News for hackers. Stuff that matters.
Re:FragAttacks: new security vulnerabilities that affect wi-... by transpute on Tuesday May 11, 2021 @05:03PM (#27123493)
Future Wi-Fi devices will be able to see through your home and business walls, for activity monitoring and biometric identification, https://www.theregister.com/2021/03/31/wifi_devices_monitori...

> In three years or so, the Wi-Fi specification is scheduled to get an upgrade that will turn wireless devices into sensors capable of gathering data about the people and objects bathed in their signals... When 802.11bf will be finalized and introduced as an IEEE standard in September 2024, Wi-Fi will cease to be a communication-only standard and will legitimately become a full-fledged sensing paradigm... tracking can be done surreptitiously because Wi-Fi signals can penetrate walls, don't require light, and don't offer any visible indicator of their presence.

IEEE 802.11bf paper: https://arxiv.org/abs/2103.14918

Papers on device-free wireless sensing (DFWS): https://dhalperi.github.io/linux-80211n-csitool/

Remote sensing with low-cost ESP32 and 802.11n: https://academic.oup.com/jcde/article/7/5/644/5837600

Re:FragAttacks: new security vulnerabilities that affect wi-... by andrepd on Tuesday May 11, 2021 @07:30PM (#27124931)
What the actual fuck??

Honestly I don't see any purely technical solution to this. At some point we have to demand that laws be written to outlaw this.

Re:FragAttacks: new security vulnerabilities that affect wi-... by tttp on Tuesday May 11, 2021 @10:46PM (#27126047)
If you live in Europe, you might want to sign the European citizen initiative banning biometrics

Reclaimyourface.eu

Re:FragAttacks: new security vulnerabilities that affect wi-... by disabled on Wednesday May 12, 2021 @07:07AM (#27128911)
Thank you so much for the link! :-) I am going to share it with everyone I can!
Re:FragAttacks: new security vulnerabilities that affect wi-... by trancilo on Wednesday May 12, 2021 @05:53AM (#27128514)
Signed. Thanks for sharing.
Re:FragAttacks: new security vulnerabilities that affect wi-... by brisad on Wednesday May 12, 2021 @06:25AM (#27128675)
Thanks for this comment. While it is a no-brainer for me to support this, I initially felt that this is hopeless and very few people care. But after seeing your comment, it pushed me to also sign :-) We shouldn't give up.
Re:FragAttacks: new security vulnerabilities that affect wi-... by oefnak on Thursday May 13, 2021 @04:48AM (#27139943)
I tried to sign but was unable to pass the captcha on my phone.
Re:FragAttacks: new security vulnerabilities that affect wi-... by ratdragon on Thursday May 13, 2021 @02:16PM (#27145381)
Tried all browsers I have. Captcha doesn't even pop up.
Re:FragAttacks: new security vulnerabilities that affect wi-... by amiga on Thursday May 13, 2021 @09:20AM (#27141752)
Are you a robot?
Re:FragAttacks: new security vulnerabilities that affect wi-... by elric on Wednesday May 12, 2021 @02:54AM (#27127489)
They need 1 million signatures, they're currently at 51197 after 3 months. This is not likely to go anywhere. I guess people just don't care enough.
Re:FragAttacks: new security vulnerabilities that affect wi-... by 1337shadow on Wednesday May 12, 2021 @10:02AM (#27130420)
It's funny how you seem to believe that people "don't care" when it's actually more likely that people simply disagree.
Re:FragAttacks: new security vulnerabilities that affect wi-... by elric on Wednesday May 12, 2021 @11:57AM (#27131804)
Do you mean to say that people are fond of surveillance and facial recognition?
Re:FragAttacks: new security vulnerabilities that affect wi-... by 1337shadow on Thursday May 13, 2021 @04:19AM (#27139719)
A lot of people are fond of security indeed! And I can imagine many even excited about this new technology. Maybe they just don't buy into this campaign. "we don't know what companies and governments want to use it for", but obviously gvts want to enforce the law and companies want to sell more stuff so nothing mysterious there and especially nothing against LGBTQI+ in the EU for sure despite the campaign's message.
Re:FragAttacks: new security vulnerabilities that affect wi-... by shandor on Wednesday May 12, 2021 @12:36AM (#27126637)
I...don't await eagerly the time when tinfoil ceases to be the joke it has been for decades, instead being promoted to a solution anybody even remotely interested in their privacy utilizes.
Re:FragAttacks: new security vulnerabilities that affect wi-... by SilverRed on Wednesday May 12, 2021 @02:03AM (#27127121)
RF blocking walls could be useful for more than just privacy. Could block out neighbors overpowered wifi APs. Just have a data line in and wifi APs inside.
Re:FragAttacks: new security vulnerabilities that affect wi-... by 6t6t6t6 on Wednesday May 12, 2021 @07:31PM (#27136506)
That would work, as far as you don't plan on using your cell phone at home.
Re:FragAttacks: new security vulnerabilities that affect wi-... by resizeitplz on Thursday May 13, 2021 @07:08AM (#27140779)
Luckily most carriers support call/SMS over WiFi. And if that isn't available, a signal booster could bridge the RF barrier.
Re:FragAttacks: new security vulnerabilities that affect wi-... by teitoklien on Thursday May 13, 2021 @03:37AM (#27139418)
Soon we’ll have to paint our home walls with Wifi proof paint to bounce off external signals , if they keep designing stuff like this...
Re:FragAttacks: new security vulnerabilities that affect wi-... by marmot777 on Thursday May 13, 2021 @10:50PM (#27150130)
Tinfoil hats are the joke. Tinfoil itself isn’t that funny. :-)
Re:FragAttacks: new security vulnerabilities that affect wi-... by rasz on Wednesday May 12, 2021 @01:45PM (#27133079)
https://ans.unibs.it/projects/csi-murder/ enabled by https://github.com/open-sdr/openwifi

Both partially funded by EU's Horizon2020 program.

