How do I recognize or prevent using a malicious WiFi network?

Question

Suppose I unknowingly connect to a malicious WiFi-network. I want to visit my bank's website. When entering its domain name (or clicking my bookmark), my laptop does a DNS request. My requests covertly gets resolved through some rigged DNS server which was fed to me by the WiFi. So my browser and I think we're connecting to my bank's website but in reality I'm visiting a spoof site.

How do I detect this, and how do I prevent this? VPN? Making sure I only visit https/SSL sites (which would be typically the case with banking) and checking my browser's green padlock and not ignoring any certificate warnings? DNSSEC (how)? Not using public WiFi networks at all?

Answer 1

Not using public WiFi networks is of course the best solution =)

In case of public WiFi, you can use VPN to connect to your protected network to be sure, that no one is able to intercept your traffic. Your VPN should encrypt all traffic as well and your VPN client should check if the VPN server, you are connecting to, is not a rouge one. You can use openVPN for this purpose.

Answer 2

Public WiFi is essentially unsafe. And if there is a possibility to avoid it, do it. Visiting HTTPS/SSL Sites is a good start, it gives some reassurance. Using a VPN to protect your requests is also beneficial. Valery mentioned OpenVPN which I use myself and can confirm it works. Or you can use Tor like browsers, which provide increased anonymity and encryption. If you NEED to use any bank accounts, make sure you have 2 or 3 step verification. That way even if some information gets leaked, without physically being there, they can't get in. Or if you are extra paranoid, you can have a traveling bank account that contains limited funds, although that is a little bit silly, I have seen people do that.

Answer 3

A public WiFi is not much different than using any other Internet Service Provider. And the question to ask is always the same: can I trust this enough for that action?. The real answer then depends on a lot of parameters:

• the sensitivity of the data exchanged - the bank website is sensitive
• the WiFi provider - large hotel companies can probably be trusted, they would not like being involved in fraudulent bank sites, and should be able to secure their WiFi access, unsure for smaller organizations
• the security of the SSL handshake: if you control that the domain in URL address bar is the correct domain and your browser validates the certificate, you should trust the connection - I do not even imagine that you could not use HTTPS...

IMHO a VPN adds little security per itself. If you think that the WiFi hotspot can fake your bank web site, why could not it fake a public VPN (*)? It would be certainly different for a corporate VPN, because strong authentication is normally required between the client and the server and a MITM attack is likely to be detected by at least one part.

---

(*) If you are used to securely control that you are connected to the correct VPN entry point, you should be able to trust the connection too. What I mean is that using a VPN you are not used to will add no security because it could be faked, without you being able to detect it.