5 ms·

So, as I understand it, you 0wn a machine in one organization, then use it to tunnel over to Wi-Fi in the building next door, 0wn another machine there, rinse a

So, as I understand it, you 0wn a machine in one organization, then use it to tunnel over to Wi-Fi in the building next door, 0wn another machine there, rinse and repeat until you've created the world's least consensual mesh network?

mandevil 2y ago
From thousands of kilometers away, to make attribution/legal issues even more complex.
_nalply 2y ago
They are exploiting that Wifi didn't have 2fa, because they couldn't overcome 2fa. A company accross the street had a machine that both was accessible by ethernet and wifi and they used that as a bridge. Conclusions: 1. Anything that doesn't have 2fa is leaking like a sieve. 2. The targeted company needs to implement 2fa for their Wifi as well. Not mentioned, but I assume that their 2fa is using specialised hardware gadgets like Yubikey and not texts or totp, because else they could target the cell phones, and like everything else they are leaking, or they are attacking the cell phone base stations. Final conclusion: A network is as strong as the weakest link. In that case Wifi was not protected by strong 2fa and could be used to breach.
- cortesoft 2y ago
  My conclusion is that being on the corporate Wi-Fi should not give you access to anything. There should not have been any advantage to getting on the Wi-Fi, it should be treated like the public internet. A separate VPN, with MFA, should be required to access anything.
  - sleepybrett 2y ago
    it should be a factor (defense in depth) but not the ONLY factor.
  - alsetmusic 2y ago
    My current org restricts wifi by user and by device in Active Directory. Thus you need to be whitelisted twice to get access. We use 2fa pretty much everywhere, but I don't think we use it there. But it certainly wouldn't hurt as yet another layer. Wifi adapters should be disabled via Group Policy for wired devices anyway.
    - sam_lowry_ 2y ago
      Active Directory? You are already powned.
  - UltraSane 2y ago
    When WiFi security was really bad I worked at a company that didn't use it at all. You connected to the WiFi without any authentication and then had to connect to a VPN server that used 2FA auth.
  - rocqua 2y ago
    Corporate WiFi based on a password and a device certificate is fine. For BYO devices, you have a separate WiFi network that does require a VPN to reach the corporate network.
  - legulere 2y ago
    Also a VPN is just another perimeter. You wouldn't want a single device like a printer getting successfully attacked leading to everything in your network getting compromised. The real solution is to use a zero trust architecture
- ninalanyon 2y ago
  Devices that are authorized to be on the corporate network should not need usernames and passwords to connect to the wifi. That should be controlled by certificates managed by the IT department.
- Aloisius 2y ago
  Being able to validate credentials via the public facing website without MFA was a considerable problem as well. Also not locking down accounts after failed attempted logins. Wifi with 802.1X and certs would have been fine here without MFA.
- eru 2y ago
  > A network is as strong as the weakest link. Depends on how you look at it. We have end-to-end security with things like https, so we don't need to worry about the links in the middle.
  - Spivak 2y ago
