2

The title basically says it all, but I'll provide a hypothetical for clarity.

Bob is on vacation and needs to check his bank account. He logs into his bank's website using a username and password on the hotel's public, wireless connection. Alice is monitoring the network, and can intercept this information and use it for malicious purposes.

But what if Alice doesn't arrive at the hotel until a week after Bob has been there? With enough poking around, could Alice retrieve the username and password Bob sent a week ago?

Do various factors, such as being on a wired connection, using HTTPS (which I certainly hope a banking website is), or using a VPN/TOR affect this?

Note: While I have a formal education in computer science, I'm relatively new to the information security scene, as well as the SE community (this is actually my first post!) So please bear with me, any comments or advice is appreciated.

3
  • Basically using any form of public network is very risky. VPN in this case would make it a lot safer. TOR would be rather opposite as it's form of public network so it's like public wifi (google Exit Nodes Security). And that VPN would have to use user certificate for authentication because VPN can be spoofed as well (so it accepts any password). On public WIFI or public LAN there are numerous possible attacks to trick you thinking it's real banking website while it's not. DNS attack, ARP attack, rouge SSL certs.
    – Aria
    Aug 3, 2016 at 1:06
  • If anything would have to be left at the hotel it would be rouge router, rouge sniffer (LAN, WIFI) or other rouge system which did actually planted malware into the Alice PC. So because of that it's best to have firewall fully enabled on any public network. However if there wasnt any rouge network devices there would not be anything stored. HTTPS data is not cached by proxies, same goes for passwords. Cookies usually expire also very quickly. However, if there was unprotected cookie passed as argument, it could be potentially stored until proxy logs are rotated, however this is rarely practice
    – Aria
    Aug 3, 2016 at 1:07
  • @Jedi I'm mostly concerned with individual malicious attackers. I'd imagine even if big corps or government agencies obtained Bob's bank login info, they wouldn't do much with it. The "assume everything is being collected" mindset is one I've had ever since my spark of interest in Info Sec.
    – egeisler
    Aug 3, 2016 at 2:25

1 Answer 1

1

To answer the stated question- if Alice doesn't arrive at a hotel until a week after Bob has left- or, really, if she arrives at the moment just after Bob finishes his sensitive business- then it is unlikely that whatever nefarious activities Alice undertakes- in the context of targeting guests- will compromise Bob.

Schneiers first law notwithstanding, it would be unusual for a hotel to be capturing and storing traffic, and it would also be unusual for Alice to target that particular repository of data, should even she know of its existence. People currently at the hotel are going to be much more interesting targets, as their presence offers more opportunities to enable them to be compromised.

Phishing in general is far and away the most common method of compromise, and most compromises that occur are, from the perspective of the attacker, simply opportunistic commercial transactions. Guests staying at a hotel can reveal a lot of information about themselves that can be employed to convince them to open an email with an appealing and seemingly trustworthy offer- one that perhaps even appears to have been sent directly from hotel staff. Not to belabor the metaphor but hotel ponds are well stocked.

Of course, sensitive information about Bob will be stored in the systems the hotel uses to conduct its business, which include software to store and manage payment data as well as guest contact information, preferences and any notes made about their stay by hotel staff. Should Alice target and compromise these systems then Bob's information would be exposed to her.

On the general topic of hotel hygiene- for all intents and purposes, internet services at a hotel are like other shared services like pools and restaurants- amenities targeted to a captive audience. Cleanliness, quality, and other attributes are not necessarily competitive requirements. Internet services are no different.

Hotels have also always drawn elements looking to take advantage of guests- who are unfamiliar with the area, who aren't staying long, who have schedules and logistical constraints that prevent them from following up on inconveniences, and who on vacation often have their guard down.

Of course, you are not likely to be robbed at a large hotel in a major US city, and you are similarly not likely to have your credentials stolen. But if you are inclined to take precautions, you are not crazy for doing so.

From a practical perspective:

  • If you have a sensitive service provider who for some reason does not require https, find another service provider
  • If you travel and frequently have to do business over public or hotel wifi, for email and other sensitive accounts find providers who support 2FA https://twofactorauth.org/
  • If you have to check credit card or bank accounts from a hotel and don't have 2FA and you are worried about it, prefer getting a network connection from your phone by tethering over using the hotel network, either wired or wireless. It likely doesn't make a difference in any specific case, but generally speaking cell data networks are more safe.
  • Tor and VPN are not better than https on the specific issue of protecting credentials. All of those tools protect the content of your communications. What Tor and VPN also do is prevent someone monitoring network traffic from knowing whom you engaged with in those communications. With https, someone watching network traffic can tell that you had a session with Bank of America that started at 2pm and lasted for 15 minutes, though they can't tell what credentials and other data you exchanged. With VPN, someone watching network traffic can only tell that you connected to your VPN provider at 2pm, not whom you communicated with over the VPN. Only your VPN provider knows that. And with Tor, outside of state actors, no one monitoring the network has any idea what you did.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .