All security features are part of a SYSTEM that includes the USER. SSL is no exception. Just because you're using a SSL-protected web site (and you have the comforting little padlock in the corner of you browser), doesn't mean that someone at the coffee shop hasn't poisoned the ARP tables and issued you a fake certificate when you first logged into your bank's web site. It all comes down to whether the USER actually reads the certificate warning message or just habitually clicks 'yes.' Think it's hard to poison ARP tables and issue fake SSL certificates? Guess again. It's disturbingly simple with a Windows tool called Cain & Abel.

There's no way around it. Public hotspots are a dangerous place.


[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/385/33122#33122