5. That is the difference.

The real solutions



1. Website owners, service providers should deploy proper (trusted) SSL/TLS infrastructure, protect session cookies, etc. Whenever a user (or security professional) notices a problem with the quality of the service (e.g. missing SSL/TLS), the service provider has to be notified. If no change is made, it is recommended to drop the service provider and choose a more secure one. Users have to use HTTPS Everywhere plugin.

2. Protect the device against exploits by patching the software on it, use a secure browser (Chrome, IE11 + enhanced protection), disable unnecessary plugins (Java, Flash, Silverlight), or at least use it via click-to-play. Also, the use of exploit mitigations tools (EMET, HitmanPro Alert, Malwarebytes AntiExploit) and a good internet security suite is a good idea.

3. Website owners have to deploy HSTS, and optionally include their site in an HSTS preload list

4. Don't click blindly on fake downloads (like fake Flash Player updates)


5. The benefits of a VPN is usually overestimated. A VPN provider is just another provider, like the hotspot provider, or the ISP. They can do the same malicious stuff (traffic injecting, traffic monitoring, user tracking). Especially when people use free VPNs. And "Average Joe" will choose a free VPN. Also, VPN connections tend to be disconnected, and almost none of the VPN providers provide fail secure VPNs. Also, for the price of a good VPN service you can buy a good data plan and use 4G/3G instead of low-quality public hotspots. But besides this, on mobile OSes (Android, iOS, etc.) I strongly recommend the use of VPN, because it is not practically feasible to know for users which app is using SSL/TLS and which is not.

6. Use a location-aware firewall, and whenever the network is not trusted, set it to a Public.

7. In a small-business/home environment, buy a WiFi router with guest WiFi access possibility, where the different passwords can be set to guest networks than used for the other.

Asking the question "Are you using open WiFi?", or "Do you do online banking on open WiFi?" are the wrong questions. The good questions are:
  • Do you trust the operator(s) of the network you are using?
  • Are the clients separated?
  • If clients are not separated, is it possible that there are people with malicious intent on the network?
  • Are you security-aware, and are you following the rules previously mentioned? If you do follow these rules, those will protect you on whatever network you are.

And call me an idiot, but I do online banking, e-shopping, and all the other sensitive stuff while I'm using open WiFi. And whenever I order pizza from an HTTP website, attackers can learn my address. Which is already in the phone book, on Facebook, and in every photo metadata I took with my smartphone about my cat and uploaded to the Internet (http://iknowwhereyourcatlives.com/).


Most articles and research publications are full of FUD about what people can learn from others. Maybe they are just outdated, maybe they are not. But it is totally safe to use Gmail on an open WiFi, no one will be able to read my e-mails.

PS: I know "Average Joe" won't find my blog post, won't start to read it, won't understand half I wrote. But even if they do, they won't patch their browser plugins, pay for a VPN, or check the session cookie. So they are doomed to fail. That's life. Deal with it.

