Best Practices for Public Networks

The guest Wi-Fi in a hotel lobby is open to everyone in the building. This lesson follows one guest's laptop onto it: which network to join, who can read the laptop's traffic, and which attacks such a network faces.

Below are the card at the front desk and the list of wireless networks the laptop shows in the lobby.

Front desk card:  Guest Wi-Fi  Harborview-Guest  (no password)
Laptop, networks in range:
  Harbourview-Guest   security: none (unencrypted)
  Harborview-Guest    security: none (unencrypted)

The hotel runs one guest network, the one named on the card. Compare each name in the list with the card, one character at a time. Harbourview-Guest spells the first word with an extra u, where the card has none. Only Harborview-Guest matches the card letter for letter, so it's the only one that can be the hotel's network.

Harbourview-Guest is an evil twin of the hotel's network. The protection is the comparison above: before joining any wireless network, check that its name matches the intended network's name exactly. A twin whose name is identical to the hotel's would pass this check, since two identical names cannot be told apart.

Suppose the guest joins Harbourview-Guest by mistake at 9:14 a.m. Every request the laptop sends then passes through the adversary's access point, so the adversary captures all of it. These are the laptop's requests in its first minute.

09:14:02  DNS lookup  portal.example.org
09:14:03  HTTPS       https://portal.example.org/account

The second request uses HTTPS, an encrypted protocol. The adversary captures it but reads only where it's going: the server's address and, on most connections, the site's name, which the laptop has to send in the open. The page it asks for and what comes back stay encrypted. The first line, the lookup, uses no encryption, so the adversary reads the site name.

The adversary and the hotel can each read the lookup because each runs the network the laptop joined. A listener in radio range runs nothing. Both networks send traffic through the air unencrypted, so another laptop anywhere in radio range can capture the lookup without setting up a twin at all.

Most of what a laptop sends today travels over encrypted protocols, as the HTTPS request does. The DNS lookup here doesn't, and DNS queries are vulnerable data: this one tells anyone reading it which site the guest was about to visit. Many browsers can now encrypt DNS lookups as well, but this laptop's lookups aren't encrypted. So before joining an unencrypted Wi-Fi network, an individual should consider how sensitive their data is.

Now suppose the laptop turns on a virtual private network before its first request. Everything it sends is then encrypted as far as the VPN operator's system.

On Harborview-Guest the hotel provides the service, and on a twin the adversary does. Each now carries only encrypted traffic, so neither can read either line, and neither can a laptop listening in radio range. The VPN provider sees only where the HTTPS request is going, since HTTPS still encrypts the rest. It can read the lookup. So the VPN changes who reads the DNS lookup: the VPN provider, in place of the hotel, the adversary, or a listener nearby.

Two other attacks on the hotel's network need no guest to join anything. In the first, an adversary floods the lobby with a strong electromagnetic signal on the frequencies Harborview-Guest uses. No legitimate traffic can then pass between the hotel's access point and the laptops, so the lobby's Wi-Fi stops working for every guest at once.

In the second, an adversary walks the hotel's parking lot with a laptop that detects wireless network beacons. It picks up Harborview-Guest at the lobby doors and again 60 meters past the east wall. The adversary learns the type of network the hotel runs, open and unencrypted, and maps where its signal extends outside the building.

Two ways to describe an adversary are skill level and motivation.

Kits that run an evil twin are sold online, so the operator of Harbourview-Guest may be a low-skilled adversary running a tool someone else built. Nothing in the three attacks at the hotel needed a new tool or an undocumented flaw.

Motivation is a separate question from skill. Adversaries' motivations include greed, a desire for recognition, dedication to a cause, revenge, politics, and beliefs, and a low-skilled adversary can hold any of them.