Wireless Hotspot Vulnerabilities on BBC Watchdog

Question

I watched a program on the BBC last night that highlighted the risks of using any public wireless hotspot.

http://www.guardian.co.uk/technology/2009/oct/29/wifi-watchdog-hotspot-security-vulnerable

They had examples of hijacking someones gmail session and getting some email usernames and passwords. I would assume they are talking about an intruder sitting in the wireless zone and using a packet sniffer to monitor unencrypted traffic, and some email usernames and passwords and web traffic are transported unencrypted. The way they were talking it was as if they could also hijack someones session, I assume by reading the cookies being transmitted and then using them to jump on their session.

However, I was very confused over this, as most important sites use SSL and gmail definitely works over HTTPS. Therefore, all traffic between the browser and the web server (including anything being broadcast over the local public network) would be encrypted and unreadable.

Am I correct in thinking that you're only at risk if you're using anything that's not using HTTPS & SSL? If that's the case and it seems likely that it is, then that stuff is pretty obvious, and the program was probably aimed at less tech savvy people than myself.

I'd be very interested how they got into someone's gmail though, as to my understanding that is totally secure!

Cheers,

Mike

Answer 1

Gmail's SSL can be turned off. This has advantages and disadvantages. Security being the main concern.

Additionally, SSL isn't infallible. It's secure enough for now, but it's no longer the unbreakable fortress of encryption it once seemed.

Answer 2

A lot of people use the same password for multiple accounts/sites. Grab one that goes across unencrypted and try it as the password for an encrypted site. Odds are pretty high its the right one.

Answer 3

I was half listening to Watchdog last night, can't say I remember seeing anything to suggest that they had tried the following but it could be possible:

Someone could sit in a HotSpot with the equipment to create a "fake" Wireless Access Point in a back pack (reading Scott Hanselman's Blog suggests you may only need a Windows 7 Laptop configured correctly), this wireless access point could be used to perform a Man-In-The-Middle attack presenting a fake version of G-Mail or any other service. This should be thwarted by SSL, however, if the user did not heed the warnings or was using an older browser that used confusing terminology they may not notice the Certificate was invalid.