The Hidden Dangers of Public Wi-Fi

#publicwifi #cybersecurity #ITSecurity #securityrisk

Public Wi-Fi, which has long since become the norm, poses threats to not only individual users but also businesses. With the rise of remote work, people can now work from virtually anywhere: a cafe close to home, a hotel in a different city, or even while waiting for a plane at the airport. Next, let's explore the risks of connecting to public Wi-Fi, both for you personally and for businesses.

According to the Forbes Advisor the majority of people (56%) connect to public Wi-Fi networks that don't require a password. This convenience comes at a price, and many are unaware that attackers can steal card details, passwords, and other sensitive information.

• Man-in-the-Middle (MITM) Attacks: This is one of the most common threats on public Wi-Fi. In an MITM attack, the hacker secretly intercepts and possibly alters the communication between two parties. The user believes they are directly communicating with a website, email server, or another user, but the hacker is relaying the information, capturing sensitive data in the process.

• Eavesdropping: Public Wi-Fi networks, especially those without encryption (like WPA2), allow hackers to "listen" to data being transmitted over the network. Tools like packet analyzers can capture unencrypted traffic, making it easy for hackers to extract sensitive information.

• Rogue Hotspots: A hacker sets up a fake Wi-Fi network, often with a name similar to a legitimate network (e.g., "CoffeeShopFreeWiFi" instead of "CoffeeShop_WiFi"). Unsuspecting users connect to this rogue hotspot, and the hacker can monitor all traffic, capturing any sensitive data transmitted.

• Honeypot Networks: Similar to rogue hotspots, these are malicious networks set up to lure users. Once connected, the hacker can deploy malware or attempt to exploit vulnerabilities on the user's device.

• Spoofing: In a spoofing attack, the hacker impersonates another device on the network, redirecting traffic through their device. This allows them to capture and manipulate data.

• Session Hijacking: Here, the attacker hijacks a session between the client and server (e.g., a login session on a website). This can allow them to gain unauthorized access to accounts or services.

• Malware Distribution: Public Wi-Fi can be used as a medium to distribute malware. For example, malware can be injected into software updates or downloads. Once the user's device is infected, the malware can steal information, monitor user activity, or enlist the device in a botnet.

• Login Page Phishing: Some public Wi-Fi networks redirect users to a login or terms acceptance page before granting access. Hackers can replicate these pages to capture login credentials or other personal information.

Protection Measures:

To safeguard against these threats when using public Wi-Fi:

For Hotspot Owners – leverage web filtering for Wi-Fi hotspots. You will not only protect your guests from malware and harmful resources, but you will also increase customer loyalty. By informing them that this cafe or library offers a secure Internet zone, parents can hand devices to their children without worrying about exposure to inappropriate content. Using a DNS filtering service will also allow you to gather valuable anonymized statistics about your users' preferences, which can be leveraged in marketing campaigns.

For Public Wi-Fi users:

• Implement DNS filtering services, like SafeDNS. Install a roaming client on devices and choose cybersecurity categories to block malicious websites.

• Avoid accessing sensitive sites or services, such as banking platforms.

• Turn off sharing settings on your device.

• Always forget the network after disconnecting to avoid automatic reconnections.

• Use HTTPS websites and ensure SSL/TLS is in use when transmitting sensitive data.

In summary, while public Wi-Fi offers convenience, it's crucial to be aware of its vulnerabilities and take necessary precautions to ensure data security.

SOURCE: : https://thehackernews.com/2023/08/the-hidden-dangers-of-public-wi-fi.html

What is Phishing

Every day, email inboxes fill up with annoying, unwanted messages. However, some of these junk messages are malicious/ phishing attacks. By using phishing emails, texts, or social media posts that lead to phishing sites, fraudsters attempt to deceive you into revealing your personal and sensitive information – bank account numbers, credit card info, Social Security number, or login IDs, usernames, and passwords. Once obtained, they use your credentials to steal your money, your identity, or both.

How does it work?

You get a legitimate-looking email with the subject line. For instance: “Your Amazon order confirmation.” This message is often referred to as a ‘lure,’ because it is disguised to trick you into taking the bait. Whether you recently ordered something from Amazon or not, you open the email. Inside, the message encourages you to follow a link entitled Your Account, but you aren’t paying attention when the link opens automatically in your browser.

Other phishing attacks target businesses. For example, an employee may receive phishing emails from imposters posing as a C-level executive within their organization. If an employee follows the email’s instructions, the phishers could gain illegal access to the company’s data. This is especially easy if an employee provides their login credentials. After tricking an employee into giving their login and password, the cybercriminals then have full cntrol over the company’s systems. Phishers could also pose as a bank or another financial institution that the company doesn’t hold accounts with. In this case, an employee who falls for a scam sends money directly to the phishers.

In a nutshell, phishing starts with fraudulent communication via email, text messages, or social media. A message appears to be from a trusted source like your bank, an e-commerce site, the IRS, G Drive, UPS, FedEx, or any number of others, but it isn’t.

Follow these tips to avoid phishing and scams and stay safe.

Repairing the damage caused by phishing can be frustrating, time-consuming, and expensive. Following a few basic safety rules is much easier:

• Do not click any links or download any attachments in suspicious emails. Instead, open your web browser and go to the website by entering it in the address bar.

