Hacker News

points by mschuster91 1 day ago | 0 comments

> You have to compromise a lot to be able to make a MITM here.

It's trivially easy to mount an ARP spoofing attack. I did that at school two decades ago and on-the-fly rewrote <img src=...> to hardcore porn images for funsies.

mitmproxy [1], a popular toolkit for making that easy, has the option to generate "eMudhra" certificates on the fly now.

It is trivially easy to compromise things, all you need is physical access to the network.

[1] https://news.ycombinator.com/item?id=50189232

[–] sersi 1 day ago

I don't know why you're downvoted, any public wifi access point in a shop could be compromised and users would never notice.

[–] treesknees 1 day ago

Client isolation is very common on wireless and wired LANs these days in enterprise and guest network environments. You also have tools like dynamic arp inspection to block poisoning attempts via the network switch.

If you get past all of that, you still need a victim who is actively using a cli tool on macOS using https.

It’s not impossible, but the conditions are much more specific than those needed to inject porn into a webpage on a poorly configured school network in 2006.

[–] 9dev 1 day ago

…and yet it doesn't help at all if a laptop sees an AP with strong signal in its vicinity and connects to that instead of the meticulously configured AP that sits behind the counter with a slightly weaker signal.

[–] treesknees 1 day ago

You’re not actually making the point you think you are. This comes back to the original comment stating you need to compromise a lot to MITM here.

So you need to somehow trick macOS into remotely connecting to the wrong bssid, and then arp poison a user who happens to be using a macOS cli tool that’s using https.

Sounds pretty targeted and unlikely to happen.

[–] 9dev 1 day ago

Go to a random coffee shop that allows people to work at the tables, and you’ll find a few developers with MacBooks there pretty soon. They will be connected to the local hotspot, which either has no password at all, or WPA2 with the password written on a billboard behind the counter. Spin up an evil twin, then wait for the connections to roll in.

I don’t think that’s either targeted or unlikely?

[–] yonatan8070 1 day ago

Exactly, I do this all the time for doing out-of-office demos with our company's robots.

I just set up my phone's hotspot to be the same SSID and password as the network the robots already know from the office, and I'll have the robots, a couple phones, and a laptop connected in 10 seconds.

[–] raverbashing 1 day ago

> all you need is physical access to the network

Yeah that's not so much "trivially easy"

[–] breakwaterlabs 1 day ago

Do you have a cell phone? Do you use Wifi? Do you use an ISP who, in the last few decades, has performed any form of interception or traffic-tampering?

I hazard that the answer to all three of those is "yes".

[–] paaloeye 1 day ago

> all you need is physical access to the network.

yeah, it's trivial to punch somebody in the face in the morning, all you need to do is to be by their bad in the morning when they are waking up.

[–] cryptonym 1 day ago

You don't have physical access to the network, doesn't mean other actor aren't here. Working for providers, governments, or being able to impersonate them. This is a serious issue, it shouldn't be downplayed.

If you think it's not that important, it becomes a critic about TLS and basically saying that ciphers for web traffic are useless.

[–] mschuster91 1 day ago

Public wifi hotspots tend to give you that opportunity. Large commercial hotspots have inter-client communication blocked, but your average coffee shop style network? You're lucky if it even is an isolated VLAN from the shop's cash register lol.

[–] bawolff 1 day ago

Have you never used wifi at a coffee shop?

Physical access to networks isn't that hard to come by.

[–] ForHackernews 1 day ago

Great, you have an inconvenient way to possibly-maybe see some random's gmail inbox at Starbucks.

You'd be better off just mugging them in the parking lot.

[–] itintheory 1 day ago

> gmail inbox

Except it won't impact gmail unless you're accessing it through curl. The browsers already distrusted the compromised intermediates via CRL within hours of disclosure, and removed the affected root via update.

[–] jfyi 1 day ago

Sure practicality is always an issue. It's an issue that attackers will go to great lengths to resolve too.

What if it's the Starbucks at 1730 Pennsylvania Ave NW, Washington, DC 20006 for an extended period of time? Compounded with other security issues like password reuse...

We can always draw a line and say, "that's not practical". The assessment an attacker is likely to do is going to be "is this practical inside my budget for the value I hope to acquire?" or maybe even just "waow, lulz".

[–] alt227 1 day ago

No, you have a pretty easy way of intercepting someones git credentials and repo access. Arguably more dangerous than a gmail inbox.

[–] paaloeye 1 day ago

I have, but good luck predicting where I'm going to have my next cuppa. Outside of petty crimes mentioned, I don't see how it could be industrially weaponised to make actual damage.

Regardless, real bad actors are busy compromising your next `npm install` anyway. Much better reward.

[–] rolosa 1 day ago

Why would I care about you specifically, and not the dozens of other people working at the coffee shop? Does the world revolve around you?

[–] bawolff 1 day ago

If they are specificly targeting you, then they probably dont need to use the coffee shop. The coffee shop is for low skill attackers targeting people at random.

If someone has it in for you and hired a high skill attacker, its not a stretch to imagine they compromised your home network.

[–] voidUpdate 1 day ago

Compromising a specific person is difficult. Compromising any old person is trivial

[–] dahart 1 day ago

> good luck predicting where I’m going to have my next cuppa.

Why are you assuming there isn’t someone else trying to hack you at the next cafe? Actual damage can happen one person at a time, and can occasionally lead to larger scale compromises. Randomizing your location isn’t going to reduce your risk. Now that everyone who’s paying attention knows they can MITM your Mac, you shouldn’t trust any network.