According to a study conducted by the Kaspersky Security Network, nearly a quarter of the world's public WiFi hotspots don't use any kind of encryption. For data safety purposes, it is critical to ensure the WiFi network you are connecting to is encrypted. However, several other risks can still lead to problems even if a hotspot uses encryption.
Many Users Are Unaware of Public WiFi Risks
Walk into any coffee shop during the week and you will see patrons typing away on laptops at most of the tables. Many business people, students, and entrepreneurs treat these locations like a second office.
Most users working on public WiFi have a lot of important, and possibly sensitive information on their devices, some of which could cause serious harm if a hacker gets a hold of it. Unfortunately, the majority of public WiFi users likely don't realize the threats they face.
If you want to stay safe while using public WiFi, you need to know what the potential threats are. To provide you with the tools to work as safely and securely as possible in public spaces, we developed a list to help you identify 7 dangers of public WiFi and what you can do to protect yourself.
1. Theft of Personal Information
One of the most serious and common threats concerns theft of personal information. Personal information comes in many forms:
- Login credentials
- Financial information
- Personal data
If a hacker gets access to your computer or other personal devices through a compromised public WiFi connection, they could have free rein over everything stored. For example, they might get access to your login credentials and log into your bank's or credit card's website.
Once hackers obtained your details, they can log in to your personal pages and cause damage to your finances and reputation. If they don't get full access to the data on your computer, they could still intercept information you are sending over the Internet. This threat will be explored in more detail shortly.
2. Cyber Attacks on Businesses
Business travellers and others who are on the road throughout the day may connect to public WiFi to check their emails, download files, review customers' information, and perform various other tasks that require a network connection.
Most businesses have security measures in place to reduce the risk of connecting over WiFi, but if you or your colleagues need to log into some sort of security tool to get access to the company's network, there are still risks with using a public connection.
For instance, you never know what the WiFi provider might track. A lot of public connections are free to use but that does not mean there is not a cost involved. The WiFi provider might be tracking everything you do on the WiFi connection and sell your data to advertisers.
A good way to think about it is if you are not paying to use a service, someone else might be paying them for data about their users. You also cannot always assume you are connecting to a legitimate WiFi service, which brings us to the next potential threat.
3. Man-In-The-Middle Attacks
A man-in-the-middle attack happens when someone "impersonates" a legitimate public WiFi service to trick you into connecting. For example, say you are staying in a SleepTight hotel for the night. The hotel offers free WiFi to its guests so you power up your laptop, turn on WiFi and see a network called "SleepTyte". If you are not paying close enough attention, you might miss the slight misspelling.
In fact, the SleepTyte network is actually someone in a room down the hall who has their own hotspot set up to lure unsuspecting guests. When you connect to it, the Internet works as expected so you would not think twice. But in reality, everything you do while on that connection goes through the hacker's computer. Those "men-in-the-middle" could have access to all your login information, passwords and anything else you do while on that WiFi connection.
4. Unencrypted Connections
When you connect to a website that supports encryption, the data that goes back and forth gets encrypted using a secure key. If someone were to intercept that data without the possession of the key, they wouldn't be able to read it - the data would look like unreadable computer code.
Not all websites offer encryption though. You can tell by the HTTP prefix stated before the domain name. If it starts with HTTPS, it is an encrypted site. If the web address just contains HTTP, it is not encrypted.
When you are connected to a public WiFi network, anyone within range of your computer can intercept everything you send or receive. If you are connected to an unencrypted website, it will all be fully readable. How can someone intercept your network communication? They use the next listed threat.
5. Packet Sniffing / Eavesdropping
Anyone connected to the same WiFi network as you can eavesdrop on what you send and receive using a tool called a packet analyzer or packet sniffer. These tools provide the possibility to view everything transmitted over the WiFi network, provided it is not encrypted.
These tools are not inherently bad. Like many tools, you can use them for good or bad purposes. Packet sniffers let network administrators troubleshoot connection problems and other performance issues with their wireless networks (good). On the other hand, they also let hackers intercept other users' information and steal anything of any value (bad).
6. Malware Distribution
Another threat that can occur while using public WiFi, is the implementation of malware on your device. Malware exists in many forms:
- Trojan horses
If someone on the same public WiFi as you has bad intentions, they could plant malware on your computer if it is not protected properly. A suspect WiFi provider could use the hotspot itself to infect your computer with one or more of these threats.
It could be as simple as using the WiFi network to place ads on every website you visit. The website itself does not run ads, but the WiFi service can overlay them on top of other websites.
In that case, the ads would normally disappear once you disconnect from the WiFi and go back to your home or office connection. In more serious cases, they could install malware on your personal devices that would persist across all connections.
7. Session Hijacking
Session hijacking is another public WiFi security threat. In this case, an attacker intercepts information about your computer and its connection to websites or other services. Once the attacker has that information, he can configure his own computer to match yours and hijack the connection.
For example, hackers could hijack your connection to your bank's website after you log in. From the bank's end of the connection, it would look like your computer and since you are already logged in, the attacker would have access to everything in your account.
How to Protect Yourself From the Dangers of Public WiFi
If you need to use public WiFi, there are several things you can do to help protect yourself from these threats. Some are more effective than others, but it is good to keep in mind that hackers usually aim for the path of least resistance. If you have taken steps to protect yourself, they will more than likely move on to an easier target.
Don't Share Anything Private
Firstly, if you have to connect to a public WiFi network with no protection measurements in place, make sure not to share anything private or log into any sensitive websites. Keep your browsing to a minimum, do not check your email or any other messaging services, and disconnect from the public WiFi immediately once you find the information you need.
Use a VPN Service
A virtual private network, or VPN, service encrypts everything you send and receive over a WiFi network. It gets encrypted regardless of whether the WiFi network or website you are accessing supports encryption.
With a VPN, you connect to the VPN server over an encrypted connection and everything you do gets routed through that server. Anybody trying to eavesdrop or intercept that information will not be able to read it anyway.
Use 2-Factor Authentication
Many websites that deal with sensitive information use a security feature called two-factor authentication (2FA). This is a secondary authentication method working alongside your password.
It uses either a specialized app on your smartphone, such as Google Authenticator, or text messaging to send you a unique code after you enter your username and password. If a hacker manages to steal your login information, they still cannot log in without that 2FA code.
Use Cellular Data or a Mobile Hotspot
The safest way to avoid public WiFi security threats is to avoid it in the first place. Instead of connecting to public WiFi when you need to get online, use a cellular data connection or a portable hotspot, such as the Goodspeed 4G mobile hotspot.
These methods give you a private connection that is much more secure than using a public connection. In many cases, it will be quite a bit faster as well since you are not sharing the connection with anyone else.
Some smartphone models support dual SIM cards providing the opportunity to add an additional SIM card. Solutions such as Goodspeed GO can be used to establish a secure connection without having to carry an additional hotspot with you while travelling.
Avoid Letting Yourself Get Complacent
It is understandable that the convenience of using public WiFI is sometimes hard to pass upon. However, the dangers of public WiFi should make you think twice about using them, at least for any type of sensitive information. Make sure to not let yourself get lured in.
With Goodspeed's personal global Internet services, you can use the Internet globally in a convenient manner without the risks that can occur while using public WiFi. Take a look at what we have to offer and reach out to us if you have any questions. We gladly help you get set up with a fast and secure connection if you want to leave public WiFi and its associated risks behind.
- Zara & Michael @UROS