These days there are a lot of public places that offer Free Public Wi-Fi. You go to the mall or any coffee shop and scan the available Wi-Fi connections you may see several free public Wi-Fi connections. In the Philippines where mobile signal quality sucks a lot, it's not uncommon for a lot of people to connect to free public Wi-Fi.
I personally don't connect often to public Wi-Fi networks since I mostly rely on my mobile plan. There are times though that I feel the need to connect to public Wi-Fi specifically when my mobile signal is weak or when it's unstable with mobile internet slow as a snail. When I do connect to public Wi-Fi, I would skip those that don't have password protection. Plus, I used a VPN connection to encrypt my browsing.
I have a written a blog regarding phishing and its different forms and decided to expand further on the topic of Public Wi-Fi Safety. My purpose is to provide important information to users of public Wi-Fi on what the potential risk are and ways of protecting your device and your digital identity.
How do cyber criminals take advantage of the Public Wi-Fi? There are several ways for a cyber-criminal to take advantage of a public Wi-Fi. Two of the most common and dangerous are listed below:
Man-in-the-Middle-Attacks (MITM) - In this type of attack, hackers intercept the communication between your device and the intended server. They position themselves between your device and the public Wi-Fi hotspot, allowing them to eavesdrop on your data, steal sensitive information like login credentials, or even inject malicious content into the communication.
Rogue Hotspots - Cybercriminals can set up fake Wi-Fi hotspots with names that seem legitimate, like "Free Airport Wi-Fi, Coffee Shop Wi-Fi." Unsuspecting users connect to these rogue hotspots, allowing hackers to monitor their traffic and potentially deploy attacks. These fake Wi-Fi are dangerous because they mimic a real Public Wi-Fi server. Be mindful when you connect to a public hotspot and avoid entering sensitive information like email and social media account names.
Packet Sniffing - Hackers can use packet sniffing tools to capture unencrypted data transmitted over the network. If the data isn't encrypted, they can extract valuable information from it, including usernames, passwords, and personal messages.
How to protect your digital identity and your sensitive information when connected to a Public Wi-Fi? I listed below some things that a public Wi-Fi user can do as safety precautions.
Use secure networks - Whenever possible, use secure public networks with network encryption. Avoid open networks that don't require a password, as they're more vulnerable. Using Wi-Fi hotspots protected with encryption adds a layer of protection as user browsing data is encrypted.
Use a VPN - A Virtual Private Network (VPN) encrypts your internet connection, making it much more difficult for hackers to intercept your data. This is one of the most effective ways to secure your connection on public Wi-Fi. VPN is one of the most useful tools to hide your digital identity from would be cyberattacks. Even if the public Wi-Fi is password protected hacker's might still be able to breach this and having your own private VPN connection means your browsing data is secured and your digital identity protected.
During an MITM the hacker mask the cyberattack by emulating the public Wi-Fi router thus fooling your phone or computer into connecting. The second phase is for the hacker to trick the real public Wi-Fi router that his device is the customer phone or computer that is already connected to the network. Once the hacker established connection at both ends - the user and the router he can view browsing data and any information that is accessed by the user.
Packet Injection - Malicious packets could be uploaded to the target device. An example of this could be a malicious APK that targets Android phones. Once a malware is uploaded to your device if can wreak havoc and could steal sensitive information without the user knowing.
Session Hijacking - When you browse a site like your bank's website, the banks server would generate a session token. It's like a key that is assigned to you by your bank so as to authenticate your session. However, if the hacker's gets hold of your session token it could use the stolen token to transfer funds or worst case clean your bank account dry. This is one of the reasons why majority of the banks implement a timeout whenever we do some banking transaction online. It kind of detects if there is any pause in the transaction and invalidates the session once the timeout is reached forcing the user to repeat the authentication process thus invalidating the previous session token.
Avoid Wi-Fi auto-connect - Disable your device's auto-connect feature for public Wi-Fi networks to prevent unintentional connections to rogue hotspots. I think is one of the most basic fails that would allow a cyber-attacker to hack our devices. Only enable auto-connect to Wi-Fi network that you trust like your home or work network.
Keep your device OS updated - There are two types of software updates - Feature and Security updates. If you have received a notification from your phone or laptop for an important security update, please do an immediate update. Security updates usually includes security patches to recently discovered vulnerabilities on the OS. Windows and IOS routinely release periodical security updates. For Android devices, this is somewhat problematic, as the there are numerous Android OEMs who are responsible to push the updates and few of these OEMS can guarantee of at least 3 years of software updates.
Illustration of Man in the Middle Attacks
Once the attacker gained some access to your device either thru MITM or Rogue Hotspots, he may do some further damage by initiating further cyberattacks listed below:
Avoid any financial transaction - When connected to a public Wi-Fi network it's important not to take risk and do a form of financial transaction that a hacker might take advantage of. If you do need to update your account or transfer money online do connect to a trusted Wi-Fi network or use mobile data. Better yet use a trusted VPN provider to shield your online activities.
If you're still unsure and feel that you may need additional security and online threat protection. The best way to achieve this would be to secure your digital device/s by means of Trusted Security Providers like Kaspersky, Bitdefender, Norton and other AV brands. These brands do offer some form of internet protection security packages that might include VPN which should be a good deal.
