If you follow tech and cybersecurity news, this is something that you see a lot: Public WiFi networks, the free wireless networks found at hotels, airports and cafes, are unsafe and can cut you some major cyberslack.
As is the case with most threats, when something is publicized a lot, people tend to become less sensible and ignore it. It becomes common belief that the danger will mostly apply to other people and not me. (This is one of the weirdest aspects of human nature, finding one’s security in the insecurity of others.)
However, the truth is that WiFi networks are unsafe, whether you have anything to hide or not. That said, this doesn’t mean you should avoid public WiFi at all costs, and knowing the pitfalls and their workarounds can help you benefit from free Internet while avoiding security mishaps.
Here’s what you need to know about public WiFi security threats.
Man-in-the-Middle attacks
A “Man in the Middle” attack is a hack in which a third malicious party intercepts communications between two endpoints. By posing as the legitimate interlocutor to each of those endpoints, the attacker can gain access to confidential information being exchanged between the parties.
The hacker can choose to passively sit back and ingest the data or manipulate them to carry out more evil deeds.
For instance, a hacker might capture your request to connect to a famous website such as Gmail, and send you a response that seems to come from the real Gmail service, tricking you into revealing your credentials or redirecting you to an authentic-looking website that will download malware on your device.
Encrypted websites and services are more resilient to MitM attacks, but not totally.
A real Man-in-the-Middle attack is a bit more complicated and depends on several factors to become successful, an important one being a foothold into the network that the victim is using. Fortunately for hackers (and unfortunately for you) public WiFi networks provide them with easy access to your communications.
What should you do? Only connect to HTTPS sites browsing the Internet on a public WiFi, and make sure the green “secure” icon is present.
WiFi trap networks
Ever seen those movies where robbers set up a fake accident scene and use it to ambush victims? Well, the same can happen in cyberspace. Anyone with a cheap WiFi router (or even a smartphone) and an Internet connection can setup a public access point and lure negligent users who want to binge watch Netflix and save on their mobile data plan usage.
And from there, they can carry out a host of attacks.
Attackers use labels associated with known WiFi networks in the immediate vicinity to avoid arousing suspicion and take advantage of the auto-connect WiFi feature that some users enable on their devices.
When you connect to a router that belongs to the attackers, they will have an even easier time to sniff out and break into your communications in comparison to MitM attacks on a public network. This type of attack is also known as “Evil Twin.”
What can you do? Don’t join networks you don’t know about. If you see similarly named networks, make sure you double check with the owner of the network (such as the library or hotel) before joining the network. Also, turn off automatic connections to known WiFi networks.
Eavesdropping
In many cases, attackers only want to pick up your Internet traffic in order to discern patterns and dig out sensitive information. This type of attack is also known as “Packet Sniffing.” There are plenty of free software such as WireShark that hackers can use for Packet Sniffing.
These are legitimate network monitoring tools that IT and cybersecurity professionals use to analyze traffic patterns and find security holes or discover cyberattacks. Cybercriminals use the same tools to further their evil ends.
With data being sent airborne on a WiFi network that anyone can access, eavesdropping becomes a stroll in the park for attackers, and they’ll be able to find a wealth of data on unwary users.
What can you do? Use strong encryption on all your exchanges, which again includes exclusive use of HTTPS websites and a Virtual Private Network (VPN).
Session hijacking
With enough effort, hackers who eavesdrop on your network traffic can obtain information to impersonate you and gain access to your online accounts. Every time you login to an online account, a cookie is sent to your device, a token that is used in further exchanges to recognize you and your current session.
If an attacker can lay their hand on your cookie, they’ll be able to use it to perform “Session Hijacking,” or gain access to your ongoing session. What makes session hijacking critical is that attackers won’t need your account password to carry it out.
Sites that only use encrypted HTTPS traffic on their login page and not on other pages are susceptible to this type of attack. Sites that apply HTTPS across all their pages are considerably less vulnerable, but attackers can still gain access to your browser cookies through malware and exploit kits.
Public hotspots are an attractive target for session hijacking because a lot of users are on open sessions.
What can you do? Again, encrypted communications is your best defense against session hijacking. Also make sure you have an up-to-date antivirus software installed on your device to prevent malware from exfiltrating your data. And make sure you log off from your browser accounts when you’re finished using a public network to make sure that no one can continue using your session cookie after you leave.
What can you do?
Aside from stressing the importance of basic cybersecurity practices and ample use of encryption, I would strongly suggest to avoid using public WiFi networks for doing anything critical or sending sensitive information. If you the task can wait until you get home or to your office, it’s usually worth it to play it safe.