If the WiFi isn't free, or if you have to establish some unique identity to use it, beware of rogue gateways. Any of the other laptops could be putting out a stronger signal and be presenting a fake login page. If you're sitting far from the real transmitter, it can be a problem. And since you don't know where the transmitter is, and many employees may not know while they think they do...

I know quite a few universities are vulnerable. It's very easy to grab university ids and passwords (and often SSNs) on campuses. Just start up a fake login page and sit in one of the corners. Some laptops will associate with you, and you snarf their login. They'll just assume the university's system is screwed up again and probably never report it.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/385/33183#33183