rapt0r
join:2009-03-19
|  How it is possible to get Malware with Open Hotspot
I'm wondering if technically possible to get Infected when connecting to open WiFi Hotspot.
Assuming I found a rouge Open Wireless and I get connected to its network and DHCP will lease IP.
Is it possible when connected a Malware is downloaded into clients machine?
Or web browser is Hijacked?
What are the different possibilities of getting infected? |
|
nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
 ·AT&T U-Verse
 ·AT&T Midwest
| The greatest risk, is when you are using Windows networking and are sharing some of your files.
Another risk is a rogue DNS server. For example, when you do a google search, it could give you the IP address of a fake google page.
If you are taking reasonable precautions, and having your browser warn you before running any executable, then the risk should be something you can handle. Just be more cautious and less trusting when at an untrusted hotspot.
--
AT&T dsl; Westell 327w modem/router; openSuSE 11.0; firefox 3.0.8 |
|
docrice
join:2008-03-31
Fremont, CA
| reply to rapt0r
There are many vectors in getting malicious code onto your machine, regardless of whether it's at an open hotspot or not. Since your question is framed within that context, I'm assuming you're referring to direct network attacks instead of tricking the user into going into a webpage that automatically downloads code through XSS, "friendly" ActiveX install prompts, etc..
If the hotspot has a captive portal which serves a web page that's compromised, that's one place. DNS redirection is certainly a possibility. Even layer 2 redirection can cause you to chain your traffic through an unknown entity. How about an unpatched exploit that your machine may have that somehow allows remote SMB / RPC / etc. access into your OS perimeter?
In other words, there's a lot. You just have to reduce your risk profile by running with least-privilege, blocking everything inbound that isn't return traffic of your initiation, using something like NoScript in Firefox, etc.. |
|
