Do not use WiFi!

[Jan Panteltje]

Do not use WiFi!
https://techcrunch.com/2019/08/06/warshipping-hackers-ship-exploits-mail-room/?guccounter=1&guce_referrer_us=aHR0cHM6Ly93d3cubnUubmwvdGVjaC81OTc1OTAwL25pZXV3LXNvb3J0LWN5YmVyYWFudmFsLWthbi1wZXItcGFra2V0cG9zdC13b3JkZW4tdmVyc3R1dXJkLmh0bWw&guce_referrer_cs=zQ1AlhtWh3gh9FgOJXSYZQ

[Rich]

Jan Panteltje <pNaOnSt...@yahoo.com> wrote:
>
> Do not use WiFi!
> https://techcrunch.com/2019/08/06/warshipping-hackers-ship-exploits-mail-room/?guccounter=1&guce_referrer_us=aHR0cHM6Ly93d3cubnUubmwvdGVjaC81OTc1OTAwL25pZXV3LXNvb3J0LWN5YmVyYWFudmFsLWthbi1wZXItcGFra2V0cG9zdC13b3JkZW4tdmVyc3R1dXJkLmh0bWw&guce_referrer_cs=zQ1AlhtWh3gh9FgOJXSYZQ

There is actually nothing new here security wise.

What is new is simply the manner of sniffing/scanning the targets
wireless access points.

Instead of needing to park in the parking lot (and expose oneself to
being noticed) this simply ships a remotely controllable sniffer via a
package delivery service.

But the wi-fi exploits, they are all old and well known. Nothing new
at all being done there.

[Jan Panteltje]

On a sunny day (Thu, 8 Aug 2019 12:50:39 -0000 (UTC)) it happened Rich
<ri...@example.invalid> wrote in <qih5qv$hqk$3...@dont-email.me>:

That is true, just a different method,
so do not use it.

[Mandy Liefbowitz]

On Thu, 08 Aug 2019 13:23:31 GMT, Jan Panteltje
<pNaOnSt...@yahoo.com> wrote:

>On a sunny day (Thu, 8 Aug 2019 12:50:39 -0000 (UTC)) it happened Rich
><ri...@example.invalid> wrote in <qih5qv$hqk$3...@dont-email.me>:
>
>>Jan Panteltje <pNaOnSt...@yahoo.com> wrote:
>>>
>>> Do not use WiFi!
>>>
>>> https://techcrunch.com/2019/08/06/warshipping-hackers-ship-exploits-mail-room/

Edited for line length and anonymity, though the latter is probably
too late.

NOTE: TechCrunch is part of "Oath" [Along with AOL and a whole raft
of other sub-companies] and they have about a trillion tracker and
other data-vacuuming "partners". You may be required to sign away your
rights to privacy if you go onto the site. Or you could "manage your
options", which would take about a year and much carpal tunnel
syndrome, they don't make it easy to bulk-block their "partners". I'm
not entirely convinced the "manage options" thing *works* and if it
did I'm not convinced it is sticky without allowing Oath to load a
septilliard cookies ["biscuits" to those speaking Real English]. I
have turned off my acceptance of biscuits so I *can't* do the "manage"
thing. If I bump into Oath websites, I just skip them. My automatic
response set includes terse terms relate to babies and breaking stuff.
I do like jammy dodgers with tea, though. Some biscuits are nice.

Of course, they may only be asking permission of E.U. subjects so you
USAliens may not be shown the "consent" page. Aren't you *lucky*?

>>
>>There is actually nothing new here security wise.
>>
>>What is new is simply the manner of sniffing/scanning the targets
>>wireless access points.
>>
>>Instead of needing to park in the parking lot (and expose oneself to
>>being noticed) this simply ships a remotely controllable sniffer via a
>>package delivery service.

They load software onto your router? Isn't that *malware*, and
"computer misuse" and a tiny tad unlawful?

And preventable?

>>
>>But the wi-fi exploits, they are all old and well known. Nothing new
>>at all being done there.

