5 ms·

Invalid SSL cert on the site. > There were even reports of people's Gmail accounts being hacked. This sounds suspiciously false - even if they are phones were

Invalid SSL cert on the site. > There were even reports of people's Gmail accounts being hacked. This sounds suspiciously false - even if they are phones were forced to downgrade to A5/1 this should have no effect on TLS.

sowbug 10y ago
Without HSTS and cert pinning they don't even get as far as TLS.
- forgotpwtomain 10y ago
  If they've connected to Gmail before they would have received HSTS headers. So I'm not sure what you are suggesting? Could you elaborate on how you think GSM cipher downgrades lead to stolen Gmail credentials? edit: Furthermore Chrome/Firefox implement HSTS preload lists on which gmail.com is included. [0][1] [0] https://cs.chromium.org/chromium/src/net/http/transport_security_state_static.json https://cs.chromium.org/chromium/src/net/http/transport_secu... [1] https://blog.mozilla.org/security/2012/11/01/preloading-hsts/ https://blog.mozilla.org/security/2012/11/01/preloading-hsts...
  - MertsA 10y ago
    I can see something simple like redirecting random pages to a fake login page. The average person will fall for the simplest of attacks so it wouldn't surprise me to hear that they were just using a captive portal that asked for their Google account credentials to use wifi.
    - breatheoften 10y ago
      This doesn't even seem that different from how gmail actually works -- before I stopped using it I was always astonished by the insane chain of redirects the browser is directed through before eventually seeing the login screen.
  - sowbug 10y ago
    The article said people were reporting that Gmail accounts have been hacked in an environment where malicious Wifi APs are prevalent. Your post said that report "sounds suspiciously false." My reply contended that it's possible. A device running something other than a recent version of a modern browser is entirely susceptible to connection to Gmail over a non-TLS pipe or TLS to a MITM, especially when that device is using a fake Wifi AP. Citing that the state of the art in browser technology exists does not change that point. Do you agree it's possible the claim is true?
    - forgotpwtomain 10y ago
      > Citing that the state of the art in browser technology exists does not change that point. > Do you agree it's possible the claim is true? HSTS preload lists are not new (the Mozilla blog I referenced above is dated 2012). > The article said people were reporting that Gmail accounts have been hacked in an environment where malicious Wifi APs are prevalent. Your post said that report "sounds suspiciously false." If it's a case of 'technically illiterate user entered gmail credentials on a wifi-login page' than that can happen on literally any wifi-AP. I'm saying that the claim that phones are being forced to connect to fake base-stations mounted on Cessna's (which is possible) is not at all substantiated by reports of people's Gmail accounts being hacked, the later just sounds like lazy journalism as another commenter has pointed out.
      - sowbug 10y ago
        I very much doubt the claims are as narrowly scoped as that. As you say, it's either imprecise journalism or merely repeating the reports of people who are (by definition) terribly confused about what's going on. By the way, I wouldn't call these people technically illiterate. The way you're using that term sets a bar so high that it includes almost everyone. If many people were at that level of technical literacy, we wouldn't have needed HSTS in the first place.
        tonyarkles 10y ago
        You folks are talking about HSTS and Browsers, but with phones there's a quite simpler attack vector for grabbing email credentials: IMAP. If the FBI has a certificate for imap.gmail.com that is signed by a CA, they can MITM that route. Even for my 2FA GMail setup (where each non-2FA enabled app gets an app-specific password), doing IMAP MITM will get the app-specific password, which would enable further IMAP access.
natch 10y ago
I don't know. Are you assuming that the Android phones at the camp are updated with the latest Android versions and security patches?
- gurkendoktor 10y ago
  There's also a screenshot of an iPhone lock-screen in the Cracked article (running iOS 10 too), but it's dated November 11. It seems odd that it would appear in an article on December 01.
MertsA 10y ago
Do you have an extension that is trying to redirect you to https? It's an http link but I can see that https doesn't work on cracked.com.
- forgotpwtomain 10y ago
  Traveling and the ISP here hi-jacks DNS requests for http sites to it's currently broken proxy..
  - MertsA 10y ago
    That's the real crime here.
karambahh 10y ago
They mention unsecured Wi-Fi? Either way, openly attacking citizens accounts seems... surprising for a government agency confronted to peaceful protesters? I don't doubt the US (or German, or UK, etc) have the technical capacity to do such things, but would they risk it be discovered for such a "low" target as a natural site? If true that probably means they have much more powerful tools at their disposal for "true emergencies"...?
- dsfyu404ed 10y ago
  However bad you think the government's actions are double your expectations and it's still worse than that.

