3

I recently was outside looking for public wifi because my android mobile internet wasn't very good. I went past a garage that had free wifi apparently, so I went up there and connected to their wifi.

However, despite being somewhat close to the garage, the wifi signal was still poor. I looked and saw a few dozen meters away some apartments and I realised that I could be connecting to some unknown wifi in the apartments,run by someone bad. I then quickly disconnected and left.

The good thing was that I was only on the wifi network for about 10-15 seconds and I didn't visit any websites where they could look at my data. Also the signal was really really weak. Though I looked online and found this:

Once a victim connects to the rogue Wi-Fi hotspot, the host hacker can then intercept data and even use tools to inject malware into the connected devices.

https://us.norton.com/internetsecurity-wifi-why-hackers-love-public-wifi.html

So I feel a bit uncomfortable. My phone also acted a little strange, saying it had 15% battery still and then suddenly 1% and switching off. Then when i plug it back in to recharge, it suddenly says it has 40% battery.

Improve this question
2
  • Sure it's possible, however very, very unlikely. I would not worry
    – pm1391
    Mar 20, 2018 at 2:01
  • Sounds like your battery is old.
    – AndrolGenhald
    Mar 20, 2018 at 13:40

3 Answers 3

Reset to default
5

Is it physically possible? Yes. Is it even remotely likely? No. There are two primary ways to attack someone's device (mobile or otherwise) over an attacker-controlled network, such has WiFi:

  1. Injecting malware - When you are connected to a malicious hotspot, there is the risk that files you download are intercepted and modified. If you are downloading a program for example, a malicious hotspot could replace it with malware. Likewise if you are willingly sending sensitive personal information to a website, it risks interception. For this to be an issue, you have to actually use the network, not just be passively connected to it. You said you did not.

  2. Exploiting the protocol - Connecting to WiFi involves several complex protocols, including the IEEE 802.11 standard (WiFi itself) and DHCP. Any bugs in the implementation of these protocols carries with it the risk of being exploited. If the attacker is exploiting the protocols, then merely connecting to the network (or in some cases, simply being in range of it) is sufficient to compromise your device. Some applications also automatically connect to the network as soon as you connect (for software updates, notifications, sync, etc). If these applications are vulnerable or outdated, it may be possible to exploit those as well. These are advanced attacks and are unlikely to occur, especially if your device is kept up-to-date.

So, what should you do? Despite what some other answers are saying, you do not need to do anything as drastic as a factory reset (note that an advanced attacker can still maintain a compromise despite having done a factory reset). Just set your device to only connect to trusted hotspots, and make sure the hotspots you are using are trusted and encrypted with WPA2.

Improve this answer
6
  • "Exploiting the protocol" ...? Can you list some examples of exploiting dhcp would allow for a remote exploit or malware injection? Also, 1 is misleading. There are multiple automated calls your device probably make when auto connected. It is using the wifi even if you don't go to chrome. Gmail and FB notifications being one of many examples. Outdated device and a tls buffer overflow...CVE-2018-0488 being an example.
    – bashCypher
    Mar 20, 2018 at 4:37
  • 1
    @KrisBlouch One example for DHCP was back with "shellshock" (dhcpcd was silly enough to send attacker-controlled environmental variables to a bash script). You can find far more by looking up "dhcp cve". Note that an up-to-date system should not be vulnerable to any of this, short of the risk of 0days. And yes it is still possible for e.g. an automatic update to occur when you first connect, but the majority of this communication is encrypted (same with Gmail and FB). The bigger risk is when browsing the internet, where many websites do not use TLS.
    – forest
    Mar 20, 2018 at 4:39
  • @user173395 Most of that is encrypted as I mentioned. Just like with exploiting the WiFi protocol, there is also the risk of exploiting those applications as well. If your system is outdated, then this risk increases. Otherwise, the biggest risk is unencrypted connections in the browser.
    – forest
    Mar 20, 2018 at 4:45
  • @forest hmm... I have heard of no use cases of this and it's specific to bash it seems but I'm impressed you know of it and I'll bet there are other DHCP issues similar if this exists. It speaks to your insight ...or very fast googling. I'm impressed by either. I still stand by everything else I've said above and in my answer below. They should update their device and if that fails, they should consider a reset.
    – bashCypher
    Mar 20, 2018 at 4:47
  • 1
    @KrisBlouch The bash issue is one I remember back from shellshock. Any other specifics for dhcpcd (I know of a few issues for ISC DHCP, but few people use that) I'd have to search for. I'll update my answer to mention automatic connections in a minute, thanks for pointing it out.
    – forest
    Mar 20, 2018 at 4:49
-1

Ofcourse ! If you connect to unknown network, there is always a chance of getting infected by malware. You should check if there is anything new on your phone. and I would also suggest to use some kind of security software on the phone. There are plenty of free malware scanners and antivirus solutions. Battery performance could be because some new process might be eating your processor.

Improve this answer
1
-1

Yes. Big question is "how" you might have been hacked. Number one issue with logging into a malicious wifi is whats called Man in the Middle (MiTM). Techniques used with MiTM, like SSL stripping, allow attackers to very effectively view all of your traffic in plaintext. While on this wifi... did you log into any sites?! If you passed any sensitive information or "auto logged in" into anything, you should change that password immediately.

Ok, outside that, it's up to how secure your phone is. If you have any updates for you phone you have been ignoring... you're probably in trouble. If everything on your phone is updated, you're probably fine (can't promise that though).

There are multiple security scanner apps out there for free, run one. It can be difficult to check new/strange connections or processes on a mobile device.. so it might be worth a factory reset. Good luck!

Improve this answer
3
  • 2
    He connected to a open network for 10 seconds, didn't do anything and you are suggesting a factory reset?
    – pm1391
    Mar 20, 2018 at 2:21
  • I didnt go on any websites. I basically connected for about 10-15 seconds and then disconnected. Ihave however been putting off a phone update unfortunately
    – user173395
    Mar 20, 2018 at 2:25
  • 1
    I can't tell you whats right to do here. Your phone being out of date is bad news. If you logged into an "open wifi" in 2018 that wasn't for the garage customers I'd be concerned (did it have a "splash" screen, where you have to accept something to log in? Or did it just go straight to inet?) Update your phone. If it refuses to update, I'd factory reset it. Sorry I can't help more; we'd have to run some tests.
    – bashCypher
    Mar 20, 2018 at 2:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .