What is Digg?Sponsored by Newegg.com
$5,000 Newegg Eggstreme Challenge Video Contest Extended to 11/15 view!
newegg.com - Show them what YOU would do with the money you save by shopping at Newegg. Seriously, show them...
73 Comments
- spammishking, on 01/03/2008, -2/+74We're doomed if we have to rely on the typical consumer to educate themselves on network security
- usrlocalbin, on 01/03/2008, -3/+25"Why won't my modem boot up?! When it finally does my harddrive wont connect to the internets!."
"Well there was a big flashing sign on my harddrive that said I had a virus so I let it install the 'Virus Remover 10,000' to fix my problems"
"I just use this fan dangled contraption only for email, I don't understand why I need a firewall. I don't know much about all this 'technological hocus pocus'.
And most corporate users complain that their password can't be their dogs name, their address, or their first name.
Well said spammishking. - Chairboy, on 01/03/2008, -0/+21I'd like to read more about memes. Specifically, 'Free Public WiFi'. This is essentially a meme-based thing that has spread virally around the world. Someone had an access point with that as the name, and people tried connecting to it. Because of a quirk with how Windows XP caches access point names, those people started broadcasting point-to-point SSIDs of 'Free Public WiFi' and other folks tried connecting to it. And so on, and so on.
Whenever you see 'Free Public WiFi', you're seeing evidence of one of the most effective (if inadvertent) meme-viruses around. No destructive payload, and maybe it was an accident, but it has spread throughought the WiFi Windows XP world like an idea, or meme, and has pretty much global coverage.
That, friend, is fascinating. - PhillyMJS, on 01/03/2008, -1/+18"but only if consumers use them."
In other words, we're doomed.
Having a wide-open wireless network with the SSID "linksys" is the new symbol of the technically-ignorant consumer-- replacing the "12:00" eternally blinking on the VCR. - usrlocalbin, on 01/03/2008, -0/+14That's like saying that typical people shouldn't have to educate themselves on not taking a bath with a toaster.
The sad thing is that a lot of problems 'typical users' have could have been averted by a bit of common sense and not clicking that damn mouse button so quick.
Should they have to learn how to configure a Cisco PIX? No. Should they learn when a banner says they won a free iPhone not to enter their credit card info? Yes. - KraziLogicz, on 01/03/2008, -0/+10the virus has gone airborne, we need to cut access to the city
- Otto, on 01/03/2008, -2/+9Do they even have a Proof of Concept? Just a single worm that can send itself from one router to another?
I thought not.
Until every single router has exploitable back doors, the amount of "overlap" is irrelevant. The bug will be blocked when it finds a model of router it can't hack.
And wireless routers kinda suck nowadays, you can barely get connections from across the room sometimes, much less down the street. How are these routers going to connect to each other? - S1L3NTC, on 01/03/2008, -0/+6Way to hype up a non-existent threat!
So Wifi access points are suddenly go to have their firmware replaced and proactively airhack and compromise other access points? Where is the processing power coming from?
Where would the data be stored?
Other than some kind of DoS attack, or "control" over traffic, I don't see what the gain would be.
It's not as if your WiFi router is going to hack your machine.
Someone needs to put their tinfoil hat back on and stick their head in the microwave on high until they feel safe again. - Rotzooi, on 01/03/2008, -6/+12Just one more article in a long list of things that should get us scared.
Yawn - inactive, on 01/03/2008, -0/+5Highly unlikely to happen, no one will make any money with anti-virus software for your router. But if your in the market I can hook you up.
- Cyber_Akuma, on 01/03/2008, -0/+4Ugh, what makes your post even worse is the fact that you have an American flag, making all Americans look like idiots.
Is it not up to you to make sure your seatbelt is on when you drive your car? Is it not up to you to not drive straight into a tree?
Is it not up to you to lock your front door?
Is it not up to you to put a lock on a locker when you go swimming/to a gym/to school/etc?
The are giving you a quality product, its up to YOU to lock it because theres many choices and different security methods from which you can use, and some people might not need it (such as a public area using it for free WiFi for it's customers). They can't pre-lock it because YOU need to choose the settings and passwords you want to use. - Yarnage, on 01/03/2008, -2/+6I'm sorry but this article is complete non-sense. Yes it's possible to infect a router with a virus, but no two routers are alike and many are based on different architectures and operating systems which means that if a virus infected one, it wouldn't be possible for it to even go on the other. Not to mention any security holes on one are most likely going to be different on another.
Sure, you can go around and take people's networks down but a virus hopping from router to router? That's a movie; that's not actually possible with so many architectures unless it could re-compile itself on the fly for different architectures (I don't think we're even CLOSE to this reality.... yet). Try developing an application and making it work on 10 different devices and you'll see what I mean. - m00nmaster, on 01/03/2008, -0/+3http://www.wififreespot.com/
- AnimeOmega, on 01/03/2008, -2/+5There's medicine and vaccines for different illnesses, but they're effective only if people use them. No shi... lol
- hm2k, on 01/03/2008, -1/+4Better get out my tinfoil hat again...
- karapuz, on 01/03/2008, -0/+3I've seen that in several airports. At first I thought it was a script kiddie with a laptop trying to infect wifi users. (Connect to my 'Free Public WiFi' and get a free mallware)
- Thuktun, on 01/03/2008, -0/+3Wireless AP manufacturers could probably do a bit more securing in the factory, setting things up with WPA by default with random SSIDs and passkeys printed on a sticker on the router. That way, it would still be mostly plug-and-play without being easily ownable in its factory-provided state.
- mudsown, on 01/03/2008, -1/+4you forgot to add "with pics"
- inactive, on 01/03/2008, -0/+2Well lets take probably the most common wifi router in the world(my guess)... Linksys wrt54g and variants of. It has as much computing power as a Pentium 2 computer (more than enough to saturate a 10Mb Internet connection) It has 8 megabytes of ram and another 4 megabytes of flash. Oh and it runs Linux.
The OpenWRT distribution could be modified into a router rootkit, considering it uses exploits to install its self(on the wrt54g line of routers). Also OpenWRT has a full package system, so even though memory is limited, a script to download and run different metasploit scripts would be trivially easy to build.
Given the stealth techniques that worm authors now use, I guess you could wait until traffic was idle, then use that time to look for other routers (or computers behind the firewall) to exploit. When it exhaused the exploit possibilities, it could download (using the integrated package manager) the latest exploit script.
Also... It looks like OpenWRT has client modes for its wifi radios for bridging applications. In that case, once it gets inside your network, it would also be inside your neighbors firewall. If they are open, or only have wep and WPA1 in place, they are vulnerable as well.
With use of stealth techniques (it could spoof an official looking configuration web page) most users would not even know it was there.
That would be a pretty large and complex project however, well beyond the capabilites of most script kiddies. But do claim there no threat, is hyping down. - Tenoq, on 01/04/2008, -0/+2You were that guy who sued for 'cruise control' not driving his campervan when he went to make a coffee, right?
- GTMopo3, on 01/03/2008, -0/+2What if you didn't broadcast your SSID wouldn't that stop this "virus"? Also a few people keep talking about it not working on different routers because they are different hardware, however that might be true some areas like universities might be using mostly the same hardware they bought in bulk. Although that isn't of epic proportions I think that could pose a possible threat. Any thoughts?
- marcomc2, on 01/03/2008, -0/+2Skynet will soon be fully operational..
- Betrayer, on 01/03/2008, -1/+3This is interesting and all but they forgot to calculate the actual ISP's that the Wifi routers are connected to. (comcast for example could detect the routers communicating to themselves and could shut them down)Sounds to me like some students got caught breaking the law by War Driving and had to turn it into a "project".
- inactive, on 01/03/2008, -0/+2So it becomes not just a router crack but also a PC crack because you're inside the "firewall". You would not even really need the routers to talk to each other, you could just drive around Manhattan uploading the exploit as you go.
The main block I see to this is that flashing the firmware on every wrt I have ever seen requires wired access unless the person specifically turns off that protection. - SPThom, on 01/03/2008, -0/+2No, consumers AREN'T getting closer to being "up to snuff" on security... Technology's just doing more of the dirty work for them. If anything, this keeps the typical user less informed when there are new types of exploits, because they're not thinking about security at all. Sure, nobody wants to have their network hacked, but most people don't even realize it's possible.
- Dipster, on 01/03/2008, -0/+2Okay, this is becoming lamer than the Chuck Norris memes.
- HonestAbe, on 01/03/2008, -0/+2FUD.
- Yarnage, on 01/03/2008, -0/+2ethicalh is correct. Routers run on numerous hardware and software platforms. If a virus infected one, it's very unlikely it could even run on the other, much less exploit another security hole. This article is complete crap.
- Cyber_Akuma, on 01/03/2008, -0/+2I am pretty sure the virus is incompatible with your brain.
- leerayIG88, on 01/03/2008, -0/+2Unless...hes a ROBOT!!?? *dun dun dunnn*
- chuckbo, on 01/03/2008, -0/+2Kansas City airport has free wifi access -- they've had it for at least a couple of years.
- Cyber_Akuma, on 01/03/2008, -0/+2I would like to find this "free public WiFi" thing. I keep hearing about public places like restaurants, coffee shops, etc offering free WiFi for their customers, but every one I have been to asks me to purchase an hour or so use of their connection when I try it.
