Comments
bkd69 • May 10, 2012 6:21 AM
From the looks of things, those appear to be only semi-private networks, there as a courtesy for the sports press, and not the actual private network of the MLB organization.
Given that their HQ is a few floors up from the ground floor (if that is inside their HQ, and not some other facility), the loss of bandwidth to public leechers is likely minimal, at worst. You might be able to get results from across the street with a Pringles cantenna, but if you’re thatdriven to eavesdrop on the sports press, it’d probably be easier to get credentials of your own, or somehow get access to to an adjacent floor.
Tachyon • May 10, 2012 6:27 AM
Way to miss the point. It’s funny. We’re not doing a risk assessment deep dive. It’s passwords on a wall during a live tv show.
Just funny, calm down 🙂
Nesetalis • May 10, 2012 6:46 AM
Ahh thats great… :p
noahkelly • May 10, 2012 6:47 AM
Took me about 20 seconds till i got. What a classic. That brightens up my day. Cheers 🙂
bkd69 • May 10, 2012 7:01 AM
Not just funny…I want free wifi the next time I go to Chelsea Market.
🙂
Paul Renault • May 10, 2012 7:04 AM
Actually, the ‘publicly-posted-password’ is so that individual users of the Wifi network can’t snoop on each other. Each user on the network gets his/her own nonce.
In unencrypted Wifi networks, everyone can snoop on everyone else.
This, rather than being a fail, is a success.
sh0bud • May 10, 2012 7:06 AM
There was a CTF (capture the flag) last year, in which one of the steps needed to solve the puzzle was to hack into the network-connected webcam, steer it around, and read a password off a post-it note.
Clive Robinson • May 10, 2012 7:39 AM
@ Tachyon,
We’re not doing a risk assessment deep dive. It’s passwords on a wall during a live tv show.
And yes it’s quite funny (but then many journalists and the organisations around them are more than worthy of “Oi thicko” awards.
But there is a dark side that can lead to pain (which is why we laugh at it because it gives us “We’d never be that daft” sense of superiority which most jokes are based on)…
So hopefully the details are realy randomly selected and used only for that one occasion (now past) then we can have a laugh at them and move on…
But what if they are not? then you’ve got some information, that you can use to get into the network and any machine that connects to it. Whilst MLB might have their systems set up properly how many “Journalists” or others there do?
How about setting up a fake AP using those details, chances are good you might catch a journalist and be able to trap one of their requests to the web and thus use it to download malware of some form onto their laptop…
After all it’s not as though people (who should have thought about it) have not been caught out at various monotone “Hat” conferences just about every year…
And once you’ve got “ET Malware” software onto one journalists laptop the chances are you can then use it to get other journalists working for the same organisation maybe on the city or celebs desks.
And as we very well know in the UK major news stories (on News International rags) were obtained by both phone and computer hacking with atleast one UK journalist having been jailed for it in the past with a whole bunch having recently been arressted and awaiting their fate.
In fact it appears to be so rife that it’s probably better than evens that in the US exactly the same tactics are being used by other news organisations “in the same stable” with the same (previous) success [Google ‘lord leveson inquiry’ to get the low down on it].
But look at it another way like thieves most journalists have no honour amongst themselves, if you are an “up thrusting” journalist what better way to get career enhancing scoop or two than by nicking it from another journalist who’s working on it for a rival news organisation?
And yes we know that some journo’s have stolen stories from each other, what has never been clear is the mechanism used 😉
Ivor Emanrus • May 10, 2012 8:08 AM
But those passwords are obviously only valid for this year- how are we supposed to work out what next year’s might be?
😉
Nicholas Weaver • May 10, 2012 8:29 AM
Actually, thats a common strategy, we use it where we work…
A WPA password has three purposes: It prevents casual snooping, it prevents casual leeches, and its a nice digital “No Tresspassing” sign so if you do catch a leech you can throw the book at them.
Putting the WiFi password up on the walls inside means you have the same usability of a purely public wifi netork, but with the benefits of the WPA password.
Steve Jones • May 10, 2012 8:32 AM
Easier than checking the Post-it note under the keyboard 😉
In the pre-HDTV days, such a piece of paper on the wall would likely be illegible to the TV viewers.
Talk about security by obscurity…
I think Clive has the level of danger correct. There are many people who use that network who would be endangered by this security lapse, and not all of them work for the corporation that manages the network.
Jeff • May 10, 2012 8:55 AM
Paul R’s comment @ 7:04 brings up a question for me.
I’ve never used a public wifi network. I’m assuming that most of them at places like McDonalds and Starbucks do not have a password. Are you saying that this allows people to snoop on eachother, but that if there were a password (even one given to everybody) that snooping would be (hopefully much) more difficult?
Lain. • May 10, 2012 9:13 AM
Jeff at May 10, 2012 8:55 AM
If the WiFi is protected by a simple WEP key, then the public password is completely useless: anyone knowing him could sniff traffic from any other device.
