3 ms·

everyone freaks out because "oh man your computer will get hacked in N seconds on the defcon wifi". lets dissect this a little bit. if i put a computer on the

by munin 15y ago

everyone freaks out because "oh man your computer will get hacked in N seconds on the defcon wifi". lets dissect this a little bit. if i put a computer on the defcon wifi, it'll probably be say, modern linux (ubuntu, debian, or redhat) running either a minimal subset of services (ssh) or perhaps nothing, with firewall policy applied, or a modern windows (windows7) with the firewall on. i'll be using a modern, fully patched web browser, also perhaps with some additional mitigation technology (thought nothing out of the ordinary) think perhaps noscript and EMET. and also this is the one time of the year when i'm ready for this. every other day of the year i go to the coffee shop i don't know anything about the other randoms there but i assume they're drifting office droids hacking on their excel macros or recruiters cruising linkedin in between meetings. so, if someone exploits me on the defcon wifi ... where else will that exploit work? everywhere, probably! it's probably a super awesome exploit that has super awesome properties that targets super popular software and is also unpatched. someone owns my openssh 5.3 on my laptop on the defcon wifi ... if i pcap that ... i'm a rich man. i can own boxes like mine. so ... as a hypothetical attacker, why would i do this? i'm surrounded by people like me. they're alert. they're cautious. and they are the most capable people in the world to detect what i am doing and reveal it to everyone. oh and there are a whole bunch of law enforcement people there too, AND the entire thing happens in a casino which has heavy security and is already wired for sound and audio everywhere you go. ... anyone who is smart enough to be able to own your box at defcon, is also going to be smart enough to realize that they might as well wait until the week after when you're sitting at a coffee shop.

Pewpewarrows 15y ago
If you're blackhat, sure. But I'd venture to guess that a good portion, as greyhats, are there to do just what this article suggests: raise awareness of new potential threats, claim bragging rights, and improve security for all.
- munin 15y ago
  by owning random boxes on the wifi? no, "claiming bragging rights" is what onstage demos are for :P
nookiemonster 15y ago
Defcon is cheap to attend. You should go sometime and get a feel for the event. If a trip to Vegas is out of your price range, go check visit Hot Topic. You'll get the proper feel. The Defcon crowd is awfully touristy. I mean that professionally. In fact, it's far more the marketing success of defcon that should get attention from hacker news. They have been building quite an empire over the last 19 years.
matthew-wegner 15y ago
I don't think it's your computer joining the network that's the issue; the network itself is likely tainted. By extreme example, a rogue cell tower was demonstrated last year which monitored outgoing SMS messages. Your phone would automatically join it because its signal strength was greater and it had all required information. The issue with Defcon Wi-Fi is that you should assume all outbound traffic is captured. Are you sure your mail notifier, Dropbox client, IM client, etc, aren't sending credentials or some kind that can be (at least temporarily) exploited?
- munin 15y ago
  yes. i'd have big problems on any other network i'd join if i wasn't sure, wouldn't i?
  - dlss 15y ago
    being 100% sure is 100% impossible
    - etherael 15y ago
      are you sure?
      - zackattack 15y ago
        evidently he isn't
  - burgerbrain 15y ago
    You make the mistake of assuming that all networks are created equal and that just because you could potentially be vulnerable on a network that this vulnerability would have manifest itself to you by now. For example, signin for this very website is done in cleartext. Do you have "big problems" right now? No, I hardly expect you do. Would you expect to if you jumped onto your standard open coffeeshop wifi? Realisticly no. It is fairly unlikely that anyone in your average starbucks gives half a shit about your HNs account. Now, if you went to DEFCON and didn't take additional precautions? Well, I'm not going to say anyone will really happen to care about your account even then, but you can be damned sure they'll log it anyway. My point is 1) "any other network" on average is probably not as hostile as the open networks as DEFCON, and 2) your vulnerability will not necessarily manifest visibly as "big problems".
0x0 15y ago
On the other hand, they might just PCAP all of _your_ traffic, and wait until some flaw like DSA-1571-1 surfaces, and go back a week, a month, a year later to recover the plaintext of all your encrypted sessions.
- munin 15y ago
  this is a risk you already run anytime you connect to any network so i'm not really sure why it makes defcon "more" dangerous.
  - duskwuff 15y ago
    When you connect to any other wireless network, there a chance that your traffic is being sniffed. When you connect to the wireless at DefCon, the only real question is how many people are sniffing it, and for what. :)
swolchok 15y ago
> if i put a computer on the defcon wifi, it'll probably be say, modern linux (ubuntu, debian, or redhat) running either a minimal subset of services (ssh) or perhaps nothing, with firewall policy applied, or a modern windows (windows7) with the firewall on. i'll be using a modern, fully patched web browser, also perhaps with some additional mitigation technology (thought nothing out of the ordinary) think perhaps noscript and EMET. The first time I went to DEFCON, I got to hear Roger Dingledine complain about how Ubuntu had been shipping a version of Tor with a known remote root vulnerability for months. Modern Linux distribution != magical instant application of all patches.
iuguy 15y ago
By way of disclosure, I'm one half of the founders of http://www.44con.com/ http://www.44con.com/ and my co-founder is a DEF CON goon. I can't talk about the wifi there, but what we're doing for 44Con is reason enough not to use the wifi. We will be logging everything on that network and running it through netwitness gear. We won't have a wall of sheep, but unless you're certain your transport is encrypted, your details will be captured and stored. At DEF CON it's worse - you can't assume that your GSM or any form of RF connection is secure. Fake ATMs, Rogue cell towers and RFID hacking have all been done before there. It's the nature of the atmosphere there.

