26

I always feel scared to connect to hotel, airport Wi-Fi etc. I feel that if the Wi-Fi router is hacked, my personal information can be collected by a hacker. How can I determine if a Wi-Fi network is safe to connect to?

Also, what can an adversary do if he hacks the router I connect to? For example, can he obtain my browsing history? Can he obtain my login credentials if I log in to Gmail? Can he see the emails I sent using the network? Can he install malware onto my mobile? Can he disable the encryption somehow? Can he create some backdoor on my laptop/mobile and access it remotely?

Edit: I got some pretty good answers when the adversary doesn't have control over the router (like arp attacks, mitm attacks). What can an adversary do if he has control over the router?

Improve this question
6
  • 2
    A wireless network is probably safe to connect to, if you own the network, and live alone at the bottom of the sea. Otherwise, I wouldn't consider wifi "safe".
    – jernaumorat
    Commented Jul 6, 2018 at 6:53
  • A WiFi is safe to connect to if it lets you establish a VPN connection.
    – Simon Richter
    Commented Jul 6, 2018 at 12:24
  • @SimonRichter Only relatively. A sufficiently-advanced attacker controlling your WiFi may be able to MITM that VPN connection. Yes, this requires that they impersonate the provider's certificates, but as we've seen in recent years, that's possible far more often than might be desirable.
    – Darael
    Commented Jul 6, 2018 at 14:20
  • 1
    My rule of thumb: If it's public accessible, a VPN is required for all traffic, and all inbound traffic is dropped via the PC firewall, or even better, via an IoT device or VM running a router OS (OpenWrt, pfsense, Sophos UTM, etc. (An allow rule for ports 68 & 69 must be in place prior to connecting to the SSID, but once connected and assigned an IP, is deleted, at which all that should be left is a rule blocking all inbound traffic.)
    – JW0914
    Commented Jul 9, 2018 at 22:48
  • @JW0914 I know blocking via PC firewall. Can you please explain more about blocking via IoT device or VM running a router OS?
    – black panther
    Commented Jul 11, 2018 at 2:19

3 Answers 3

Reset to default
38

Can you tell if the network you're attached to, assuming you're just an average user, has a been compromised?

No

What can an attacker do if they're on the same network as you?

Regardless if you're connected to an open access point, an access point with WEP enabled (hopefully not) or an access point with WPA/WPA2 you can be attacked. Many public places have WiFi with WPA2 enabled and they just freely give out the password. You're still at risk.

An attacker doesn't need to compromise a router to attack you on a public network. It's very easy to arp spoof the entire network and pretend to be the router. Then all your traffic will pass through them. It'd be seamless to your experience

Once the arp spoof and ipv#_forwarding is configured it's trivial to sniff your traffic, inject malicious javascript into http traffic, etc etc etc.

The attacker doesn't even need to arp spoof you to attack your machine though. Just being on the same network as the attacker gives them the ability to scan your machine for open ports, vulnerable services running, start probing your machine.

Using tools such as nmap to first scan the network for potential targets and then port scanning each target, an attacker can quickly find you and identify any possible holes in your machine. Nmap even has some nifty passive scanning features where it won't even expose the attacker on the network because it just listens to who's transmitting instead of actively probing.

How can you mitigate risk?

Always use TLS and if you can, connect to a VPN whenever you're on a public wifi. Make sure that you don't have any unnecessary services running on your machine that are open to the network. Honestly, you probably shouldn't have any ports open. Any openings are potential access points. Also make sure your machine is fully patched and running all available firewall services.

Mind you this is all just mitigation. If you're connecting to public wifi points you have some accepted risk.

Some reference material for you:

If you want to dig in a little deeper into what can be done, how and with what tools, please look at these links below. To do what I've described above has a very low barrier of entry.

What is NMAP

What is Man in the Middle Attacks?

What is arp spoofing?

What are beef hooks?

What is MiTM Framwork?

What is SSLStrip?

Bonus:

How do you see what ports are open and listening on Windows?

  1. Open a command prompt
  2. Run netstat -ano | FIND /N "LISTEN"

The output will show you all the ports that are open and listening internally and externally. The one's marked with 127.0.0.1 you can ignore because those are only visible internally to your machine.

Anything marked as 0.0.0.0:Port will be visible to attackers on the network. Also anything marked with private addresses such as

10.0.0.0 to 10.255.255.255
172.16.0.0 to 172.31.255.255
192.168.0.0 to 192.168.255.255

will be visible.

The command and results are almost the same on Linux

netstat -ano | grep LISTEN

How to identify what services are running on your listening ports

From an elevated command prompt run netstat -a -b and look for ports marked as listening. You'll see the name of the service in brackets.

