0

I was booking a haircut online and noticed that when they made me sign up for an account, the credentials were not being encrypted (or at least that's what firefox was telling me).

It's not a huge deal because it's just an account that I use to book haircuts, but it got me wondering, how much of a security risk is this if I'm on a WPA2 encrypted wifi (and can be reasonably sure no attackers know the password)? Are there other points of attack at which the data could be seen besides sniffing the packets over wifi?

Matt
  • 103
  • 2

3 Answers3

3

Your data would only be protected by WPA2 to the router. Beyond that, if it is not protected by TLS/SSL (HTTPS), your data was most likely sent in the clear. As for how much of a risk? Not much considering it is only used for haircuts. If someone had a network tap anywhere between the router and the haircut website, they could see your data in the clear.

pm1391
  • 1,427
  • 2
  • 8
  • 19
  • So by network tap, are you talking about someone physically intercepting the cable from my router to my internet company? – Matt Oct 15 '18 at 01:37
  • Sure, that is just one possible way. – pm1391 Oct 15 '18 at 03:02
  • What would be the other possible ways? – Matt Oct 15 '18 at 15:26
  • Redirecting traffic could be another way. But a bigger issue here. TLS/SSL uses server certificates so you know you are talking to the haircut server and not someone else (authenticity). Without TLS, you can't be sure of that. – pm1391 Oct 15 '18 at 18:20
  • But what I'm asking is specifically how could an attacker redirect my traffic or otherwise cause me to talk to a server other than the true haircut server besides physically intercepting the wires that my cable company put up or somehow gaining my wifi password to reroute my DNS? Sorry if this is a noob question, I'm just really curious. – Matt Oct 15 '18 at 18:58
  • Compromising DNS. If they compromise your DNS server (typically on your router), they can point you to another website. Additionally, read this https://security.stackexchange.com/questions/12153/how-secure-are-wpa2-keys. – pm1391 Oct 15 '18 at 19:06
  • But how could they compromise my DNS server without knowing my PSK? – Matt Oct 16 '18 at 14:15
1

The idea behind WiFi WPA2 is to secure wirelessly interconnected devices, more of WPA2 was brought into existence to offer similar security features that a wired connection does. Now, considering the HTTP protocol, this is an extended network connection which goes beyond your WiFi (local) network. When you now communicating over HTTP, you will have to ALWAYS consider your connection to be via TLS/SSL (even if You're within you WPA2 network because, just to name one, you are vulnerable to MITM attack.

WPA2 on itself in our current cyberworld isn't enough, you should always think of securing your Transport Layer connection.

sec-social
  • 11
  • 2
  • How would a MITM (I'm assuming that stands for man in the middle) attack occur within my WPA2 network if the attacker doesn't know the wifi password? – Matt Oct 15 '18 at 01:41
  • While we can limit our thinking within WPA2, we should also think what other services are associated in the Network Transport Layer. Your data can be intercepted by simply knowing the BSSID of your wireless network(https://en.wikipedia.org/wiki/Aircrack-ng) Yes, you can create a closed connection which doesn't connect to the INTERNET, in this case, you will have an internal DNS resolver, but if you're using a public DNS resolver like your ISP, anyone is capable of doing advance MITM attack. Check this out https://security.stackexchange.com/questions/110903/mitm-over-wpa2-e-g-with-ettercap – sec-social Oct 15 '18 at 12:04
0

Anyone who also has the password for your wireless network can intercept any data that you send across it, at least if it's a basic home consumer network with no fancy WPA1/2 enterprise features enabled.

Other than that, it's the same as having your computer directly plugged in to your ISP. Most cable ISPs have baseline privacy turned on, so that other cable customers can't see other people's data. Anyone who operates any of the big routers on the Internet between you and the other end, or people who work at the data center where the hair cut website is hosted, could tap in to the connection and find out about your hair cuts.

Alex Cannon
  • 402
  • 2
  • 7