Microsoft really hasn’t done itself any favors this time. The news has hit the Interwebs that Microsoft has collected the locations of millions of laptops, cell phones, and access points all over planet earth. They then apparently make this data publicly available through Live.com with little regard to the privacy concerns. How does that compare with others who collect this sort of data?:
Unlike Google and Skyhook Wireless, which have compiled similar lists of these unique Wi-Fi addresses, Microsoft has not taken any measures to curb access to its database. Google tightened controls last month in response to a June 15 CNET article, and Skyhook uses a limited form of geolocation to protect privacy.
Lovely. It makes me loathe Microsoft even more than I already do. How did Microsoft get this data?:
Microsoft assembled the database through crowdsourced data gathering from Windows Phone 7 devices and through what it calls “managed driving” by Street View-like vehicles that record Wi-Fi signals accessible from public roads. Its Web interface is, the company says, intended to provide “search results, weather, movie times, maps and directions based on a device’s current location.”
Sneaky. When asked about this, here’s what Microsoft had to say:
Reid Kuhn, a program manger with Microsoft’s Windows Phone Engineering Team, sent CNET this statement: “To provide location-based services, Microsoft collects publicly broadcast cell tower IDs and MAC addresses of Wi-Fi access points via both user devices and managed driving. If a user chooses to use their smartphone or mobile device as a Wi-Fi access point, their MAC address may also be included as a part of our service. However, since mobile devices typically move from one place to another they are not helpful in providing location. Once we determine that a device is not in a fixed location, we remove it from our list of active MAC addresses.”
Microsoft did not, however, respond to questions whether its database includes only Wi-Fi devices acting as access points, or whether client devices using the networks have been swept in as well–something that Google did with its Street View cars. A May blog post touts “Transparency About Microsoft’s Practices,” but doesn’t provide details.
The privacy implications are huge. Someone can use this info to retrace your steps to see where you’ve been. All they’d need is your MAC address which is easy”ish” to get. Hackers could leverage that info as part of a larger attack. Scary isn’t it.
Sorry Microsoft. This is a #fail for you.
Research Shows That Wi-Fi Protected Setup Is Horrifically Insecure
Posted in Commentary with tags Security, WiFi on August 31, 2014 by itnerdIf you have a router that uses Wi-Fi Protected Setup or WPS, then there’s a good chance that it is insecure. Some research that I came across shows that wireless routers are still quite vulnerable to attack if they don’t use a good implementation of Wi-Fi Protected Setup. Bad implementations do a poor job of randomizing the key used to authenticate hardware PINs. Because of this, the new attack only requires a single guess at the hardware PIN to collect data necessary to break it. After a few hours to process the data, an attacker can access the router’s WPS functionality. Now here’s what makes this really bad:
The Wi-Fi Alliance could not confirm whether the products impacted by the attack were certified, according to spokeswoman Carol Carrubba.
“A vendor implementation that improperly generates random numbers is more susceptible to attack, and it appears as though this is the case with at least two devices,” she said in a statement. “It is likely that the issue lies in the specific vendor implementations rather than the technology itself. As the published research does not identify specific products, we do not know whether any Wi-Fi certified devices are affected, and we are unable to confirm the findings.”
That means that your router might be affected. Or it might not be affected. There’s no way to be sure at the moment. My take? As a matter of course I disable WPS for any customer and I explain why. It is a far to easy way for someone to get access to your network. Thus if you want your network to be secure, you need to keep this feature disabled.
In the meantime, I wonder how many router companies are going to be shipping firmware updates to address this. Assuming that they admit to it at all.
2 Comments »