this post was submitted on 08 Mar 2024
333 points (97.4% liked)

Europe

8324 readers
1 users here now

News/Interesting Stories/Beautiful Pictures from Europe ๐Ÿ‡ช๐Ÿ‡บ

(Current banner: Thunder mountain, Germany, ๐Ÿ‡ฉ๐Ÿ‡ช ) Feel free to post submissions for banner pictures

Rules

(This list is obviously incomplete, but it will get expanded when necessary)

  1. Be nice to each other (e.g. No direct insults against each other);
  2. No racism, antisemitism, dehumanisation of minorities or glorification of National Socialism allowed;
  3. No posts linking to mis-information funded by foreign states or billionaires.

Also check out [email protected]

founded 1 year ago
MODERATORS
 

Four German military officials discussed what targets German-made Taurus missiles could potentially hit if Chancellor Olaf Scholz ever allowed them to be sent to Kyiv, and the call had been intercepted by Russian intelligence.

According to German authorities, the "data leak" was down to just one participant dialling in on an insecure line, either via his mobile or the hotel wi-fi.

The exact mode of dial-in is "still being clarified", Germany has said.

"I think that's a good lesson for everybody: never use hotel internet if you want to do a secure call," Germany's ambassador to the UK, Miguel Berger, told the BBC this week. Some may feel the advice came a little too late.

Eyebrows were raised when it emerged the call happened on the widely-used WebEx platform - but Berlin has insisted the officials used an especially secure, certified version.

Professor Alan Woodward from the Surrey Centre for Cyber Security says that WebEx does provide end-to-end encryption "if you use the app itself".

But using a landline or open hotel wi-fi could mean security was no longer guaranteed - and Russian spies, it's now supposed, were ready to pounce.

you are viewing a single comment's thread
view the rest of the comments
[โ€“] [email protected] 17 points 8 months ago (2 children)

It is fine if you use unprotected wifi and then connect to a VPN.

[โ€“] [email protected] 37 points 8 months ago (1 children)

You don't even need a VPN if the software uses proper TLS encryption or equivalent

[โ€“] azertyfun 3 points 8 months ago (2 children)

TLS downgrade attacks are a thing, and can enable MITM attacks. There are server-side mitigations (such as only allowing TLS 1.2+ which should be the case but often isn't because the server has to support a niche user or application that only supports TLS 1.1), and since you usually don't know which TLS version you are using, for very sensitive connections it should be assumed that TLS is not enough.

Don't even get me started on the non-security of standard mobile/landline calls. They're basically transparent for an attacker with means like Russia's.

Proper E2E encryption and/or a VPN should be mandatory for a call to be considered secure, period.

[โ€“] Toine 4 points 8 months ago (1 children)

If WebEx is susceptible to MITM attacks, it shouldn't be used for sensitive calls. It's better to use a VPN, but something like this should not happen at all, even without VPNs.

[โ€“] azertyfun 1 points 8 months ago

Sure, but when you demonstrably don't have a handle on E2E encryption using a VPN should be the FIRST step because it is very easy to implement, secure, and enforce. Virtually every private company does it.

Conversely E2E encryption is hard, lots of popular apps disable it by default or in some cases because it breaks a lot of useful things (like search). I agree it SHOULD still be mandated, but it's several orders of magnitude more expensive to switch the communication tool than mandating a VPN so for me that immediately pushes it second to VPN on the priority list.

[โ€“] [email protected] 2 points 8 months ago

I like the American option. We just built an entire second Internet and air-gapped it.

[โ€“] [email protected] 5 points 8 months ago* (last edited 8 months ago) (1 children)

These VPN ad campaigns are incredibly detrimental to people's understanding of security mechanisms in the internet.

[โ€“] [email protected] 4 points 8 months ago (1 children)

How would this not have helped out in this case? I imagine the Bundeswehr must have an organization-wide VPN which would render any MITM in a local Wifi network impossible, barring user error.

[โ€“] [email protected] 1 points 8 months ago

The data still has to go through the man in the middle. It doesn't matter if it's encrypted by the VPN or the App.