The real threat from public wifi hotspots

Vast numbers of people use the free Wi-Fi service at cafes, hotels, and other public places. They don’t realise that by doing this, they are possibly compromising their data and exposing themselves to financial loss.

A recent survey conducted by the Cyber Security Agency of Singapore found that over 60% of respondents had no hesitation in connecting to non-password protected Wi-Fi networks in public places.

Why exactly is this dangerous and what are the risks that you are getting exposed to?

 

There could be a hacker between you and the Wi-Fi hotspot

In recent years, the number of places offering free Wi-Fi has mushroomed. Many restaurants, bookstores, and even large retail outlets provide this service. But this facility could come at a heavy price.

Hackers use a technique known as “man-in-the-middle” to get between you and the Wi-Fi hotspot. If they are successful, then your access to the internet does not take place directly through the legitimate hotspot. Instead, the information and data from your smartphone goes to the hacker who passes it on to the hotspot.

As a result, every action that you subsequently take becomes unsecured. A record can be created of the websites that you visit. If you make an online purchase, the details of what you have bought and the particulars about your credit card are revealed.

Your email account and all the information on it can be accessed by the hacker. In fact, it is possible for a malicious program to be transferred over the unauthorised Wi-Fi connection to your smartphone.

A recent news report pointed out how hackers can easily get into your smartphone using a public Wi-Fi connection. Ethical hackers, belonging to the Whitehat Society at the Singapore Management University demonstrated how they accessed their victim’s phone and took pictures using its camera.

The hackers were even able to pinpoint the location of the phone and read the SMSs that were being sent from it. All they needed to gain access was the phone number of the victim.

 

Beware of the Evil Twin

Source: Shutterstock

This is a variation of the “man-in-the-middle” technique. Instead of positioning themselves between the real Wi-Fi hotspot and the victim, the hackers create a duplicate hotspot.

You could be at a cafe or at a hotel which provides free Wi-Fi. When you access this service, you log on to the hacker’s hotspot assuming that it is the hotel’s. How is this possible? The usual modus operandi is that the hacker is somewhere close by and the illegitimate signal is powerful enough to reach the hotel and fool you into thinking that you are using the hotel’s official account.

The Wi-Fi hotspot that you innocently log on to will have a name that is very like the hotel’s. The difference will be a single letter or an added number. You will have no reason to suspect that you are walking right into the hands of the hacker.

Now every action that you take on your smartphone is visible to the “Evil Twin” hotspot.

 

Check into DarkHotel

Kaspersky Lab, a global cybersecurity company, revealed how attackers targeted specific high-profile guests at a hotel over a period of seven years without being detected. This cyberattack was not a random fishing operation where the hackers collect data from any guest that logs on to the hotel Wi-Fi and then use the information to access credit card details and bank accounts.

The hackers were extremely sophisticated and waited for victims that had been identified earlier. How did they know that a particular victim was going to visit the hotel? They got into the hotel’s network and kept a tab on the reservation system.

Prior to the victim’s arrival, they would install malware into the hotel’s system. When the victim left, they would delete the malicious program. During the hotel stay, when the victim tried to log on to the Wi-Fi hotspot, a pop-up would appear on the smartphone requesting the download of an Adobe software update.

When this pop-up was accepted, the victim unknowingly received a malicious program instead.

This method of hacking smartphones, dubbed DarkHotel, was reportedly used in several luxury hotels across Asia.

 

How can you protect yourself?

Are there any precautions that you can take to avoid getting hacked? Of course, you have the option of not using public Wi-Fi altogether. But if you want to continue with this free service that is becoming increasingly common, there are some safeguards that you can take.

The first step is to use a virtual private network (VPN) when you are accessing public Wi-Fi. This is a system that creates a private network that encrypts your data and also uses other security mechanisms to prevent unauthorised people from accessing your information. All you need to do is download an app and install the VPN.

Another useful precaution is to use different passwords for different sites. You may use a particular username and password for registering on to a site that requires this information to allow you to access certain data. Many people use the same username and password across sites and even for their credit cards and bank accounts. This makes the hacker’s job very easy. Once they ascertain your details for one site, they can see if it allows them to log on to your other accounts.

A mistake that many people make is that they keep the Wi-Fi connection on their smartphone active even when the network that they normally use is not within range. If you do this, it gives hackers the opportunity to get into your phone. Put the Wi-Fi off when you are away from your home or office. Taking this step can enhance your security. At the very least, your smartphone battery will last longer.

What if the public Wi-Fi connection that you access requires you to enter a password to access it? Does this ensure that it is safe to use? Unfortunately, a password is not of much help as it would be accessible to many users.

 

Bottomline: Avoid public Wi-Fi if you can

It is best to stay away from free Wi-Fi at cafes and malls. If you must use it, always use a VPN. If you need to access your bank account, don’t do it over a public network. Wait till you are home or on some other secure network.

(By Ravinder Kapur)

Related Articles
- Time to worry about your banks’ cybersecurity?
- The number one priority for banks in 2017: Cybersecurity
- Cybercrime: Singapore is a target