Openwifi talk at FOSDEM 2020 https://www.youtube.com/watch?v=8q5nHUWP43U

Re:FragAttacks: new security vulnerabilities that affect wi-... by transpute on Thursday May 13, 2021 @11:00PM (#27150195)
Thank you!
Re:FragAttacks: new security vulnerabilities that affect wi-... by kbenson on Wednesday May 12, 2021 @12:04AM (#27126466)
> Honestly I don't see any purely technical solution to this.

For home, chicken wire in the walls and wired networks. A Faraday cage is the simple solution, but unfortunately for this case is unlikely to be in most interior walls in modern buildings.

Re:FragAttacks: new security vulnerabilities that affect wi-... by coddle-hark on Wednesday May 12, 2021 @01:29AM (#27126941)
That would be illegal where I’m from since it also disrupts 911 service. Yes, even in your own home.
Re:FragAttacks: new security vulnerabilities that affect wi-... by SilverRed on Wednesday May 12, 2021 @02:04AM (#27127130)
RF flooding and interference is illegal but I have never seen that simply blocking phone signal is illegal. Even concrete walls will do that.
Re:FragAttacks: new security vulnerabilities that affect wi-... by kbenson on Wednesday May 12, 2021 @02:03AM (#27127119)
That sounds like one of those things made into law but hard to enforce for practical reasons, and if they did try to enforce it, might be something that a civil rights group might take up to get stricken down. Especially with what we're discussing in this thread coming.
Re:FragAttacks: new security vulnerabilities that affect wi-... by lpasselin on Tuesday May 11, 2021 @10:00PM (#27125833)
Re:FragAttacks: new security vulnerabilities that affect wi-... by transpute on Tuesday May 11, 2021 @10:32PM (#27125974)
Gait recognition! I wonder if they can remotely decode passwords being typed on physical keyboards, since keyboards have a well-known spatial layout.
Re:FragAttacks: new security vulnerabilities that affect wi-... by R0b0t1 on Tuesday May 11, 2021 @11:12PM (#27126194)
The characteristic length of 2.4GHz waves is ~12cm. This is roughly their feature resolution size. But you can do better with more antennas, more frequencies, more time, and phase information.
Re:FragAttacks: new security vulnerabilities that affect wi-... by boilerupnc on Tuesday May 11, 2021 @11:47PM (#27126372)
I've tried this [0] "typing biometrics authentication" out in some test apps. It worked well in detecting typing a password between two hands, just my left hand and just my right hand. I tried to do the same cadence - but it seems to also notice keypress duration as well. Not sure how I feel about my typing rhythm being a personal signature.

[0] https://www.typingdna.com/

Re:FragAttacks: new security vulnerabilities that affect wi-... by transpute on Wednesday May 12, 2021 @12:16AM (#27126531)
Search-as-you-type interfaces, including search engines, often have enough signal to perform keystroke timing for the same purpose.
Re:FragAttacks: new security vulnerabilities that affect wi-... by logicchains on Wednesday May 12, 2021 @02:03AM (#27127129)
>Honestly I don't see any purely technical solution to this.

https://en.wikipedia.org/wiki/Faraday_cage

Re:FragAttacks: new security vulnerabilities that affect wi-... by fsflover on Wednesday May 12, 2021 @03:51AM (#27127814)
Use a router certified with "Respects Your Freedom": https://fsf.org/ryf
Re:FragAttacks: new security vulnerabilities that affect wi-... by 4oh9do on Wednesday May 12, 2021 @03:28AM (#27127673)
> Honestly I don't see any purely technical solution to this.

The technical solution is pretty simple: do not use Wi-Fi. I use wired connections for all of the devices in my household. The only non-technical aspect of the solution was an interior design-based one about unobtrusive cable wiring around the house.

Re:FragAttacks: new security vulnerabilities that affect wi-... by zlynx on Wednesday May 12, 2021 @02:39AM (#27127381)
Build better walls. Don't try to outlaw people "looking at you", no matter what frequency they use.

I find it equally ridiculous to try to outlaw software radio that might listen to "unapproved" radio bands, or listening to clear-text WiFi, baby monitors and cell phones.

It's almost as stupid as people who would want brain implant computers to implement DRM so people can't record and share their own memory of a movie.

Another analogy would be a country of blind people trying to legislate sighted people wearing blindfolds, because all of their privacy fences have huge holes in them.

Technology improves people's abilities. Adapt.

Re:FragAttacks: new security vulnerabilities that affect wi-... by Xplune13 on Wednesday May 12, 2021 @05:29AM (#27128378)
I think you should read your own comment but slowly to realize how absurd it is to say "Build better walls". You are basically saying the whole world should rebuild the walls because of this totally not needed WiFi standard. Great!

