Walking around with your smartphone wi-fi on? Think again!


Android wi-fi on

Android wi-fi on

Logging on to an unsecure Wi-Fi network can open up the personal information on your computer to nearby hackers and you may not know your information has been compromised until it is too late.

With more than 68,000 Wi-Fi hot spots currently in the United States and that number growing daily, there are many that are not secure, making their users targets for those trying to steal personal and business data.

Hot spots are popping up everywhere — airports, coffee shops, hotels, bookstores, schools and even fast-food restaurants — and the more networks, the more opportunities for hackers.

Many of those hot spots provide secure wireless networks — requiring a password log in — but many of them do not, even those in high-traffic, public places and municipal wi-fi networks.

With travel season upon us, now is a good time to re-visit how you can protect yourself online.

How Hackers Access Your Info

Honey Pot

Normally, when a wireless client such as a laptop is turned on, or having your smartphone wi-fi on, it will probe for the networks it has previously connected to. These networks are stored in a list called the Preferred Network List (PNL). Also, along with this list, it will display any networks available in its range including the hotspot network.

A hacker may do either of two things:

  1. Silently monitor the probe and bring up a fake access point with the same ESSID the client is searching for. This will cause the client to connect to the hacker machine, thinking it is the legitimate network.
  2. He may create fake access points with the same ESSID as neighboring ones to confuse the user to connect to him. Such attacks are very easy to conduct in coffee shops and airports where a user might be looking to connect to a Wi-Fi connection.

These attacks are called Honeypot attacks, which happen due to Mis-Association to the hacker’s access point thinking it is the legitimate one.

Once the honeypot association is made by the attacker with a valid client from an internal corporate network, he can find out a lot of information about both the client and the network and use them to launch further attacks like Man In the Middle attack, Wireless Denial Of Service (DOS) attack, etc. So, as you can see, wireless honeypot itself is not an attack but it paves the way for other attacks.

 Man-in-the-middle Attack (MITM Attack)

MITM Attack is a form of eavesdropping where a hacker places himself in the middle of an online session between your computer and a hotspot.

An attacker could configure his laptop or other wireless device to act as a WiFi hotspot and give it a name commonly used in a public area such as an airport or coffee shop. The hacker then waits for nearby laptops and smartphones to connect to it. Once connected to the bogus network, the computer — and all of its sensitive information, including user ID, passwords, credit card numbers – is exposed to the hacker. The intruder can mine the computer for valuable data, direct the user to phony webpages that look like familiar ones, and record every keystroke.”

Protecting your personal information in public unsecured wi-fi locations

iphone wi-fi on

iphone wi-fi on

There are several effective defenses against MITM attacks, but nearly all of them are on the router/server side and give users no control of the security of the transaction. One such defense is the use of strong encryption between the client and the server. In this case the server can authenticate itself by presenting a digital certificate and then the client and the server can establish an encrypted channel through which to send sensitive data. But this relies on the server on the other end having such encryption enabled. On the other end, users can protect themselves against some kinds of MITM attacks by never connecting to open WiFi routers or by employing a browser plug-in such as HTTPS Everywhere or ForceTLS that always establishes a secure connection whenever the option is available. However, each of these defenses has limitations and there have been demonstrations of practical attacks such as SSLStrip or SSLSniff that can negate the security of SSL connections.

 The best way to protect yourself from attacks from hackers is to never connect to an unknown or unsecure Wi-Fi network. If you have to, here are some precautions you can take:






- Turn Off Wi-Fi on Your Device: With the growth of smartphones and broadband connections, many opt to leave the wi-fi on and ready for action. The downside is that being “always on” renders devices more susceptible. When turned on and not connected, your device sends out probes (this includes smartphones). A hacker can monitor the probe and bring up a fake SSID that your device is looking for.


- Change Default Settings on Your Device: Change the default setting on your laptop or smartphone so you have to manually select the Wi-Fi network you’re connecting to.

Help us raise awareness, send to your friends and colleagues.




  1. […] your hotspot to access the Internet, and could even intercept your login information to sites that you login to. Following the stops above to number 3, you should be on your “Mobile Hotspot” […]