Visitors to Sochi Olympics will be instantly hacked
sports.yahoo.com
sports.yahoo.com
----
Right technical post/description of how not to use technology coming up.
TL; DR I guess if you can't operate a box then there isn't much hope of being able to operate a phone or a laptop.
# Phone:
User logs onto public wifi and was asked to run setup program to access internet, setup program was actually malware. Note, this was a "user initiated action" and whilst I realise that many people just download and run anything without even checking the permissions anyone with even a modicum of technical knowledge would not have been caught out by this. Also this would not affect iPhones since they cannot run apps that are not distributed via the app store.
# Do not EVER use public wifi.
* log into reddit and then anyone within wifi range can steal your reddit session (same for all sites that don't enforce https on every page).
Ever seen that message that says "we couldn't verify the certificate for mail.google.com" (or similar) when accessing emails? This is because the people operating the wifi are intercepting secure traffic which means they can intercept any password sent over the network, so if you have mail configured and you click ok when that warning comes up (which 90% of users do unfortunately because it just looks like a normal alert rather than a really serious security warning) then they will have your email password.
# Mac laptop:
I actually don't know how this was done, I've contacted the guy from the video and he said he will write up a technical post on Friday. Out of the box, new macs only run code from the App Store so unless that setting was changed (in which case saying it was hacked is bullshit rather than a simplification) I just don't see how it could have become infected.
Edit: Found out that they downloaded an antivirus software from a dodgy site and followed the instructions to allow it to run. If people are going to follow instructions to disable security on their computer then there really isn't much that can be done to help them.
# Windows Laptop:
They opened an email attachment in office and clicked "allow macros". Again, not something that a clued up user would do. Still something that Microsoft could handle better - make it something that has to be preconfigured rather than just giving the user the option since there really isn't any good reason for most consumers to be running macros.
# In summary:
Nothing new to see here and only one of the pieces of installed malware was of Russian origin so basically this is just a bit of a smear campaign. Sure the free wifi may be more dodgy over there than in the US/UK (yay for Britain) but it is not a problem limited to Russia, I had the same problem in Sri Lanka and public wifi is not secure and should never be used.
----
u/daniel_chatfield
http://www.reddit.com/r/videos/comments/1x2t3j/all_visitors_...
This is important because not only does Developer ID allow you to run apps that you downloaded directly, but there's also pretty much no checks on the whole process. It would be pretty easy for a malicious developer to pay $99 (presumably with a stolen credit card), get a Developer ID certificate, and go to town. Apple can revoke the certificate, but it would come too late for a quick thing like this.
For iPhones, it's possible that they got up to some shenanigans using configuration profiles. These aren't well known, but you can install a configuration profile downloaded from anywhere, and they can do amusing things like add new root certificates, fiddle with network settings, etc. The user has to approve any new configuration profile, but plenty of nontechnical people will obediently tap "INSTALL" when told to.
Of course if the Olympics were held in Washington, he wouldn't be perplexed. He would probably be so sure about it, that it wouldn't even be worth mentioning.
This post is an prominent example of propaganda: No technical details, just pure old FUD for the masses. Why and How did this came up in HN's frontpage (we're supposed to me technically speaking, above average when it comes to computers), is beyond me.
[1] Tall guys, short blond hair, speaking English with as Russian accent as you can get, having obvious temper-control problems and always heavily armed (K-7 and a couple of bombs, just in case) even when sitting on a 11.6" inch laptop. Sorry, I forgot to add that they are probably sitting on a cold basement in Syberia.
Wouldn't the US do the exact same thing if it was in the US?
The other bit to realize is that there will be sex, around 100k condoms worth. That's 35 condoms per athlete on average. Certainly there's dirty laundry incentive for news and political orgs.
I should have stopped reading right there :)