- Cyber_Akuma, on 01/03/2008, -0/+1I know, I only have it to deter somebody from just leeching off my connection, I am aware if somebody actually wanted to break in my WEP encryption would not do much, but what else can I do? The DS dosen't support WPA.
- shredswithpiks, on 01/03/2008, -0/+1blame arubanetworks
- TheGreger, on 01/03/2008, -0/+1No, I think that's just the nature of the term.
- Cyber_Akuma, on 01/03/2008, -2/+3I have to say, I think people are getting a LITTLE smarter with WiFi security.
About 2-3 years ago when I did a WiFi search about 95% of the access points I would find ANYWHERE (not counting any public place that offered WiFi) were not secured with anything, I could easily connect.
Nowadays its more the opposite, 95% of private access points that I have come across either just scanning with my laptop or using WiFiFoFum on my cell are encrypted with WEP or WPA.
But then again, I have no way of knowing its not consumers wising up so much as ISPs selling pre-configured routers to customers.... - AustinGoodchild, on 01/04/2008, -0/+1Just enable WPA.
- scabbers, on 01/03/2008, -1/+2I remember when rootshell.com got hacked.
- Yarnage, on 01/03/2008, -2/+3Geek Squad. It has nothing to do with anyone becoming smarter. I had to help my cousins get their XBox 360 on their wireless network. They had no idea it had encryption before the Geek Squad set it up for them.
- jonstafari, on 01/04/2008, -0/+1hey, you never know. one day you might have to fly your alien spaceship to the alien mothership and upload you virus via wifi... yeah... oh wait, that was USB
- Atomic1fire, on 01/04/2008, -0/+1a computer is like a pet
If you dont take care of it
your going to end up with something you dont want
in the case of a pet a dead mr fluffy
in the case of a computer a computer you cant use because a virus or something got to it - marybaboo, on 01/08/2008, -0/+1I guess it's time to start pushing DDWRT on consumers: http://www.tinyduck.com/quack/ddwrt
- dbr_onix, on 01/04/2008, -0/+1This has nothign to do with people getting smarter, it's router manufacturers: A lot of consumer wireless access points you can buy today come with a randomized WEP or WPA key written on the base of the router. People enter it into their computer when it asks, they don't really consider it as "improved security", it's just what you have to do.
Security is sensible defaults, nothing more. - midoritsuru, on 01/04/2008, -0/+1this might explain why the router at work inexplicably died this week...hm.....thanks for the heads up.
- geddon, on 01/03/2008, -0/+1My icon is the flag of the United Corporations of America. As an employee of the UCA, I can attest to the fact that "these products" are not produced with any quality in mind, but instead, are shipped off to third world countries and constructed by under-payed wage slaves.
Blaming our lack of intelligence for these products working the way we expect them to is a dark, humorless joke. - byttle, on 01/03/2008, -0/+1wireless N...and a small town...leave me alone...
- shredswithpiks, on 01/03/2008, -1/+1and only works if you can hit other routers in the neighborhood that happen to be unsecure, default login, linksys WRT routers.
- bzboy88, on 01/13/2008, -0/+0Yah, the people that have any in depth knowledge of computers and know something besides how to turn a computer on and double click on internet explorer should not be surprised by this article. The common user on the other hand is up a river without a paddle. but i dont think it is right to say that a whole city could be affected by this maybe just most of the citizens but companies and isp's should be smart enough to not let there computers be affected... or you would hope they would, lol....
- inajeep, on 01/03/2008, -2/+2shoo shoo wifi flu
- HonoredMule, on 01/03/2008, -1/+1Protecting idiots from themselves is no easy task, and we already often walk a fine line of locking down THEIR stuff so THEY don't break it.
There's always a few (like me) who will be offended for good reason when their computer doesn't obey.
The file is locked and in use? I own that file, and the computer that's running it, and am aware of the consequences of deleting it, so do what I ***** tell you! The sad thing is, 90% of the time the file that won't go away is malware, and the process trying to remove it is protection software acting on the user's (machine owner's) express authorization.
But that's why linux's security model rocks so much. NOTHING has higher authority than a user on the "do what I ***** tell you" list...not even the kernel.
Protecting users from themselves merely preserves their stupidity and inherent security risks THEY represent. While it sounds like I'm describing a lose-lose situation, there is an answer to the idiot-security problem. NEVER set what user's CAN'T do, but always outline what they MUST do: "We're sorry, but to enable wireless you must first change your router password from the default to something of at least medium strength. Please enter a new password: " -
Show 51 - 73 of 73 discussions
© Digg Inc. 2009
— Content created and posted by Digg users is