Also I do not agree on "technology improves people's abilities" statement. It is always based on how the technology is used. Famous example. Harnessing nuclear energy. You can use it to blow up cities or to generate power around the world.

One shouldn't develop technology for advancement's sake. Every new technology should be given thorough thought and analysis into it on why is it needed? and are the negatives outweigh the positives? or vice versa? and so on.

Re:FragAttacks: new security vulnerabilities that affect wi-... by da_big_ghey on Wednesday May 12, 2021 @10:13AM (#27130560)
problem are law can not stop egrigous bad actor, so necesary for to proof against such persons with better wall. we "should" not having to do this but we are having to if we are caring for privacy.
Re:FragAttacks: new security vulnerabilities that affect wi-... by Spare_account on Wednesday May 12, 2021 @02:51AM (#27127463)
There are a lot of walls to upgrade then, who should pay for that?

Standing in someone's garden, peering through their window is dealt with via legislation.

Since the invention of video recording devices, rather than having everyone upgrade their windows, legislation was reinterpreted and updated to govern the recording of people in private places vs public places.

It doesn't seem unreasonable for the same to be done to keep up with other forms of technology.

Re:FragAttacks: new security vulnerabilities that affect wi-... by KMag on Wednesday May 12, 2021 @07:56PM (#27136688)
> Build better walls. Don't try to outlaw people "looking at you", no matter what frequency they use.

It's just not possible to make a wall that can't be seen through, at least without making them tens of meters thick, even using high density concrete, tungsten, or uranium.

Muons aren't photons, but cosmic muon tomography has been used to image the Great Pyramid of Giza and also several mountains. Exposure times for cosmic muon tomography are very long, but with enough exposure time, correlating 5-minute blocks across days, someone could work out mean density throughout your house and make low-res 3D video of your daily routine, even with 1 meter thick walls of reactor-grade high-density concrete with sheet steel cladding.

Re:FragAttacks: new security vulnerabilities that affect wi-... by tgv on Wednesday May 12, 2021 @03:04AM (#27127549)
> Build better walls.

Rebuilding all houses in the world because someone creates a totally superfluous gadget. Seems reasonable.

Re:FragAttacks: new security vulnerabilities that affect wi-... by EricE on Wednesday May 12, 2021 @02:28PM (#27133534)
I dunno - I could see a huge market for wallpaper with embedded wire mesh in it :)
Re:FragAttacks: new security vulnerabilities that affect wi-... by wyager on Tuesday May 11, 2021 @09:44PM (#27125748)
Or just don’t install these devices in your house/live in a place where privacy is functionally impossible like an apartment building.
Re:FragAttacks: new security vulnerabilities that affect wi-... by NoPicklez on Tuesday May 11, 2021 @09:50PM (#27125786)
If the standard is built into all future WiFi standards you might have no choice in having to install those devices. If you want to obtain the fastest speeds/range/features etc.
Re:FragAttacks: new security vulnerabilities that affect wi-... by rodneyhayes on Tuesday May 11, 2021 @09:58PM (#27125822)
Seems like someone can just pull up anywhere in a car and have this capability. You probably won’t have a choice.
Re:FragAttacks: new security vulnerabilities that affect wi-... by SilverRed on Wednesday May 12, 2021 @02:04AM (#27127137)
And if someone stands out side with a wifi device emitting a signal in to your house?
Re:FragAttacks: new security vulnerabilities that affect wi-... by disabled on Tuesday May 11, 2021 @07:26PM (#27124900)
A lot of this work has been research of Dina Katabi at MIT, via a function called the Sparse Fourier ("4-E-A") Transform.

I am not excusing the privacy implications, which will be abused to the extreme. However, it will be used also for health reasons, like monitoring respiration, and activity.

Re:FragAttacks: new security vulnerabilities that affect wi-... by transpute on Tuesday May 11, 2021 @08:01PM (#27125123)
From https://en.wikipedia.org/wiki/Dina_Katabi

> her work on X-ray vision was chosen as one of the "50 ways that MIT has transformed computer science."

And the housing market.

Re:FragAttacks: new security vulnerabilities that affect wi-... by eternalban on Wednesday May 12, 2021 @05:19AM (#27128322)
Simple and Practical Algorithm for Sparse Fourier Transform, Hassanieh, Indyk, Katabi, Price (2012)

https://groups.csail.mit.edu/netmit/sFFT/soda_paper.pdf

The sparse fourier transform : theory & practice - Haitham Al-Hassanieh (thesis, 2016 MIT) - Dina Katabi (thesis advisor)

https://dspace.mit.edu/handle/1721.1/103715

Re:FragAttacks: new security vulnerabilities that affect wi-... by peanutz454 on Wednesday May 12, 2021 @12:07AM (#27126483)
Sorry I am not sure I am following, how does this impact housing market?
Re:FragAttacks: new security vulnerabilities that affect wi-... by wayvey on Wednesday May 12, 2021 @03:54AM (#27127833)
Possibly some future demand for faraday-caged homes?
Re:FragAttacks: new security vulnerabilities that affect wi-... by 4gotunameagain on Wednesday May 12, 2021 @04:34AM (#27128088)
Faraday cages do not stop Xrays, the wavelength can be smaller than the atomic spacing of metals.
Re:FragAttacks: new security vulnerabilities that affect wi-... by salawat on Tuesday May 11, 2021 @05:10PM (#27123576)
This is one of those things that shouldn't even have a standard made for it.

