Mistakes humans make with data – mistake #1: using public Wi-Fi

This is Part 1/5 of the "Mistakes humans make with Data" series.

In your local coffee shop, a student connects to the Wi-Fi to research an essay. The businessman on the table opposite uses it to look up his flight information and look at emails. Meanwhile, a group of friends in the corner are watching a funny video shared on social media. What they all have in common is that they all logged onto the café’s public Wi-Fi network with little if any thought about the security risks.

According to a recent report by Norton, seventy percent of hacking incidents happen when users connect to unsecured Wi-Fi networks in places like coffee shops, restaurants and airports. Yet despite the prevalence of these attacks, the LifeLock Cyber Safety Insights Report also found that two-thirds of Americans are willing to accept risks to their online privacy in exchange for convenience. Appears that we just can’t live without broadband.

So why is it risky to connect to public Wi-Fi? There are many risks but here are just three of them.

Man-in-the-Middle attacks

A Man-in-the-Middle (MitM) attack is the equivalent of having someone eavesdropping your conversations. After connecting to the public Wi-Fi offered by the café, an attacker can intercept data transmission between two unprotected endpoints, essentially getting in the middle – ‘sniffing’ your data while you’re sipping a cappuccino.

Malicious hotspots

While you might think you are connecting to the right Wi-Fi network, you may in fact be tricked into logging on to a rogue access point (AP). Cybercriminals set up a hotspot with a name that sounds legitimate, in this case mirroring the name of the café, to deceive users. This can have serious consequences as all your communications are going through the rogue hotspot, including credit card details or passwords if you are doing online shopping or banking. You may also be redirected to a malicious site to infect your device with malware.

Unencrypted networks

Data is at risk when stored, in use and in transit. So, unless your Wi-Fi has end-to-end encryption enabled, the data sent between your computer and the wireless router may not be secure. In Portland, Floyd’s Coffee Shop had its security compromised in 2019, when cybercriminals hacked into their Wi-Fi and changed passwords, even gaining access to the shop’s surveillance cameras.

So, next time you order a coffee and sit down to log onto the Wi-Fi, just think twice, particularly if it is not password protected. If you just have to get online, at least avoid doing your e-commerce or banking until you know you are safe.

Tips for staying safe on public Wi-Fi networks

Nigel Thorpe, SecureAge’s Technical Director, shares his tips to conclude.

• Man-in-the-Middle attacks and unencrypted networks are relatively straightforward to defeat. Most websites today use SSL – as seen by the little padlock in your browser’s address bar – to encrypt data between the web server and your mobile device. This will defeat those MitM attacks.
  
  

• If you feel the need for tighter security you could always add an extra layer in the form of a VPN product. This directs all of your network traffic through a secure ‘tunnel’. But do your research – not all VPNs are created equal.

Now we come to the bigger problem – how to stop someone from running amuck with your machine. If you’ve hooked up to a malicious hotspot, or a hacker has compromised the café’s Wi-Fi, then they can pretty easily take the next step into your machine. Once inside, stealing data that’s stored on your laptop, or running malware on your device is simple. There are two technologies that can help here.

• Ensure that you have software that encrypts all of your data. And no, BitLocker won’t do the job since, when your system is running, it will just hand over unprotected data to anyone who asks for it – hackers included.

• Use a product that only allows authorised processes to run. If the café hacker puts some malware on your machine, they will have to run it to make it do its damage. But if your system automatically blocks everything which is not explicitly authorised, then no malware, however new and stealthy it may be, will be able to work.

• See part 2 of "Mistakes humans make with Data" – Phishing Scams here
• See part 3 of "Mistakes humans make with Data" – USB Flash Drive here
• See part 4 of "Mistakes humans make with Data" – Vulnerable Passwords here
• See part 5 of "Mistakes humans make with Data" – Unencrypted Hard Drives here