HNHacker News
TopNewBestAskShowJobs

thoughtprocess

5 karma · joined April 6, 2012

submissionscomments
thoughtprocess··on Hotel Wifi JavaScript Injection
Same problem @ court houses offing WiFi to juror's. They express that you should take advantage of access to the local free/UNENCRYPTED WiFi for "JUROR's ONLY" to access.

Thought, the network is open which is a danger within itself, the network asks you to accept an invalid security certificate(which means their MiTM everything from the get-go), and then they took the time to make your read/accept an agreement stating in bold that this is an insecure network, and that everything you do over it will be audited, and monitored(SsL-STRIPING). As a juror, you must then sign-in using your badge#.

It defeats the purpose of any of these post associated protections, if an attacker simple injected his own certificate, or java-script frame. Even creating a Honeypot-Rouge-AP using any number of wireless capable devices such as, smartphones, and mobile routers, even wristwatches &sunglasses.

Compromising a jury from an attackers stand-point would be too, sit in the cafeteria, and literally eat-cake.

:-\