3 ms·

After thinking about it for a bit, couldn't a worm with fake Facebook accounts that are friends-of-friends with a high percentage of the population use this to

After thinking about it for a bit, couldn't a worm with fake Facebook accounts that are friends-of-friends with a high percentage of the population use this to spread virtually unimpeded? I suspect that the API is such that all of the friends of the fake accounts will relay to the fake accounts all of their respective friends passwords (given they had connected to said friend's network at least once), and that two steps should given sufficient coverage in dense urban areas to get worms that give near total wifi coverage of the area. Such a worm platform could of course be used to launch a wide range of attacks, as it has a relatively high concentration and a solid coverage of the area (for data relaying). This screams badness at every level: it's relying on the notion of a Facebook friendship to root security, despite that Facebook friendships have no such semantic meaning in the context of Facebook. You were doing so well Microsoft... but this... this is really, really bad, to the point it might pose an infrastructure risk for cities.

deleted 11y ago
[deleted]
yuhong 11y ago
If they derive the PTK on the server from the stored PMK and sending that instead, this attack would not allow decryption of transmitted packets (other than group key broadcasts) because of the ANonce generated by the AP on each connection used in the key derivation. And the PSK uses PBKDF2 to generate the PMK, making mass cracking expensive.
- SomeStupidPoint 11y ago
  For the usage I was thinking of, it doesn't need to decrypt mass packets, but rather, join a massive number of networks. My idea was simply a way to accelerate the spread of a worm through consumer wifi gear by using the set of fake profiles to always be friends-of-friends with the owner of the network (and thus friends with someone who has connected, thus allowing you to connect). The process would be something like this: 1. Find a vulnerability in consumer wifi gear, such that insecure default allow the default config to accept new code from only inside the LAN. (These types of vulnerabilities with default passowords are common; however, remote access is often disabled.) 2. Upload code to one router. 3. Infected routers look for neighbors who they can connect to the network of, then upload the attack code once they're masquerading as a device on the LAN. 4. Repeat 3. Normally, the reason that this attack doesn't really work is that there are simply too few open or insecure LANs of the same hardware type for the attack to have an effective spread rate, thus it's only a thin weak network and breaks quickly in the face of customers fixing, upgrading, or simply turning off their gear. However, in allowing friends-of-friends to get access to a LAN, Microsoft has removed this barrier to worms spreading across consumer networking gear for anyone that can amass a stock set of profiles with decent geographical coverage, making it a viable way to accelerate the spread of a worm through networking gear. Ed: Of course, once the routers themselves are infected, and you have good geographical coverage, the infected routers can be used as a platform to launch attacks. Again, the reason that we don't see this in practice is that it's too hard to get access to all of those LANs because of even the weak security that exists. Microsoft removed that, making the attack viable if people can infiltrate the Facebook social graph.
  - yuhong 11y ago
    Didn't think of exploiting routers themselves before.

deleted 11y ago

[deleted]

yuhong 11y ago

If they derive the PTK on the server from the stored PMK and sending that instead, this attack would not allow decryption of transmitted packets (other than group key broadcasts) because of the ANonce generated by the AP on each connection used in the key derivation. And the PSK uses PBKDF2 to generate the PMK, making mass cracking expensive.

SomeStupidPoint 11y ago
For the usage I was thinking of, it doesn't need to decrypt mass packets, but rather, join a massive number of networks. My idea was simply a way to accelerate the spread of a worm through consumer wifi gear by using the set of fake profiles to always be friends-of-friends with the owner of the network (and thus friends with someone who has connected, thus allowing you to connect). The process would be something like this: 1. Find a vulnerability in consumer wifi gear, such that insecure default allow the default config to accept new code from only inside the LAN. (These types of vulnerabilities with default passowords are common; however, remote access is often disabled.) 2. Upload code to one router. 3. Infected routers look for neighbors who they can connect to the network of, then upload the attack code once they're masquerading as a device on the LAN. 4. Repeat 3. Normally, the reason that this attack doesn't really work is that there are simply too few open or insecure LANs of the same hardware type for the attack to have an effective spread rate, thus it's only a thin weak network and breaks quickly in the face of customers fixing, upgrading, or simply turning off their gear. However, in allowing friends-of-friends to get access to a LAN, Microsoft has removed this barrier to worms spreading across consumer networking gear for anyone that can amass a stock set of profiles with decent geographical coverage, making it a viable way to accelerate the spread of a worm through networking gear. Ed: Of course, once the routers themselves are infected, and you have good geographical coverage, the infected routers can be used as a platform to launch attacks. Again, the reason that we don't see this in practice is that it's too hard to get access to all of those LANs because of even the weak security that exists. Microsoft removed that, making the attack viable if people can infiltrate the Facebook social graph.
- yuhong 11y ago
  Didn't think of exploiting routers themselves before.