What does everyone think is going to happen with capabilities like that?

Re:FragAttacks: new security vulnerabilities that affect wi-... by transpute on Tuesday May 11, 2021 @05:15PM (#27123622)
Good news, the paper mentions privacy.

> We identify a number of critical issues that need to be addressed in this space... First, individuals should be provided the opportunity to opt out of SENS services – in other words, to avoid being monitored and tracked by the Wi-Fi devices around them.

Bad news, the paper proposes remote human identification by every Wi-Fi device.

> This would require the widespread introduction of reliable SENS algorithm for human or animal identification.

Would opt-in be legally easier than requiring human body scan registration for opt-out of Wi-Fi remote sensing?

Re:FragAttacks: new security vulnerabilities that affect wi-... by salawat on Tuesday May 11, 2021 @07:13PM (#27124797)
This is a poison pill.

In order to not be tracked you must consent to be tracked so we know you don't want to be tracked.

This should not be done or allowed. Period. It's a huge invasion of privacy.

Re:FragAttacks: new security vulnerabilities that affect wi-... by brobdingnagians on Tuesday May 11, 2021 @05:53PM (#27124041)
It would be better to have a beacon that simply broadcasts that you do not want to be tracked, with no further identifying features. There isn't really a good reason for identifying you to then look up that you don't want to be tracked. Make that legally binding and enforce it.

Or, better yet, make it totally opt in.

Re:FragAttacks: new security vulnerabilities that affect wi-... by farrelmahaztra on Tuesday May 11, 2021 @06:19PM (#27124308)
How would opt-in work in practice? Say, if this gets pushed out on $CAFE public wifi for analytics. Would it be something akin to "tick this consent box to use the wifi"?

And if $CAFE tracks you regardless of you not ticking the box or connecting to the network, how do I detect that as a regular customer?

Re:FragAttacks: new security vulnerabilities that affect wi-... by quickthrowman on Tuesday May 11, 2021 @06:17PM (#27124293)
Yeah, this tech standard is totally insane, why would I want anyone or anything to be able to scan people and objects inside my house without my knowledge? I’m aware of microphone attacks for keyboard password entry and other methods of surreptitious surveillance, but this is way past a microphone or webcam. I will pay a massive premium to purchase WiFi equipment without this feature.

Unfortunately these will be everywhere, far beyond any existing camera surveillance network.

Re:FragAttacks: new security vulnerabilities that affect wi-... by transpute on Tuesday May 11, 2021 @06:59PM (#27124691)
It's also passive. Someone could stand outside your house or factory with their device and "illuminate" activity inside the building. Only EMF shielding in/on the walls could block them. Nation-state regulators could get involved, since these devices would be using spectrum that belongs to the public.

2012 article on a military use case, https://www.popsci.com/technology/article/2012-07/seeing-thr...

2017 video on an industrial use case, https://www.digitaltrends.com/cool-tech/wi-fi-radiation-tran...

Re:FragAttacks: new security vulnerabilities that affect wi-... by rapjr9 on Tuesday May 11, 2021 @11:46PM (#27126366)
This is very similar to radar, which raises the question, is radar already used to spy on peoples movements through walls?
Re:FragAttacks: new security vulnerabilities that affect wi-... by ancientworldnow on Wednesday May 12, 2021 @12:22AM (#27126557)
X-Ray backscatter is definitely used for this, most famously by secret NYPD vans.

https://www.theatlantic.com/politics/archive/2015/10/the-nyp...

Re:FragAttacks: new security vulnerabilities that affect wi-... by transpute on Wednesday May 12, 2021 @12:30AM (#27126597)
> The radars work like finely tuned motion detectors, using radio waves to zero in on movements as slight as human breathing from a distance of more than 50 feet. They can detect whether anyone is inside of a house, where they are and whether they are moving.

The cost of those devices should fall with 802.11bf Wi-Fi.

> the vans deliver a radiation dose 40 percent larger than delivered by a backscatter airport scanner; bystanders present when the van is in use are exposed to the radiation that the van emits… there may be significant health risks associated with the use of backscatter x-ray devices as these machines use ionizing radiation, a type of radiation long known to mutate DNA and cause cancer.

Could this radiation meter detect the presence of such a van?

https://www.gqelectronicsllc.com/comersus/store/comersus_vie...

Re:FragAttacks: new security vulnerabilities that affect wi-... by hooande on Tuesday May 11, 2021 @08:09PM (#27125171)
Can make a lot of interesting products. Lights that turn on or change color when different people enter a room. home security systems that can detect motion. the ability to summon help for people who fall.

I've been looking into this for a while, should be mature enough in a year or so. there are already dozens of companies in this space

Re:FragAttacks: new security vulnerabilities that affect wi-... by idiotsecant on Tuesday May 11, 2021 @08:07PM (#27125150)
Do you think making it a standard is required to use it? The technology exists now. Writing it down isn't breathing it into existence.
Re:FragAttacks: new security vulnerabilities that affect wi-... by transpute on Tuesday May 11, 2021 @08:09PM (#27125174)
Good to have threats documented, so technology/spectrum can be regulated and legal frameworks developed.

e.g. lockpicks are regulated, how about wallpicks-via-WiFi?