As I'm never going to read the damnable article, thank you for your
concise summary. :) and {{{{{Hugs}}}}}

>
>That is true, just a different method,
>so do not use it.

If, and I stress the conditional, this is a risk to computers, should
you not be posting in "comp.risks"?

"sci.crypt" is about the *software* not the hardware nor the risks to
the software nor hacking tools. Well, not hacking tools in use, more
the theory and mathematics of cryptological tools in general. And, of
course, Adacrypt which is the class clown used as an eternal example
of what *never* to do or be.

"comp.risks" is a fun group and well worth adding to your list.

Mand.

[Rich]

Mandy Liefbowitz <mandyli...@the.port.side> wrote:
> On Thu, 08 Aug 2019 13:23:31 GMT, Jan Panteltje
> <pNaOnSt...@yahoo.com> wrote:
>
>>On a sunny day (Thu, 8 Aug 2019 12:50:39 -0000 (UTC)) it happened Rich
>><ri...@example.invalid> wrote in <qih5qv$hqk$3...@dont-email.me>:
>>
>>>Jan Panteltje <pNaOnSt...@yahoo.com> wrote:
>>>>
>>>> Do not use WiFi!
>>>>
>>>> https://techcrunch.com/2019/08/06/warshipping-hackers-ship-exploits-mail-room/
>
> Edited for line length and anonymity, though the latter is probably
> too late.
>
> NOTE: TechCrunch is part of "Oath" [Along with AOL and a whole raft
> of other sub-companies] and they have about a trillion tracker and
> other data-vacuuming "partners". You may be required to sign away your
> rights to privacy if you go onto the site.

1) Firefox
2) NoScript - in default deny all JS
3) uBlock Origin - in default deny first party and third party stuff
4) Cookie AutoDelete - which autodeletes the sites cookies when the tab
containing the site is closed

And most of these worries slip away.

In fact, I just tested by goin to the article again. Only one cookie
was set, and it got cleaned up after I closed the tab. So 99.99% of
the extras were set by the javascript from the ad platforms, and
disallowing the JS also prevented the cookies from being set.

[Mandy Liefbowitz]

On Thu, 8 Aug 2019 21:11:18 -0000 (UTC), Rich <ri...@example.invalid>
wrote:

>Mandy Liefbowitz <mandyli...@the.port.side> wrote:
>> On Thu, 08 Aug 2019 13:23:31 GMT, Jan Panteltje
>> <pNaOnSt...@yahoo.com> wrote:
>>
>>>On a sunny day (Thu, 8 Aug 2019 12:50:39 -0000 (UTC)) it happened Rich
>>><ri...@example.invalid> wrote in <qih5qv$hqk$3...@dont-email.me>:
>>>
>>>>Jan Panteltje <pNaOnSt...@yahoo.com> wrote:
>>>>>
>>>>> Do not use WiFi!
>>>>>
>>>>> https://techcrunch.com/2019/08/06/warshipping-hackers-ship-exploits-mail-room/
>>
>> Edited for line length and anonymity, though the latter is probably
>> too late.
>>
>> NOTE: TechCrunch is part of "Oath" [Along with AOL and a whole raft
>> of other sub-companies] and they have about a trillion tracker and
>> other data-vacuuming "partners". You may be required to sign away your
>> rights to privacy if you go onto the site.
>
>1) Firefox

Yerp.

>2) NoScript - in default deny all JS

Yerp.

>3) uBlock Origin - in default deny first party and third party stuff

Yerp.

>4) Cookie AutoDelete - which autodeletes the sites cookies when the tab
> containing the site is closed

Nope. I don't need this one as I don't allow biscuits to be set. That
*may* be another reason Oath is irked at me, they can't see a
"no-Oath" cookie anywhere in my biscuit tin so each time I go to one
of their sites they see me as a totally clean, innocent slate.

It's no big deal. I just avoid them in the future.

>
>And most of these worries slip away.

Yerp.

>
>In fact, I just tested by goin to the article again. Only one cookie
>was set, and it got cleaned up after I closed the tab. So 99.99% of
>the extras were set by the javascript from the ad platforms, and
>disallowing the JS also prevented the cookies from being set.

