Free public WiFi is now available in many places. Airports, hotels, and coffee shops all promote free internet connection as an added benefit of using their services. For many people, being able to connect to a free internet on the go seems ideal. This would be particularly useful for the traveling business person, now able to access their work emails or share documents online.
However, there are more risks to using public WiFi hotspots than many internet users might have realized, and most of those risks are related to Man in the Middle attacks.
Man in the Middle attack
A Man in the Middle (MitM) attack occurs when a malicious actor manages to intercept the communication between two parties. There are various types of MitM attacks, but one of the most common is to intercept a user’s request to access a website, sending back a response with a fraudulent webpage that looks legitimate. This may happen to pretty much any website, from online banking to file sharing and email providers.
For example, if Alice tries to access her email and a hacker manages to intercept the communication between her device and the email provider, he can perform a MitM attack, luring her into a fake website. If the hacker gains access to her login and password, he could use her email to perform more malicious actions, such as sending phishing emails to Alice’s contact list.
Therefore, the Man in the Middle is a third party who is able to intercept the data sent between two points, pretending to be a legitimate intermediary. Usually, MitM attacks are performed to try and trick users into entering their sensitive data into a fake website, but they can also be used to merely intercept a private conversation.
WiFi eavesdropping
WiFi eavesdropping is one kind of MitM attack where the hacker uses a public WiFi to monitor the activities of anyone that connects to it. The information intercepted may vary from personal data to patterns in internet traffic and browsing.
Typically, this is done by creating a fake WiFi network with a name that seems legitimate. The fake hotspot name is often very similar to the one of a nearby store or company. This is also known as the Evil Twin method.
For example, a consumer may enter a coffee shop and realize that there are three WiFi networks available with similar names: CoffeeShop, CoffeeShop1, and CoffeeShop2. The chances are that at least one of these is a fraudster’s WiFi.
Hackers may use this technique to collect data of any device that establishes a connection, which eventually allows them to steal login credentials, credit card information, and other sensitive data.
WiFi eavesdropping is just one of the risks associated with public networks, so it is always preferable to avoid using them. If you really need to use a public WiFi, make sure to check with an employee whether it is authentic and secure.
