News for hackers. Stuff that matters.
Re:FragAttacks: new security vulnerabilities that affect wi-... by beermonster on Tuesday May 11, 2021 @05:07PM (#27123534)
And let’s not forget also Amazon Sidewalk

Scary times.

Re:FragAttacks: new security vulnerabilities that affect wi-... by FridayoLeary on Tuesday May 11, 2021 @06:34PM (#27124456)
Is that some sort of hatch in the pavement? You order something on Prime, and moments later, a slab embossed with Amazons' logo opens, a deliveryperson jumps out and deposits the package into your outstretched arm.
Re:FragAttacks: new security vulnerabilities that affect wi-... by doggodaddo78 on Tuesday May 11, 2021 @06:44PM (#27124545)
Almost. It's anyone with Amazon IoTs sharing wifi with each other.
Re:FragAttacks: new security vulnerabilities that affect wi-... by tialaramex on Tuesday May 11, 2021 @08:27PM (#27125288)
It's ambient network access, a desirable behaviour which I anticipate our descendants (or their descendants) will take for granted.

Imagine gradually choking as you wait for a friend to open their front door - oops, you forgot their air doesn't know you're allowed to use Oxygen, hope they get here in time to explicitly authorise you to breathe...

Because of the Network Effect the grand total number of Networks you care about will always be... one. So, it doesn't make sense to have a dozen fiercely independent WiFi networks in the same physical volume all of which are, in fact, just offering access to the same network (the Internet) but with separate credentials needed for each.

There have been very slow steps on the obvious way forward here. If you've been a student somewhere civilized in the last couple of decades you might have seen EduRoam. Under EduROAM your credentials from say, the University of Florida, or Stanford work at MIT and NYU, but also in Oxford, and in Tokyo. No more need to maintain separate "guest" networks so that the visiting lecturer's laptop works. But most of us, most of the time, are using dozens of little pointless fiefdoms.

Re:FragAttacks: new security vulnerabilities that affect wi-... by saagarjha on Tuesday May 11, 2021 @09:17PM (#27125590)
Right, but do you want that one network to be run by a single company called Amazon?
Re:FragAttacks: new security vulnerabilities that affect wi-... by beermonster on Thursday May 13, 2021 @09:07AM (#27141630)
All these guides showing you how to create a quick VPN on something like Lightsail. All this does is change your ISP to be .. Amazon!

Also putting all your big-tech eggs in one basket isn't a great direction for the Internet.

Re:FragAttacks: new security vulnerabilities that affect wi-... by nine_k on Tuesday May 11, 2021 @09:05PM (#27125520)
You will still have to identity particular users, because you want to sell access, because you want to identity those who break the rules and attack other users. But most importantly, users want to separate their networks from one another.

OTOH the technology can move from private radios to the model of cellular networks, where you don't care which tower you connect to, and the security / authorization lives at a different level.

Re:FragAttacks: new security vulnerabilities that affect wi-... by reasonabl_human on Wednesday May 12, 2021 @02:27AM (#27127313)
That’s exactly what is being pitched! Sounds pretty great to me. Just move auth upstream, like eduroam/ cellular. Doesn’t preclude people from making their own separate access points, but would make doing so antiquated for most people.
Re:FragAttacks: new security vulnerabilities that affect wi-... by swiley on Tuesday May 11, 2021 @05:16PM (#27123630)
Only if you tolerate devices with non-free software.
Re:FragAttacks: new security vulnerabilities that affect wi-... by ethbr0 on Tuesday May 11, 2021 @05:28PM (#27123754)
Like any TV?
Re:FragAttacks: new security vulnerabilities that affect wi-... by totetsu on Tuesday May 11, 2021 @07:08PM (#27124764)
Never needed a TV once since I was old enough for P2P to be invented
Re:FragAttacks: new security vulnerabilities that affect wi-... by swiley on Tuesday May 11, 2021 @05:31PM (#27123780)
Yeah or anything else with non-free firmware.
Re:FragAttacks: new security vulnerabilities that affect wi-... by doggodaddo78 on Tuesday May 11, 2021 @06:45PM (#27124548)
So, everything practical.
Re:FragAttacks: new security vulnerabilities that affect wi-... by wutXthree on Tuesday May 11, 2021 @07:18PM (#27124835)
If you bought it, you own it. Does your DVD player hardware come with a license agreement?
Re:FragAttacks: new security vulnerabilities that affect wi-... by kadoban on Tuesday May 11, 2021 @07:35PM (#27124958)
I can't tell if I'm missing something here because for some reason I think you're expecting the answer to be "no"?

But, yes DVD players come with license agreements, EULAs.

Re:FragAttacks: new security vulnerabilities that affect wi-... by wutXthree on Tuesday May 11, 2021 @10:18PM (#27125927)
Hunh? So you are saying that if I buy the DVD player at https://www.bestbuy.com/site/sony-dvd-player-with-hd-upconve... that I'm agreeing to an "EULA" that doesn't seem to exist on the site and that is apparently not mentioned at all before purchase?

