Security Threats of Public Wi-Fi - Is It Just Fearmongering?

The words "free Wi-Fi" displayed in public spaces are always welcome additions to the place's core function, regardless of whether it's a restaurant, coffee shop or train station. Even though surfing away free of charge in exchange for just entering a short password or your e-mail address might seem convenient, this simple accessibility also makes public Wi-Fi networks an ideal target for cybercriminals. Although there have undoubtedly been reports of ill-wishers leveraging the appeal of free internet, given the fact that millions of people still use public networks, it's a valid question to ask how likely it is to become a victim.

This article examines whether public Wi-Fi is as dangerous as it is increasingly portrayed.

The Dangers of Public Wi-Fi

Before we can reasonably determine how much of a threat public Wi-Fi poses, we must first consider the attacks that have been commonly reported in this context. The following paragraph lists the most common cybercrimes committed by attackers exploiting public networks.

 

Snooping

As the name suggests, snooping describes the phenomenon of a person eavesdropping on your online activity via a public network. Evidently, snoops these days have appropriated sneakier tactics than simply catching a glimpse of your screen from the other side of the café: Attackers on the network use special software on their own devices to monitor your private browsing while using public Wi-Fi.

While letting a snoop know you were reading up on the latest gossip on Taylor Swift might not seem like a huge deal, a genuine issue arises as soon as you enter any login credentials to a page requesting you to sign in. By doing so, the attacker doing the snooping can get a hold of your passwords and use them to access a multitude of your virtual identities, potentially leading to Identity Theft. 

Man-in-the-middle Attacks

The possibility of a Man-in-the-Middle Attack happening is another systematic risk associated with utilizing public Wi-Fi. This term describes the phenomenon of a third party, also known as a man-in-the-middle, intercepting the communication between two systems.

Picture this scenario as an example: You are sitting in the airport waiting room, patiently waiting for the boarding you begin. While scrolling through Zalando, you find a pair of sneakers that catch your attention and are ready to make a purchase. You sign in and fill out the delivery and payment information as usual. However, little do you know that a hacker has secretly positioned themselves between you and the online store, sneakily taking notes of the data only Zalando was meant to receive. Simply as that, not only has the man-in-the-middle learned about your login credentials, but also your address and credit card information. 

Evil Twin Attacks

As with man-in-the-middle attacks, "evil twin" attacks occur when malicious parties create fake access points with names that sound safe or familiar in the hopes that you would connect to them without batting an eye. For example, the hacker might name their created network “Burger King Free Wifi” to trick their victims into thinking they are connected to a seemingly trusted entity’s access point. Unlike the genuine counterpart, however, this “evil twin” is usually designed to monitor and collect users’ data, such as their login and banking information.

Malware and Viruses

One of the most well-known risks generally associated with accessing the internet is the potential for malware to be downloaded without your knowledge and consent. Sadly, this vulnerability persists while utilizing public Wi-Fi, much more so than when using a private network.

But how does using a free network result in the installation of a virus? Unfortunately, there are multiple typical methods hackers use to infect your device. In some cases, hackers exploit vulnerabilities in an operating system or software within the local network by writing codes specifically targeting these shortcomings. Alternatively, cunning attackers can hack the connection point itself, resulting in a pop-up window suggesting an update to a well-known software during the connection process (a.k.a Trojan Virus). Whichever method the criminal chooses, the victim will ultimately suffer the same repercussions: sensitive data theft, file deletion, and occasionally even device incapacitation.

How likely are such attacks?

Although public Wi-Fi networks certainly carry some frightening risks with a lot on the line, it is evident that such attacks aren't guaranteed occurrence. So how likely is it really that one will fall victim to a malicious network?

According to a study by Kaspersky Security Network, a quarter of the world's Wi-Fi networks lack encryption or password protection. This means that any individual near an access point can easily intercept and store all user traffic and then examine it for data of interest, making these networks the easiest target for hackers.

