Computer experts built a free Wi-Fi hotspot and asked for the children of people logging on in return for internet service.
The request was in the terms and conditions. Many did not even check and simply agreed to get Wi-Fi access.
Those logging on and consenting showed their passwords, emails and IDs as their data travelled over the rogue network.
‘In return for free use of this wireless hotspot you agree to give us your firstborn child or your favourite pet for all eternity.’
Tainted Love: How Wi-Fi betrays us
All part of an experiment by the Cyber Security Research Institute into the massive security issues from logging onto Wi-Fi access points on behalf of the Finnish cyber security company F-Secure (now WithSecure). The CSRI research found that in return for connectivity to free internet people would click on anything.
The research, published as a report for F-Secure called, ‘Tainted love: How Wi-Fi betrays us,’ went viral on the internet and has been backed by the European police intelligence agency Europol and the UK Information Commissioner’s Office.
The intense interest has led interviews in UK nationals and follow-up articles in publications and websites around the globe due to the report’s development of a unique term called ‘The Herod Clause’. It has also led to an unprecedented take-up of the use of ‘Virtual Private Network’ software. A system that protects your data as it travels across public networks by encrypting it.
Fake Wi-Fi hotspot
An idea that evolved from the terms and conditions for using the access point and getting free connectivity in two central London locations. The clause for Wi-Fi connectivity said: “In return for free use of this wireless hotspot you agree to give us your firstborn child, or your favourite pet for all eternity“.
This Draconian measure did not appear to effect users’ readiness to tick the box accepting the ‘Ts and Cs.’
Six people agreed to it before it was removed from the legal conditions for using the experimental kit. The term has now been comically adopted by the legal profession for an outrageous and easily rebutted legal demand.
The kit was worryingly easy and cheap to assemble. It was made up of a Raspberry Pi mini-computer. A portable wireless router and dongle, and a Wi-Fi aerial powered by a battery pack with a five-hour life.
A bundle then strapped together with a number of high-tech elastic bands. Deploying it was ludicrously simple. We simply placed it on a table in front of us in Canary Wharf. In Parliament Square it was put on a bench next to us. In both cases ‘the deployment’ was filmed.
“Mobile phones are built to look for Wi-Fi and connect to it whenever they can without alerting the phone’s owner.”
Peter Warren, Future Intelligence
For the experiment – created by Future Intelligence editor Peter Warren – the services of Finn Steglich were required. Steglich works for Syss, a penetration testing company in Germany. He brought the fake Wi-Fi hotspot kit to London in bits, each in a separate part of his baggage.
Treacherous terms and conditions
We chose to set up the hotspot at Canary Wharf because it’s in the heart of London’s Docklands financial district and soon attracted a number of people to connect to it. While the site outside Parliament was simple. It’s at the heart of UK Government. So the experiment was repeated at Westminster in front of the British Parliament buildings and Queen Elizabeth Conference Centre where Government departments were holding official meetings.
Around the corner is the headquarters of the National Crime Agency, the body responsible for policing cyberspace in the UK. With the world-famous Big Ben, Houses of Parliament, and Westminster Abbey landmarks also close, so there were many tourists passing through – all eager to hook up to a free Wi-Fi service.
As in the earlier test, many people took the bait of free connectivity and started using the service. This time the Terms and Conditions did not include the ‘Herod Clause’ which claimed the right to take firstborn children of those signing. But still dozens of people signed up for free Wi-Fi. Those using Pop3 or IMAP email (the most common email protocols) revealed their email addresses, usernames and passwords. They appeared in plain text on Finn Steglich’s laptop screen. Which meant that if Steglich were a criminal rather than an ethical hacker, they could have lost their IDs and their money.
“The problem with this is that this is much more insecure than 99% of our population know. With public Wi-Fi, you could just as easily put it up on a big white screen wherever you are.”
Troels Oerting, Europol’s Assistant Director and the Head of the organisation’s European Cybercrime Centre
The report by the CSRI has drawn significant backing from the UK’s Information Commissioner’s Office and has been endorsed by the European police investigations unit Europol, which conducts intelligence operation against European organised crime groups.
