Hacking demonstration

Question

We are thinking about giving an awareness live demonstration in the company I work for. The general idea is to show the users how can they be hacked while connected to a public wifi spot such as a coffee shop, conference, etc. We have thought about:

• Using a rogue AP
• ARP spoofing
• DNS cache poisoning

Can anyone suggest other attacks/ways of better tacking this demonstration? We want the users to better understand the impact of connecting both personal and corporate devices to public/unknown networks.

Answer 1

In practical terms there are three threats I'd be worried about:

1. Passive monitoring by network owner/other users on the network
2. Direct exploitation by network owner/other users on the network
3. Active man-in-the-middle attacks such as Karma and sslstrip

If you haven't already, I'd recommend simply adding Wireshark to your demonstration, and showing a capture of someone logging into a website over HTTP (if you can find one, or create one). This will show how trivial it is to sniff sensitive information from a shared network if the connection isn't encrypted.

For threats #1 and #3 above, a good trusted VPN service (e.g.Encrypt.me or NordVPN) will mitigate these risks. For #2, keep your devices and applications up-to-date.

However... I'd argue that there is a bit too much hysteria about the risk of using public WiFi.

Most of the legitimate concern about public WiFi began because of #3, particularly before HSTS became a thing. Back then it was possible to use sslstrip against major banking sites and other valuable services (Google, Facebook), and the only real mitigation was "don't join non-password-protected WiFi networks", or to use a trusted VPN at all times. Now that HSTS is available this is much less of a problem (for those sites which support it), although it's still a good idea to use a trusted VPN if you're worried about local MITM attacks of this sort.

For most users, #1 is a non-issue as the services they're worried about would be using HTTPS. The major exception is that DNS requests are still in-the-clear in most cases (users might not want someone on their network knowing that they're making DNS requests for pornhub.com). A trusted VPN will solve this problem.

Direct explotiation (#2) is also a non-issue for most users unless they're using very outdated software (i.e. running unpatched Windows 7 or an obsolete Android device), or unless their threat model includes attackers with 0-day remote code exec exploits (if this is the case, they likely have bigger problems than connecting to public WiFi).