Final Note

I use this attack pattern all the time to test devices on my home network for weaknesses. My favorite is testing my phone apps for random things they're sending over the internet. Anyone with a live boot of kali or parrot os can have this attack up and running in about 5 minutes. Last year I even wrote a tool that does most of this for you and injects javascript miners into public networks. You can find my article about it here

Improve this answer
15
  • 1
    "connect to a VPN whenever you're on a public wifi." But attackers can't intercept the request content of HTTPS sites with HSTS enabled.
    – noɥʇʎԀʎzɐɹƆ
    Commented Jul 5, 2018 at 23:16
  • 1
    @noɥʇʎԀʎzɐɹƆ one more quick comment on this before I'm off here for the day. Even sites that enforce https often have ads on them. Those ads OFTEN don't enforce https at all. So if you navigate to a secure site like CNN or MSN you'll get a secure connection to their server but then when your browser beacons out for the ads to load you get http connections that can be injected into. I've done this a ton. It's very common
    – DotNetRussell
    Commented Jul 6, 2018 at 0:24
  • 3
    @AnthonyRussell: If it's active mixed content, modern browsers will (eventually, when the WHATWG gets around to it) remove the padlock if not block it outright. No idea on the timeline for that, though.
    – Kevin
    Commented Jul 6, 2018 at 1:37
  • 1
    @blackpanther if I can see what ports you have open then I can figure out what services you have running. If I can see what services are running I can "Banner grab" and determine the version. If I can determine the version I can google "<service> <version> exploit" and get every exploit ever written for that service. Checkout exploit-db.com if you want a better idea on what this looks like.
    – DotNetRussell
    Commented Jul 7, 2018 at 12:16
  • 1
    You can do a lot more than show a button. I can redirect you to other pages without your interaction. Install key loggers. Heck if your browser runs activeX objects I could open a shell on your machine without your knowledge. That last example is rare these days but what's not rare is tricking you into installing a shell for me, keylogging, session stealing, and redirection.
    – DotNetRussell
    Commented Jul 7, 2018 at 12:47
1

We can break your concerns into below cases to elaborate more easily.

Case 1: You are connecting to open WiFi like somewhat you get in airports/public locations: There is no guarantee for any security on this case and that’s why most of the people not recommending to use Open WiFi network. Please refer: https://www.makeuseof.com/tag/3-dangers-logging-public-wi-fi/

Case 2: Trusted network/SSID with authentication and WPA2: Much better security in terms of secured and authenticated wifi network with WPA2. How to ensure you are connected to WPA2 enabled WiFi network with a pre-shared key:

Check your connected WiFi/Wireless network properties to ensure you are connected to WPA2 enabled network.

enter image description here Please refer this link for more details on WPA2 and possible configuration options (like WPA2 + AES, WPA2 + TKIP, etc): https://www.howtogeek.com/204697/wi-fi-security-should-you-use-wpa2-aes-wpa2-tkip-or-both/

Case 3: Trusted/SSID with authentication but not WPA2 in use: Connecting to other wireless protocols (other than WPA2) could be more dangerous as there are known vulnerabilities around those.

So, Case 1 is not secured at all – basically you are jumping into a river where you know nothing about the depth and creatures live there.

On Case 3, even it could be a genuine network but due to concerns on the non-secure protocols in use may lead to attacks.

The Case 2 could be the most secure and guaranteed network out of all above scenario.

Now to answer your second part of the question on possible ways of attack, please refer below list:

  • Man-in-the-middle - Tapping into insecure connections
  • Attack of the clones - Diverting traffic to hacker's sites
  • One password to rule them, rule - Stealing your email/password which you may be using common on most of your logins
  • Other users/devices may be infected
  • Rogue WiFi Network - Entire network could be fake and all your traffic could be monitored

Hope this clarifies...

Improve this answer
9
  • 1
    Note that WPA2 is known insecure as of a few months ago, and depending on the device may be no better than an open network. See krackattacks.com for details.
    – Austin Hemmelgarn
    Commented Jul 6, 2018 at 1:10
  • Yes, that's y indicated as better in these 3 cases. Thanks.
    – Sayan
    Commented Jul 6, 2018 at 1:14
  • 1
    @AustinHemmelgarn, nonsense. First, even with a "broken" WPA2 implementation, you are far more secure with WPA2 than any connection in the clear. Please check your own link for details as to why that is the case. Second, note that there has still been no known in the wild incident of KRACK being exploited (i.e. non-research), nor do I expect to ever see one. Please see my answer here for more on why this is unlikely to happen.
    – YLearn
    Commented Jul 6, 2018 at 3:28
  • @YLearn Not entirely true. If your using a device with wpa_supplicant version 2.6, it's just as insecure as no encryption, because a key reinstallation attack results in those devices installing a known key (specifically a null key). Quite a few Android devices are still affected by this.
    – Austin Hemmelgarn
    Commented Jul 6, 2018 at 12:59
  • @AustinHemmelgarn, true. However, to actually exploit this, an attacker needs to perform a successful MitM attack (with its associated challenges) or there is no communication between client and AP. Additionally, if the infrastructure (i.e. the AP) is patched, then this would only apply to direct device to device connections. It is significantly easier to capture clear text (which requires almost no knowledge)than to set up a successful MitM and perform KRACK (which requires a fair amount of knowledge and the correct circumstances).
    – YLearn
    Commented Jul 6, 2018 at 13:20
0

Use VPN, by doing so you will tunnel all your communications via encrypted connection, therefore the attacker won't be able to hurt you. Good luck!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .