Nothing Is for Free… Not Even the Wireless

I recently walked into a little coffee shop that will remain nameless, and was amazed at what I saw while waiting in line. Almost everyone in the coffee shop who was sitting at a table had a laptop open. I assumed that the large majority of them where connected to the “Free Wi-Fi” that the fine establishment was offering to all of its patrons. And where most folks in the coffee shop were engaged in sipping their coffee while reading the news online, or perhaps checking their social media statuses and what not, I wondered how many unsuspecting coffee drinkers had checked their bank accounts or paid bills using the free Wi-Fi service.

I realize that the events taking place at the coffee shop are not isolated to specific locales. You can see the same thing at bookstores, hotels and even some restaurants. As a security-minded technology professional, I urge you to reconsider next time you feel the urge to check your email or bank account utilizing an insecure free-Wi-Fi connection. 

If you’re wondering what an “insecure” network is, its pretty simple. The reality is, any wireless network that you can connect to freely, without authentication, should be considered insecure. The reason being is that you have no idea who else is connected, or what may be running on that network. I personally subscribe to the notion that any wireless network that is not mine is insecure, but that’s a different issue.

Here’s why: There are hacker tools out there that are designed to “sniff” network traffic to capture the information that is passed along over the Internet. By “sniffing,” I mean that the software listens to the traffic and can capture the information in transit. Data is transmitted across the Internet in packets. Well, the real deal is the fact that these packets can be captured and reassembled by a third party.

So when you send your username and password for your bank account on a free wireless network, anyone who is “sniffing” the traffic can capture those packets, reassemble them and use your bank account login information to login as you. Same goes for Facebook. MySpace. Hotmail. Yahoo. Twitter. The list goes on.

Granted, there are ways to protect your login information. Placing an “S” in front of HTTP in the address bar of your browser (i.e. HTTPS://www.abc.com) allows you to send information over the Internet utilizing Secure Sockets Layer (SSL), an encryption protocol used over the Internet. You can read more about SSL by way of Wikipedia. However, even if you attempt to use SSL, it has been found to be vulnerable to certain types of attacks, which means once again, your login information or whatever other personal information you use online might be at risk.

Don’t get me wrong, I’m all for having a cup of joe while trying to work on reports or whatnot, but my advice to anyone reading this is to please be aware that just because the Wi-Fi is free, that doesn’t mean it is safe. Sure, you can use it to check news and surf around, but I would suggest that you save any Internet activity that requires a login for when you are on a secure network. It's simply not worth the risk of having your accounts compromised.

Oh, and that little coffee shop. Well, once I got to my car, I was able to connect to their Internet using my cellphone. If I can do it with a cellphone from the parking lot, think about what someone else could do if they wanted to harvest user accounts and passwords. In the IT Security industry, we have a term for it: Man-in-the-Middle.

Getting back to my original point, the sign might read “Free Wi-Fi,” but it could end up costing you in the long run. Be smart and be safe.