by munin 15y ago

Pewpewarrows 15y ago

If you're blackhat, sure. But I'd venture to guess that a good portion, as greyhats, are there to do just what this article suggests: raise awareness of new potential threats, claim bragging rights, and improve security for all.

munin 15y ago
by owning random boxes on the wifi? no, "claiming bragging rights" is what onstage demos are for :P

nookiemonster 15y ago

Defcon is cheap to attend. You should go sometime and get a feel for the event. If a trip to Vegas is out of your price range, go check visit Hot Topic. You'll get the proper feel. The Defcon crowd is awfully touristy. I mean that professionally. In fact, it's far more the marketing success of defcon that should get attention from hacker news. They have been building quite an empire over the last 19 years.

matthew-wegner 15y ago

I don't think it's your computer joining the network that's the issue; the network itself is likely tainted. By extreme example, a rogue cell tower was demonstrated last year which monitored outgoing SMS messages. Your phone would automatically join it because its signal strength was greater and it had all required information. The issue with Defcon Wi-Fi is that you should assume all outbound traffic is captured. Are you sure your mail notifier, Dropbox client, IM client, etc, aren't sending credentials or some kind that can be (at least temporarily) exploited?

munin 15y ago
yes. i'd have big problems on any other network i'd join if i wasn't sure, wouldn't i?
- dlss 15y ago
  being 100% sure is 100% impossible
  - etherael 15y ago
    are you sure?
    - zackattack 15y ago
      evidently he isn't
- burgerbrain 15y ago
  You make the mistake of assuming that all networks are created equal and that just because you could potentially be vulnerable on a network that this vulnerability would have manifest itself to you by now. For example, signin for this very website is done in cleartext. Do you have "big problems" right now? No, I hardly expect you do. Would you expect to if you jumped onto your standard open coffeeshop wifi? Realisticly no. It is fairly unlikely that anyone in your average starbucks gives half a shit about your HNs account. Now, if you went to DEFCON and didn't take additional precautions? Well, I'm not going to say anyone will really happen to care about your account even then, but you can be damned sure they'll log it anyway. My point is 1) "any other network" on average is probably not as hostile as the open networks as DEFCON, and 2) your vulnerability will not necessarily manifest visibly as "big problems".

0x0 15y ago

On the other hand, they might just PCAP all of _your_ traffic, and wait until some flaw like DSA-1571-1 surfaces, and go back a week, a month, a year later to recover the plaintext of all your encrypted sessions.

munin 15y ago
this is a risk you already run anytime you connect to any network so i'm not really sure why it makes defcon "more" dangerous.
- duskwuff 15y ago
  When you connect to any other wireless network, there a chance that your traffic is being sniffed. When you connect to the wireless at DefCon, the only real question is how many people are sniffing it, and for what. :)

swolchok 15y ago

> if i put a computer on the defcon wifi, it'll probably be say, modern linux (ubuntu, debian, or redhat) running either a minimal subset of services (ssh) or perhaps nothing, with firewall policy applied, or a modern windows (windows7) with the firewall on. i'll be using a modern, fully patched web browser, also perhaps with some additional mitigation technology (thought nothing out of the ordinary) think perhaps noscript and EMET. The first time I went to DEFCON, I got to hear Roger Dingledine complain about how Ubuntu had been shipping a version of Tor with a known remote root vulnerability for months. Modern Linux distribution != magical instant application of all patches.

iuguy 15y ago

By way of disclosure, I'm one half of the founders of http://www.44con.com/ http://www.44con.com/ and my co-founder is a DEF CON goon. I can't talk about the wifi there, but what we're doing for 44Con is reason enough not to use the wifi. We will be logging everything on that network and running it through netwitness gear. We won't have a wall of sheep, but unless you're certain your transport is encrypted, your details will be captured and stored. At DEF CON it's worse - you can't assume that your GSM or any form of RF connection is secure. Fake ATMs, Rogue cell towers and RFID hacking have all been done before there. It's the nature of the atmosphere there.