News for hackers. Stuff that matters.

A comment on Cure53 Audit of Chinese ‘Police App’. Parent comment

Re:Cure53 Audit of Chinese ‘Police App’ by cal5k on Sunday August 04, 2019 @10:02AM (#20606560)
MITM? You don't need to MITM something that isn't even encrypted... anyone with a modicum of technical ability can use WireShark to grab these files if they're transmitted over public Wi-Fi. And probably cellular connections, too.
[ Parent | on HN ]
Re:Cure53 Audit of Chinese ‘Police App’ by sheep-a on Sunday August 04, 2019 @10:08AM (#20606602)
Exactly, sit outside the police station/wherever just nearby spin up wireshark in monitor mode and you have a stream of personal info on the owners of those scanned phones
[ Parent | on HN ]
Re:Cure53 Audit of Chinese ‘Police App’ by dfcmt on Sunday August 04, 2019 @10:24AM (#20606693)
But they aren't transmitted over public wifi. They are transmitted inside of some kind of private network, given that they are transmitted to a server in the 192.168/24 range
[ Parent | on HN ]
Re:Cure53 Audit of Chinese ‘Police App’ by yorwba on Sunday August 04, 2019 @10:34AM (#20606742)
You can have servers with an IP in that range available on public WiFi, no problem at all. If the network is not public, whoever installs the app still needs to connect to it, so you can intercept any credentials they enter, or even run Wireshark on the device.
[ Parent | on HN ]