I was playing with an N800 at work yesterday when I saw this new hotspot called Free Public WIFI. Oboy! I figured the city had quietly rolled it out, and gave it a shot. Unfortunately, I got a useless link-local address. I tried it in the parking lot after work and saw the spot was now unavailable, so I figured it was something our IT guys were bringing online (our current WiFi is firewalled) for visitors. Our guest intranet page was offline at the same time so it seemed to make sense.

Imagine my surprise when I brought it up to one of my colleagues this morning and he claimed it was some sort of virus. Intrigued, we googled it, and this article came up:

http://blogs.chron.com/techblog/arch...ublic_wif.html

It turns out that at some point someone created a legitimate Free Public WIFI node, and now this is being replicated ad hoc by Windows PC (likely laptops) all over the place. The author succinctly states:

Interesting!

Microsoft has a hotfix for the "feature", and it will be permanently rectified in the next service pack. I'm just amazed I never saw it mentioned here (I searched)!

I saw the same thing a few weeks ago when I was in a hotel in Tampa. I saw the hotspot, and was thinking to myself 'Oh, the hotel has a free public wifi hotspot, sweet!', and then slowly noticed that after connecting that it was ad-hoc and rather useless for anything. I then figured that it was just some punk with a laptop who was trying to lure other laptop users into connecting to his machine for some malicious purpose or another, and was glad that my little linux tablet probably wouldnt be too vulnerable. I didn't think much of it, but now that you bring it up I have a bit more faith in humanity that it was a windows 'feature' rather than just another wannabe hacker. Go figure I always assume the worst.

Well, Firebird, where security is concerned IMO "assume the worst" is a good posture.

Yeah. I dont know, it just brought back memories of that whole trick where you run a http server and some tools on your laptop in order to spoof a legit wifi hotspot and trick users into entering their account information in your fake hotspot login page.

LOL, I've seen it too.. but if that was in my hometown or somewhere else in the world I can't remember -- been travelling too much. But I remember casually trying to connect and getting the local IP question mark.

Chalk up another sighting in Toronto. I've seen it at work over the past year and a half, in fact I tried to connect to it again yesterday (useless link-local IP). Bizarre.

Regarding one of the comments on that site Tex... I see hpsetup as well.

one of the first exploits i read about was walking into a starbucks and setting up a fake AP to get PCs to think your laptop was the AP.

this was done by running something like kismet to get BSSID and ESSID of the AP, and then forging your MAC address to be identical to the real AP. then with an injected mass de-auth packet, you can then begin to steal the traffic from the AP, as the PCs/laptops begin to reacquire their connections. with this going on, it is expected that the PC/laptops, begin to braodcast keys associated with the AP, and if people are VPN'd into work you may be able to cull the key for that too.

it seems that some script kiddies are growing up, and their ruses are getting more intelligent

If you guys have anything auto connect with a name and password, you might want to change those passwords.

The more people try it, the more it's gonna spread.

I'm in NYC and have seen the Free Public Wifi and the hpsetup in many ocassions. Never really tried to connect to one of them but every day I see it more and more...