The experiment which has been endorsed by the UK Information Commissioner’s Office, has underlined the total disregard for computer security by people when they are mobile – a finding borne out by a recent survey from the broadcasting watchdog Ofcom, which found that over 77% of people were not concerned about the
security of public Wi-Fi.
Europol has been warning about the vulnerability and issued a report about the potential risks of public Wi-Fi in March 2014.
Head of Cyber Crime Troels Oerting welcomed the F-Secure experiment and his team launched the test report across Europe to coincide with the UK launch in London, emphasising Europol’s wholehearted support for the experiment.
“The problem with this is that this is much more insecure than 99% of our population know. With public Wi-Fi, you could just as easily put it up on a big white screen wherever you are,” said Troels Oerting, Europol’s Assistant Director and the Head of the organisation’s European Cybercrime Centre (EC3).
He added that Europol has already seen criminals exploiting the public weakness for free Wi-Fi.
“We have got reports from member states that criminals have provided free Wi-Fi in areas where they want to steal people’s information. So we have already seen this in operation.”
Oerting who is based at Europol’s headquarters in The Hague and co-ordinates cybercrime investigation across all 27 member states of the EU says free Wi-Fi should be used with caution. Oerting urges those using it to consider encrypting their data to protect themselves against thieves who might steal identities, passwords and access to bank accounts. ‘It’s scary‘ he says (click below to hear Oerting’s comments).
A WiFi weakness that is growing at an alarming rate. EU Vice President Neelie Croes is publicly backing the extension of free Wi-Fi and urging citizens to share hotspots in order to boost connectivity.
FI editor Peter Warren comments: "Most people don't realise that their smartphone uses a blend of 3G or 4G and Wi-Fi. The mobile phone companies and the technology industry should make this clear - people think they're buying a 3G or 4G service, but they don't realise it has gaps, and the providers use free Wi-Fi to fill in those gaps. These devices are promiscuous. Mobile phones are built to look for Wi-Fi and connect to it whenever they can without alerting the phone's owner. So the only way to protect your data is either to switch off the Wi-Fi on your device or to encrypt it, and my preference would be to encrypt."
In a report published in 2013, the European Commission’s working party on the Digital Agenda for Europe predicted that by 2016, 78% of all communications via smartphone and tablet devices would be delivered by Wi-Fi. The study recommends that extra spectrum be made available to meet this extra demand, and applauds the fact that ‘Europe loves Wi-Fi’.
In the UK the Information Commissioner’s Technology Officer Andrew Patterson revealed to the testing team that the ICO has also been experimenting with fake Wi-Fi access in Manchester close to its headquarters at Wilmslow, with results that were presented at an internal meeting. Patterson agrees that there is a need for far greater public awareness about the potential security risks and data breaches that Wi-Fi brings.
F-Secure Technology Officer Sean Sullivan believes his company has the answer: a virtual private network (VPN) product called Freedom which encrypts data and metadata so that even if you use free public Wi-Fi with no security your privacy, IS and commercially confidential information are not revealed to anyone who can access the hotspot. FI editor Peter Warren comments: “Most people don’t realise that their smartphone uses a blend of 3G or 4G and Wi-Fi. The mobile phone companies and the technology industry should make this clear – people think they’re buying a 3G or 4G service, but they don’t realise it has gaps, and the providers use free Wi-Fi to fill in those gaps. These devices are promiscuous. Mobile phones are built to look for Wi-Fi and connect to it whenever they can without alerting the phone’s owner. So the only way to protect your data is either to switch off the Wi-Fi on your device or to encrypt it, and my preference would be to encrypt.”
Sean Sullivan radio interview follows.
The F-secure Wi-Fi experiment has been widely covered in newspapers, TV, radio and blogs around the world.
It was particularly popular in Russia, the USA, Ireland and the Basque country of northern Spain as well as national British newspapers and TV networks.
No users’ accounts were compromised during the testing period and the data collected is securely held by Syss. The full text of the report is available and to obtain a copy you should email [email protected]
http://safeandsavvy.f-secure.com/2014/09/29/danger-of-public-wifi/
The full PDF of the Tainted Love report follows.
Other technology issues jointly researched by Future Intelligence and F-Secure include investigations into breaking computerised door locks and the time children spend online.