The remaining three-quarters of the analyzed networks use encryption based on the Wi-Fi Protected Access (WPA) protocol family, which is currently labeled the most secure. However, as we have repeatedly witnessed, nothing in the digital age is ever wholly safe:  As per recent research by Gao et al., standard practices for enhancing Wi-Fi security are not that effective when confronting today’s sophisticated, mature cybercrime market. According to the study, the majority (55%) of the detected attacks on public networks remain ad injections, which interestingly were more common on better protected Access Points (AP). Furthermore, even if the encryption keys guarding the network seem reliable, there is no assurance that a determined attacker will still not manage to find their way into the system.

To sum it up, while it is unlikely that every public Wi-Fi you will ever connect to will harvest your information, an attack on the network can happen anywhere and anytime. So, does this mean you should never use a public network again? Not necessarily. However, it is advised to follow some simple safety guidelines to ensure that the criminal does not have the last laugh in the case of an attack.

Minimizing the Chance of an Attack

If you would like to drastically minimize the likelihood of being hacked while using public Wi-Fi, we recommend taking the following few precautions for your safety.

Make sure you are on an SSL-certified Website

Another simple practice that can help minimize attacks is ensuring the websites you visit (especially on public WiFi) are SSL-certified. Typically, a URL beginning with "HTTPS://" and a lock symbol to the left of it will indicate this certification. While the visible difference between an HTTP and an HTTPS domain is just a single added letter, this slight change has a huge impact when it comes to the safety of a site: In contrast to HTTP, HTTPS protects your communication by encrypting it between browser and server and utilizing TLS to validate the other end of the transaction.

While the exclusive usage of sites with properly enforced HTTPS is undoubtedly a step in the right direction, it is worth noting that its protection measure is not free from exploitable vulnerabilities. For example, you could still find pictures or scripts from websites not secured by HTTPS, even if you visit an SSL-certified site.

Use a VPN

Generally, the best course of action when utilizing a public network is to avoid logging onto any platform that stores sensitive information. If you must, however, it is strongly advised to use a virtual private network (VPN) to encrypt the traffic, regardless of the type of device you are using.

Virtual Private Network (VPN) software provides privacy by encrypting all your incoming and outgoing traffic, no matter where you are located and which network you use. This protection is achieved by the VPN hiding your internet protocol (IP) address from the public. Accordingly, with the help of additional encryption of all data traffic, a VPN router is an optimal way to prevent third parties from unwantedly accessing private information shared via a public network.

Enable MFA or Passwordless Authentication

Even if a hacker manages to obtain your login credentials, having Multi-Factor-Authentication (MFA) activated on your profile should thwart their attempt to access your account. By requiring one or more additional login factors (for example, biometrics or a code sent via text message), MFA makes it harder to access a profile with a password only. As a result, you will immediately get notified if someone has attempted to log into one of your virtual identities.

An even safer alternative to MFA would be enabling Passwordless Authentication on any platform that offers this option. Although both methods undoubtedly surpass traditional password-based logins in terms of security, passwordless systems are even less susceptible to phishing and cyber-attacks due to their complete waiver of passwords. 

Further Protection Measures

While using technological safety precautions created to assure the highest level of device security is crucial, we shouldn't undervalue the effectiveness of seemingly obvious but strong alternative solutions. Here are some other measures you can take to protect yourself from the risks of public Wi-Fi:

• Avoid using networks that are not password-protected – Even though Wi-Fi codes are generally easy to obtain, unprotected networks are generally an easier target for hackers.
• When not in use, turn off your WiFi – Keep your WiFi connection off unless you are actively on your device using the internet.  
• Refrain from using sites that require you to log in – Especially ones storing sensitive information, such as your credit card information.
• Complete renunciation – While it might sound cliché, it truly is the only method guaranteeing 100% safety from the risks of public networks.  

In conclusion

While you might not fall over every time you go rollerblading, it is always helpful to wear protection-gear just in case. The same logic is applicable to using public Wi-Fi: Protection measures such as using VPNs, MFA or passwordless and exclusively visiting SLL-certified websites are designed to minimize the chance of cyberattacks while using public networks. Considering the evolving techniques of today’s mature cybercrime market, it is better to be safe than sorry.