Access to free, public Wi-Fi networks has spread rapidly and is available in many locations. Wherever you imagine, there may be a network of this type, airports, hotels and shopping malls all provide this free Internet connection as an additional benefit of using their services. For many people, being able to connect to free internet anywhere seems fantastic. This type of connection also becomes extremely useful for business owners while they are traveling, now being able to access their work emails or share documents online.

However, there are more risks to using public Wi-Fi hotspots than users may realize, and most of these risks are related to the Man in the Middle Attack.


Man in the Middle attack

The Man in the Middle (MitM) attack occurs when a malicious actor manages to intercept communication between two parties. There are several types of MitM attacks, but one of the most common is intercepting a user's request to access a certain page on the internet, sending back a completely fraudulent one that appears legitimate and trustworthy. This can happen on practically any website, such as Internet Banking, online stores, social networks and email providers.

For example, if Alice tries to access her email and a hacker intercepts the communication between her device and the provider, he has a chance to execute a MitM attack, luring her to a fake website. Once Alice enters her details and the hacker manages to collect them, he can use her email to carry out malicious actions, such as sending phishing content to Alice's contact list.

Therefore, MitM is a third party capable of intercepting data sent between two points, pretending to be a legitimate intermediary. Generally, MitM attacks are carried out to try to convince users to enter their sensitive data into a fake website, but they can also be used to simply intercept a private conversation.


WiFi eavesdropping

WiFi Eavesdropping is a type of MitM attack in which the hacker uses a public connection to monitor the activities of anyone connected to it. The information intercepted can range from personal information to browsing patterns.

Typically, this is done by creating a fake Wi-Fi network with a seemingly legitimate name. This fake name is often very similar to that of a nearby store or business. The mentioned method is better known as Evil Twin.

For example, a customer might enter a CoffeeShop and notice that there are three WiFi networks available with similar names: CoffeeShop, CoffeeShop1, and CoffeeShop2. Chances are that at least one of these three networks is fraudulent.

Hackers can use this tactic to collect data from any device that establishes a connection, allowing them to steal login credentials, credit card information, and other sensitive information.

WiFi Eavesdropping is just one of the risks associated with public networks, so it is always preferable to avoid using them. If you really need public Wi-Fi, be sure to check with a local employee to make sure it's authentic and secure.


Packet Sniffing

Sometimes criminals make use of specific computer programs to intercept data. These programs are known as Packet Sniffers and are often used by legitimate IT professionals to record network traffic, making it easier to detect and analyze problems. These programs are also used to monitor browsing patterns for private companies.

However, many of these Packet Sniffers are used by hackers to collect sensitive data and carry out illegal activities. So, even if nothing bad appears to have happened at first, victims may soon discover that someone has stolen their identity or that their company's confidential information has been leaked in some way.


Basically speaking, cookies are small packets of data that browsers collect from websites as a way of retaining some information about users. These data packets are stored locally (as text files) on the user's computer so that the website recognizes them when they return.

Cookies are useful because they facilitate communication between users and the websites they visit. For example, cookies allow users to stay logged in without having to enter their credentials every time they visit a particular website. They can also be used by online stores to record items that customers have previously added to their shopping carts or to monitor their browsing patterns, understanding which products are most desired, etc.

Since cookies are simple text files, they cannot carry a keylogger or any virus, so they do not cause harm to your computer. However, cookies can be dangerous in terms of privacy and are often used in MitM attacks.

If hackers are able to intercept and steal the cookies you are using to communicate with certain websites, they can use this information against you. This is called Cookies Theft and is often related to what we call Session Hijacking.

Successful Session Hijacking allows the attacker to impersonate the victim and communicate with websites on their behalf. This means that they can use the victim's current session to access personal emails or other websites that may contain confidential data. Session Hijacking typically occurs on public Wi-Fi networks because they are easier to monitor and much more vulnerable to MitM attacks.


How to protect yourself from MitM Attacks?

  • Disable any setting that allows your device to automatically connect to available WiFi networks.

  • Turn off file sharing and log out of accounts you're not using.

  • Use password-protected WiFi networks whenever possible. When there is no other option but to use a public WiFi network, try not to send or access sensitive information.

  • Keep your antivirus and your device's operating system up to date.

  • Avoid any financial activity while using public networks, including cryptocurrency transactions.

  • Use websites that have the HTTPS protocol. However, it is worth remembering that some hackers perform HTTPS Spoofing, therefore, this measure is not 100% foolproof.

  • Using a VPN (Virtual Private Network) is always recommended, especially if you need to access confidential or business-related data.

  • Don't trust the WiFi name just because it looks similar to a store or business. If in doubt, ask a team member to confirm the authenticity of the network. Also ask if they have a secure network you could use.


Final considerations

Internet criminals are always looking for new ways to access people's data, so it is essential to be informed and stay alert. Here we discuss some of the many risks that public WiFi networks can present. While most of these risks can be avoided just by using a password-protected connection, it's important to understand how these attacks work and how to prevent yourself from becoming the next victim.