DIGITAL SANKALP

Tweak your browser to show YouTube song lyrics

Tweak your browser to show YouTube song lyrics

YouTube makes a great jukebox, whether you use it to stream an entire playlist of songs from your favorite artist or just listen to th...

8:19 am

Tweak your browser to show YouTube song lyrics

Tweak your browser to show YouTube song lyrics

YouTube makes a great jukebox, whether you use it to stream an entire playlist of songs from your favorite artist or just listen to th...

8:19 am

Tweak your browser to show YouTube song lyrics

Tweak your browser to show YouTube song lyrics

YouTube makes a great jukebox, whether you use it to stream an entire playlist of songs from your favorite artist or just listen to th...

8:16 am

Tweak your browser to show YouTube song lyrics

Tweak your browser to show YouTube song lyrics

YouTube makes a great jukebox, whether you use it to stream an entire playlist of songs from your favorite artist or just listen to th...

8:16 am

Add an external drive to your WMP or iTunes music collection

Add an external drive to your WMP or iTunes music collection

As people replace their hard drives with smaller SSDs, many will choose to move large music collections to external drives. And they'l...

8:14 am

Add an external drive to your WMP or iTunes music collection

Add an external drive to your WMP or iTunes music collection

As people replace their hard drives with smaller SSDs, many will choose to move large music collections to external drives. And they'l...

8:14 am

Tips for hassle-free computing at 33,000 feet

Tips for hassle-free computing at 33,000 feet

I'm writing this from around seven miles high in the sky, where I can't help but marvel at the technology that's allowing my l...

8:09 am

Tips for hassle-free computing at 33,000 feet

Tips for hassle-free computing at 33,000 feet

I'm writing this from around seven miles high in the sky, where I can't help but marvel at the technology that's allowing my l...