I just tried again, again the "consent" form. I fiddled about with my
security, ad-blocky and cookie settings. Still shows. I tried the
"manage options" clicky rectangle. I get so far as a page telling me I
have "third party cookies" set to "bugger off with a vengeance". This
I was quite aware of but I mislike *them* knowing it.

This last page tell me I *can't* set anti-Oath preferences no matter
what I do without allowing a Hilbert Hotel full of biscuits into my
nice, little box.

Fie upon them and the horse they rode in on. If they can't leave me
alone, I don't want their verminous contaminants in my life. To the
dark regions with their cruddy sites full of woe and greed and
venality.

I'll pass, thanks. If this be the future of the Internet then I'm
glad I'll never really need nor want it.

But thank you for trying to help.
Mand.

[Rich]

Interesting that you get a different result.

As for 'them' knowing you refuse third party cookies, if you truly do,
it is hard to avoid them not knowing, since they way they 'know' is by:

1) setting a third party cookie
2) checking to see if the third party cookie got set

[Mandy Liefbowitz]

On Thu, 08 Aug 2019 23:35:02 +0100, Mandy Liefbowitz

<mandyli...@the.port.side> wrote:

>On Thu, 8 Aug 2019 21:11:18 -0000 (UTC), Rich <ri...@example.invalid>
>wrote:
>
>>Mandy Liefbowitz <mandyli...@the.port.side> wrote:
>>> On Thu, 08 Aug 2019 13:23:31 GMT, Jan Panteltje
>>> <pNaOnSt...@yahoo.com> wrote:
>>>
>>>>On a sunny day (Thu, 8 Aug 2019 12:50:39 -0000 (UTC)) it happened Rich
>>>><ri...@example.invalid> wrote in <qih5qv$hqk$3...@dont-email.me>:
>>>>
>>>>>Jan Panteltje <pNaOnSt...@yahoo.com> wrote:
>>>>>>
>>>>>> Do not use WiFi!
>>>>>>
>>>>>> https://techcrunch.com/2019/08/06/warshipping-hackers-ship-exploits-mail-room/
>>>
>>> Edited for line length and anonymity, though the latter is probably
>>> too late.
>>>
>>> NOTE: TechCrunch is part of "Oath" [Along with AOL and a whole raft
>>> of other sub-companies] and they have about a trillion tracker and
>>> other data-vacuuming "partners". You may be required to sign away your
>>> rights to privacy if you go onto the site.
>>
>>1) Firefox
>
> Yerp.
>
>>2) NoScript - in default deny all JS
>
> Yerp.

Oh, beggars.

Nope. The "deny all" wasn't set. There was a bloody *Whitelist*!

I've no idea which one let an Oath script through but I didn't
recognise some of the ones NoScript thought were WhitHats so I blocked
them. Oath's "consent form" has now gone away.

Thank you for helping, even if it was helping me see how dumb I can
be.

>
>>3) uBlock Origin - in default deny first party and third party stuff
>
>Yerp.
>
>>4) Cookie AutoDelete - which autodeletes the sites cookies when the tab
>> containing the site is closed
>
> Nope. I don't need this one as I don't allow biscuits to be set. That
>*may* be another reason Oath is irked at me, they can't see a
>"no-Oath" cookie anywhere in my biscuit tin so each time I go to one
>of their sites they see me as a totally clean, innocent slate.
>
> It's no big deal. I just avoid them in the future.
>
>>
>>And most of these worries slip away.
>
> Yerp.
>
>>
>>In fact, I just tested by goin to the article again. Only one cookie
>>was set, and it got cleaned up after I closed the tab. So 99.99% of
>>the extras were set by the javascript from the ad platforms, and
>>disallowing the JS also prevented the cookies from being set.
>

<< snipped>>

Yerp. I also got to read the article and, apart from it being a
bug-in-a-box, you are correct there is nothing new here. It is just
war-driving with an extension cord that ends inside the premises being
attacked. Anyone with a Raspberry FLAN could do it. So long as the
battery lasted and the signal was good.

