Hacker Read top | best | new | newcomments | leaders | about | bookmarklet login

Was this an attempted security fix? December is not a great time to roll out wi-fi changes unless to fix a security issue.


sort by: page size:

Well I did mention it's "an end-of-the-world type vulnerability, at least as far as Wi-Fi goes".

I don't think it's a lot of consolation saying something along the lines of "Wi-Fi security is broken, but it's not so bad because it's Wi-Fi"


I don't know what we expected — it's (literally) intentionally less secure WiFi.

Because it hasn't been seen before, it's not likely that it has been exploited. Even after knowing about the flaw for a while, the Wi-Fi Alliance says there is no evidence that this was used maliciously before. https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-se... We can't know absolutely but with all the attention wifi has gotten since the days of war driving, there's a good chance it would have been caught.

That's exactly what's happening. This is not a wireless attack, it's a physical access problem.

AT&T has been doing something similar for years.

https://forums.att.com/conversations/att-fiber-equipment/pos...


They have been caught trying to connect to unsecured WiFi before.

And in the process walking all over various security best practices?

And was there not a similar security snafu involving iPhones broadcasting past ssids every time they tried to connect to a access point?


That's only a denial of service issue, not a security issue. Wifi is too cheap to meter

Doesn't sound like a great security strategy. What happens the day some neighbor makes their Wi-Fi public?

or he might have been writing an article in a Starbucks working on an open wifi. Anybody who has Wireshark installed can go fish for passwords and other log in credentials in your local Starbucks!

When will people learn that an open Wifi is not secure!

(not claiming this is what actually happened here!)


This is a bad take. If your threat model has you concerned about people who follow you around and exploit your Wi-Fi firmware, you probably shouldn't ever have Wi-Fi on -- or maybe you shouldn't be using a smartphone.

For everyone else, the new behavior allows users to disconnect from bad Wi-Fi in Control Center while improving their battery life in case they forget to turn Wi-Fi back on.


As if public Wi-Fi has been somehow related to the attack or its causes.

> the design flaws are hard to abuse because…

This is good.

> in practice the biggest concern are the programming mistakes in Wi-Fi products since several of them are trivial to exploit.

Any indication which devices are known to be affected? None of the pages I've read so far give that information. Though it could be that this information is subject to "responsible disclosure" and won't be released until manufacturers have had a reasonable amount of time to release patches.


Wacky story, but this is very typical. They had unsecured wireless devices attached to thier network. A misconfigured device, misconfigured due to the hurricane, ended up causing internal problems. I muust ask, why was a wifi device so ready to connect to some random device? Be glad this wasnt a rogue device.

> wireless is secure if you do it right.

WiFi and bluetooth basebands and drivers have been repeatedly compromised, via public and non-public exploits. WPA3, despite promises of security improvements, remains vulnerable to deauth attacks. 5G LTE, despite promises of tower authentication improvements, remains vulnerable to IMSI catchers.

Oct 2022, Over-the-Air remotely exploitable Linux WiFi vulnerabilities (5 CVEs), https://news.ycombinator.com/item?id=33200171

July 2021, iOS WiFi RCE 0-day vuln, https://news.ycombinator.com/item?id=27868487

May 2021, https://news.ycombinator.com/item?id=27121918 & https://www.fragattacks.com/

> FragAttacks (fragmentation and aggregation attacks) ... is a collection of new security vulnerabilities that affect Wi-Fi devices. An adversary that is within range of a victim's Wi-Fi network can abuse these vulnerabilities to steal user information or attack devices. Three of the discovered vulnerabilities are design flaws in the Wi-Fi standard and therefore affect most devices. On top of this, several other vulnerabilities were discovered that are caused by widespread programming mistakes in Wi-Fi products. Experiments indicate that every Wi-Fi product is affected by at least one vulnerability and that most products are affected by several vulnerabilities.

July 2017, Broadpwn bug affects millions of Android and iOS devices, https://news.ycombinator.com/item?id=14727400


The Wi-Fi Alliance has published an official statement:

'There is no evidence that the vulnerability has been exploited maliciously […].'

That is probably about to change …

https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-se...


Yea, this ^. This attack approach is interesting but any company that's serious about security needs to realize that anything opened up on wifi is a big hole - this used to be more amusingly exploited by war-driving, just driving around a neighborhood looking for someone with an open network that spills out into the street so you could download the latest episode of friends.

I don't work in this sort of security and it seems terrifying, the social engineering side is especially crazy.


In case someone reads the cached version, I added a note about my point about Wifi after it was brought up that the attacker could be the Wifi provider itself so refresh the page.

Surprised they go with "DO NOT" connect to wi-fi, but just "avoid" attaching untrusted hardware devices. That seems backwards.
next

Legal | privacy