Microsoft issued a warning travelers across the world, saying Russian hackers have targeted Wi-Fi networks at hotels, conference centers, and other hospitality venues.
  • Sims@lemmy.mlEnglish
    3 hours

    Incredible that all big US tech is now suddenly trusted researchers/detectives, judge, jury and a societal security pillar alerting citizens without any intrinsic bad intentions (cough).

    I think these ridiculous scaremonger posts, with insanely biased claims, belong to either not-the-onion or similar joke subs, or should simply just be deleted. Some random tech-lord psycho corp (that never speaks the truth) claims random badness about US/Epsteins enemies… I mean ffs 1. its stupid, and 2. its racist slur without any evidence AT ALL!! …and racism don’t belong on Lemmy subs at all!

    Oh, and its incredible that they never found any of the US Gov attacks against both their own citizens, and against all other nations and their citizens. Snowden showed it all, but micro-shit are somehow not capable of catching US instigated crimes against humanity, and not capable of detecting any of the Capitalist surveillance operators that hacks every user on all sites, or anything really. I mean, Microsh*t themselves steal more information and are harming more people than any ‘hacker’. Its almost like they voluntarily participate in deliberate propaganda - coordinated with US fascist Gov.

    Here’s what Microshts best security advice should be: “Don’t use Microsoft products !”. Microsht is far far more dangerous for normal people than any ‘hacker’ threats out there…

  • RedGreenBlue@lemmy.zipEnglish
    10 hours

    Hackers warns Microsoft are targeting Windows users PCs: What to know.

    Microsoft is stealing your files, cookies, etc. Microsoft have access to your 365 account, one drive and email.

    Microsoft collects documents and are able to capture keystrokes, screenshots, audio, and video, monitor the clipboard, and change your preferences and more.

  • IWW4@lemmy.zipEnglish
    11 hours

    Is this an archive article?

    Hotel WiFi has been “targetted” by hackers since the they were first put in.

    • some_designer_dude@lemmy.worldEnglish
      6 hours

      Hacking hotel wifi is like “paint by numbers” for pen-testers, I’m sure. “I’m in!” “… The door was just, like, wide open.”

  • Septimaeus@infosec.pubEnglish
    14 hours

    Seriously, this is the lowest hanging fruit. Never trust hotel WiFi.

    The only rare exception is if they have a captive profile that requires downloading an encryption profile before you can reach the web. But even then, use a VPN and encrypted DNS, and if either is blocked for whatever reason, pass.

    • Scrubber0777@lemmy.mlEnglish
      13 hours

      Agree with your sentiment especially not trusting hotel Wifi (or heck all open network for this matter).

      I’d even err on the safe side and suggest not download any certificate and encryption profile at all.

      Even if I find myself as a tech literate person, I’d not trust my ability to identify the legitimacy of the download.

    • rozodru@piefed.worldEnglish
      11 hours

      extremely low hanging fruit. I travel a lot for work and all my laptops have VPNs with encrypted DNS. Even had to set that up on one of my FreeBSD installs (which was a god damn pain and with the shit wifi on that there really wasn’t much of a point at the end of the day).

      it’s even more mandatory for places that have NO captive portals. Those connections are opening themselves up to a can of worms. Looking at you Union Station in Toronto Canada. seriously, fix your shit. One of the biggest transit hubs in all of Canada and their wifi is completely 100% open.

      • Septimaeus@infosec.pubEnglish
        10 hours

        lol same at Union Station WDC and all Amtrak trains (if the wifi even works). Finally switched to a gl.inet (openwrt) hotspot for work travel and haven’t looked back.

    • pHr34kY@lemmy.worldEnglish
      12 hours

      I don’t think anything can monitor or mess with your local web traffic once you have encrypted DNS.

      VPNs don’t add any privacy over HTTPS+DoH. Installing CA certs and whatnot is insane.

      Stop getting your opsec advice from influencers on youtube. It’s snake oil.

      • Septimaeus@infosec.pubEnglish
        10 hours

        Hotel can see every site you connect to and you’re exposed to SNI fingerprinting by their ISP. Metadata leaks over both LAN and WAN (traffic volume, timing patterns, dest IPs, connection frequency) and both netadmin and ISP can infer your browsing habits without actually seeing the content. Other guests with wireshark and too much time on their hands.

        Moreover, many types of traffic aren’t HTTPS, including NTP, DHCP, SNMP, FTP, SSH (without HTTPS), most IoT devices, VoIP, gaming traffic, many application APIs, apps with embedded DNS overrides (really apps in general, especially mobile apps, especially meta and alphabet apps), even email unless TLS is explicitly configured. And many websites simply don’t serve HTTPS and will attempt to redirect to HTTP.

        This is without getting into encryption strength and post-quantum standards. And I was referring to 802.1X/MDM enterprise profiles not CA.

  • John Richard@lemmy.worldEnglish
    13 hours

    How do I warn people that Microsoft is targeting Windows users with adware, spyware, security vulnerabilities and surveillance?

  • ExLisper@lemmy.curiana.netEnglish
    12 hours

    “”" Users are then prompted to download malicious files, after which the hijackers infect the user’s device with malware that collects browser cookies, passwords, documents and more, Microsoft said. The hackers are able to capture keystrokes, screenshots, audio, and video, monitor the clipboard, and operate the device remotely.

    In some instances, users attempting to access a compromised network may be redirected to fake login screens, at which point, the hijackers will be able to access the user’s Microsoft 365 account, giving them further access to the person’s email and OneDrive.“”"

    Yeah, don’t download random files or giver your credentials to random pages, on both public and private WiFi. As long as you don’t do stupid things everyone uses https now so you’ll be fine.

  • gian @lemmy.grys.itEnglish
    12 hours

    On an unrelated news, Microsoft warns that water is wet.

    That hotel Wi-Fi networks are not the most secure networks is nothing new to be honest…

  • cub Gucci@lemmy.todayEnglish
    13 hours

    The only open wifi I trust is the one that doesn’t give me access to the internet unless I install their CA