Another Coffee Pub WiFi Vulnerability

May1409May 14, 09

I received quite a few emails about the Peets WiFi Hack I detailed back in January of this year, and many of you seem to be interested in the many security issues facing free wireless internet providers. In keeping with this, the following is a quick analysis of the wireless authentication method used by a chain of coffee pubs in Canada. For the sake of sincerity, I am not going to identify the establishment - we all appreciate these free services and I want them to stay available.

The vulnerability in question is one that affects more than just wireless network scenarios, because it comes from the way this coffee pub has designed their HTML forms and corresponding server-side script. Many parts of the login process have been done correctly, including the use of HTTPS, but a single oversight causes the entire system to be weak to standard attack methods. First-time users are required to complete a simple registration before using their email address and chosen password to authenticate their computer based on its MAC address. To most users, this system would appear to be completely secure - they have entered a password, but their browser indicates that the form they are sending is encrypted. Unfortunately, the login form produces an HTTP GET request instead of the more appropriate POST request. Because of this, the user's email address and their password are sent in the clear and in plain-text format as well-described parameters in the query string. Any malicious user on the unencrypted network is able to see this request, and is able to see both the email address and password that have been submitted.

This is obviously a security flaw, but the context in which the flaw exists is not sensitive. The account information cannot be directly used to gain sensitive data about the user, so there is little at risk. But, as is the case with most vulnerabilities, one risk cannot be interpreted as an isolated entity. When I discovered that there was a compromise in this system (which I use nearly every day), I began to think about ways an attacker could potentially use this authentication data to their advantage - I was quickly met with a surprising situation. Consider the typical computer user, who employs only a few passwords for everything they do online. Now imagine being given both this persons email (their address) and their "usual" password (their key). Using a house as a metaphor, you can see how these two pieces of data are the only things an attacker needs to gain access to something potentially valuable. A simple example of this would be if the attacker were to test the collected password on the user's web-based email account. Very easily done, and very dangerous.

Have you had an experience with public wireless security? Perhaps next time you log in at your favorite coffee pub, you will take a moment to ensure your information is being handled with the proper care.

About Jason Miller:

I am a JavaScript developer from Waterloo, Ontario, Canada. When I am not typing green code onto a black screen, you might find me at the nearest coffee pub checking out the brew. I run a internet firm called developIT and maintain blogs and web apps when I can.
Shana Phillips#
Scott Jones#
Scott Jones#
Ann Tabares#
Scott Jones#
Lisa Calabrese#
Speak shoe made is the space on their own in your thoughts, as a result of their unequalled top quality. If you want to obtain a two of Speak shoe and so are pondering where to begin by , you have to have faith in the online world to assist you purchase them right. Buying online can be the two fascinating along with convenient since it produces different decision via across the globe to your step. Actually, this is actually the key reason you understand about a brand name such as Discuss whatever area you stay in. Here's a few ways you should abide by when you buy the actual shoe online.You have to start by means of experiencing the varied appliances Converse shoe have to give you for you personally. You could have a specific requirement under consideration and hence you have to release looking to view a model that meets these types of technical specs. Just one good way to have the look for simpler is always to stop by websites which exclusively deal in Speak shoe. Yet another substitute is always to go to websites that supply various manufacturers then seek by means of classification ordinary website. Sometimes methods, you may reach an internet site which brings forth countless models in addition to alternatives plus a brief description in the characteristics each model offers. You must study these kinds of when you narrow down on the proper design for you personally.Secondly, you will need to evaluate among models to reach the appropriate design. Besides this kind of, you need to compare the prices to the desired design so that you know which usually web page contains the very best offer on hand for you personally. Once again, you may take the time to check out several websites making reviews over these. Also you can go to internet websites which can be entirely designed to listing the types which help anyone compare prices. This kind of internet websites are more hassle-free and will fetch every piece of information you want with only some sort of click from the switch. Make sure to mix look into the charges for auction on these websites given that many of them can be showing you obsolete data.Finally, establish the proper dimension when looking for talk shoe on the net. Sites listing different measurements that exist split up into by means of these people. Examine this styles which can be pointed out inside website. This particular company is known for a wonderful healthy and style with their shoe. Get ready to experience all of this for time for it to refer to the appropriate dimensions when you find yourself inserting your order through them. There are not many labels which can be seeing that honest since Talk shoe. They're shoe of which make you stay at ease as well as allow you to be a layout symbol where you go. Make an online search to shop for this kind of acknowledged brand and also enjoy good special discounts and attractive presents on every one of your acquisitions. Whether it's sports activities or even a journey, whether it's the actual high heat or even the wet wetlands, prepare for a special time together with Converse shoe for ones corporation. These types of long lasting shoe will win over you actually because of their usefulness and also brilliance.
Leave a Comment

Post Comment