Connecting to public Wi-Fi hotspots can be dangerous for users. This was stated by experts in information security. Experts believe that the data transmitted through such networks is easier to intercept and decrypt, we can even talk about logins and passwords for accessing bank clients. Izvestia found out the details about what threats a connection to free Wi-Fi poses and how to protect yourself when using such networks.

Digital risks

According to experts interviewed by Izvestia, connecting to open Wi-Fi networks, users, in fact, give data about their traffic to strangers – administrators of unverified networks. Traffic monitoring and filtering allow you to track the entire sequence of human actions.

“By connecting to public Wi-Fi networks, the user accepts the risk of data leaks and complete compromise of the information transmitted through them,” says Yuri Shabalin, CEO of Stingray Technologies and cybersecurity expert. – It is not known who else is connected to the same equipment, what their goals are. But the chance that your data will become available to attackers is very high.

According to Shabalin, the user can become a victim of the so-called Man-in-The-Middle cyberattack – “the man in the middle”. Its essence is that attackers intercept information that is transmitted between two points, the recipient and the sender. They can be not only people, but also entire companies.

Photo: Global Look Press/Sven Simon/Frank Hoermann

“The purpose of such a cyberattack is to gain access to the transmitted data and (or) change it for the sake of blackmail or to implement another, more complex and multi-stage attack,” says the expert.

For example, hackers can steal valuable information on contracts and purchases. The attackers can then contact the organization on behalf of its management and use the stolen confidential information to modify the tender data. The result of such a scheme is the potential loss of contracts, customers and reputational damage.

Criminals can use a wide variety of other schemes. Computer network expert and teacher at the Moscow School of Programmers (MSP) Kirill Sitnov gives an example from Argentina, where a free network operator in a coffee shop used Wi-Fi-connected devices to mine cryptocurrencies.

Legal Requirements

Not everyone likes when you have to go through authorization when connecting to free Internet. However, it is the user registration system on the network that is a sign that a public Wi-Fi point is legal.

“In Russia, since 2014, a law has been in force on the mandatory identification of users in public Internet points,” says Kirill Sitnov. – At the same time, how exactly the authorization will take place is decided by the owners of the networks. There are two options – either using the State Services portal, or by phone number.

Photo: Izvestia / Pavel Volkov

If the owner of a public Wi-Fi point has not installed a user authorization system, he faces administrative liability. Persons holding administrative positions in the company may be fined 5-10 thousand rubles, companies and individual entrepreneurs – 100-200 thousand rubles, and in case of repeated violation, the fines will increase to 300 thousand rubles.

Users are not responsible for using Wi-Fi networks without authorization. At the same time, Kirill Sitnov draws attention to the fact that, from the user’s point of view, it is the lack of mandatory identification in the Wi-Fi network that should be the first wake-up call.

“Sometimes attackers purposefully create Wi-Fi access points in order to scan the traffic of potential victims,” says Konstantin Melnikov, head of the digital threat analysis and assessment department at Infosecurity a Softline Company. “Therefore, absolutely any open network should be alarming, because it is not known how your information transmitted through it will be used in the future.

Protection Mechanisms

Meanwhile, as Yury Shabalin notes, even the authorization system does not always save you from “listening” to traffic by intruders. The expert gives an example: a user connects to a Wi-Fi network in a coffee shop and is identified.

However, if there is no password on the router itself, then anyone can connect to it, go to the administrative panel and do whatever they want there. According to Shabalin, experts recorded such cases during special tests. Due to such a vulnerability, even such basic user data as their phone numbers and credentials from the State Services portal can be stolen – the very information that they entered at the time of registration on the Wi-Fi network.

Photo: Global Look Press/dpa/Sebastian Gollnow

The interlocutor of Izvestia notes that the risks of using public Wi-Fi networks can be minimized by observing a number of security rules. The first thing you should pay attention to, in addition to the need for authorization, is the name of the network.

• Attackers can create a fake access point with a name that looks like a well-known network. For example, if the metropolitan metro network is called Mosmetro_Free, then its hacker clone will be called Mosmetro_Free_001,” says Yury Shabalin. – And when the user connects to this clone, all the data transmitted and received by him will become available to third parties.

Another reason to be wary is the presence of a public network in the wrong place for it. For example, if a chain with a name that includes Mosmetro_Free appears in a shopping center, it is possible that attackers are involved in this. However, the correct name of a Wi-Fi network does not guarantee its security. According to Yury Shabalin, there are situations when, when connecting to the network, a page appears asking you to install or download something on the user’s device – it can be an application or a certificate. Such an offer is a reason to immediately disconnect from this network.

“If, after connecting to a Wi-Fi network, you receive messages that the certificates of the sites you are going to are invalid, this means that someone is trying to intercept your traffic,” the expert warns.

Nothing personal

If the user’s data is still stolen while using an open Wi-Fi network, then it will be extremely difficult to find the person responsible, Konstantin Melnikov warns. Of course, all paths will lead to the network administrator, but it may turn out that he simply does not want to understand the problem.

Photo: Global Look Press/dpa/Sebastian Gollnow

“In this situation, you will need an in-depth analysis of the logging logs in order to understand which devices were on the network, what identifiers were assigned to them and, accordingly, where and how to look for these devices,” the specialist explains.

Yuri Shabalin also believes that it will be problematic for a user to prove the fact of the theft of his data due to the use of a public network. That is why it is important to be proactive, preventively eliminating the leakage of personal information, or not to use public Wi-Fi networks at all, or, if necessary, use a VPN.

“It is very important to always disable the option to automatically connect to Wi-Fi networks on mobile devices,” advises the interlocutor of Izvestia. – After all, thanks to it, your device can automatically join a fake network with a known name.

But even if you are completely confident in the public Wi-Fi network you are connecting to and have authorized it, as required by law, experts recommend that you still follow the main rule – do not visit sites where you need to enter confidential information, from passwords to accounts. records up to bank card data.

“By connecting to any public Wi-Fi network, you actually take responsibility for all further events, because no one gave you written security guarantees,” sums up Ekaterina Starostina, an expert in the field of cybersecurity at Webmonitorex.