sowbug 10y ago

Without HSTS and cert pinning they don't even get as far as TLS.

forgotpwtomain 10y ago
If they've connected to Gmail before they would have received HSTS headers. So I'm not sure what you are suggesting? Could you elaborate on how you think GSM cipher downgrades lead to stolen Gmail credentials? edit: Furthermore Chrome/Firefox implement HSTS preload lists on which gmail.com is included. [0][1] [0] https://cs.chromium.org/chromium/src/net/http/transport_security_state_static.json https://cs.chromium.org/chromium/src/net/http/transport_secu... [1] https://blog.mozilla.org/security/2012/11/01/preloading-hsts/ https://blog.mozilla.org/security/2012/11/01/preloading-hsts...
- MertsA 10y ago
  I can see something simple like redirecting random pages to a fake login page. The average person will fall for the simplest of attacks so it wouldn't surprise me to hear that they were just using a captive portal that asked for their Google account credentials to use wifi.
  - breatheoften 10y ago
    This doesn't even seem that different from how gmail actually works -- before I stopped using it I was always astonished by the insane chain of redirects the browser is directed through before eventually seeing the login screen.
- sowbug 10y ago
  The article said people were reporting that Gmail accounts have been hacked in an environment where malicious Wifi APs are prevalent. Your post said that report "sounds suspiciously false." My reply contended that it's possible. A device running something other than a recent version of a modern browser is entirely susceptible to connection to Gmail over a non-TLS pipe or TLS to a MITM, especially when that device is using a fake Wifi AP. Citing that the state of the art in browser technology exists does not change that point. Do you agree it's possible the claim is true?
  - forgotpwtomain 10y ago
    > Citing that the state of the art in browser technology exists does not change that point. > Do you agree it's possible the claim is true? HSTS preload lists are not new (the Mozilla blog I referenced above is dated 2012). > The article said people were reporting that Gmail accounts have been hacked in an environment where malicious Wifi APs are prevalent. Your post said that report "sounds suspiciously false." If it's a case of 'technically illiterate user entered gmail credentials on a wifi-login page' than that can happen on literally any wifi-AP. I'm saying that the claim that phones are being forced to connect to fake base-stations mounted on Cessna's (which is possible) is not at all substantiated by reports of people's Gmail accounts being hacked, the later just sounds like lazy journalism as another commenter has pointed out.
    - sowbug 10y ago
      I very much doubt the claims are as narrowly scoped as that. As you say, it's either imprecise journalism or merely repeating the reports of people who are (by definition) terribly confused about what's going on. By the way, I wouldn't call these people technically illiterate. The way you're using that term sets a bar so high that it includes almost everyone. If many people were at that level of technical literacy, we wouldn't have needed HSTS in the first place.
      - tonyarkles 10y ago
        You folks are talking about HSTS and Browsers, but with phones there's a quite simpler attack vector for grabbing email credentials: IMAP. If the FBI has a certificate for imap.gmail.com that is signed by a CA, they can MITM that route. Even for my 2FA GMail setup (where each non-2FA enabled app gets an app-specific password), doing IMAP MITM will get the app-specific password, which would enable further IMAP access.

natch 10y ago

I don't know. Are you assuming that the Android phones at the camp are updated with the latest Android versions and security patches?

gurkendoktor 10y ago
There's also a screenshot of an iPhone lock-screen in the Cracked article (running iOS 10 too), but it's dated November 11. It seems odd that it would appear in an article on December 01.

MertsA 10y ago

Do you have an extension that is trying to redirect you to https? It's an http link but I can see that https doesn't work on cracked.com.

forgotpwtomain 10y ago
Traveling and the ISP here hi-jacks DNS requests for http sites to it's currently broken proxy..
- MertsA 10y ago
  That's the real crime here.

karambahh 10y ago

They mention unsecured Wi-Fi? Either way, openly attacking citizens accounts seems... surprising for a government agency confronted to peaceful protesters? I don't doubt the US (or German, or UK, etc) have the technical capacity to do such things, but would they risk it be discovered for such a "low" target as a natural site? If true that probably means they have much more powerful tools at their disposal for "true emergencies"...?

dsfyu404ed 10y ago
However bad you think the government's actions are double your expectations and it's still worse than that.