Re:FragAttacks: new security vulnerabilities that affect wi-... by grkvlt on Wednesday May 12, 2021 @06:47AM (#27128772)
> lockpicks are regulated

you think?

Re:FragAttacks: new security vulnerabilities that affect wi-... by transpute on Wednesday May 12, 2021 @09:21AM (#27130001)
Only in a few places.

http://lockwiki.com/index.php/Legal_Issues

https://unitedlocksmith.net/blog/the-locksport-travel-guide-...

> In Japan if you are found with lock picks you will be subject to a fine of 500,000 yen and a year in prison. In Poland, it is illegal to possess any picks without being able to show that your profession requires it ... In Hungary ownership of lock picks is completely illegal. The only people in Hungary that are allowed to have these tools are the military, and as a result lock picks are classified as military equipment. For travel within the United States or even traveling to the US, you should consult the lock pick laws in the state you are visiting.

Re:FragAttacks: new security vulnerabilities that affect wi-... by beermonster on Tuesday May 11, 2021 @05:07PM (#27123534)
And let’s not forget also Amazon Sidewalk

Scary times.

Re:FragAttacks: new security vulnerabilities that affect wi-... by FridayoLeary on Tuesday May 11, 2021 @06:34PM (#27124456)
Is that some sort of hatch in the pavement? You order something on Prime, and moments later, a slab embossed with Amazons' logo opens, a deliveryperson jumps out and deposits the package into your outstretched arm.
Re:FragAttacks: new security vulnerabilities that affect wi-... by doggodaddo78 on Tuesday May 11, 2021 @06:44PM (#27124545)
Almost. It's anyone with Amazon IoTs sharing wifi with each other.
Re:FragAttacks: new security vulnerabilities that affect wi-... by tialaramex on Tuesday May 11, 2021 @08:27PM (#27125288)
It's ambient network access, a desirable behaviour which I anticipate our descendants (or their descendants) will take for granted.

Imagine gradually choking as you wait for a friend to open their front door - oops, you forgot their air doesn't know you're allowed to use Oxygen, hope they get here in time to explicitly authorise you to breathe...

Because of the Network Effect the grand total number of Networks you care about will always be... one. So, it doesn't make sense to have a dozen fiercely independent WiFi networks in the same physical volume all of which are, in fact, just offering access to the same network (the Internet) but with separate credentials needed for each.

There have been very slow steps on the obvious way forward here. If you've been a student somewhere civilized in the last couple of decades you might have seen EduRoam. Under EduROAM your credentials from say, the University of Florida, or Stanford work at MIT and NYU, but also in Oxford, and in Tokyo. No more need to maintain separate "guest" networks so that the visiting lecturer's laptop works. But most of us, most of the time, are using dozens of little pointless fiefdoms.

Re:FragAttacks: new security vulnerabilities that affect wi-... by saagarjha on Tuesday May 11, 2021 @09:17PM (#27125590)
Right, but do you want that one network to be run by a single company called Amazon?
Re:FragAttacks: new security vulnerabilities that affect wi-... by beermonster on Thursday May 13, 2021 @09:07AM (#27141630)
All these guides showing you how to create a quick VPN on something like Lightsail. All this does is change your ISP to be .. Amazon!

Also putting all your big-tech eggs in one basket isn't a great direction for the Internet.

Re:FragAttacks: new security vulnerabilities that affect wi-... by nine_k on Tuesday May 11, 2021 @09:05PM (#27125520)
You will still have to identity particular users, because you want to sell access, because you want to identity those who break the rules and attack other users. But most importantly, users want to separate their networks from one another.

OTOH the technology can move from private radios to the model of cellular networks, where you don't care which tower you connect to, and the security / authorization lives at a different level.

Re:FragAttacks: new security vulnerabilities that affect wi-... by reasonabl_human on Wednesday May 12, 2021 @02:27AM (#27127313)
That’s exactly what is being pitched! Sounds pretty great to me. Just move auth upstream, like eduroam/ cellular. Doesn’t preclude people from making their own separate access points, but would make doing so antiquated for most people.
Re:FragAttacks: new security vulnerabilities that affect wi-... by swiley on Tuesday May 11, 2021 @05:16PM (#27123630)
Only if you tolerate devices with non-free software.
Re:FragAttacks: new security vulnerabilities that affect wi-... by ethbr0 on Tuesday May 11, 2021 @05:28PM (#27123754)
Like any TV?
Re:FragAttacks: new security vulnerabilities that affect wi-... by totetsu on Tuesday May 11, 2021 @07:08PM (#27124764)
Never needed a TV once since I was old enough for P2P to be invented
Re:FragAttacks: new security vulnerabilities that affect wi-... by swiley on Tuesday May 11, 2021 @05:31PM (#27123780)
Yeah or anything else with non-free firmware.
Re:FragAttacks: new security vulnerabilities that affect wi-... by doggodaddo78 on Tuesday May 11, 2021 @06:45PM (#27124548)
So, everything practical.
Re:FragAttacks: new security vulnerabilities that affect wi-... by wutXthree on Tuesday May 11, 2021 @07:18PM (#27124835)
If you bought it, you own it. Does your DVD player hardware come with a license agreement?
Re:FragAttacks: new security vulnerabilities that affect wi-... by kadoban on Tuesday May 11, 2021 @07:35PM (#27124958)
I can't tell if I'm missing something here because for some reason I think you're expecting the answer to be "no"?

