Could free Wi-Fi threaten your online security?

[Wilhelm]

 

There's nothing like free Wi-Fi to save money on cellular data plans. But sometimes, logging onto a Wi-Fi hotspot comes with the price of compromising your security.

If you're not careful, you could launch onto a rogue network set up by hackers to steal your information. It's called the man-in-the-middle hack.

"Unfortunately security often takes a back seat to convenience," said Derek Manky with Fortinet Fortiguard Labs.

To prove it, Fortinet’s Aamir Lakhani demonstrated how a hacker can use a $99 mini Wi-Fi router, called a pineapple, to intercept traffic to your device.

By default, new devices now automatically log onto known Wi-Fi networks, looking for the names of the last known connections. As your device sends out the call or beacon, hackers generate a list of your last known Wi-Fi connections and duplicate those names to their rogue hotspot, hoping your device will latch on.

“[For this demonstration] my goal is to try and steal someone’s password,” explained Lakhani.

In a controlled setting, Lakhani set up two computers, the hacker’s computer and one that is tricked into connecting to it through his rogue router.

“I can see all the websites that it’s going to. I can see all the images that it’s viewing as well,” he said. He can also view the cookies on the computer and access to secure websites.

“Now that I control the traffic, I can control wherever this user goes,” he explained.

He can also send the user fake websites, like Gmail, to steal passwords and login information and he can also send fake updates for commonly used software programs that once clicked on can install malware.

“Once he installs the plugin, I own his box wherever he goes,” Lakhani warned.

That includes accesss to everything on the computer. That’s enough information to steal your identity and access your accounts.

To protect yourself from this happening, turn off the “automatically connect to Wi-Fi" setting on your devices. When visiting websites on a public network, look for https in the search box to ensure a site is secure, and try to use a virtual private network (VPN) to encrypt everything. Or use cellular data when logging onto sensitive accounts because thieves can easily plug their mini hacking into a portable power supply, hide it and lurk nearby public hotspots.

"These are prime attack opportunities for cyber criminals and hackers," said Manky.

You may want to check if your cell phone company provides something called a hotspot 2.0. It offers better protection on public hotspots, but it's only available for Apple systems in our area right now.