Is Hotel WiFi Safe?

0:02Welcome to the Shared Security Podcast, the longest running cyber security and privacy show for actual humans. No jargon, no hype, just honest analysis from industry veterans who've seen everything and survived it. Each week we break down the stories that matter, expose the nonsense that doesn't, and give you the tools to stay safe in a world where everything is connected and nothing is guaranteed. This is Shared Security. This week on Shared Security we're talking about hotel wifi, and is it actually safe?

0:43Well, the answer isn't never use hotel wifi, but the moment your phone or laptop throws up a hotel login page is exactly when you should slow down and pay attention. So we're talking about the captive crunch malware campaign where attackers turn that ordinary wifi connection step into a chance to steal credentials or deliver malware. So we'll cover the right flags that should make you stop. We'll talk about a VPN and what that does and doesn't do, and the simple habits that keep a hotel connection from turning into an account takeover.

1:21And joining me for this conversation is the one and only Scott Wright. Oh there, hello from Canada. Hello from Canada. How's it going up in Canada? Oh, not too bad. We're under attack by Canada geese that have machine guns and weird looking hairdos, but yeah. Yeah, that's awful. I'm sorry you're going through that. We have Canada geese here too, and they are invasive, but you know, I mean you guys have invaded the United States at one point before.

1:56Not before, we'll do it again if we have to. You'll do it again if you've got to burn the White House down again. You've got to do it. I know. Yeah. Besides all that, we're here to talk about wifi. You know, it's fascinating to me, we were just talking about this before the podcast is that the threats around wifi haven't really changed over the years. We're talking way back, right? We've been always having this conversation about wifi on the show, and if you look back on our previous episodes, you'll see we're kind of talking about the same thing.

2:28Even though there's new attacks and there's kind of new methods, but the end of the day, the same advice still applies that we're going to talk about on this podcast today. It's because it's not all technology that has the risks. That's right. Yeah. That's right. So just to kind of frame everything, so I was kind of inspired by a couple of weeks ago, Microsoft released some details about an attack that they've been seeing more focused on Entra ID, which is kind of the central authentication system for Microsoft products.

3:01And there is a dub this attack called captive crunch, not captain crunch, like the cereal. I mean, a little confusing there, but captive crunch. And this malware campaign is essentially pretty widespread according to Microsoft. So this has been affecting hotel chains, large conference centers, you know, things like that. And what they found was that, you know, these are mostly state sponsored threat actors that are doing these things. But what happens is you'll be just like you normally do connect to the hotel wifi and you get this thing called a captive portal, which is, you know, some type of login or authentication to, you know, so not everybody can access the wifi network, but hotel guests specifically.

3:50And these vary by hotel chain, by the systems that they're using. But what's happening is that users will get this pop up for, hey, Microsoft found malware on your machine, you need to click here, or they'll be a prompt for your user credentials, like for your Microsoft login credentials with something saying, hey, you know, this is Microsoft tech support. We found this thing on your computer, you need to follow these instructions and all these things kind of vary, but it's one of those things of if you're not aware during that login process of something weird like, why is the hotel asking me to scan my computer or why am I getting this Microsoft login prompt?

4:36It definitely is out of the ordinary. And I think that's the one trigger for a user, right? Is you're not seeing a hotel login page. That should be your first warning sign that something else is going on here. Yeah, it's an interesting problem. And as I was saying to you earlier, I started looking at this about 10 years ago after the Honey Stick project where I was dropping USB drives. I started exploring the possibility of doing a project called the Honey Point project where we would set up some rogue, but not malicious access points with free Wi-Fi, capture some data and just sort of see what was exposed and do a little experiment and report on that.

5:20And it turned out that technologically it was actually kind of hard to, you know, actually see anything because even 10 years ago, most important data streams were being encrypted and a lot of people using VPNs even then. So you couldn't really see much. It doesn't mean that we couldn't have done something, but I decided not to go forward with that one just because there wasn't a lot of free data available. We could have though, as you suggested, done something a little more on the social engineering side because when you set up one of these access points, you can create, as you said, a captive portal that can collect any information you want.

5:59You could, you know, you could typically, hotels always ask for your room number in your name or something, but there are other free Wi-Fi portals where they just ask for an email address and, you know, it seems like a fair exchange. I'll give you my email address and you can be free Wi-Fi, right? But you may immediately get an email, you know, that is a phishing email and trying to social engineer you from that point of view, but you could also get, as you said, those pop-ups that could try to download malware right to your computer.

6:32So it's more of a social engineering risk, really, than the technology risks that we all sort of assumed it would be. Yeah, you're exactly right. And the other thing I wanted to bring up is that a lot of people think that if I'm using a VPN, that's going to protect me. And that isn't always the case, right? Because a VPN is used for really hiding the web traffic that you are sending across the ISP that the hotel is using. Or even if you're using a VPN at home, your, your internet access provider, right, is they're unable to see your queries and what your, what websites you're going to and things like that.

7:12Now VPNs is a bigger issue altogether because there's been issues with some VPN providers are able actually to see what you're doing. And there's been court subpoenas and all these things of how much is logged, right, with these VPN providers. But it's really not protecting you from a malware type of attack where, like in this case, with the captive crunch malware, like you're still going to get a pop-up, like you're still going to get, if someone has attacked the actual hotel network in that captive portal system, turning your VPN on before that isn't really going to help you at all.