But, yes DVD players come with license agreements, EULAs.

Re:FragAttacks: new security vulnerabilities that affect wi-... by wutXthree on Tuesday May 11, 2021 @10:18PM (#27125927)
Hunh? So you are saying that if I buy the DVD player at https://www.bestbuy.com/site/sony-dvd-player-with-hd-upconve... that I'm agreeing to an "EULA" that doesn't seem to exist on the site and that is apparently not mentioned at all before purchase?

Please tell me you're joking.

Re:FragAttacks: new security vulnerabilities that affect wi-... by kadoban on Tuesday May 11, 2021 @10:21PM (#27125939)
Do you live in the USA? Very likely yes that DVD player will come with a EULA (End User License Agreement) in/on the box when it arrives.

Other places I'm not sure, but I'd guess you'll get one anyway.

Will they hold up in court? Who knows. But look and you're likely to find one they'll at least pretend applies to you.

(And to be clear, yes I agree that this is _ridiculous_)

Re:FragAttacks: new security vulnerabilities that affect wi-... by kuschku on Wednesday May 12, 2021 @04:36AM (#27128104)
If you're in the EU, that DVD player won't have a EULA attached. If you're in the US, it will.
Re:FragAttacks: new security vulnerabilities that affect wi-... by swiley on Tuesday May 11, 2021 @07:57PM (#27125103)
The last one I bought came with a printout of the GPL2.
Re:FragAttacks: new security vulnerabilities that affect wi-... by doggodaddo78 on Tuesday May 11, 2021 @08:49PM (#27125415)
You tell me because I don't own a DVD player. :)
Re:FragAttacks: new security vulnerabilities that affect wi-... by jhardy54 on Tuesday May 11, 2021 @08:24PM (#27125269)
Yes.
Re:FragAttacks: new security vulnerabilities that affect wi-... by neolog on Tuesday May 11, 2021 @06:03PM (#27124139)
Commercial displays are a solution here, though they're expensive.
Re:FragAttacks: new security vulnerabilities that affect wi-... by bonestamp2 on Tuesday May 11, 2021 @08:00PM (#27125116)
Don't put your wifi credentials into your TV, then you've effectively got a giant monitor/commercial display.

If you're feeling especially crafty, open the back of your TV and disconnect the wifi/bluetooth board. It's a discrete board in all of my TVs of different brands. I assume they build them this way so they can use the same network board design/production for years and just upgrade the main logic board in newer models.

Re:FragAttacks: new security vulnerabilities that affect wi-... by alias_neo on Wednesday May 12, 2021 @04:48AM (#27128165)
I can't find any references right now, but someone once mentioned TVs shipping with SIM cards embedded so that they could collect telemetry even if you didn't connect it to your network.

Even if it isn't/hasn't happened, there's nothing to stop someone like Samsung sticking cellular modems in their TVs to work around you doing this.

If we think about it like Air-Tags too, popular enough product, it'll just connect to one of your neighbour's TV's which _is_ online.

I remember years ago, Vodafone gave me a "free" femtocell because signal in my home was poor. They neglected to mention the fact it broadcast a public cellular signal which allowed other Vodafone customers to use _my_ internet bandwidth.

Re:FragAttacks: new security vulnerabilities that affect wi-... by bonestamp2 on Wednesday May 12, 2021 @05:56PM (#27135633)
> there's nothing to stop someone like Samsung sticking cellular modems in their TVs to work around you doing this.

True. Although, if they put that SIM card on the bluetooth/wifi network board that I'm disconnecting then I'll be ok.

I would be surprised if they used cellular technology for this though (from a cost perspective). I'd expect a lorawan/helium like implementation.

Re:FragAttacks: new security vulnerabilities that affect wi-... by SilverRed on Wednesday May 12, 2021 @02:06AM (#27127153)
>Don't put your wifi credentials into your TV

Amazon has a solution to this. If your tv is within wifi range of an amazon device, your TV will be able to connect to a network. It might even be your neighbors device.

Re:FragAttacks: new security vulnerabilities that affect wi-... by JetAlone on Tuesday May 11, 2021 @08:24PM (#27125268)
Can't say I'm planning to buy a TV anytime soon but that's good advice, thank you.
Re:FragAttacks: new security vulnerabilities that affect wi-... by danielheath on Tuesday May 11, 2021 @06:09PM (#27124215)
Expensive compared to the advertising-subsidised consumer version, maybe.
Re:FragAttacks: new security vulnerabilities that affect wi-... by ethbr0 on Tuesday May 11, 2021 @06:17PM (#27124288)
Expensive compared to retail-volume models. This is also a fight against manufacturing economies of scale.
Re:FragAttacks: new security vulnerabilities that affect wi-... by slimsag on Tuesday May 11, 2021 @11:37PM (#27126318)
Samsung sells "Commercial signage displays" to people, $1k for a 65" display.

e.g. the Samsung QB65R on Amazon

So yeah it's like $100-200 more expensive, but hardly seems.. unapproachable?

