The next attacks targeted client computers and attacker aims to intercept user credentials and use them
to control a computer.
We're back in a familiar scenario.
A user is connected to a Wi-Fi network an access point that supports the network is controlled by an
attacker the AP which is at the same time a DHC server will then set up a default gateway a router and
a DNS server.
It doesn't configure a proxy server an intermediary.
The key objective of the attacker is now to force a victim's computer to send all data through his device.
For example a proxy server if this is achieved the attacker would be able to eavesdrop and modify the
data sent by the victim on the fly to fly a modification of received and sent transmissions is a huge
threat to computer security we'll soon learn exactly why
an effective attack requires only to turn on the DNS server that was set for klank computers by an access
point as the default DNS server the server has to be configured to return the IP address of your proxy
server as an answer to all queries about names.
Once it's configured you control the communications channel between a client and the requested website.
You can modify send data on the fly in the simplest scenario.
You can inject scripts into data exchange between the browser and the Web site.
You can embed links to an invisible pixel stored on your computer disk on these sites.
Displaying a page will also cause the browser to display the pixel to download it.
The browser will have to connect to your computer while establishing a remote connection in windows
before a logging page is displayed.
The system sends user credentials to a given computer probably using the end TLM protocol over the next
module will see that receiving and TLM challenge is equivalent with obtaining a user's password
inserting the above code line into a web site means that the user will connect to the server number
10 got 0 0 1 and his credentials will be automatically sent there.
The send data won't authenticate the user and display the image.
But we're quite satisfied with the information we've obtained.
We've received a scent challenge message gaining control over a channel means that a person who set
up an access point for example at an airport or at a restaurant knows our windows password this attack
is still extremely popular and a number of variations exist depending on the prime target of the attacker
attackers can attempt to steal our credentials to a given web site instead of an image.
An attacker can inject a script that launches an app or a code that is stored on his server this code
can be used for example to sniff out values submitted and log in and password fields.
A relatively recent extremely vicious type of attack enables attackers to modify the data downloaded
by users on the fly.
If you connect to a web server using HTP to download the file the file is not protected in any way.
The authenticity of HTP packets is not being verified.
The packets are not encrypted they can easily be modified by attackers on the fly.
Fortunately there aren't yet any openly available tools on the Internet that make these operations possible.
It's obvious that before you launch a program a warning will be prompted do you want to run this program.
It comes from the Internet and is potentially unsafe.
Because we've grown used to messages like this we will automatically hit yes as proof of concept an
attack consisting of downloaded and modified file being digitally signed on the fly with a valid certificate
was shown a user was still prompted with a warning that the window had a different friend color and
Windows systems.
And additionally it came with the information that the file was from a trusted source.
As far as client attacks are concerned as you've seen an attacker aims to convince users to connect
to his fake access point.
This can be achieved by setting up an access point that would establish connections to networks with
an SS ID that a user wants to connect to the access point will listen to packets checking access points
near their client.
Then it will extract SS IDs and set up a network with a given society.
This is another proof that turning off SS ID broadcasting is not a good idea.
A better solution would have an access point broadcast itself and it would be up to the client to choose
the appropriate connection despite all these threats to security.
The advantages of wireless LANs outweigh the risks.
What can be done to tighten up the security.
There's only one solution.
If you connect to an untrusted network don't log into any important services like your business mailbox
or your bank account.
Immediately after establishing an internet connection configure a secure VPN connection to an enterprise
server.
You need to make sure that all communications are really sent through the VPN channel.
This doesn't always have to be the case.
It's a matter of varying levels of routing detail.
A person who controls a fake access point could have predicted that will connect to using a VPN and
set specific points in such a way that will connect to some Web sites directly through the Rogie access
point.