3 ms·

This is a pretty nasty situation that could happen to anyone. It might not have even been the wifi password. Any malware could have set up a vpn and done the sa

This is a pretty nasty situation that could happen to anyone. It might not have even been the wifi password. Any malware could have set up a vpn and done the same thing. Of course it's important to stop real crime but there has to be some improvements here. At the very least they could have collected the passwords for the devices and dumped the storage to be investigated later rather than leaving these people without their essential devices for 3 months.

azalemeth 5y ago
It's worth noting that if they didn't hand over the passwords they're automatically liable for an offence whose punishment is two years in gaol, and all the police need to prove is that it is likely that they did know them. One of the quotes of the article describes the husband getting what is presumably an admin key from work for a Windows laptop -- if the crown wanted to, that alone would be enough to utterly throw him under the bus. I honestly have an irrational fear of this happening to me. It's a great way for a malicious actor to utterly wreck someone's life. I tunnel all outbound traffic over a supposedly privacy-preserving (or at least non-UK) VPN, but honestly, this is the dystopian stuff of my nightmares. And I don't know why!
- alibarber 5y ago
  How do you tunnel your traffic though? Unless you can be sure it's forcing everything on your wifi network through it, then that wouldn't offer any protection to someone else using it without the tunnel, as is assumed to happen in this case.
  - slimsag 5y ago
    A lot of WiFi routers actually support plugging in VPN details in the router software itself, it's not complex at all[0] even for your average consumer. [0] https://www.expressvpn.com/vpn-software/vpn-router#recommended-routers https://www.expressvpn.com/vpn-software/vpn-router#recommend...
    - rnotaro 5y ago
      I believe you're over estimating the skills of the average consumer. The average consumer usually don't even know how to access their router' web interface.
  - azalemeth 5y ago
    As the other poster here says, I just configure it at the network level: my default gateway is a single-board computer set up to act as a router and intercept and rebind DNS. It's not hard, seamlessly works, and is quite fast via wireguard. My VPN provider also provides a reverse port to provide convenient ssh tunneling into the SBC "bastion host" which I have configured to use a random port, changing IP addresses, and only accept certificate-based authentication.
andyjh 5y ago
My first thought was that it's more likely something like this than a bad actor on their wifi: https://en.wikipedia.org/wiki/Hola_%28VPN%29 https://en.wikipedia.org/wiki/Hola_%28VPN%29 Anyone with that browser extension installed on any device on their network is making themselves an open VPN exit for millions of random people.
ixfo 5y ago
Collecting passwords and dumping the storage is likely all they did. 3 months is fairly prompt for any kind of "cyber" in the UK to even get a brief look at, due to huge processing backlogs in the overworked departments whose job it is to deal with it. I'd suspect that what happened here is they thought they had an easy win, went through the motions, determined fairly rapidly from interviews etc it wasn't actually a viable lead, and didn't pursue further. But the machinery is set in motion by the initial conversation, for fear of prompt deletion if the storage is left with the would-be perp.

azalemeth 5y ago

It's worth noting that if they didn't hand over the passwords they're automatically liable for an offence whose punishment is two years in gaol, and all the police need to prove is that it is likely that they did know them. One of the quotes of the article describes the husband getting what is presumably an admin key from work for a Windows laptop -- if the crown wanted to, that alone would be enough to utterly throw him under the bus. I honestly have an irrational fear of this happening to me. It's a great way for a malicious actor to utterly wreck someone's life. I tunnel all outbound traffic over a supposedly privacy-preserving (or at least non-UK) VPN, but honestly, this is the dystopian stuff of my nightmares. And I don't know why!

alibarber 5y ago
How do you tunnel your traffic though? Unless you can be sure it's forcing everything on your wifi network through it, then that wouldn't offer any protection to someone else using it without the tunnel, as is assumed to happen in this case.
- slimsag 5y ago
  A lot of WiFi routers actually support plugging in VPN details in the router software itself, it's not complex at all[0] even for your average consumer. [0] https://www.expressvpn.com/vpn-software/vpn-router#recommended-routers https://www.expressvpn.com/vpn-software/vpn-router#recommend...
  - rnotaro 5y ago
    I believe you're over estimating the skills of the average consumer. The average consumer usually don't even know how to access their router' web interface.
- azalemeth 5y ago
  As the other poster here says, I just configure it at the network level: my default gateway is a single-board computer set up to act as a router and intercept and rebind DNS. It's not hard, seamlessly works, and is quite fast via wireguard. My VPN provider also provides a reverse port to provide convenient ssh tunneling into the SBC "bastion host" which I have configured to use a random port, changing IP addresses, and only accept certificate-based authentication.

andyjh 5y ago

My first thought was that it's more likely something like this than a bad actor on their wifi: https://en.wikipedia.org/wiki/Hola_%28VPN%29 https://en.wikipedia.org/wiki/Hola_%28VPN%29 Anyone with that browser extension installed on any device on their network is making themselves an open VPN exit for millions of random people.

ixfo 5y ago

Collecting passwords and dumping the storage is likely all they did. 3 months is fairly prompt for any kind of "cyber" in the UK to even get a brief look at, due to huge processing backlogs in the overworked departments whose job it is to deal with it. I'd suspect that what happened here is they thought they had an easy win, went through the motions, determined fairly rapidly from interviews etc it wasn't actually a viable lead, and didn't pursue further. But the machinery is set in motion by the initial conversation, for fear of prompt deletion if the storage is left with the would-be perp.