Please tell me you're joking.

Re:FragAttacks: new security vulnerabilities that affect wi-... by kadoban on Tuesday May 11, 2021 @10:21PM (#27125939)
Do you live in the USA? Very likely yes that DVD player will come with a EULA (End User License Agreement) in/on the box when it arrives.

Other places I'm not sure, but I'd guess you'll get one anyway.

Will they hold up in court? Who knows. But look and you're likely to find one they'll at least pretend applies to you.

(And to be clear, yes I agree that this is _ridiculous_)

Re:FragAttacks: new security vulnerabilities that affect wi-... by kuschku on Wednesday May 12, 2021 @04:36AM (#27128104)
If you're in the EU, that DVD player won't have a EULA attached. If you're in the US, it will.
Re:FragAttacks: new security vulnerabilities that affect wi-... by swiley on Tuesday May 11, 2021 @07:57PM (#27125103)
The last one I bought came with a printout of the GPL2.
Re:FragAttacks: new security vulnerabilities that affect wi-... by doggodaddo78 on Tuesday May 11, 2021 @08:49PM (#27125415)
You tell me because I don't own a DVD player. :)
Re:FragAttacks: new security vulnerabilities that affect wi-... by jhardy54 on Tuesday May 11, 2021 @08:24PM (#27125269)
Yes.
Re:FragAttacks: new security vulnerabilities that affect wi-... by neolog on Tuesday May 11, 2021 @06:03PM (#27124139)
Commercial displays are a solution here, though they're expensive.
Re:FragAttacks: new security vulnerabilities that affect wi-... by bonestamp2 on Tuesday May 11, 2021 @08:00PM (#27125116)
Don't put your wifi credentials into your TV, then you've effectively got a giant monitor/commercial display.

If you're feeling especially crafty, open the back of your TV and disconnect the wifi/bluetooth board. It's a discrete board in all of my TVs of different brands. I assume they build them this way so they can use the same network board design/production for years and just upgrade the main logic board in newer models.

Re:FragAttacks: new security vulnerabilities that affect wi-... by alias_neo on Wednesday May 12, 2021 @04:48AM (#27128165)
I can't find any references right now, but someone once mentioned TVs shipping with SIM cards embedded so that they could collect telemetry even if you didn't connect it to your network.

Even if it isn't/hasn't happened, there's nothing to stop someone like Samsung sticking cellular modems in their TVs to work around you doing this.

If we think about it like Air-Tags too, popular enough product, it'll just connect to one of your neighbour's TV's which _is_ online.

I remember years ago, Vodafone gave me a "free" femtocell because signal in my home was poor. They neglected to mention the fact it broadcast a public cellular signal which allowed other Vodafone customers to use _my_ internet bandwidth.

Re:FragAttacks: new security vulnerabilities that affect wi-... by bonestamp2 on Wednesday May 12, 2021 @05:56PM (#27135633)
> there's nothing to stop someone like Samsung sticking cellular modems in their TVs to work around you doing this.

True. Although, if they put that SIM card on the bluetooth/wifi network board that I'm disconnecting then I'll be ok.

I would be surprised if they used cellular technology for this though (from a cost perspective). I'd expect a lorawan/helium like implementation.

Re:FragAttacks: new security vulnerabilities that affect wi-... by SilverRed on Wednesday May 12, 2021 @02:06AM (#27127153)
>Don't put your wifi credentials into your TV

Amazon has a solution to this. If your tv is within wifi range of an amazon device, your TV will be able to connect to a network. It might even be your neighbors device.

Re:FragAttacks: new security vulnerabilities that affect wi-... by JetAlone on Tuesday May 11, 2021 @08:24PM (#27125268)
Can't say I'm planning to buy a TV anytime soon but that's good advice, thank you.
Re:FragAttacks: new security vulnerabilities that affect wi-... by danielheath on Tuesday May 11, 2021 @06:09PM (#27124215)
Expensive compared to the advertising-subsidised consumer version, maybe.
Re:FragAttacks: new security vulnerabilities that affect wi-... by ethbr0 on Tuesday May 11, 2021 @06:17PM (#27124288)
Expensive compared to retail-volume models. This is also a fight against manufacturing economies of scale.
Re:FragAttacks: new security vulnerabilities that affect wi-... by slimsag on Tuesday May 11, 2021 @11:37PM (#27126318)
Samsung sells "Commercial signage displays" to people, $1k for a 65" display.

e.g. the Samsung QB65R on Amazon

So yeah it's like $100-200 more expensive, but hardly seems.. unapproachable?

Re:FragAttacks: new security vulnerabilities that affect wi-... by Lammy on Tuesday May 11, 2021 @08:24PM (#27125270)
Or your neighbors do.
Re:FragAttacks: new security vulnerabilities that affect wi-... by doggodaddo78 on Tuesday May 11, 2021 @06:44PM (#27124537)