The risks of using public wi-fi and how to minimise them

The list of significant risks associated with using public a WiFi network is lengthy. Cybercriminals eavesdropping on unsecured networks steal sensitive data including account login credentials. Bad actors often use public Wi-Fi to distribute malware to connected devices. Some public Wi-Fi hotspots are actually set up by criminals to closely resemble legitimate networks and trick users into connecting. Once they do, their credentials can be sniffed, devices can be infected and their sensitive data can be stolen.

While you can never be completely safe when using a public WiFi network, understanding the risks and taking the steps to minimise them will help you to better secure your devices and data while connected to one of these shared often unsecured networks.

Man-in-the-middle, snooping, and sniffing attacks

Man-in-the-middle (MitM) attacks are fairly common on public Wi-Fi networks. When you're online, data is being transmitted from, and received by, your device. In a MitM attack, a cybercriminal connected to the public network can leverage known vulnerabilities to position themselves between your device and the sites you visit and intercept and read the data in transit. This data could include sensitive information like account login credentials and payment card information.

Snooping and sniffing attacks are similar to MitM attacks. Developers of malicious eavesdropping software applications create ready-made tools that criminals can purchase on the Dark Web and use to spy on users of public Wi-Fi. These malicious snooping kits allow data thieves to "see" what Wi-Fi users are doing and what sites they visit. Bad actors can intercept account login credentials, see what information their targets are entering into the websites they visit (like payment card details), and gain access to their victims' online accounts by stealing their credentials.

Malicious Wi-Fi hotspots

Criminals will set up rogue hotspots broadcasting names similar to those of legitimate networks in an attempt to trick users into connecting to them. Perhaps, for example, you are traveling and decide to stay the night at a Hotel, We will call the the hotel “sleepy head hotel” . When you attempt to connect to the Hotel’s WiFi network, you see the network name and connect to it without noticing that the first character in the name is the number 5 rather than the capital letter "S." You've now connected to a malicious hotspot that will allow an attacker to monitor all of your traffic and steal sensitive data.

Using public Wi-Fi to deliver malware

Cybercriminals exploit known software and operating system vulnerabilities to install malware. (Are your computers patched and fully up to date?) Devices with these vulnerabilities that are connected to public WiFi networks are especially susceptible to infection. Attackers either develop or buy malicious code that allows them to deliver malware to these vulnerable devices via an unsecured WiFi network connection

Unencrypted free Wi-Fi hotspots

Encryption encodes the traffic in transit to and from a device on a network. With encryption, the data you share with the sites you visit cannot be read by criminals if it is intercepted. The problem is that you cannot be sure that the public Wi-Fi networks you use are encrypted. Encryption is typically turned off by default on older equipment so don't assume the network is secure. This means that, unless the public WiFi network is set up by someone who knows that encryption must be enabled along with host isolation (restricting internet users on the same WiFi network from seeing each other), it's unlikely that it will be. This will leave network users' data unprotected.

What not to do when using public Wi-Fi

Here are some actions you should avoid while connected to public Wi-Fi networks:

•   Do not connect to free public Wi-Fi networks that are not password protected. Being required to obtain a password from the free WiFi host at least helps to ensure that the network is legitimate and is less likely to be used by bad actors seeking to steal information or deliver malware.

•   Do not allow your devices to automatically connect to available Wi-Fi networks. Allowing auto-connect lets your devices join networks that may be those created by malicious actors or networks that are monitored by cybercriminals looking for opportunities to deliver malware or steal information.

•   Avoid leaving your Wi-Fi and Bluetooth connectivity turned on when you're not using them. Leaving these connectivity options on leaves your devices vulnerable to attack.

•   Unless you are using a virtual private network (VPN) application, you should never use public Wi-Fi to access sensitive, personal data. This means you should never log into accounts like those where your financial or healthcare information is stored.

•   Don't allow apps to automatically log into sites and access sensitive information. If you must use public Wi-Fi to log into a site, go directly to that website and make sure it is using the secure HTTPS protocol. If it is, log into the site directly. The use of HTTPS is indicated by the presence of a locked padlock icon to the left of the site's URL in the address bar. Also consider the use of a virtual private network.

VPN and other recommendations for safe public Wi-Fi use

The best way to ensure that your data is safe while using public Wi-Fi is to install and use a VPN app on your device. Among other benefits, a VPN creates a secure tunnel connecting your device to the sites you visit. The VPN encrypts all of the data in transit to and from your device via that secure tunnel ensuring that, even if it is intercepted by a bad actor, it cannot be read.

A quality VPN is easy to use and should not noticeably impact your data transfer speeds. There are some free VPN options available, but do your research and read comments and complaints before choosing a VPN service. They often lack the infrastructure to support the traffic they receive, leading to slower speeds and periodic service disconnections. Some have even been found to be tracking their users' online activities. It’s vital therefore to research the available options and ensure the the provider is reputable and aligns to international cyber security standards.

Other ways to stay safe while using a public Wi-Fi network include:

Double checking you are connecting to correct network

•   Disabling file sharing on your device

•   Only visiting sites that use the HTTPS protocol

•   Making sure you log out of your accounts when you're no longer using them

Summing up...

Unsecured, free public Wi-Fi networks are inherently unsafe. If you must use public Wi-Fi, implementing the recommendations provided herein will help you to protect your information. Remember that the best way to ensure that your data is safe is to utilize a quality VPN application. Protecting yourself from attack and identity theft is critically important.

If you would like to lean more about how to protect your business and employees from cyber crime, please book a meeting using the link below.