{"id":4307,"date":"2017-06-23T11:04:42","date_gmt":"2017-06-23T15:04:42","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=4307"},"modified":"2020-08-25T11:50:33","modified_gmt":"2020-08-25T15:50:33","slug":"silicon-valley-wi-fi-pineapple","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/silicon-valley-wi-fi-pineapple\/","title":{"rendered":"Would Silicon Valley\u2019s Wi-Fi Pineapple Scheme Really Work?"},"content":{"rendered":"

The Show\u2019s Massive MiTM Attack Could Work \u2013 But These Security Measures Can Keep You Safe<\/h2>\n

Minor Spoilers for Silicon Valley Season 4 Episode 9, \u201cHooli-Con.\u201d<\/em><\/p>\n

This week\u2019s Silicon Valley episode saw the Pied Piper crew in yet another jam. They need to get a few hundred thousand downloads of their app to make their peer-to-peer network work and keep their company in business.<\/p>\n

Richard and the crew launch a plan to use Hooli-Con, the show\u2019s parody of a major industry event like WWDC, as a way to get \u201cforced adoption\u201d of their app.<\/span><\/p>\n

To do this they would set up rogue Wi-Fi networks at the convention and distribute a fake version of the official convention app that also secretly includes Pied Piper\u2019s code, giving them the downloads they need.<\/p>\n

\"Silicon
A Wi-Fi Pineapple is a wireless router designed to be used for man-in-the-middle attacks and network inspection.<\/figcaption><\/figure>\n

Characters Gilfoyle and Dinesh explain the scheme: \u201cWe position ourselves between everyone\u2019s devices and the real Wi-Fi,\u201d with Wi-Fi Pineapples and then \u201cshow them a fake landing page and force everyone to download a fake version of the Hooli-Con app.\u201d<\/p>\n

While I won\u2019t comment on how Pied Piper\u2019s plan turned out, you may be wondering if such a scheme is really possible.<\/p>\n

The short answer is yes, but it comes with a lot of qualifiers; and if a website is using the best security measures out there they can actually make these types of attacks impossible <\/strong>(skip to the last section if you want to learn about that).<\/p>\n

Here is how it would work:<\/p>\n

The Silicon Valley Wi-Fi Pineapple Scheme<\/h2>\n

First off, Wi-Fi Pineapples are real<\/a> and affordable. For only $200 they give you both the router hardware and network software needed to spoof a wireless network.<\/p>\n

This allows you to set up a wireless network that you can control and use for this malicious plan. The next step is to get innocent users to connect to your Pineapple\u2019s network and then begin manipulating their traffic with a \u201cman-in-the-middle\u201d attack (MiTM).<\/p>\n

In a MiTM attack the Pineapple you control is positioned between (\u201cin the middle of\u201d) the server and the user\u2019s device. The two parties believe they are talking to each other, but in reality all communication is happening through the attacker (in this case, the Pied Piper crew) who can modify or delete any data being sent or received.<\/p>\n

How easy it will be to successfully execute the man-in-the-middle attack depends on two factors: how security savvy the targeted users are, and the security features of the website you want to be \u201cin the middle of.\u201d<\/p>\n

In a best-case scenario, with un-savvy users and a weak website configuration, you can fairly easily execute the MiTM attack and have full control over all data being sent between the user and the website they are visiting.<\/p>\n<\/span>\n

It can be as simple as redirecting the DNS to an address you control (while not technically a MiTM, this could be enough to execute Pied Piper\u2019s plan). Or you could use sslstrip<\/a>, software that automatically prevents users from connecting over HTTPS. This keeps them on the un-secured HTTP protocol where all data is in plain text and unauthenticated, and therefore trivially easy to manipulate. However, things can quickly get complicated if your victims notice the padlock icon in their browser is missing.<\/p>\n

\"SSLStrip\"
Downgrading a connection from HTTPS to HTTP is an easy way to manipulate traffic, but security-conscious users may notice the change and modern website configurations can prevent such an attack.<\/figcaption><\/figure>\n