• Alternate Internet Explorer with other browsers.

• Use antivirus and firewall solutions, and keep them up to date.

• Always use a secure website (HTTPS) and check the digital certificates.

• check your accounts and statements regularly, and report any suspicious activity immediately.

• Report suspicious emails to security companies and local authorities.

What is Network Infrastructure Security?

Network Infrastructure Security, typically applied to enterprise IT environments, is a process of protecting the underlying networking infrastructure by installing preventative measures to deny unauthorized access, modification, deletion, and theft of resources and data. These security measures can include access control, application security, firewalls, virtual private networks (VPN), behavioral analytics, intrusion prevention systems, and wireless security.

How does Network Infrastructure Security work?

Network Infrastructure Security requires a holistic approach of ongoing processes and practices to ensure that the underlying infrastructure remains protected. The Cybersecurity and Infrastructure Security Agency (CISA) recommends considering several approaches when addressing what methods to implement.

• Segment and segregate networks and functions - Particular attention should be paid to the overall infrastructure layout. Proper segmentation and segregation is an effective security mechanism to limit potential intruder exploits from propagating into other parts of the internal network. Using hardware such as routers can separate networks creating boundaries that filter broadcast traffic. These micro-segments can then further restrict traffic or even be shut down when attacks are detected. Virtual separation is similar in design as physically separating a network with routers but without the required hardware.

• Limit unnecessary lateral communications - Not to be overlooked is the peer-to-peer communications within a network. Unfiltered communication between peers could allow intruders to move about freely from computer to computer. This affords attackers the opportunity to establish persistence in the target network by embedding backdoors or installing applications.

• Harden network devices - Hardening network devices is a primary way to enhance network infrastructure security. It is advised to adhere to industry standards and best practices regarding network encryption, available services, securing access, strong passwords, protecting routers, restricting physical access, backing up configurations, and periodically testing security settings.

• Secure access to infrastructure devices - Administrative privileges are granted to allow certain trusted users access to resources. To ensure the authenticity of the users by implementing multi-factor authentication (MFA), managing privileged access, and managing administrative credentials.

• Perform out-of-band (OoB) network management - OoB management implements dedicated communications paths to manage network devices remotely. This strengthens network security by separating user traffic from management traffic.

• Validate integrity of hardware and software - Gray market products threaten IT infrastructure by allowing a vector for attack into a network. Illegitimate products can be pre-loaded with malicious software waiting to be introduced into an unsuspecting network. Organizations should regularly perform integrity checks on their devices and software.

Why is Network Infrastructure Security important?

The greatest threat of network infrastructure security is from hackers and malicious applications that attack and attempt to gain control over the routing infrastructure. Network infrastructure components include all the devices needed for network communications, including routers, firewalls, switches, servers, load-balancers, intrusion detection systems (IDS), domain name system (DNS), and storage systems. Each of these systems presents an entry point to hackers who want to place malicious software on target networks. 

• Gateway Risk: Hackers who gain access to a gateway router can monitor, modify, and deny traffic in and out of the network.

• Infiltration Risk: Gaining more control from the internal routing and switching devices, a hacker can monitor, modify, and deny traffic between key hosts inside the network and exploit the trusted relationships between internal hosts to move laterally to other hosts.

Although there are any number of damaging attacks that hackers can inflict on a network, securing and defending the routing infrastructure should be of primary importance in preventing deep system infiltration.

What are the benefits of Network Infrastructure Security?

Network infrastructure security, when implemented well, provides several key benefits to a business’s network.

• Improved resource sharing saves on costs: Due to protection, resources on the network can be utilized by multiple users without threat, ultimately reducing the cost of operations.

• Shared site licenses: Security ensures that site licenses would be cheaper than licensing every machine.

• File sharing improves productivity: Users can securely share files across the internal network.

• Internal communications are secure: Internal email and chat systems will be protected from prying eyes.

• Compartmentalization and secure files: User files and data are now protected from each other, compared with using machines that multiple users share.

• Data protection: Data back-up to local servers is simple and secure, protecting vital intellectual property.

What are the different types of Network Infrastructure Security?

A variety of approaches to network infrastructure security exist, it is best to adhere to multiple approaches to broaden network defense.

• Access Control: The prevention of unauthorized users and devices from accessing the network.

• Application Security: Security measures placed on hardware and software to lock down potential vulnerabilities.

• Firewalls: Gatekeeping devices that can allow or prevent specific traffic from entering or leaving the network.

• Virtual Private Networks (VPN): VPNs encrypt connections between endpoints creating a secure “tunnel” of communications over the internet.

• Behavioral Analytics: These tools automatically detect network activity that deviates from usual activities.

• Wireless Security: Wireless networks are less secure than hardwired networks, and with the proliferation of new mobile devices and apps, there are ever-increasing vectors for network infiltration.

Ransomware protection

Ransomware is avoidable and in fact your network can be protected. This requires strategy planning for any incoming incident. Your network is vulnerable and could be affected with virus, ransomware, or malware. My Remote Tech will have the solution for you in order to prevent 99.9% of digital threats. One of our key solutions is dividing your existing network into multiple networks by creating VLANs which gives us more control over network and better security.