Re:FragAttacks: new security vulnerabilities that affect wi-... by Lammy on Tuesday May 11, 2021 @08:24PM (#27125270)
Or your neighbors do.
Re:FragAttacks: new security vulnerabilities that affect wi-... by doggodaddo78 on Tuesday May 11, 2021 @06:44PM (#27124537)
Re:FragAttacks: new security vulnerabilities that affect wi-... by mushufasa on Tuesday May 11, 2021 @10:05PM (#27125857)
wasn't this a scene in Batman, Dark Night?

yes, yes it was https://www.youtube.com/watch?v=IRELLH86Edo

Re:FragAttacks: new security vulnerabilities that affect wi-... by neolog on Tuesday May 11, 2021 @06:04PM (#27124164)
Is it practical to put a Faraday mesh into the exterior walls of a house?
Re:FragAttacks: new security vulnerabilities that affect wi-... by ortusdux on Tuesday May 11, 2021 @07:09PM (#27124769)
I've rented two houses that used chicken wire to bind the plaster to the lath. You could get a bit of cell service near the windows, but you needed a WAP in each room. Finding studs was a nightmare.
Re:FragAttacks: new security vulnerabilities that affect wi-... by fulafel on Wednesday May 12, 2021 @01:32AM (#27126958)
Yes, this kind of shielding in construction is well understood, people concerned about information leakage have been doing it for decades and made the specs public. (Also people suffering from perceived "eletromagnetic hypersensitivity")
Re:FragAttacks: new security vulnerabilities that affect wi-... by shard on Tuesday May 11, 2021 @07:42PM (#27125012)
Of course, any house totally shielded with a Faraday cage would look extra suspicious and thus receive closer scrutiny. You'd need most of the house to be non-shielded to act as a honeypot while maintaining a small shielded section of the house for "emergencies".
Re:FragAttacks: new security vulnerabilities that affect wi-... by hungryforcodes on Wednesday May 12, 2021 @12:51AM (#27126712)
Who are you hiding from exactly?
Re:FragAttacks: new security vulnerabilities that affect wi-... by dogecoinbase on Wednesday May 12, 2021 @01:21AM (#27126892)
Advertisers.
Re:FragAttacks: new security vulnerabilities that affect wi-... by FridayoLeary on Tuesday May 11, 2021 @06:36PM (#27124467)
With 2 conditions; a) you would have to do it before closing up the walls and b) give up on radio.
Re:FragAttacks: new security vulnerabilities that affect wi-... by lstamour on Tuesday May 11, 2021 @07:16PM (#27124824)
Also, expect to have very strange windows. Of course, if visible light can pass through, that might be considered a flaw in your faraday cage so YMMV.

Personally, I'd like it if my devices knew what room I was in. Back in 2013, I'd started working on a home automation project with that goal in mind, but then all these closed source devices came out that were incredibly cheap and convenient and I haven't revisited the idea since.

I do look back with a bit of regret that more hasn't been done to push for reverse engineering these devices or somehow encouraging companies to open source their routers to support third-party operating systems, etc. We take for granted that we've open source smartphones and standard PC specifications when we don't yet have a standard that could let me run YouTube TV on my Echo Show 8, for example, or add lossless FLAC playback to my smart speaker...

Re:FragAttacks: new security vulnerabilities that affect wi-... by NegativeLatency on Tuesday May 11, 2021 @07:40PM (#27124998)
I imagine window screen mesh connected electrically to the rest of your grid should work sufficiently (like the mesh on the microwave window)
Re:FragAttacks: new security vulnerabilities that affect wi-... by EricE on Wednesday May 12, 2021 @02:30PM (#27133553)
>Also, expect to have very strange windows.

I have screens on my windows so I can have them open yet not have bugs wandering in and out - just pick wire mesh and ground it. Done!

Re:FragAttacks: new security vulnerabilities that affect wi-... by wutXthree on Tuesday May 11, 2021 @07:20PM (#27124850)
You could just put antennae outside the walls like many houses/cars do.
Re:FragAttacks: new security vulnerabilities that affect wi-... by knicholes on Tuesday May 11, 2021 @07:48PM (#27125042)
I recently cut a couple holes in my house exterior through stucco. Like a sibling comment, that stucco was secured over some wire mesh. I can't remember how dense the mesh needs to be to block whichever frequencies would be used, but something like that would be commonplace and provide reasonable doubt.
Re:FragAttacks: new security vulnerabilities that affect wi-... by hellbannedguy on Tuesday May 11, 2021 @08:22PM (#27125255)
There are different types of lathe used for plaster walls.

From chicken wire to mesh with 1/8, or less, inch rectangles.

I imagine the whole room would have to be covered with lathe. In good construction the lathe is covering every sq. inch of a room before the the base coat is put on.

Plaster wall are not typical anymore. Stucco is still used on exterior walls, but it usually just covers up ap the foundation, and might extent up the wall a few feet.

Plaster walls in a bathroom are the best walls though. The house I'm in has 1" thick plaster walls, and they hold up to a lot of abuse.

A well plastered plaster room would need screen on the door too, but that's doable.

If I was building a house, it would have stucco walls. Maybe only the exterior walls, and the ceilings? Then my signals could go room to room, but the world is locked out.

No one uses chicken wire, but it works just as well as the new smaller holed lathe sheets.

I still have no clue if modern sheets of lathe would act as a Faraday Cage?

I have fooled around with Faraday Cages, and tiny openings matter.

(I remember hearing about a guy who stole a vechicle with lowjack. He covered the vechicle with chicken wire, and the cell signal with through? He was caught.)

