Hacking public Wi-Fi

1 February 2018 Editor's Choice, Information Security, Infrastructure

Public Wi-Fi is great in so many ways. It costs nothing, saves on mobile data, and is often faster when it comes to downloading. However, as much as we love the convenience, hackers love public Wi-Fi too, and for different reasons.

Nastassja Poorter, enterprise sales director at DRS, a Cognosec AB company, says there are several ways cyber crooks can access an individual’s private information and even steal their identity or capture their banking logins through public Wi-Fi.

One of the ways in which they can do this, is through Man-in-the-Middle (MITM) attacks, during which a hacker intercepts communications between two parties. While they may think their communications are private and that data is being shared directly between the server and the client, the link is, in fact, being intercepted by a third-party. The attacker can then alter the communication and display, for example, a fake or phishing website or send a message of his own.

“Public Wi-Fi is particularly susceptible to attacks of this nature due to the fact that any HTTP site data being transmitted is unencrypted, effectively rendering your data public. Through compromised routers, attackers can steal reams of personal information and give them access to financial logins, private messages, user names and passwords. People should never, under any circumstances, do online banking transactions or share any personal information with others while using public Wi-Fi.”

So what can users do? Check for secure sites, ones that have https:// instead of just http in front of them. “Certificates denoted by the ’s’ mean the website is more secure, and offers a decent level of encryption, so only use such sites when accessing personal information,” says Poorter.

The next thing users of public Wi-Fi need to be aware of are ‘Evil Twin’, or fake, Wi-Fi connections. In these attacks, a cyber criminal sets their service identifier (SSID) to be the same as an access point (AP) at the local hotspot or wireless network. He can then disrupt or disable the genuine AP by disconnecting it, directing a denial of service attack against it, or creating radio frequency interference around it. This is particularly cunning, as it bypasses any security systems a public Wi-Fi hotspot might have in place.

She advises users to be very suspicious should two network connections show up that have a similar name, and if possible, make use of a virtual private network (VPN). This will establish a level of encryption between the user and a website, so any data that could potentially be intercepted is unreadable to a cyber criminal unless they have the decryption key, which they don’t.

According to Poorter, the next danger associated with public Wi-Fi is packet sniffing. “Every time there is data transmitted over the Internet, irrespective of whether it’s an email, Google search or retail transaction, the data is broken down into digital information that is sent in data packets. The packets are labelled and addressed with instructions explaining where they are going to. Millions of data packets move between destinations all the time, uninterrupted,” she explains.

“However, and here’s the caveat: If someone has installed sniffing hardware or software somewhere on the network, they can eavesdrop, snatch that data in mid-transmission just long enough to ‘sniff’ or inspect it, and if found to be interesting or valuable, quickly capture and copy it before sending it on its way. This is done without anyone being the wiser. Packet sniffing is like wiretapping for the Internet.”

Packet sniffers can read emails, see passwords, view your Web history and, more alarmingly, capture account information such as logins and credit card numbers in detail. “Again, I recommend turning to strong encryption, in the form of a VPN to avoid this,” says Poorter.

Another danger of public Wi-Fi is sidejacking, or session hijacking. In these instances, an attacker will essentially steal a user’s access to a website by using a packet sniffer to get their hands on an unencrypted cookie that grants access to the site in question. This technique allows the cyber crook to impersonate the user, as the session cookie is already providing access to the website’s content. Alarmingly, sidejacking bypasses encryption to some degree.

Poorter says although attackers can’t read a password through this technique, they could still download malicious software that could, and get their hands on enough information to make stealing your identity a breeze. “Again, make use of https:// and VPNs to secure against this type of threat.”





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Phishing attacks through SVG image files
Kaspersky News & Events Information Security
Kaspersky has detected a new trend: attackers are distributing phishing emails to individual and corporate users with attachments in SVG (Scalable Vector Graphics) files, a format commonly used for storing images.

Read more...
A passport to offline backups
SMART Security Solutions Technews Publishing Editor's Choice Infrastructure Smart Home Automation
SMART Security Solutions tested a 6 TB WD My Passport and found it is much more than simply another portable hard drive when considering the free security software the company includes with the device.

Read more...
Navigating the complexities of privileged access management
Editor's Choice Access Control & Identity Management
Privileged Access Management and Identity Access Management are critical pillars of modern cybersecurity, designed to secure access to sensitive resources, enforce principles like least privilege, and implement just-in-time access controls.

Read more...
The impact of GenAI on cybersecurity
Sophos News & Events Information Security
Sophos survey finds that 89% of IT leaders worry GenAI flaws could negatively impact their organisation’s cybersecurity strategies, with 87% of respondents stating they were concerned about a resulting lack of cybersecurity accountability.

Read more...
Rewriting the rules of reputation
Technews Publishing Editor's Choice Security Services & Risk Management
Public Relations is more crucial than ever in the generative AI and LLMs age. AI-driven search engines no longer just scan social media or reviews, they prioritise authoritative, editorial content.

Read more...
Efficient, future-proof estate security and management
Technews Publishing ElementC Solutions Duxbury Networking Fang Fences & Guards Secutel Technologies OneSpace Technologies DeepAlert SMART Security Solutions Editor's Choice Information Security Security Services & Risk Management Residential Estate (Industry) AI & Data Analytics IoT & Automation
In February this year, SMART Security Solutions travelled to Cape Town to experience the unbelievable experience of a city where potholes are fixed, and traffic lights work; and to host the Cape Town SMART Estate Security Conference 2025.

Read more...
Historic Collaboration cuts ATM Bombings by 30%
Online Intelligence Editor's Choice News & Events Security Services & Risk Management
Project Big-Bang, a collaborative industry-wide task team, has successfully reduced ATM bombings in South Africa by 30,7% during the predetermined measurement period of November, December and January 2024/5.

Read more...
World-first safe K9 training for drug detection
Technews Publishing SMART Security Solutions Editor's Choice News & Events Security Services & Risk Management Government and Parastatal (Industry)
The Braveheart Bio-Dog Academy recently announced the results of its scientific research into training dogs to accurately detect drugs and explosives without harming either the dogs or their handlers.

Read more...
The need for integrated control room displays
Leaderware Editor's Choice Surveillance Training & Education
Display walls provide a coordinated perspective that facilitates the ongoing feel for situations, assists in the coordination of resources to deal with the situation, and facilitates follow up by response personnel.

Read more...
Five tech trends shaping business in 2025
Information Security Infrastructure
From runaway IT costs to the urgent need for comprehensive AI strategies that drive sustainable business impact, executives must be prepared to navigate a complex and evolving technology environment to extract maximum value from their investments.

Read more...