I travel a lot. When I am away from home, I connect to the internet using a mobile hotspot provided by a major ISP in the US. I am the only one who uses this computer and this hotspot, both of which I own.

Assuming my ISP has not been compromised how hard would it be for an unsavory person be able to intercept or view my internet traffic? Are there any ways to make the system more secure?

  • Are you using a phone as a hotspot here? – undo Oct 19 '16 at 3:12

Part of your answer depends on how your ISP allows you to connect to the Internet.

First consider the security of the device itself.

From the ISP side facing the Internet: If your hotspot is given a public IP address either permanently or temporarily it would be susceptible to attacks from the Internet, and while on-line it would likely get indexed in major vulnerability scanning projects like shodan.io or scans.io at some point (Note: you may be able to find similar devices like yours on sites like shodan.io). Likewise during these times your hotspot was on-line it could potentially be susceptible to attack, especially if no one is regularly going through efforts to secure it.

A quick way to check your security would be to determine your own IP when using the hotspot then perform remote testing against the IP in use and check to see if there are any signs that you can connect to it directly (insert long conversation here). Please note depending on where you live it may not be legal to test this either.

From the wireless side: This will vary a bit more based on the protocols both in use at the time and also the protocol supported by the device over all. You may access it using a more modern cipher in a secure fashion but the device itself may support many weak protocols which may enable an attacker to perform brute force attacks to access it. More importantly a LOT of these devices support web servers on their internal wireless network which could easily be attacked. Finally since the devices TCP/IP kernel is essentially accepting wireless connections from anyone around you it could also be attacked directly (this is far more difficult to do but it is a distinct possibility).

Second, consider how you are using it. What protocols does the device use to connect to the ISP ? are these secure ? does it fall back to insecure protocols when it can't connect to it's primary connection ? Does the device support roaming ? Similarly what protocols do you normally use to connect to it, could your connection be downgraded by an attacker, what's the weakest protocol supported, and do the weaknesses in the worst case scenario allow for an attacker to be able to sniff your traffic ? Do you trust the firmware of the device ? The software ? Where it calls home to ? All the protocols it uses ? Does your ISP track and monitor your connections and things like DNS requests ?

Third, how do you verify you are actually connecting to your device first ? Is it possible that someone nearby with a wi-fi pineapple could be intercepting your traffic then forwarding it on ? Do you verify that you are connecting to the correct device each time ? Do you have any type of certificate authentication in place ?

Basically, the security of these devices are not ideal especially if they don't receive regular security updates from the ISP (rare at best). That said they may not be much worse than any other random wi-fi connection you use anywhere else. If you have serious security concerns you should assume the worst and simply think of it as part of the untrusted Internet and leverage things like VPN's to minimize the risk where possible.

There are many other components about a secure connection that I am not including here (long conversation) but this will help you assess the risk areas and some of the attack surface for such a device.

|improve this answer|||||

as it seems you are conceerned about security you should have opt for WPA2 psk as security mode while creating hot spot . if you have ,you are quite secure

the WPA2 psk uses strong encryption algo AES so possibility of interception is low , more over keys are derived per session so passive attacks are difficult..

the attack you are open to is EVIL TWIN : some one may spoof your SSID

and one more possibility is to apture tour wpa handshake and bruteforce tour PSK

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.