Lets say I go to some hotel, the hotel has a WIFI network that requires as password and/or username to access. Can other hotelguests then see my wifi traffic if they are not logged in to the wifi, and can they see it when they are connected to the WIFI as a guest like me..but not as the network admininistrator (which CAN obviously see it)?
3
-
Fun listening: Tim Perry - HTTPS Is Not Enough.– VeedracJun 10, 2017 at 22:09
-
1Just a slightly offtopic side note: You usually can't be sure you are connected to the right network. Once you connect to one insecure network, you might have opted for autoconnect. What's worse, your device will cast names of such networks in order to find them. So, in many cases, some tool like Pineapple can be used to connect you to attacker's Wi-Fi without realizing it, no matter how much secure is the network you think you are connected to.– v6akJun 11, 2017 at 11:47
-
And even if you don't enable automatic reconnect, attacker can poison your webbrowser cache (e.g., load some JS over HTTP with distant expiration date), even on pages you don't visit.– v6akJun 11, 2017 at 11:55
Add a comment
|
4 Answers
Yes, if they know what they're doing. See https://www.howtogeek.com/204335/warning-encrypted-wpa2-wi-fi-networks-are-still-vulnerable-to-snooping/ for an assessment of the vulnerabilities for WPA2-PSK (the most common form of encrypted WiFi). If the hotel wifi network uses WEP, that's even easier to crack, and if it doesn't use encryption at all (open Wifi), it's trivial.
The only way to protect yourself is to use a VPN service, so that all of your network traffic is encrypted at your end (regardless of whether you are browsing a news web site or doing Internet banking). This will protect you from someone snooping at the router as well.
Note that it doesn't stop anyone from kicking you off the wifi (via DEAUTH), but at least they won't get any of your data even if they capture the encryption key used between your device and their wifi hotspot.
-
8"The only way to protect yourself is to use a VPN service" is misleading. Assuming all the protocols you use are encrypted and properly authenticated (cert checking, etc.), only a minimal amount of info (DNS queries, SNI, etc.) leaks regardless of whether you're using WPA, open wifi, or wired ethernet with potentially hostile machines connected. The moral of the story is all networks are hostile; use safe protocols. Jun 11, 2017 at 0:44
-
1Using encrypted connections is a good idea, if the service supports it. If the web site doesn't use SSL, or the protocol (e.g. DNS) isn't encrypted, your traffic can be sniffed. For people who are used to just typing in a website name, and having the web server automatically redirect them to the encrypted version of the web site, an MITM attack becomes possible (HSTS makes it more difficult, but not impossible).– PakJun 11, 2017 at 2:04
-
1VPN does not protect you unless your system cuts all the network when the VPN is unavailable. If it doesn't, attacker can trivially block the port and force you to communicate without VPN.– v6akJun 11, 2017 at 11:40
-
Then best to ensure that your devices don't connect without the VPN! My devices don't.– PakJun 11, 2017 at 11:44
-
1
Well, sort of.
Someone would wants to read your data has two options(that I can think of) to your your data. He could either try to sniff the data that goes over the air. This can be achieved by simply using a wifi interface and configuring it to run under monitor mode. You wouldn't notice a thing either, but the attacker would likely miss some packages.
The other option would be to conduct a man in the middle attack by using ARP spoofing. Basically tricking your computer to send data to his computer instead of the router, and then forwarding it to the router. He then does the same with data going in the other direction. (this by the way, also allows the attack to alter data going in either direction, allowing him to inject anything he likes)
However, Note that both these methods don't work against you if you use encryption. If you communicate with a website over https then your data should, usually be safe.
These attacks both only work if the attacker can access the network.
-
so you can't 'sniff the data that goes over the air.' on a wifi network that you're not connected to? Jun 11, 2017 at 14:41
-
Well, you can. However if you're not connected to the network and the network uses any kind of PreShared Key (a password needed to connect to the network), then that traffic will have a layer of encryption on it, and would be useless to the sniffer.– SnappieJun 11, 2017 at 17:37
No. (assuming they're not using WEP) Under 802.11i security, even with everyone using the same PSK, the actual on-air encryption key is different for each station-AP pair. The "four-way handshake" uses a nonce from both the AP and the station (your laptop) to make a unique encryption key. There is a potential attack if this exchange (both messages) are observed.
Note that this only protects the data in the air. If someone can get to the wired network, then other attacks are possible.
Best to use a VPN and/or HTTPS connections to protect your data end-to-end.
-
3Public wifis often use no security layer at all, and the username and password are entered on a web page to activate access for the requesting MAC address (captive portal). Jun 10, 2017 at 19:33
-
1@DaveM, the "potential attack" you mention is trivial for an attacker to exploit. They simply send a DEAUTH packet to your MAC, and your computer will be forced to reconnect -- and it will renegotiate the key again; this time, while the attacker is eavesdropping. Jun 10, 2017 at 21:49
The bottom line is you should always assume any public wifi network is high risk and your data is exposed to sniffing. There are people who will tell you as long as they are not using WEP your safe or that your OK if they use WPA2 etc, but this isn't enough.
One of the big problems with public wifi at hotels, coffee shops etc is that often, it isn't administered by someone who has strong technical and security knowledge. Systems can be mis-configured, may not have latest security patches, may be based on domestic rather than enterprise grade equipment, is unlikely to be monitored for threats etc. Bottom line, the wifi is a low profit 'add-on' service often run by people whose main objective is to have a sign saying 'free wifi' to draw business and who have little concern regarding the security of your data.
Then you have the other part of the problem - it is way too easy for bad guys to hack at the system. They can be anonymous, they can setup fake access points which easily fool users and they can take advantage of all the things mentioned in the first paragraph. I've actually sat in a motel, setup my laptop as an access point and just watched the number of poeple who try to connect - I reckon if I set up a fake capture portal that looked to be branded like the hotel I would probably get credit card details as well!
Note also that many of the capture portals used by hotels and the like are often very poorly designed. There are numerous posts on various security lists regarding vulnerabilities found in many commercial capture portal solutions.
So, assume your operating in a hostile environment. Only use services where you can be confident that your traffic is end-to-end encrypted or only use the service for low sensitivity data i.e. accessing public web pages etc. Check certificates before entering credentials etc.
If you travel a lot or are forced to use public or untrusted networks, consider setting up your own tunnel from your device to a server you trust and then use that server as a hopping off point to access other services. Tolls like ssh can do this - can be a pain to setup initially, but once you have it working, it works well.