It's an old idea in SF. "Blake's 7" used it, "Star Trek" used it and
I'm fairly sure S.H.I.E.L.D. tech automatically pairs with
*everything* local to suck it dry. Not that being in SF makes anything
real but I'm sure the black hat nerds watch the same things, read the
same books and buy the same comics we do so they are probably
garnering the same ideas as people like Mr.Musk and other Whitehats
and applying them naughtily.

Thank you again for the help.
Mand.





Addendum : Floating Local Area Network. Not the same as "FLAN", which
is a *Fixed* Local Area Network with devices that rarely move around
much.

And, yes, I do need to get out more.

[Mandy Liefbowitz]

On Thu, 8 Aug 2019 22:51:42 -0000 (UTC), Rich <ri...@example.invalid>

Well, my fault. I don't any more. Thanks.

>
>As for 'them' knowing you refuse third party cookies, if you truly do,

I refuse *first* party cookies, and second, and all the rest of them.
I guess I just refuse biscuits.

Mostly. Custard creams are nice with a mug.

>it is hard to avoid them not knowing, since they way they 'know' is by:
>
> 1) setting a third party cookie
> 2) checking to see if the third party cookie got set

Yes, yes, yes [she says, irked, miffed and affronted a little], I
*know* those steps. I *still* don't like them knowing.

I'd like it if they couldn't even *see* my machine, never mind look
inside its drawers.

However, I do understand how late it is for a thought like that and
how the tech has advanced since "anonymous" was a realistic idea.

Not all who wander are lost, some are window-shopping, others are
just trying not to be noticed and a few are trying to invent a
Stardrive so don't even *see* their environment.

Mand.

[Jan Panteltje]

Mandy Liefbowitz had teh following output:
<mandyli...@the.port.side> wrote in

snip blah blah

> If, and I stress the conditional, this is a risk to computers, should
>you not be posting in "comp.risks"?
>
> "sci.crypt" is about the *software* not the hardware nor the risks to
>the software nor hacking tools. Well, not hacking tools in use, more
>the theory and mathematics of cryptological tools in general. And, of
>course, Adacrypt which is the class clown used as an eternal example
>of what *never* to do or be.
>
> "comp.risks" is a fun group and well worth adding to your list.

You know, you can encrypt with whatever (quantum or not :-)) and at the same time publish your plaintext via the 'ether'.
If you were in this group a bit longer than today,
you find many interesting hacking papers mentioned.
When encrypting anything EVERYTHING should be secure, also the hardware,
side channel attacks, processor current changes etc etc looked at.
Maybe the LAST thing I would do if you ware my enemy is try cracking your AES or whatever
but FIRST I would try every other hardware related method, as it is simply simpler.

Anyways, MY WiFi was hacked by an evil person, and everything here is wired now.

I ran your text through my AI neural net password extractor and now have all your passwords,

I gave a warning, you are free to ignore it, as I will with the rest,
Now go play scrabble or something.

[Rocket Man]

"Jan Panteltje" <pNaOnSt...@yahoo.com> wrote in message
news:qigo74$h2e$1...@dont-email.me...

>
> Do not use WiFi!
> https://techcrunch.com/2019/08/06/warshipping-hackers-ship-exploits-mail-room/?guccounter=1&guce_referrer_us=aHR0cHM6Ly93d3cubnUubmwvdGVjaC81OTc1OTAwL25pZXV3LXNvb3J0LWN5YmVyYWFudmFsLWthbi1wZXItcGFra2V0cG9zdC13b3JkZW4tdmVyc3R1dXJkLmh0bWw&guce_referrer_cs=zQ1AlhtWh3gh9FgOJXSYZQ

You might as well urge people to stop having sex, they'll keep doing it
anyway.

Rants like these are unhelpfull and will simply be ignored by the general
public.

[Jan Panteltje]

On a sunny day (Wed, 14 Aug 2019 13:03:58 +0200) it happened "Rocket Man"
<thepr...@imailinator.com> wrote in <qj0pqg$b9u$1...@news.albasani.net>:

A good warning is always in place, public is ignorant.