AT & T Hotspots Inject Ads Into Wi-Fi Traffic

Hotspots of US telco AT & T inject ads into the Wi-Fi traffic from users, so has researcher Jonathan Mayer discovered. Mayer was recently at Dulles airport and made ​​to connect to a hotspot free of AT & T.

The websites he had visited suddenly all sorts of ads in locations where they do not belong. It was not long before Mayer discovered that the wifi hotspot AT & T HTTP traffic manipulated. The telecom provider uses an ad-injection platform developed by a startup called RaGaPa. When an HTML page is loaded over HTTP are made three changes.

If the ad is inserted, and a second advertisement as a backup in case the browser does not support JavaScript. Finally scripts are added for loading and displaying the ads. By injecting advertisements users of the browsing behavior will be exposed to unknown and unreliable companies, writes the researcher.

In addition, also affected the names and content of enterprises, because the ads appear on various websites that normally show ads. It is also not clear that the ads come from the hotspot. Furthermore, it introduces security risks, says Mayer. He calls AT & T also to stop. Furthermore it shows, according to the researcher that it is important that websites are accessible only over HTTPS, since no ads will be injected into the circulation.

Chrysler Raises 1.4 Million Cars Back Because Of Vulnerability

Carmaker Chrysler raises some 1.4 million cars and trucks back because of a vulnerability in the software that allow attackers over the internet can access the vehicles. It is then possible to switch on the brakes, to turn off and to turn off the motor at low speeds.

The vulnerability was by researchers Charlie Miller and Chris Valasek discovered . The problem is in Uconnect, a component that gives the cars online capabilities and that the entertainment and navigation are operable. The functionality even offers a wifi hotspot and makes phone calls possible. Uconnect allows anyone with a vehicle connection as long as the IP address of the car is known.

After the connection was made with a car, the researchers succeeded in order to adapt the firmware of the system. This custom firmware can then send instructions via the internal network of the car to the physical components such as the engine and the wheels.

Recall

After Chrysler nine months ago was informed, was the manufacturer on July 16 with a security update . The update must be installed via a USB stick by car owners. The fear was that many owners would not do this. Therefore Chrysler now launched a voluntary recall, let the manufacturer through their own website to know. It is about 1.4 million vehicles. According to Chrysler there are no attacks still in the "wild" that have been observed using the vulnerability.

The problem is present in the MY Dodge Viper and different models of RAM pickup, the Jeep Grand Cherokee and Cherokee SUVs, Dodge Durango SUVs, different My Chrysler and Dodge Charger sedans and Dodge Challenger sports coupe.Customers of an affected vehicle will have received a USB device that they can use to upgrade the car software. The upgrade not only resolves the vulnerability, but also adds additional security measures, according to Chrysler.

7-Year-Old Girl Performs Wifi Attack Within 11 Minutes

A 7-year-old British girl has given a demonstration of how easy it is to run a wifi attack with minimal knowledge. The demonstration was part of an awareness campaign of a VPN provider, who wants to make consumers aware of the risks of open Wi-Fi networks.

Betsy Davies, who had her parents' permission, the demonstration began with the search of instructional videos on YouTube.Then she put a "rogue access point" at which users of the Wi-Fi network without they made ​​it knew the connection. In this way, Davies could intercept the traffic of users. Eventually, they had a 10-minute and 54 seconds in order to carry out the attack. A security expert oversaw the demonstration, reports the Daily Mail .