That’s Why Microsoft Is Urging Users to Avoid Public Wi-Fi Networks.
You’ve likely heard warnings that public Wi-Fi networks aren’t always trustworthy, and now Microsoft is giving you a compelling reason to avoid them. A new hacking campaign known as CaptiveCrunch targets wireless networks in hotels, conference centers, airports, and other public spaces to steal credentials and compromise devices.
Hackers are attacking Wi-Fi networks in the hospitality industry.
The warning came from Microsoft Threat Intelligence , a group of security experts and researchers who discovered that Russian attackers are exploiting login pop-ups that appear when users connect to Wi-Fi to phish for sensitive information and distribute malware. Users are accustomed to seeing these pop-ups when connecting to public networks, making them less likely to suspect something is amiss.
As Malwarebytes Labs describes , hackers can manipulate DNS and HTTP traffic from these portals, allowing them to redirect users to phishing sites (and collect login credentials and device codes), distribute malware via fake update and ClickFix requests, and launch machine-in-the-middle attacks to intercept and redirect traffic. Users may see a series of fake dialog boxes when connecting to Wi-Fi at a hotel or airport, such as a Windows Update or Windows Security window, or a request to download a PDF viewer or disk optimization utility.
How to protect your devices from attacks via public Wi-Fi networks
Microsoft researchers strongly recommend that travelers assume that public and guest wireless networks in hotels, conference centers, and airports are unreliable. Whenever possible, they should rely on private connections, such as mobile hotspots and cellular data, rather than public Wi-Fi. If you’re using a work device, you should have a corporate router or travel hotspot that provides an encrypted connection to your company’s infrastructure.
If you need to use Wi-Fi at a hotel or airport, Malwarebytes Labs recommends using a VPN with a kill switch, which blocks internet traffic if the connection is unexpectedly interrupted. Carefully check login pop-ups and be wary of portal pages that request information other than your room number or last name to connect. Use an email alias if you need to provide an address.
Never download software or browser updates, certificates, tools, or utilities through login portals, pop-up messages, or web requests, as this could infect your device with malware. If you’re unsure whether an update is required, go directly to the service or system settings. (You should never be required to download anything to connect to Wi-Fi.) If you’re asked to copy code or execute commands on your device, exit immediately, as this is a sign of a ClickFix attack. Any urgent actions, such as a countdown timer, are also a warning sign.
Finally, before your trip, make sure your devices, apps, and software are updated to patch security vulnerabilities and minimize the chances of you needing to download anything while on the road.