7:50Cause that's just protecting the information that you're sending. And by the way, that is still all encrypted through the use of HTTPS, which I know we've talked about that in the past where before, way back in the day, because Scott and I are old, we remember where you could use a tool called SSL strip, which would basically force a captive portal or, you know, another system into plain text, essentially. So then you could intercept what people were doing on a hotel network very easily.

8:26And today that is much harder to do from an attacker perspective. Yeah. And you probably have seen, I've seen this many times, you go to a hotel and there'd be four or five Wi-Fi hotspots, right? And one of them will say, you know, Hilton guests or whatever. And then you'll see one that's saying, Hilton free Wi-Fi. And what are you going to pick? Right. If you're cheap, you're going to pick the free one because it doesn't have any codes needed to get in.

8:54And that sounds like a pretty good, you know, scenario for attacking somebody. Yeah. So that's, that's a great point, Scott, is, you know, be aware of the hotel network you are connecting to because, yeah, somebody could easily put up a fake portal or a fake access point and redirect traffic through, through them. That is totally plausible. Now, the biggest thing I hear from a lot of people is like, Oh my gosh, should we even use hotel Wi-Fi? And like we always talk about this goes back to your threat model, right?

9:27Depending on who you are and what you do and what types of activities you're using the internet for, you may want to, you know, purchase one of those hotspot devices or what, like what I do when I travel, I use my phones built in personal hotspot. Not that I don't trust the Wi-Fi network, but I actually find that the speed and the quality of that connection over my mobile phone is actually better than a lot of these crappy Wi-Fi networks. I mean, it was a thing that a lot of people were scared to do just because of the cost of mobile data years ago, but now it's pretty much, you know, included in every plan.

10:05So the cost shouldn't really be an issue anymore. I do the same thing. And the only time I would use a free one is if, you know, the mobile data coverage is really weak. And, you know, you can get something stronger locally, but then I would use a VPN and I would also double check, you know, any important portals or you're going to enter information on because you can still see an, you know, a TLS encryption logon icon or whatever it is, right, that they show you when you're on a secured page, but that doesn't mean you're on the legitimate page.

10:38It only means that you've got SSL or TLS turned on. I mean, I think the biggest piece of advice too is if you just see anything strange, like, you know, popups or certificate warnings or these types of things on a hotel network, you should probably disconnect as soon as possible, right? Like, because that is not normal. You should not be seeing certificate errors. You should not be seeing popups saying, this is Microsoft support, install this thing, right?

11:07Or like your point, Scott, about if you're, if you put in an email address into a portal and then all of a sudden you're getting these weird email messages, this happens at airports too, right? If that system was compromised, you need to be aware of that. So again, I think the message is just being more aware of anything strange that happens during that login process and obviously you're not going to get, you know, Microsoft scan malware requests.

11:37As soon as you log into a hotel network, that is not normal. So yeah, really important information, I think, for being able to know. Just something to be aware of. I mean, I know we're coming towards the end of travel season, you know, the end of summer is here. I know we've got Labor Day this weekend or by the time you listen to this episode, it will be Labor Day when this episode is released in the US, but it's always good to have kind of these travel tips around how tell you how to use Wi-Fi more securely, hotel network or not.

12:06All right. So I think that's all we have time for today, but Scott, I wanted to give you a chance to plug the book again. The book. Yes. Yeah. Cool. Let me just see. How's that look there? Oh, there we go. Very nice. It's a little bit cropped, but yeah, there's my, my first version of the cover and title, the digital legacy tree, ensuring your loved ones can access the digital accounts they need after you die. The title may actually change a little bit based on feedback.

12:32I have quite a few people doing reviews now, but I'm really interested, especially in, you know, security experts or financial planners, estate planners who have, you know, a lot of experience in these areas. I'd really love to get more stories and feedback on that, but a couple of interesting, you know, quotes I just love to relay from early beta readers saying things like, this is a remarkable resource. I've recommended all my family members to get a copy of it for their use.

13:00Looking forward to seeing you get this published. Also, I keep getting, keep being impressed with your detail, which is very nice to hear. So yeah, so yeah, if you're interested, Tom, I'll put the link in the, in the show notes, but it's securityperspectives.com. You go there, you can find the link to the digital legacy tree, a book and tools. And yeah, congratulations on that. It's great. I love seeing it take off and you've been getting good feedback and that's great.

13:29So we'll continue to give that. Hope to publish this in the next month or two. Um, it's, it's going to be self published and you know, it's, I think it'll be pretty straightforward. In fact, I'm going to be probably offering free versions of the, the Kindle version for a while until I get some reviews. So stay tuned for how you can get that. All right, everyone. Well, thank you again for listening and subscribing and sharing the podcast with your friends and colleagues.

13:57It's much appreciated. We love getting feedback by the way. If you have feedback about this episode, you can drop a comment in our YouTube video for this, or you can send us an email at feedback at shared security.net. So until next time, stay safe, stay secure and stay private. Thank you for listening or watching. If you liked this episode, hit subscribe, share it with your friends and colleagues or jump into our community at shared security.net slash supporter to keep the conversation going.

14:27Thanks again, and we'll see you next week for another episode of shared security.