Hacker News

points by treesknees 1 day ago | 0 comments

Client isolation is very common on wireless and wired LANs these days in enterprise and guest network environments. You also have tools like dynamic arp inspection to block poisoning attempts via the network switch.

If you get past all of that, you still need a victim who is actively using a cli tool on macOS using https.

It’s not impossible, but the conditions are much more specific than those needed to inject porn into a webpage on a poorly configured school network in 2006.

[–] 9dev 1 day ago

…and yet it doesn't help at all if a laptop sees an AP with strong signal in its vicinity and connects to that instead of the meticulously configured AP that sits behind the counter with a slightly weaker signal.

[–] treesknees 1 day ago

You’re not actually making the point you think you are. This comes back to the original comment stating you need to compromise a lot to MITM here.

So you need to somehow trick macOS into remotely connecting to the wrong bssid, and then arp poison a user who happens to be using a macOS cli tool that’s using https.

Sounds pretty targeted and unlikely to happen.

[–] 9dev 1 day ago

Go to a random coffee shop that allows people to work at the tables, and you’ll find a few developers with MacBooks there pretty soon. They will be connected to the local hotspot, which either has no password at all, or WPA2 with the password written on a billboard behind the counter. Spin up an evil twin, then wait for the connections to roll in.

I don’t think that’s either targeted or unlikely?

[–] yonatan8070 1 day ago

Exactly, I do this all the time for doing out-of-office demos with our company's robots.

I just set up my phone's hotspot to be the same SSID and password as the network the robots already know from the office, and I'll have the robots, a couple phones, and a laptop connected in 10 seconds.