Read more

  1. Best Hacking Tools 2019
  2. Kik Hack Tools
  3. Pentest Tools Subdomain
  4. Hacker Tools For Pc
  5. Hack Tools Download
  6. Hacking Tools Name
  7. Pentest Tools Kali Linux
  8. Hacking Tools Github
  9. Pentest Tools Online
  10. Hacking Tools For Pc
  11. Pentest Tools Website
  12. Hacking Apps
  13. Pentest Automation Tools
  14. Nsa Hack Tools Download
  15. Hacker Tools Apk Download
  16. Android Hack Tools Github
  17. Hacking Apps
  18. Hacking Tools Windows
  19. Growth Hacker Tools
  20. Hacker Tool Kit
  21. Hacker Tools 2020
  22. Hacking App
  23. Wifi Hacker Tools For Windows
  24. Bluetooth Hacking Tools Kali
  25. Computer Hacker
  26. Hacking Tools For Beginners
  27. Hack Tools Pc
  28. Hacker Tools For Mac
  29. New Hacker Tools
  30. Hack Tools Online
  31. Physical Pentest Tools
  32. Termux Hacking Tools 2019
  33. Hacking Tools Kit
  34. Pentest Tools
  35. Hacking Tools And Software
  36. Pentest Tools Bluekeep
  37. Black Hat Hacker Tools
  38. Hacking Tools Pc
  39. How To Make Hacking Tools
  40. Android Hack Tools Github
  41. Pentest Recon Tools
  42. Hacker Tools Windows
  43. Hacking Tools Mac
  44. Pentest Tools Open Source
  45. Hacker Tools 2019
  46. Hacking Tools Mac
  47. How To Hack
  48. Hacking Tools For Windows 7
  49. Pentest Tools Website Vulnerability
  50. New Hacker Tools
  51. Hacker Tools Free
  52. Hack Apps
  53. Hack Tools Online
  54. Hacker Tools For Windows
  55. Pentest Tools Port Scanner
  56. Pentest Tools Bluekeep
  57. Kik Hack Tools
  58. Pentest Tools Subdomain
  59. Hack Tools For Pc
  60. Nsa Hacker Tools
  61. Hacker Search Tools
  62. Hack Tools Pc
  63. Blackhat Hacker Tools
  64. Hacker Tools Apk Download
  65. Hacker Tools For Pc
  66. Hack App
  67. Pentest Reporting Tools
  68. Hacker Techniques Tools And Incident Handling
  69. Pentest Tools Framework
  70. Hacking Tools For Kali Linux
  71. Tools Used For Hacking
  72. How To Hack
  73. Pentest Tools Find Subdomains
  74. Best Hacking Tools 2020
  75. Usb Pentest Tools
  76. Pentest Tools Linux
  77. Hacker Tools 2019
  78. Hack Tools For Mac
  79. Hacker Tools For Pc
  80. Hackers Toolbox
  81. Pentest Tools For Windows
  82. Hack Tools Mac
  83. Pentest Tools For Windows
  84. Hack Tools Download
  85. Hacker Hardware Tools
  86. Hack And Tools
  87. Hacker Hardware Tools
  88. Nsa Hack Tools
  89. Pentest Tools Windows
  90. Hackers Toolbox
  91. Hacking Tools Software
  92. New Hacker Tools
  93. Best Hacking Tools 2019
  94. What Are Hacking Tools
  95. Hacker Tools For Ios
  96. Pentest Tools Free
  97. Free Pentest Tools For Windows
  98. Hack Tools Mac
  99. Pentest Tools List
  100. Nsa Hack Tools Download
  101. Hacking Tools Free Download
  102. Hacking Tools
  103. Hack And Tools
  104. Hacker Tools For Ios
  105. Pentest Recon Tools
  106. Hacker Tools For Windows
  107. Pentest Tools Open Source
  108. Hacking Tools Name
  109. Hacker Tools For Mac
  110. Hackrf Tools
  111. Hacking Tools For Beginners
  112. Hacking Tools Pc
  113. Pentest Reporting Tools
  114. Hack Tools
  115. Pentest Tools Android
  116. Pentest Tools Free
  117. Hacker Search Tools
  118. Hack Apps
  119. Android Hack Tools Github
  120. Hacking Tools Hardware
  121. Hackrf Tools
  122. Pentest Tools Nmap
  123. Pentest Tools Subdomain
  124. Hack Tools 2019
  125. Free Pentest Tools For Windows
  126. Ethical Hacker Tools
  127. Install Pentest Tools Ubuntu
  128. Github Hacking Tools
  129. Pentest Tools Url Fuzzer
  130. Hacker Security Tools
  131. Hacker Tools
  132. Ethical Hacker Tools
  133. Hack Tools Mac
  134. Kik Hack Tools
  135. What Is Hacking Tools
  136. Hacking Tools 2019
  137. Hack Website Online Tool
  138. Wifi Hacker Tools For Windows
  139. Hacking Tools
  140. Hacking Tools 2019
  141. Hack Tools For Windows
  142. Hacking Tools Mac
  143. Pentest Tools Bluekeep
  144. Computer Hacker
  145. Hacking App
  146. Ethical Hacker Tools
  147. Pentest Tools Open Source
  148. Nsa Hack Tools Download
  149. Best Hacking Tools 2019
  150. Pentest Tools Windows
  151. Pentest Tools Kali Linux
  152. Android Hack Tools Github
  153. Pentest Tools Alternative
  154. Hacks And Tools
  155. Pentest Tools Tcp Port Scanner
  156. Hacking Tools Usb
  157. Pentest Tools Tcp Port Scanner
  158. Hacker Tools Free Download
  159. Pentest Tools Url Fuzzer
  160. Ethical Hacker Tools
  161. Hacker Tools Hardware
  162. New Hack Tools
  163. Hacking Tools Name
  164. Pentest Tools Website
  165. Hack Tools Download
  166. Pentest Tools Windows
  167. Hacking Tools For Windows 7
  168. New Hacker Tools

No comments:

Post a Comment