Have you ever been out somewhere and wanted to connect to a wireless network with your phone or laptop, only to be overwhelmed by the number of signals you find? The use of wireless exploded in the early 2000s as equipment got cheaper and simpler to set up. Nowadays, if you’re in any city you’re likely to see at least 10 wireless signals nearby, and very possibly more. While the majority of them are probably secured and unusable unless you know the password, there are still a few out there that are wide open for use.
That’s a good thing, right? Free internet sounds good to me! Especially if I’m not at home and wouldn’t have my connection otherwise!
Not so fast.
Networks that are left open are usually the result of someone who doesn’t know about wireless security, but this is a lot less of a problem in recent years as the hardware often has security already enabled. However there are some truly “public” networks available. Think Starbucks, or McDonald’s. Places like this may have free internet access, but there are some things to learn before you decide to connect.
What are the risks?
Open networks aren’t secure, by design.
An open network isn’t only open to you, and it’s definitely not only open to someone who has your best interests at heart. Anyone can connect, and anyone can see the wireless signals (which are actually radio waves) passing through the air. I’ll go into some details on the actual attacks that can be performed later, but for now the key to remember is that if a network isn’t secure, you aren’t secure. This isn’t necessarily a bad thing, if you’re sure that you’re connected to an actual legitimate network, and you’re careful about what you browse while you’re connected, but there are still many things to watch out for.
It’s also possible for a network to be “spoofed”, which means that despite the network being the same name as what you’re used to, it’s actually a fake network owned by an attacker. It may even act as a completely normal wireless network, with normal internet access. With this method, the attacker can see every bit of traffic that passes over their equipment.
Many modern devices use automatic connections.
There’s a good chance that if you take your smartphone out at home, it automatically connects to your home wireless. The problem is that this carries over to ANY wireless connection you use, not just your own. If you are near a network with the same name as one you’ve connected to previously, and it has no security enabled (or the same security as yours, though that is much more unlikely), your phone will connect to that one as well. The upshot of this is that your device is now online, and most mobile devices will do things like checking your email and Facebook when they see an internet connection. This means traffic, which an attacker could see and use given the right circumstances.It’s important to note that this doesn’t only apply to smartphones – tablets, laptops, and pretty much anything else that uses wireless could run into the same security issues.
There are many options for “free” WiFi, especially in bigger cities…
…and some of them have a glaring flaw: they’re designed to be fully automatic. If you’ve been to a store or restaurant that used AT&T, you may have seen a network called “attwifi”. This is a service provided by AT&T to put free WiFi in many places in the U.S., including McDonald’s and Starbucks stores, along with many others. Of course, as I detailed in the last few paragraphs, once you’ve connected to one of these, there’s a very good chance you’ll automatically connect to any others your device sees in its travels. And if that network happens to be one that’s spoofed and controlled by an attacker? Then you might have trouble.
What happens when I connect to an unsecured network?
If you connect to a network with no password, it’s about the same as if your computer was shouting the information across the room to the wireless access point. A computer that is playing by the rules will only look at and answer frames meant for its own traffic, but anyone with the right equipment could theoretically “listen in” on your conversation, and if the things you’re doing aren’t properly secured in their own way (I’ll go into this later), they’d potentially get sensitive information without much effort.
Of course, it’s even easier if the attacker has set up a spoofed network. This allows them to perform a “Man-in-the-Middle” attack. Since they control at least one of the devices in between your computer and the internet, they can see everything that passes through – without having to bother listening to the wireless signals and sorting them.
What sort of things are at risk?
There’s a lot of data on the modern internet that is unprotected. Let’s just assume that you are connected to an open wireless network, and someone is listening in. What can they see?
- Any plain-text information is clearly readable. This includes most web pages, so someone could potentially figure out your browsing habits and form a more targeted phishing attack later.
- Unencrypted passwords, such as those used by certain older email servers. This is most commonly found when a smartphone automatically connects to the internet and then decides to check your email for you. If you’re using a non-encrypted POP3 connection to retrieve your email, your password is probably sent in plain view. Fortunately, most email setups are using encryption nowadays.
- Even encrypted traffic can have portions that aren’t encrypted – and sometimes it’s even the important bits. An example would be if a website has their credit card processing secured, but not the page where you log in with your password. Unfortunately this is entirely dependent on the website creators to design properly.
- Some attackers will even go so far as to create fake websites on their fake networks, that ask you for a username and password. If you put your credentials in here, instead of logging you in to the website, it merely gives the attacker your information.
There are other ways for data to be intercepted, and other types of data that can be seen, but the details of that aren’t really the scope of this post. Suffice it to say that there are security risks.
How can I keep myself safe?
- Simply enough, don’t do anything that would be unsecured on an open wireless network. This includes checking bank information and other things that have passwords you care about.
- If you don’t need to, avoid putting things like your smartphone on a public wireless network. You’re already most likely connected to 3G or 4G data service. If you’re in a place with a secure network, you’re probably safe, but even then you should exercise caution.
- Use a different, secure, password for sensitive sites. This way if someone does get a hold of your password on a certain website, they don’t have ALL your passwords.
- If you absolutely have to check something like a bank account or the like while on public WiFi, make sure that the site supports secure connections. This is usually found with a “https://” in the address line, and normally a padlock icon somewhere on the screen. Google Chrome also makes the left side of the address bar green when you are on a secure site. As long as the page is fully secure, even if someone was to intercept your traffic it would be encrypted.
- If you notice anything strange (like emails stating someone is trying to change your password), change your passwords immediately. This will prevent an attacker from doing any further harm, assuming you still have access to the account in question.
Well, another wordy column this week. Once again, if you have any questions, feel free to get a hold of us. I’d also like to note that this isn’t a comprehensive list of security risks – new attacks are happening all the time, and no list will ever be able to detail every little thing that could be discovered.