0

In my college the WiFi is open type connection and before I connect to it using my laptop with windows 8.1, it displays message "Other people might be able to see info you send over this network " (See the snapshot). Also important to mention that they do MAC address filtering that is, to connect to the network we are required to provide MAC address of the device on which we want to use internet.

Now I want to know that is it possible that the whole internet history and all related information is/can be intercepted by someone on the network? If yes, then how I can prevent it from happening or protect my information?

If possible please explain with example,so that I can tell the problem to concerned authorities so that they take necessary steps to protect users.

enter image description here

  • Are you sure they do MAC filtering? Just because they ask for your MAC address doesn't mean they use MAC filtering. – KnightOfNi Mar 22 '15 at 18:23
  • Looks like it's an open (unencrypted) network and yeah, anyone can passively listen to all your plaintext traffic (HTTPS and other encrypted protocols will still be safe). They can also connect to the network and do active MITM attacks (MAC filtering is trivial to bypass and is definitely not an effective protection to keep unauthorized users off from the network). – user42178 Mar 22 '15 at 18:33
  • @KnightOfNi yes,they do.All devices are blocked to connect without providing MAC address and a copy of college identity card of the student(same applies to teachers) If anyone tries to connect to wifi without giving them MAC address,they are prompted to sign-in into the network as they are using cyberroam. please ask again if anything is still unclear to you. – Divyanshu Mar 22 '15 at 18:34
2

Everything you send over the network is visible to anyone near you. Even if they do use MAC filtering, it doesn't help -- with no encryption on the network, you're broadcasting every packet in the clear over radio. Any wifi card capable of monitor mode can record everything you send. As André mentioned in comments, this is also potentially vulnerable to active attackers. MAC control does not protect users of the network from eavesdropping; it makes it slightly more annoying for an unauthorized user to connect to the network (this does have its uses; it discourages casual passersby from using the school network, and might fulfill some bureaucratic requirement that the school needs to follow), but that's it. At the scale of a large university, a pre-shared key would be no better (it might as well be completely public).

The only way to protect against that is to encrypt your traffic. A VPN can be a very effective way to do this; if you can connect to your school's VPN from the wifi network, this will encrypt your traffic over the air. Likewise, any site you visit using HTTPS will be encrypted, so an eavesdropper can't read your messages.

At a network level, the school has more options: the best one by far is to offer a secure network using WPA2-Enterprise, for which you log in to the network with school credentials, which are used to derive an encryption key specific to you (with WPA2-PSK, anyone else who knows the wifi password can still eavesdrop or perform active attacks; with Enterprise, they can't). For devices that don't support this (like game consoles), there's no really good option; what my school does is run a WPA2 secure network that everyone's recommended to use, and run an unencrypted MAC-controlled network for devices that just don't support the secure network. This requires some amount of infrastructure (nicer APs support it better, with one AP carrying both those networks), but it works well for security.

  • what do you mean by"if you can connect to your school's VPN from the wifi network"? i have listened about VPN services only like cyberghost,hotspot shield etc. But what is meaning of school VPN and how can I connect to it? I am a novice,so please co-operate. – Divyanshu Mar 22 '15 at 18:57
  • 1
    @Divyanshu He means IF your school is running a VPN server, then you could connect to it, thus making a secure (encrypted) VPN tunnel for all your network packets to pass through. AFAIK, most universities like mine do not allow VPN access to students - only select few professors who need to access network resources or modify course details. In your case I highly doubt there would be a VPN infrastructure for students to use when the network admins seem to not even bother with implementing proper 802.1X authentication for WiFi – Joseph Mar 22 '15 at 19:06
  • 1
    @Divyanshu What Joseph said. A VPN is just a way to create a secure private network over the public Internet; companies and other institutions use them all the time to let people securely connect to the internal network while traveling, while preventing eavesdropping between the person connecting and the company network. At my school, anyone with an account on the school network can use the VPN; I didn't know (and am honestly surprised) that other schools heavily restrict it. – cpast Mar 22 '15 at 19:22
  • @cpast I must probably be the minority then. We're a paranoid bunch here :) – Joseph Mar 22 '15 at 19:54
  • No,there is no such arrangement. – Divyanshu Mar 22 '16 at 22:11
1

An open type WiFi connection is unencrypted and insecure by all means. Anyone can easily steal / monitor your data by sniffing packets in transit between your device and the wireless router hub /access point using many of the freely available packet sniffers. Unless you're using TLS, any and all data is in the clear for anyone to intercept and monitor. The particular Windows warning is clear indication that the Wifi in question is open type and thus insecure.

I would assume the network admins have just lazily put in place MAC address filtering which is practically useless in case of an unencrypted connection like this. It is a trivial matter to spoof MAC address for even a novice attacker to gain access to such a network.

The only way to protect yourself in an open, unencrypted WiFi environment is to use secure VPN tunnelling for all traffic.

An example of a secure connection at university would be nothing short of one using a proper IEEE 802.1X authentication protocol. See eduroam which is a secure, international educational roaming service which forms the backbone of most of the wireless infrastructure at most research universities around the world. Authentication of users is performed by their home institution, using the same credentials as when they access the network locally, while authorisation to access the Internet and possibly other resources is handled by the visited institution. This is the most common implementation of a robust WiFi infrastructure at universities and colleges.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.