OK, I still feel it is a security issue, but of course it depends on how
many people are affected by it. In the meantime I have been able to
reproduce the issue with the server being (accidentally) spoofed. The
reason it's hard to test this is, that I don't have my own wireless
network, and I can't affect when other people connect to the wireless
network or if they're close enough for me to talk to them.

Prerequisites to reproduce (rather hardware and setup intensive, I'm
afraid):

- A laptop with wired and wireless network, preferably similar hardware
to the Dell Latitude D505, with a newly installed Feisty. If you in fact
use the D505, you need to install the bcm43xx driver to get the wireless
working.

sudo apt-get install bcm43xx-fwcutter
sudo /usr/share/bcm43xx-fwcutter/install_bcm43xx_firmware.sh

- A wireless router with a DHCP server set up similar to your wired DHCP
server (same local IP range etc.). The router should not have any
security set up.

Steps to reproduce:

1. Bootup your laptop wired. Verify that n-m tells your that you're on the 
wired network.
2. Try to ping the remote network (ping -Ieth1 192.168.1.1)
3. If you can ping the remote network try to physically disconnect your laptop 
from the wired network. Verify tha nm-applet tells you you've been disconnected.
4. Now do a traceroute (or use a browser to connect to for example google.com). 
Verify that you're going through the wireless router.
5. Reconnect your wired network. Verify that n-m tells you that you're 
connected to the wired network.
6. Repeat step 4. Sometimes you should still be connected to the wireless 
network and go through the wireless router.

I'm always able to do this. If you're not, it must be some issue with my
specific hardware.

If you can't do the above, you're done. Otherwise, here's the
preriquisites for the server spoofing issue

- A server at some address not specified by your wired DHCP server (like 
192.168.1.2)
- Another PC with the same IP as the internal server (192.168.1.2) connected to 
the wireless. 

7. After step 6 has been completed, try to ping to 192.168.1.2. Lookup
the MAC address in the arp table (arp -a 192.168.1.2). If the MAC
address is the remote 1921.168.1.2, you've succesfully spoofed the
internal server.

-- 
[feisty] At boot-up I'm connected to an untrusted wireless network and Network 
Manager doesn't tell me about it
https://bugs.launchpad.net/bugs/114482
You received this bug notification because you are a member of Ubuntu
Bugs, which is the bug contact for Ubuntu.

-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to