Is It Safe To Use Public WiFi?

The thoughts I express in this post may seem obvious. However, a recent chat with a colleague during a lunch break revealed that many people (including those working in the IT sector) never think about it.

So why is the public Wi-Fi connection in public transport, cafes, hotels, etc. bad? The first thing you may think about is the lack of encryption or using the same encryption key for everyone. Some people may say that today all websites and services use HTTPS so your personal data and passwords can’t be intercepted by a hacker.

Anyone who has sufficient technical knowledge or a healthy dose of paranoia uses encrypted VPN when working through public networks, thus creating an additional protection layer.

But today we’ll talk about something else.

Are Public Wifi's Secure?

In order to get a free access to some public Wi-Fi networks, you need to go through the authorization procedure. In the majority of cases, after the authorization, the provider’s database keeps the MAC address of your device and/or personal identification (phone number that you use to get authorization).

This information is necessary to allow you to connect to this Wifi the next time you come without having to go through the authorization procedure again. The router identifies your device by using the MAC address and automatically gives it access. In the majority of cases, the MAC address is the only way for the provider to identify you as an authorized user.

Now let’s look at the real situation

You come to a café or a mall, go through the public Wi-Fi authorization using your mobile number, surf the web, disconnect, and leave the place.

At the same time, one of the visitors of this café or mall is a slightly criminally-minded person, who has a laptop with a simple Wi-Fi adapter, which can work in a monitor regime, and airtrack-ng package utilities. Using all of the above, that person inconspicuously scans the area, noting which MAC addresses appear in the network, exchange the traffic, and then disconnect.

After you leave the place with the public Wi-Fi, the “bad” person changes the MAC address of the Wi-Fi adaptor on his or her device to the MAC address of your device and connects to the network. The equipment views the device as yours and allows the user to enter the network without authorization.

It’s worth noting that the person may not have too much evil intent. Some people do it to get access to Wi-Fi without watching ads by finding a MAC address of the person, who paid for the ad-free connection.

Upon successful authorization, the “bad guy” can do something, which is against the law. If the illegal activity is spotted, it can be traced back to your MAC address thus making you responsible for the bad guy’s actions. You’ll be forced to rectify the situation, which may take time. Finding experts to show that you weren’t the one using the MAC address at the moment can be costly.

One such situation happened in Russia with a mathematician Dmitry Bogatov. Someone used his IP address to try to arrange mass public disturbances. Such calls to action are illegal in Russia. There was a video, which confirmed that Dmitry was not even there at the time. At the same time, there was an expert’s opinion that an IP address cannot be equated with personal identification. However, Bogatov was arrested anyway. The criminal case was dropped only a year later, during which Dmitry was under house arrest.

How can you avoid this? Unfortunately, you can’t. The problem lies in the imperfection of the authorization and authentication methods. Today, there aren’t any ways to protect a user technically. The conclusion is obvious. Don’t use public Wi-Fi.

It’s worth noting that you should be careful not just when using the public Wi-Fi. As of today, the majority of home internet users use the WPA2-PSK encryption protocol, the encryption key to which can be found by testing the available options. Which means that if the person is using a simple password (in the future the same will apply to strong passwords as well), he makes himself vulnerable to the “bad guys”, who can connect to the home Wi-Fi network and surf the web under another person’s name.

Today, this problem can be solved in a technical manner. For example, you can configure the equipment in such a way that when you connect to Wi-Fi, the access is given to the VPN only, through which you surf the web or to WPA-802.1X. However, in both cases, you need appropriate hardware. Unfortunately, not many average Internet users are ready to take advantage of these methods.