Is my WiFi connection protected?

Question

In my college the WiFi is open type connection and before I connect to it using my laptop with windows 8.1, it displays message "Other people might be able to see info you send over this network " (See the snapshot). Also important to mention that they do MAC address filtering that is, to connect to the network we are required to provide MAC address of the device on which we want to use internet.

Now I want to know that is it possible that the whole internet history and all related information is/can be intercepted by someone on the network? If yes, then how I can prevent it from happening or protect my information?

If possible please explain with example,so that I can tell the problem to concerned authorities so that they take necessary steps to protect users.

Answer 1

Everything you send over the network is visible to anyone near you. Even if they do use MAC filtering, it doesn't help -- with no encryption on the network, you're broadcasting every packet in the clear over radio. Any wifi card capable of monitor mode can record everything you send. As André mentioned in comments, this is also potentially vulnerable to active attackers. MAC control does not protect users of the network from eavesdropping; it makes it slightly more annoying for an unauthorized user to connect to the network (this does have its uses; it discourages casual passersby from using the school network, and might fulfill some bureaucratic requirement that the school needs to follow), but that's it. At the scale of a large university, a pre-shared key would be no better (it might as well be completely public).

The only way to protect against that is to encrypt your traffic. A VPN can be a very effective way to do this; if you can connect to your school's VPN from the wifi network, this will encrypt your traffic over the air. Likewise, any site you visit using HTTPS will be encrypted, so an eavesdropper can't read your messages.

At a network level, the school has more options: the best one by far is to offer a secure network using WPA2-Enterprise, for which you log in to the network with school credentials, which are used to derive an encryption key specific to you (with WPA2-PSK, anyone else who knows the wifi password can still eavesdrop or perform active attacks; with Enterprise, they can't). For devices that don't support this (like game consoles), there's no really good option; what my school does is run a WPA2 secure network that everyone's recommended to use, and run an unencrypted MAC-controlled network for devices that just don't support the secure network. This requires some amount of infrastructure (nicer APs support it better, with one AP carrying both those networks), but it works well for security.

Answer 2

An open type WiFi connection is unencrypted and insecure by all means. Anyone can easily steal / monitor your data by sniffing packets in transit between your device and the wireless router hub /access point using many of the freely available packet sniffers. Unless you're using TLS, any and all data is in the clear for anyone to intercept and monitor. The particular Windows warning is clear indication that the Wifi in question is open type and thus insecure.

I would assume the network admins have just lazily put in place MAC address filtering which is practically useless in case of an unencrypted connection like this. It is a trivial matter to spoof MAC address for even a novice attacker to gain access to such a network.

The only way to protect yourself in an open, unencrypted WiFi environment is to use secure VPN tunnelling for all traffic.

An example of a secure connection at university would be nothing short of one using a proper IEEE 802.1X authentication protocol. See eduroam which is a secure, international educational roaming service which forms the backbone of most of the wireless infrastructure at most research universities around the world. Authentication of users is performed by their home institution, using the same credentials as when they access the network locally, while authorisation to access the Internet and possibly other resources is handled by the visited institution. This is the most common implementation of a robust WiFi infrastructure at universities and colleges.