8:09 am

Here's what an eavesdropper sees when you use an unsecured Wi-Fi hotspot

<div class="imageContainer580xX" style="width:320px;height:auto;clear:both;margin:auto;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:14px;line-height:19px"><img class="largeImage  imgId100044261 " itemprop="image" src="http://zapt2.staticworld.net/images/article/2013/06/eavesdropperwifi_primary-100044261-large.jpg" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: 320px; max-width: 100%;"></div>  <div class="department" style="margin:0px 0px 10px;overflow:hidden"><a class="presentedBy" href="http://adfarm.mediaplex.com/ad/ck/12309-189045-1105-2?mpt=%%CACHEBUSTER%%" style="color:rgb(51,51,51);float:none;font-family:facitweb,sans-serif;font-size:10px;font-weight:700;text-transform:uppercase;background-image:url(http://csmb.staticworld.net/images/ads/DellLogo-Blu-54px.png);display:block;width:300px;height:30px;text-align:right;padding-right:30px;vertical-align:middle;line-height:30px;background-repeat:no-repeat no-repeat">PRESENTED BY</a><a class="topCatLink" href="http://www.pcworld.com/category/business-security" style="color:rgb(172,31,43);float:left;font-family:facitweb,sans-serif;font-size:16px;font-weight:700;text-transform:uppercase;margin-right:5px"><span style="line-height:1.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px">You've probably read at least one story with warnings about using</span><span style="line-height:1.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px"> </span><a href="http://www.pcworld.com/article/244012/lock_down_your_wi_fi_network_8_tips_for_small_businesses.html" style="line-height:1.7em;font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px;color:rgb(37,167,215)" target="_self">unsecure public Wi-Fi hotspots</a><span style="line-height:1.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:15px">, so you know that eavesdroppers can capture information traveling over those networks. But nothing gets the point across as effectively as seeing the snooping in action. So I parked myself at my local coffee shop the other day to soak up the airwaves and see what I could see.</span><br>  </a></div><span itemprop="articleBody description text" style><p style="line-height:1.7em;margin:0px 0px 0.7em">My intent wasn't to hack anyone's computer or device—that's illegal—but just to listen. It's similar to listening in on someone's CB or walkie-talkie radio conversation. Like CBs and walkie-talkies, Wi-Fi networks operate on public airwaves that anyone nearby can tune into.</p>  <p style="line-height:1.7em;margin:0px 0px 0.7em">As you'll see, it's relatively easy to capture sensitive communication at the vast majority of public hotspots—locations like cafes, restaurants, airports, hotels, and other public places. You can snag emails, passwords, and unencrypted instant messages, and you can hijack unsecured logins to popular websites. Fortunately, ways exist to protect your online activity while you're out-and-about with your laptop, tablet, and other Wi-Fi gadgets. I'll touch on those, too.</p>  <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em">Capturing webpages</h2><p style="line-height:1.7em;margin:0px 0px 0.7em">I opened my laptop at the coffee shop and began capturing Wi-Fi signals, technically called 802.11 packets, with the help of a free trial of a wireless network analyzer. The packets appeared on screen in real time as they were captured—much more quickly than I could read them—so I stopped capturing after a few minutes to analyze what I had vacuumed up. Note: You can click on any of these screenshots to view larger versions that are easier to read.</p>  <a class="zoom cboxElement" href="http://images.techhive.com/images/article/2013/06/webpage_captured-100044056-orig.png" style="color:rgb(37,167,215)"><img alt="" border="0" height="438" src="http://images.techhive.com/images/article/2013/06/webpage_captured-100044056-large.png" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: auto; height: auto; max-width: 100%; float: left;" width="580"></a>My own website, captured via the hotspot packets and reassembled for viewing.<p style="line-height:1.7em;margin:0px 0px 0.7em">  I first searched for packets containing HTML code, to see which websites other hotspot users were browsing. While I did see activity from other patrons, I didn't capture anything interesting, so I visited my own website—<a href="http://www.egeier.com/" style="color:rgb(37,167,215)" target="_blank">www.egeier.com</a>—on my smartphone.</p>  <a class="zoom cboxElement" href="http://images.techhive.com/images/article/2013/06/email_captured-100044052-orig.png" style="color:rgb(37,167,215)"><img alt="" border="0" height="383" src="http://images.techhive.com/images/article/2013/06/email_captured-100044052-medium.png" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: auto; height: auto; max-width: 100%; float: left;" width="300"></a>This is a copy of the email I sent (and subsequently received) using my smartphone connected to the hotspot.<p style="line-height:1.7em;margin:0px 0px 0.7em">  The raw packets with HTML code looked like gibberish, but as you can see above, the trial network analyzer I used reassembled the packets and displayed them as a regular webpage view. The formatting was slightly off and some of the images were missing, but plenty of information still came through.</p>  <p style="line-height:1.7em;margin:0px 0px 0.7em">I didn't find anyone else sending or receiving emails during my visit, but I did discover the test messages I sent and received via my smartphone while it was connected to the hotspot. Since I use an app to connect to my email service via POP3 without encryption, you could have seen my login credentials along with the message (I've blurred the username and password in the screenshot).</p>  <p style="line-height:1.7em;margin:0px 0px 0.7em">This is all the information someone would need to configure their email client to use my account and start receiving my emails. They might also be able to send emails from my account.</p>  <a class="zoom cboxElement" href="http://images.techhive.com/images/article/2013/06/im_captured-100044054-orig.png" style="color:rgb(37,167,215)"><img alt="" border="0" height="194" src="http://images.techhive.com/images/article/2013/06/im_captured-100044054-medium.png" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: auto; height: auto; max-width: 100%; float: left;" width="300"></a>And these are the packets that went over the network when I sent an instant message using Yahoo Instant Messenger.<p style="line-height:1.7em;margin:0px 0px 0.7em">  I also used Yahoo Messenger to send a message while I was capturing Wi-Fi signals. Sure enough, the tool plucked that information out of the air, too. You should never use an unencrypted instant-messaging service with any expectation of privacy.