    The BeyondCorp strategy. It also means that network and endpoints can be off the shelf. Big fan of this strategy.
    - eru 2y ago
      Yes, and it's already the default in consumer electronics. That's also why I don't get all the pearl clutching over dodgy unencrypted wifi: if your security relies on your wifi operator being nice, you are doing it wrong. The main thing encrypting wifi does (or rather should do..) for you is keeping your neighbours from stealing all your bandwidth.
- Sesse__ 2y ago
  > Final conclusion: A network is as strong as the weakest link. Final conclusion: Do not trust a device just because it happens to be on your local network.
  - coldpie 2y ago
    Final, final conclusion: if a computer is networked, consider it and the data on it to be semi-public. Make decisions about what to do and store on that computer with that assumption in mind.
    - EvanAnderson 2y ago
      Final, final, final conclusion: Interacting with a computer makes it networked even if you're not intentionally using traditional networking technologies (TEMPEST attacks, arbitrary code execution through direct user input, etc).
      - deleted 2y ago
        [deleted]
      - DyslexicAtheist 2y ago
        Final, final, final, final conclusion: due to the complexity of computers, the only reliable way to achieve a moderate security in a system is to prevent it from being powered on.
        dotancohen 2y ago
        The concept of C-I-A addresses this. Confidentiality, Integrity, Availability. If a system is not available for use then all the confidentiality of communications and integrity of data is useless.
        EvanAnderson 2y ago
        "Pioneered method of keeping restrooms clean by keeping them locked during business hours."
- akaiser 2y ago
  Eludes me why they didn't have device-certificate-based auth for their Enterprise WiFi in addition to the username+password. Basically comes for free with AD and NPS.
  - eru 2y ago
    'Free' still means you need some expertise in setting it up and running it.
thrdbndndn 2y ago
why do you type 0wn (zero) instead of own?
- Terr_ 2y ago
  Adding a serious response in case [0] it's a serious question: "0wn" is a kind of in-joke among hacker/security communities. [1] In particular, it differs from "own" in that it connotes "forcibly taking control of", rather than formal legal ownership. Another version is "pwn" which is a marginally newer and more-associated with online gaming. [0] https://xkcd.com/1053/ https://xkcd.com/1053/ [1] https://en.wikipedia.org/wiki/Leet https://en.wikipedia.org/wiki/Leet
  - thaumasiotes 2y ago
    > "0wn" is a kind of in-joke among hacker/security communities. In my experience, the security community says "pop".
    - edm0nd 2y ago
      Gives the term "desk pop" a whole new meaning!
- 0xEF 2y ago
  Putting the "hacker" back in Hacker News, I guess
  - dijksterhuis 2y ago
    i believe it’s pronounced H4x0r
  - moffkalast 2y ago
    Excuse me I thought this was business news? I want my zero money back.
    - danielheath 2y ago
zelon88 2y ago
The goal here was to circumvent 2FA on devices located inside the Org A office. On-prem systems prompt for 2FA. So the attacker knew a user/password combo, but couldn't leverage it directly because they would have triggered 2FA. But the 802.1x didn't have 2FA enabled. So using the user/password combo they already had, they just needed to approach the target network over WiFi in order to bypass the 2FA requirement.

