3 ms·

Could someone clarify a technical issue for me? I thought hacking WEP grants you access to the internet via that Wi-Fi network, which explains how he created a

Could someone clarify a technical issue for me? I thought hacking WEP grants you access to the internet via that Wi-Fi network, which explains how he created a MySpace page that traced back to their IP address, but how would he be able to send emails from the lawyer's email account? Even within the poorly encrypted Wi-Fi network, the lawyer was using Yahoo Mail which surely uses HTTPS, so how did the neighbor get into the lawyer's email account? Unless he used a custom mail client to spoof the From field of the email, in which case the email should be easily provably not sent via Yahoo Mail's servers.

lotharbot 15y ago
Hacking WEP grants you access to that Wi-Fi network. This means you can directly attack the target system. Exploits that allow arbitrary code execution are revealed from time to time. If the guy gets behind on security updates, use a known exploit to install a keylogger, and you now have access to the guy's email and other accounts (from his IP address and everything!)
- davis_m 15y ago
  The attacker more than likely just sniffed the credentials over the air. With the titles of the "hacking manuals" this guy didn't sound like a very sophisticated attacker. This would have been before the large movement to HTTPS for logins, and a Yahoo login would have been easy to sniff. Even with HTTPS, SSLStrip, Ettercap, and arpspoof makes short work of HTTPS logins.
  - laughinghan 15y ago
    Short work? As in, with a little Googling of these kinds of tools, anyone could be sniffing anyone else's HTTPS logins on a gigantic, campus-wide Wi-Fi network?
davis_m 15y ago
Yahoo Mail didn't implement HTTPS until after Firesheep came out. With the length of time that these sorts of trials take, I imagine that Yahoo was still transmitting usernames and passwords over HTTP in cleartext when this all happened.
- laughinghan 15y ago
  Oh, wow, in that case.

lotharbot 15y ago

Hacking WEP grants you access to that Wi-Fi network. This means you can directly attack the target system. Exploits that allow arbitrary code execution are revealed from time to time. If the guy gets behind on security updates, use a known exploit to install a keylogger, and you now have access to the guy's email and other accounts (from his IP address and everything!)

davis_m 15y ago
The attacker more than likely just sniffed the credentials over the air. With the titles of the "hacking manuals" this guy didn't sound like a very sophisticated attacker. This would have been before the large movement to HTTPS for logins, and a Yahoo login would have been easy to sniff. Even with HTTPS, SSLStrip, Ettercap, and arpspoof makes short work of HTTPS logins.
- laughinghan 15y ago
  Short work? As in, with a little Googling of these kinds of tools, anyone could be sniffing anyone else's HTTPS logins on a gigantic, campus-wide Wi-Fi network?

davis_m 15y ago

Yahoo Mail didn't implement HTTPS until after Firesheep came out. With the length of time that these sorts of trials take, I imagine that Yahoo was still transmitting usernames and passwords over HTTP in cleartext when this all happened.

laughinghan 15y ago
Oh, wow, in that case.