Re:FragAttacks: new security vulnerabilities that affect wi-... by bawolff on Tuesday May 11, 2021 @08:00PM (#27125114)
Re:FragAttacks: new security vulnerabilities that affect wi-... by transpute on Tuesday May 11, 2021 @07:17PM (#27124830)
Attic insulation ("radiant barrier") has a layer of aluminum, it can reduce EMF if joints overlap and are sealed with aluminum tape.
Re:FragAttacks: new security vulnerabilities that affect wi-... by XorNot on Tuesday May 11, 2021 @09:19PM (#27125609)
You also need to ground it (you should be doing this anyway for electrical safety).
Re:FragAttacks: new security vulnerabilities that affect wi-... by transpute on Tuesday May 11, 2021 @10:27PM (#27125960)
Should there be a resistor (100K? 1M?) on the connection between shield and ground?
Re:FragAttacks: new security vulnerabilities that affect wi-... by XorNot on Tuesday May 11, 2021 @11:40PM (#27126331)
I am not an electrical engineer, but AFAIK no. You want your ground path to be the favored path, rather then say, a sweaty human hand if there's a short.
Re:FragAttacks: new security vulnerabilities that affect wi-... by _wldu on Tuesday May 11, 2021 @09:22PM (#27125632)
Trying to stop radio waves is sort of like trying to stop water. Any little crack or hole and it'll come through.
Re:FragAttacks: new security vulnerabilities that affect wi-... by farrelmahaztra on Tuesday May 11, 2021 @06:28PM (#27124405)
In addition to that, you might want/need to use only wired connections to your router and rip out any components that enable wireless.
Re:FragAttacks: new security vulnerabilities that affect wi-... by KETpXDDzR on Tuesday May 11, 2021 @09:36PM (#27125709)
I see a market for personal WiFi jamming devices.
Re:FragAttacks: new security vulnerabilities that affect wi-... by elric on Wednesday May 12, 2021 @02:48AM (#27127447)
Those are illegal (at least in the US, and likely just about everywhere). Which is bitterly ironic in this case ... spying on people inside their homes using WiFi is "fine", but trying to jam that bullshit is ... illegal.
Re:FragAttacks: new security vulnerabilities that affect wi-... by jk7tarYZAQNpTQa on Wednesday May 12, 2021 @07:01AM (#27128864)
Illegal? Why? I'm only heavily using all the WiFi channels with my perfectly legitimate web browsing.
Re:FragAttacks: new security vulnerabilities that affect wi-... by ortusdux on Wednesday May 12, 2021 @06:06PM (#27135727)
Jamming would run afoul of the FCC. Now having one or more WAPs randomly modulate their signal strength should do the trick
Re:FragAttacks: new security vulnerabilities that affect wi-... by xanth on Tuesday May 11, 2021 @10:10PM (#27125883)
Anyone aware of a polished application that utilizes this for personal home monitoring? It'd be fantastic to integrate this with Home Assistant[1] in lieu of Zigbee motion sensors.

[1] https://www.home-assistant.io/

Re:FragAttacks: new security vulnerabilities that affect wi-... by passerby1 on Tuesday May 11, 2021 @09:38PM (#27125714)
Do I understand it correct that it's possible to 'sense' what people speak with this technique?
Re:FragAttacks: new security vulnerabilities that affect wi-... by jk7tarYZAQNpTQa on Wednesday May 12, 2021 @07:04AM (#27128882)
No, that would require a precision that's probably still decades away. It could be used to grossly place people and large objects, and notice their movement. Sensing voice would require to monitor vibrations in either the person speaking or anything that vibrates with the emitted sound.

Funnily, there are much easier ways to do that, although they require direct line of vision [1]. Another option would be to measure the vibrations on walls (think glass on the wall, but hitech).

[1] https://www.schneier.com/blog/archives/2020/06/eavesdropping...

Re:FragAttacks: new security vulnerabilities that affect wi-... by EricE on Wednesday May 12, 2021 @02:26PM (#27133515)
I need to invent faraday cage paint :p
Re:FragAttacks: new security vulnerabilities that affect wi-... by trompetenaccoun on Wednesday May 12, 2021 @04:41PM (#27134923)
https://www.businessinsider.com/a-san-francisco-apartment-th...

Instead of going to such extreme lengths though, it's more sensible to lobby for political change. There is absolutely no legitimate reason this should be introduced as a general standard for all wifi divices. This sort of spying needs to be illegal unless specifically approved in limited cases.

Re:FragAttacks: new security vulnerabilities that affect wi-... by BatteryMountain on Wednesday May 12, 2021 @03:05AM (#27127559)
Now imagine what will be accomplished with 5G.. puts on tinfoil hat.
Re:FragAttacks: new security vulnerabilities that affect wi-... by matheusmoreira on Wednesday May 12, 2021 @03:13AM (#27127596)
Is there no limit to this surveillance capitalism thing? At what point does it get dystopian enough for them to stop?
Re:FragAttacks: new security vulnerabilities that affect wi-... by acomar on Wednesday May 12, 2021 @11:56AM (#27131791)
when capitalism ends.
Re:FragAttacks: new security vulnerabilities that affect wi-... by jesusjosephsson on Wednesday May 12, 2021 @06:36AM (#27128723)
Would it be possible to use this to look at a monitor?