Blog de Matias Katz Hablamos un poco de seguridad?

To the side of the main entrance of one of the stores belonging to this major drugstore chain, there is a monitor that constantly shows information for the customer, promotions and so.

Tne other day I was walking by and I ran into the following scene:

For those of you who haven't realized what was showing up in the screen yet, here is a close-up:

In front of the presentation there was a login screen to the following server:

"popeye.[DomainDeleted].com.ar"

I believe that the client machine would connect to this server to download the daily presentation to show, or something like that.

Of course that this server is located in the private network, there is no public record named like that (I checked). So the situation didn't look very promising, since the discovered information wasn't good enough to investigate since there was no way I could access the private network where these computers were located.

However, the next day I walked by the store again and I ran into the following situation:

Again, a close-up for those of you who hadn't discovered the problem yet:

The computer connects to the network through Wi-Fi !!

The store's front face, with little to null possible supervision (due to its physical location, with its back to the staff) connects to the network with a wireless connection, allowing an attacker to do several attacks, such as:

• Denial of Service
• WEP-WPA key cracking (I didn't check the network type, but I could have turned on my phone and checked)
• Sniffing
• And the best of all..... A Rogue AP!!

By taking the following steps:

1. Starting a tool that would allow me to impersonate any Wi-Fi network
2. Causing a forced disconnect of the victim computer
3. Getting the victim computer to connect to MY AP instead of the real one
4. Impersonating the "popeye.[DomainDeleted].com.ar" server
5. Waiting for the victim computer to try to connect to that server to ask for the new information to show on screen

I could make the computer screen to show arbitrary information of my choice, and even gaining local access to the computer (through some exploit) and from there enter the store private network.

And the best of all, I could be doing all of this from the bar next door, sipping some delicious coffee and without any risk

Bye!