3rd Annual Connecticut-Israel Technology Summit Set for June 12 Video & Analysis | Huge Security Hole Puts Coffee Shop Web Surfers at Significant Risk
by Lon Seidman | Aug 8, 2011 4:09pm
(1) Comment | Commenting has expired
Posted to: Hacker, Privacy, Social Networks, Facebook
Unskilled hackers at your local coffee shop can gain complete access to your Facebook account as well as other online services with a simple mouse click. Fixing the problem is easy but many people haven’t implemented it, surfing away completely unaware of how vulnerable they may be to a cyber intrusion.
Public hotspots are essentially mini broadcast towers transmitting radio signals to your computer. Like a radio, every computer connected to the hot spot has access to everything being transmitted. Your computer only looks for data “packets” that are specifically addressed to it.
Facebook and most other websites work by initially requiring a password to log in. Following the password submission, Facebook’s server sends back a file called a “cookie.” Once the cookie is on your system, Facebook no longer needs the password while navigating the site.
But — when using that coffee shop’s WIFI, your Facebook cookie also is transmitted in the air to every computer connected to shop’s hotspot. “Law abiding” computers and their users simply ignore packets of information that are not specifically directed to them. But it is possible, using very simple software available as a browser plugin, to “listen” for other people’s cookies and download the files. Since Facebook has no way of telling the difference between computers coming from the same location, anyone can assume your Facebook identity. A simple double-click is all it takes to assume another customer’s online identity.
Watch a video demonstrating the problem:
If that’s not scary enough, once your Facebook account has been compromised, the hacker also has access to all the other sites you may access through the Facebook interface. Hundreds of sites now accept a Facebook login instead of a separate username and password. One of those is Yahoo Mail, and we were able to log into our mail account with just the Facebook cookie we grabbed out of the air. This trick works with more than just Facebook. Hackers can view your previous Amazon purchases, and even take over a WordPress blog.
Fixing this problem doesn’t take much effort. In fact operators of public hotspots could address the vulnerability altogether by securing their services with WPA wireless encryption and a password. Even a WPA password as simple as “12345” would create individual secure “tunnels” for users on the network and would prevent a hacker’s ability to swipe cookies out of the air.
Until then, fixing Facebook is as simple as turning on secure browsing in the security section of your account settings page. If you’re not secured, Facebook may pop up a warning message from time to time with instructions as to how to secure your account.
Facebook is not the only service vulnerable to this hack. If you have to use a public hotspot, only use websites that allow you to browse securely. Secure sites always begin with https:// in your address bar, rather than http://.
Some sites already have taken steps to secure themselves and their users. Google’s email service now defaults all users to a secure connection. Facebook says they are working toward making the feature mandatory, but will require users to opt-in for the more secure service for the time being. Enabling encryption requires more server resources be made available for each user, and when multiplying that demand by hundreds of millions of users, it can be a major (and expensive) infrastructure upgrade.
“It is far from a simple task to build out this capability for the more than three-quarters of a billion people that use the site and retain the stability and speed we expect, but we are making progress daily toward this end,” the company said in statement.
CTTechJunkie has reached out to a number of establishments to find out why they have not enabled local encryption on their hotspots. None have returned our calls or emails at the time of this post.
Good security practices go beyond just the local coffee shop, however. You should also secure yourself at home by ensuring your home wireless is enabled with WPA or WPA2 encryption. A neighbor or anyone in vicinity of an unsecured access point in your home can run this same hack to access your personal information. When you’re away from home, think about tethering to your cellphone for Internet access and avoiding unencrypted public hotspots. If your cellphone uses WiFi to share its signal, be sure to secure that with WPA encryption too.
Have questions? We’ll answer them here and on our Facebook page.
Creative Commons credits from the video:
http://youtube.com/user/OldThornsManor
http://youtube.com/user/Esdanol
http://www.flickr.com/photos/cakespy/3721266801/
Tags: Facebook, hacker, hacker, wifi, security settings
Comment
posted by: artstone | August 10, 2011 3:38am
Another piece of advice is to not use the same password on every. If one account is compromised, then all of their accounts will quickly fall like dominoes.
As to “why” open wifi operators don’t use encryption, many of the big networks use a standard SSID to allow automatic connection without prompting.
If Starbucks wanted to enable encryption, they either would have to use the same password in every Starbucks in the world or each Starbucks would have a different password and need a procedure to hand out the encryption key for that store. The baristas would be trying to do tech support for every type of PDA, Cell Phone, iPad and laptop that walked in the door to get their Wifi to connect. When the person visited the next Starbucks, they would have to do it all over again, and then when they go to McDonalds… Open means open.
There are older laptops that don’t support WPA/WPA2 and would be unable to access the service. If the hotspot is running WEP, then it is pointless to use encryption since it is very weak encryption. A single hot spot can’t run both WEP and WPA - it’s an either/or choice. So if they go with a credible encryption then they lock out WEP/WPA users. Right now, there is no simple answer. WPA2 encryption depends on hardware in the device, so you can’t just download a new driver into an old WEP only device.
My public library does encrypt, but they have a unique SSID and hand out a slip of paper with the encryption key. That’s a luxury you can have when you only have a single location and people aren’t waiting in line for their caffeine fix.