</p>  <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em">Capturing FTP login credentials</h2><p style="line-height:1.7em;margin:0px 0px 0.7em">If you still use FTP (File Transfer Protocol) to download, upload, or share files, you should avoid connecting to them over unsecured hotspots. Most FTP servers use unencrypted connections, so both login credentials and content are sent in plain text, where any eavesdropper can easily capture them.</p>  <a class="zoom cboxElement" href="http://images.techhive.com/images/article/2013/06/ftp_captured-100044053-orig.png" style="color:rgb(37,167,215)"><img alt="" border="0" height="389" src="http://images.techhive.com/images/article/2013/06/ftp_captured-100044053-medium.png" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: auto; height: auto; max-width: 100%; float: left;" width="300"></a>These captured packets reveal the username and password securing my FTP server (I've blurred them in this screenshot).<p style="line-height:1.7em;margin:0px 0px 0.7em">  While using my laptop to connect to my own Web server's FTP server, I was able to capture the packets containing my login ID and password—details that would have enabled any nearby eavesdropper to to gain unfettered access to my websites.</p>  <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em">Hijacking accounts</h2><p style="line-height:1.7em;margin:0px 0px 0.7em">Computers aren't the only devices susceptible to eavesdropping. I also ran an app called DroidSheep on my spare rooted Android smartphone. This app can be used to gain access to private accounts on popular Web services, such as Gmail, LinkedIn, Yahoo, and Facebook.</p>  <p style="line-height:1.7em;margin:0px 0px 0.7em">DroidSheep looks for and lists any unsecure logins to popular websites. While it doesn't capture the passwords to those sites, it <em style>can</em> exploit a vulnerability that allows you to open the site using another person's current session, giving you full access to their account in the process.</p>  <p style="line-height:1.7em;margin:0px 0px 0.7em">As you can see from the screenshot below, DroidSheep detected Google, LinkedIn, and Yahoo logins from other people who were connected to the hotspot, as well as the Facebook login I made on my other smartphone.</p>  <a class="zoom cboxElement" href="http://images.techhive.com/images/article/2013/06/droidsheep-100044049-orig.png" style="color:rgb(37,167,215)"><img alt="" border="0" height="800" src="http://images.techhive.com/images/article/2013/06/droidsheep-100044049-orig.png" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: auto; height: auto; max-width: 100%; float: left;" width="480"></a>DroidSheep detected other users' log-ins, which means those accounts were vulnerable to hijacking.<br style>  .<p style="line-height:1.7em;margin:0px 0px 0.7em">I couldn't legally access other people's logins, of course, but I did open my own Facebook login.</p><a class="zoom cboxElement" href="http://images.techhive.com/images/article/2013/06/droidsheep_hijacking-100044050-orig.png" style="color:rgb(37,167,215)"><img alt="" border="0" height="500" src="http://images.techhive.com/images/article/2013/06/droidsheep_hijacking-100044050-medium.png" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: auto; height: auto; max-width: 100%; float: left;" width="300"></a>Using DroidSheep, I was able to access my own Facebook page without providing a user ID or password. I could have done the same with any other patron's accounts if they were logged in.<p style="line-height:1.7em;margin:0px 0px 0.7em">  Once I'd done that, I could magically access my Facebook account on that rooted Android phone (see the screen at lower right) without ever providing my username or password from that device.</p><h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em">  How to use Wi-Fi hotspots securely</h2><p style="line-height:1.7em;margin:0px 0px 0.7em">Now that you've seen just how easy it is for someone to eavesdrop on your Wi-Fi, here's how you can use a public hotspot with some degree of security:</p>  <ul style="margin:1em 0px;padding:0px 0px 0px 40px"><li style="line-height:1.45em">Every time you log in to a website, make sure that your connection is encrypted. The URL address should start with <em style>https</em> instead of<em style>http</em>.</li>  <li style="line-height:1.45em">You also need to make sure that the connection stays encrypted for all of your online session. Some websites, including Facebook, will encrypt your log-in and then return you to an unsecured session—leaving you vulnerable to hijacking, as discussed earlier.</li>  <li style="line-height:1.45em">Many sites give you the option of encrypting your entire session. You can do this with Facebook by enabling Secure Browsing in the Security settings.</li><li style="line-height:1.45em">When you check your email, try to login via the Web browser and ensure that your connection is encrypted (again, look for <em style>https</em> at the beginning of the URL). If you use an email client such as Outlook, make sure your POP3 or IMAP and SMTP accounts are configured with encryption turned on.</li>  <li style="line-height:1.45em">Never use FTP or other services that aren't encrypted.</li><li style="line-height:1.45em">To encrypt your Web browsing and all other online activity, use a VPN, or virtual private network (this article will <a href="http://www.pcworld.com/article/2030763/how-and-why-to-set-up-a-vpn-today.html" style="color:rgb(37,167,215)" target="_self">show you how</a>).</li>  <li style="line-height:1.45em">Keep in mind that private networks have similar vulnerabilities: Anyone nearby can eavesdrop on the network. Enabling WPA or WPA2 security will encrypt the Wi-Fi traffic, obscuring the actual communications, but anyone who also has that password will be able to snoop on the packets traveling over the network. This is particularly important for small businesses that don't use the enterprise (802.1X) mode of WPA or WPA2 security that prevents user-to-user eavesdropping.</li>  </ul></span>

Here's what an eavesdropper sees when you use an unsecured Wi-Fi hotspot

PRESENTED BY You've probably read at least one story with warnings about using unsecure public Wi-Fi hotspots , so you know that eav...

8:06 am

DIGITAL SANKALP

Tweak your browser to show YouTube song lyrics

Tweak your browser to show YouTube song lyrics

Tweak your browser to show YouTube song lyrics

Tweak your browser to show YouTube song lyrics

Add an external drive to your WMP or iTunes music collection

Add an external drive to your WMP or iTunes music collection

Tips for hassle-free computing at 33,000 feet

Tips for hassle-free computing at 33,000 feet

Here's what an eavesdropper sees when you use an unsecured Wi-Fi hotspot

Popular Posts

Comments

Blog Archive

Blog Archive