News for hackers. Stuff that matters.
Re:FragAttacks: new security vulnerabilities that affect wi-... by salawat on Tuesday May 11, 2021 @05:10PM (#27123576)
This is one of those things that shouldn't even have a standard made for it.

What does everyone think is going to happen with capabilities like that?

Re:FragAttacks: new security vulnerabilities that affect wi-... by transpute on Tuesday May 11, 2021 @05:15PM (#27123622)
Good news, the paper mentions privacy.

> We identify a number of critical issues that need to be addressed in this space... First, individuals should be provided the opportunity to opt out of SENS services – in other words, to avoid being monitored and tracked by the Wi-Fi devices around them.

Bad news, the paper proposes remote human identification by every Wi-Fi device.

> This would require the widespread introduction of reliable SENS algorithm for human or animal identification.

Would opt-in be legally easier than requiring human body scan registration for opt-out of Wi-Fi remote sensing?

Re:FragAttacks: new security vulnerabilities that affect wi-... by salawat on Tuesday May 11, 2021 @07:13PM (#27124797)
This is a poison pill.

In order to not be tracked you must consent to be tracked so we know you don't want to be tracked.

This should not be done or allowed. Period. It's a huge invasion of privacy.

Re:FragAttacks: new security vulnerabilities that affect wi-... by brobdingnagians on Tuesday May 11, 2021 @05:53PM (#27124041)
It would be better to have a beacon that simply broadcasts that you do not want to be tracked, with no further identifying features. There isn't really a good reason for identifying you to then look up that you don't want to be tracked. Make that legally binding and enforce it.

Or, better yet, make it totally opt in.

Re:FragAttacks: new security vulnerabilities that affect wi-... by farrelmahaztra on Tuesday May 11, 2021 @06:19PM (#27124308)
How would opt-in work in practice? Say, if this gets pushed out on $CAFE public wifi for analytics. Would it be something akin to "tick this consent box to use the wifi"?

And if $CAFE tracks you regardless of you not ticking the box or connecting to the network, how do I detect that as a regular customer?

Re:FragAttacks: new security vulnerabilities that affect wi-... by quickthrowman on Tuesday May 11, 2021 @06:17PM (#27124293)
Yeah, this tech standard is totally insane, why would I want anyone or anything to be able to scan people and objects inside my house without my knowledge? I’m aware of microphone attacks for keyboard password entry and other methods of surreptitious surveillance, but this is way past a microphone or webcam. I will pay a massive premium to purchase WiFi equipment without this feature.

Unfortunately these will be everywhere, far beyond any existing camera surveillance network.

Re:FragAttacks: new security vulnerabilities that affect wi-... by transpute on Tuesday May 11, 2021 @06:59PM (#27124691)
It's also passive. Someone could stand outside your house or factory with their device and "illuminate" activity inside the building. Only EMF shielding in/on the walls could block them. Nation-state regulators could get involved, since these devices would be using spectrum that belongs to the public.

2012 article on a military use case, https://www.popsci.com/technology/article/2012-07/seeing-thr...

2017 video on an industrial use case, https://www.digitaltrends.com/cool-tech/wi-fi-radiation-tran...

Re:FragAttacks: new security vulnerabilities that affect wi-... by rapjr9 on Tuesday May 11, 2021 @11:46PM (#27126366)
This is very similar to radar, which raises the question, is radar already used to spy on peoples movements through walls?
Re:FragAttacks: new security vulnerabilities that affect wi-... by ancientworldnow on Wednesday May 12, 2021 @12:22AM (#27126557)
X-Ray backscatter is definitely used for this, most famously by secret NYPD vans.

https://www.theatlantic.com/politics/archive/2015/10/the-nyp...

Re:FragAttacks: new security vulnerabilities that affect wi-... by transpute on Wednesday May 12, 2021 @12:30AM (#27126597)
> The radars work like finely tuned motion detectors, using radio waves to zero in on movements as slight as human breathing from a distance of more than 50 feet. They can detect whether anyone is inside of a house, where they are and whether they are moving.

The cost of those devices should fall with 802.11bf Wi-Fi.

> the vans deliver a radiation dose 40 percent larger than delivered by a backscatter airport scanner; bystanders present when the van is in use are exposed to the radiation that the van emits… there may be significant health risks associated with the use of backscatter x-ray devices as these machines use ionizing radiation, a type of radiation long known to mutate DNA and cause cancer.

Could this radiation meter detect the presence of such a van?

https://www.gqelectronicsllc.com/comersus/store/comersus_vie...

Re:FragAttacks: new security vulnerabilities that affect wi-... by hooande on Tuesday May 11, 2021 @08:09PM (#27125171)
Can make a lot of interesting products. Lights that turn on or change color when different people enter a room. home security systems that can detect motion. the ability to summon help for people who fall.

I've been looking into this for a while, should be mature enough in a year or so. there are already dozens of companies in this space

Re:FragAttacks: new security vulnerabilities that affect wi-... by idiotsecant on Tuesday May 11, 2021 @08:07PM (#27125150)
Do you think making it a standard is required to use it? The technology exists now. Writing it down isn't breathing it into existence.
Re:FragAttacks: new security vulnerabilities that affect wi-... by transpute on Tuesday May 11, 2021 @08:09PM (#27125174)
Good to have threats documented, so technology/spectrum can be regulated and legal frameworks developed.

e.g. lockpicks are regulated, how about wallpicks-via-WiFi?

Re:FragAttacks: new security vulnerabilities that affect wi-... by grkvlt on Wednesday May 12, 2021 @06:47AM (#27128772)
> lockpicks are regulated

you think?

Re:FragAttacks: new security vulnerabilities that affect wi-... by transpute on Wednesday May 12, 2021 @09:21AM (#27130001)
Only in a few places.

http://lockwiki.com/index.php/Legal_Issues

https://unitedlocksmith.net/blog/the-locksport-travel-guide-...

> In Japan if you are found with lock picks you will be subject to a fine of 500,000 yen and a year in prison. In Poland, it is illegal to possess any picks without being able to show that your profession requires it ... In Hungary ownership of lock picks is completely illegal. The only people in Hungary that are allowed to have these tools are the military, and as a result lock picks are classified as military equipment. For travel within the United States or even traveling to the US, you should consult the lock pick laws in the state you are visiting.