The plan in Silicon Valley involved a \u201cfake landing page\u201d which is another clever option. When you log on to free Wi-Fi it’s common to have to sign in and accept terms and conditions through a landing page \u2013 also known as a captive portal<\/em>. This could be a look-alike domain like \u201chooli-con-2017.com\u201d which seems like a realistic domain for the event but is actually owned by the attackers (some captive portals are on local IPs which would be even easier to execute).<\/p>\n

But there is a modern security option that could make a MiTM attack impossible\u2026<\/p>\n

Make MiTM Attacks Impossible<\/h2>\n

You can make your site impervious to man-in-the-middle attacks with a technology known as HSTS, even when up against a formidable foe like a Wi-fi Pineapple.<\/p>\n

HSTS (HTTP Strict Transport Security) is an HTTP Header that tells a client (aka a browser) that it should only <\/em>be allowed to connect with the site with a valid HTTPS certificate.<\/p>\n

HSTS prevents you from downgrading a connection to HTTP. It also means you can\u2019t serve your own version of the site because you wouldn\u2019t be able to produce a valid SSL certificate. All major browsers \u2013 including Chrome, Firefox, and Edge \u2013 support HSTS and produce an un-bypassable error in this case.<\/p>\n

As always, when we are talking about secure connections, there is some complexity. Because HSTS settings are an HTTP Header, it does<\/em> require that the user has made at least one successful connection to the real site previous to connecting to the hostile network.<\/p>\n

This means if the user has never visited the site before they would not have the HSTS settings and would be vulnerable to a MiTM attack. However, there is something known as HSTS Preloading<\/em> that allows a website\u2019s HSTS settings to be shipped with a browser. The Preload list is put together by Google. It includes around 25,000 sites<\/a> and is shipped with Chrome, Firefox, Edge, IE 11, Safari, and Opera.<\/p>\n

\"browserThis removes the need to have made a successful connection to the site and with HSTS Preloading a site becomes truly impossible to MiTM.<\/p>\n

So if we tried a man-in-the-middle attack on Twitter.com, a site which does use HSTS Preloading, we would totally fail. We couldn\u2019t downgrade Twitter\u2019s connection. We couldn\u2019t redirect people elsewhere. We couldn\u2019t serve a different website.<\/p>\n

Despite the benefits of HSTS less than 5% of the Alexa Top Million use the feature<\/a>. A much smaller .3% are preloaded. However it is relatively new and adoption of the feature is growing fast. As HTTPS deployments mature we expect to see HSTS use rise significantly.<\/p>\n

Most major sites and services, like Gmail, Twitter, Facebook, and Paypal, have modern HTTPS configurations including HSTS which would make Silicon Valley\u2019s plan infeasible against most notable targets. But just 5 years ago this would have been a significantly more dangerous threat.<\/p>\n

I am mainly focused on the MiTM attack here. That\u2019s because Silicon Valley\u2019s entire plan \u2013 which requires successfully executing a MiTM attack and then <\/em>distributing an app to cell phones \u2013 would most likely be impossible due to the additional security measure you would need to defeat in the phone\u2019s OS.<\/p>\n

Modern mobile OSes like Android and iOS make it very difficult (mostly impossible on iOS) to get users to install apps from outside the official app store. This is an entirely separate set of mechanisms \u2013 including code signing, key pinning, and packaged binaries \u2013 that you would need to defeat even if you could get your MiTM attack to work.<\/p>\n

It\u2019s also worth mentioning that such a scheme is incredibly illegal \u2013 so even if you could pull it off \u2013 you probably shouldn\u2019t. Unless you also liked the HBO show Oz.<\/p>\n","protected":false},"excerpt":{"rendered":"

The Show\u2019s Massive MiTM Attack Could Work \u2013 But These Security Measures Can Keep You Safe Minor Spoilers for Silicon Valley Season 4 Episode 9, \u201cHooli-Con.\u201d This week\u2019s Silicon Valley…<\/p>\n","protected":false},"author":2,"featured_media":4314,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[16],"tags":[160,3291,3290,467],"class_list":["post-4307","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hashing-out-cyber-security","tag-hsts","tag-mitm-attacks","tag-silicon-valley","tag-ssltls","post-with-tags"],"views":26811,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2017\/06\/silicon-valley-hooli-con.png","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/4307","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=4307"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/4307\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/4314"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=4307"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=4307"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=4307"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}