mandevil 2y ago

From thousands of kilometers away, to make attribution/legal issues even more complex.

_nalply 2y ago

They are exploiting that Wifi didn't have 2fa, because they couldn't overcome 2fa. A company accross the street had a machine that both was accessible by ethernet and wifi and they used that as a bridge. Conclusions: 1. Anything that doesn't have 2fa is leaking like a sieve. 2. The targeted company needs to implement 2fa for their Wifi as well. Not mentioned, but I assume that their 2fa is using specialised hardware gadgets like Yubikey and not texts or totp, because else they could target the cell phones, and like everything else they are leaking, or they are attacking the cell phone base stations. Final conclusion: A network is as strong as the weakest link. In that case Wifi was not protected by strong 2fa and could be used to breach.

cortesoft 2y ago
My conclusion is that being on the corporate Wi-Fi should not give you access to anything. There should not have been any advantage to getting on the Wi-Fi, it should be treated like the public internet. A separate VPN, with MFA, should be required to access anything.
- sleepybrett 2y ago
  it should be a factor (defense in depth) but not the ONLY factor.
- alsetmusic 2y ago
  My current org restricts wifi by user and by device in Active Directory. Thus you need to be whitelisted twice to get access. We use 2fa pretty much everywhere, but I don't think we use it there. But it certainly wouldn't hurt as yet another layer. Wifi adapters should be disabled via Group Policy for wired devices anyway.
  - sam_lowry_ 2y ago
    Active Directory? You are already powned.
- UltraSane 2y ago
  When WiFi security was really bad I worked at a company that didn't use it at all. You connected to the WiFi without any authentication and then had to connect to a VPN server that used 2FA auth.
- rocqua 2y ago
  Corporate WiFi based on a password and a device certificate is fine. For BYO devices, you have a separate WiFi network that does require a VPN to reach the corporate network.
- legulere 2y ago
  Also a VPN is just another perimeter. You wouldn't want a single device like a printer getting successfully attacked leading to everything in your network getting compromised. The real solution is to use a zero trust architecture
ninalanyon 2y ago
Devices that are authorized to be on the corporate network should not need usernames and passwords to connect to the wifi. That should be controlled by certificates managed by the IT department.
Aloisius 2y ago
Being able to validate credentials via the public facing website without MFA was a considerable problem as well. Also not locking down accounts after failed attempted logins. Wifi with 802.1X and certs would have been fine here without MFA.
eru 2y ago
> A network is as strong as the weakest link. Depends on how you look at it. We have end-to-end security with things like https, so we don't need to worry about the links in the middle.
- Spivak 2y ago
  The BeyondCorp strategy. It also means that network and endpoints can be off the shelf. Big fan of this strategy.
  - eru 2y ago
    Yes, and it's already the default in consumer electronics. That's also why I don't get all the pearl clutching over dodgy unencrypted wifi: if your security relies on your wifi operator being nice, you are doing it wrong. The main thing encrypting wifi does (or rather should do..) for you is keeping your neighbours from stealing all your bandwidth.
Sesse__ 2y ago
> Final conclusion: A network is as strong as the weakest link. Final conclusion: Do not trust a device just because it happens to be on your local network.
- coldpie 2y ago
  Final, final conclusion: if a computer is networked, consider it and the data on it to be semi-public. Make decisions about what to do and store on that computer with that assumption in mind.
  - EvanAnderson 2y ago
    Final, final, final conclusion: Interacting with a computer makes it networked even if you're not intentionally using traditional networking technologies (TEMPEST attacks, arbitrary code execution through direct user input, etc).
    - deleted 2y ago
      [deleted]
    - DyslexicAtheist 2y ago
      Final, final, final, final conclusion: due to the complexity of computers, the only reliable way to achieve a moderate security in a system is to prevent it from being powered on.
      - dotancohen 2y ago
        The concept of C-I-A addresses this. Confidentiality, Integrity, Availability. If a system is not available for use then all the confidentiality of communications and integrity of data is useless.
      - EvanAnderson 2y ago
        "Pioneered method of keeping restrooms clean by keeping them locked during business hours."
akaiser 2y ago
Eludes me why they didn't have device-certificate-based auth for their Enterprise WiFi in addition to the username+password. Basically comes for free with AD and NPS.
- eru 2y ago
  'Free' still means you need some expertise in setting it up and running it.

thrdbndndn 2y ago

why do you type 0wn (zero) instead of own?

Terr_ 2y ago
Adding a serious response in case [0] it's a serious question: "0wn" is a kind of in-joke among hacker/security communities. [1] In particular, it differs from "own" in that it connotes "forcibly taking control of", rather than formal legal ownership. Another version is "pwn" which is a marginally newer and more-associated with online gaming. [0] https://xkcd.com/1053/ https://xkcd.com/1053/ [1] https://en.wikipedia.org/wiki/Leet https://en.wikipedia.org/wiki/Leet
- thaumasiotes 2y ago
  > "0wn" is a kind of in-joke among hacker/security communities. In my experience, the security community says "pop".
  - edm0nd 2y ago
    Gives the term "desk pop" a whole new meaning!
0xEF 2y ago
Putting the "hacker" back in Hacker News, I guess
- dijksterhuis 2y ago
  i believe it’s pronounced H4x0r
- moffkalast 2y ago
  Excuse me I thought this was business news? I want my zero money back.
  - danielheath 2y ago

zelon88 2y ago

The goal here was to circumvent 2FA on devices located inside the Org A office. On-prem systems prompt for 2FA. So the attacker knew a user/password combo, but couldn't leverage it directly because they would have triggered 2FA. But the 802.1x didn't have 2FA enabled. So using the user/password combo they already had, they just needed to approach the target network over WiFi in order to bypass the 2FA requirement.