I’m not sure about WPA. AFAIK the password is used to associate then a private key is excanged for traffic encryption which changes over time, what I don’t know is if this random private key is global or unique for each device.
Matt Pascucci • May 10, 2012 9:23 AM
Thanks for referencing this post, Bruce!! I’ve never seen so many hits to my blog at once. 🙂
aikimark • May 10, 2012 10:01 AM
For those times when a post-it note would be too small or too tacky.
Curby • May 10, 2012 10:45 AM
@Jeff, depends on the WAP. Some have features that try to restrict Wifi client to client traffic. I’m not sure how easy they are to get around.
As alluded to by others here, how big of a gaffe this is depends on the purpose and security posture of the networks. At the end of the day though, it still looks bad.
Brian McMahon • May 10, 2012 12:56 PM
Having your wireless network access details appear on TV is a more sweeping form of “broadcast SSID” than most people imagine.
Now, where’s that old Pringles can … ?
G-man • May 10, 2012 1:34 PM
Funny! I occasionally do Sports Photography at pro and NCAA sporting events. This is how they do it in the Media Room at NCAA Div 1 events too… Just a temporary wireless network set up to let the press send off articles and images to their Editors while at the event. The password is ALWAYS on the wall or taped to the desk.
Anton • May 10, 2012 4:17 PM
In case someone forgets the password, they can google the SSID and find the password here:
SSID: MLB-Press
Password: BWAA#2012
SSID: MLB-Photo
Password: Photo#2012
Chris • May 10, 2012 4:32 PM
Apparently the word “funny” underlined in blue is funny. I don’t get it. Explain?
(no, I’m not going to click the link)
Bruce Clement • May 10, 2012 4:33 PM
This is sloppy and unnecessary. In the UK he would just have someone read the SSID & password clearly into his voice mail and any real journalist would listen to it there.
Daniel • May 10, 2012 4:35 PM
Apparently the TSA is now putting babies on the no-fly list out of fear of the diaper wearing bomber.
funny?
B Journo • May 10, 2012 7:34 PM
Isn’t this just a step above an open WiFi as used by Bruce?
It might by a TV fail, but not really a security fail.
Dirk Praet • May 10, 2012 8:07 PM
@ B Journo
It might by a TV fail, but not really a security fail.
What do you mean “not a security fail” ? Every day, security professionals are trying to educate folks to treat their passwords as they would their tooth brush: use them often, change them regularly and don’t share them with anyone (courtesy Damien Mulley). And than in this case it would be OK ? It isn’t, and for the technical part of the answer, do re-read Clive’s post.
Brian • May 10, 2012 11:06 PM
Took a tour of an unnamed midwestern MLB ballpark this summer. Had access to a lot of offices with PCs sitting around. You’d be amazed at how many of them had username/password combinations on post-it notes slapped on the monitor and/or keyboards.
Bobby • May 11, 2012 12:53 AM
must be for public use. Perhaps it should have been left open.
Reader • May 11, 2012 1:44 AM
Yes, public use, like in airline lounges “today’s password is united11052012”.
Mark • May 11, 2012 3:00 AM
@Clive
I’ve seen a lot of worms lately while traveling that set up fake access points based on access points that people’s laptops have accessed in the past. They are easy to spot if you are looking, but as sadly as is all too common. Most people I know think things like thinking and paying attention are for the “Smart Guy.”
Paul Renault • May 11, 2012 6:07 AM
Jeff at May 10, 2012 8:55 AM
Yes: The WPA password is used to negociate a ‘session key’ which is used to encrypt the data flow. Every device connecting to the Wifi point gets their own, different session key.
The session key gets renegociated after some time, typically every hour.
If you have to set your Wifi to use WPA (instead of WPA2), look for something like “Group Key Update Interval”. It’s typically set to 3600 seconds (1 hour). This is too long, there’s a risk that part of the session key can be guessed correctly.
Set the interval to something less than 12 minutes. That interval is shorter than the minimum time it takes to guess one character correctly. If the session key is changed every 11 minutes, then the so-called ‘chopchop’ attack can never manage to guess one character of the currrent session key.
Notansel • May 11, 2012 1:30 PM
I’m there with G-man. News photography, and especially sports new photography, requires us to upload shots very soon after they are taken. Even when under contract, we often have to race past others in order to get published (and paid).
BUT … It is a funny picture.
Rajesh • May 12, 2012 9:57 AM
The password behavior of the admin is really simple. The yyyy is common, might be he is following the fact, the best security is always simple.
Zaphod • May 13, 2012 12:14 AM
@Ivor Emanrus
Here you are;
SSID: MLB-Press
Password: BWAA#2013
SSID: MLB-Photo
Password: Photo#2013
Z.
Subscribe to comments on this entry
Leave a comment
Sidebar photo of Bruce Schneier by Joe MacInnis.
grumpy • May 10, 2012 6:03 AM
Single point of failure… 🙂