In a recent article, Exporters and Cybercrime: Beware the Man-In-The-Middle, I discussed some of the risks mobile workers face every day from potential ‘man-in-the-middle‘ (or MITM) attacks.
All of us will have used a public WiFi hotspot at some point either for personal or professional use. I spend a large amount of time travelling the country and very often a coffee shop is converted in to an office of convenience for an hour or two.
Understanding the risks of WiFi hotspots
But do we really understand the risks associated with connecting to these public networks? To understand the risk you first need to understand the functionality. Your mobile phone is constantly broadcasting a list of connections that it has connected to in the past. If it identifies one it has connected to previously the phone will automatically connect. Check this the next time you’re in your favourite coffee shop or fast food restaurant – by the time you’ve ordered, sat down and taken your phone out of your pocket you’ll find the WiFi is already connected.
And this is the risk, someone could easily be sat in the same café with a device that is mimicking the local WiFi signal. It’s labelled the same and as far as your phone is concerned it is the same. You won’t notice the difference either, however every key stroke, every search, every page visited, every username entered, and potentially password provided, is also visible to the person that set-up the hotspot.
Taking this a step further, imagine you’re at a conference, the ‘list’ put out by peoples’ mobiles can be read and will enable a cybercriminal to create multiple hotspots, connecting to any number of devices and pull information directly from them. As well as the MITM elements there could be other dangers – apps or websites leaking data, phishing attacks or mobile malware.
Protect yourself against Man In The Middle attacks.
For most mobile users, the simplest defence against Main In The Middle attacks is to switch from a shared Wifi connection to a tethered connection on your personal mobile phone. This acts as a Wifi hotspot that is only accessible to you. Even if a hacker can see your connection, they can't see your access password so they can't impersonate it. There's no sign on the wall telling everybody your password.
The disadvantage of using your phone as a personal Wifi hotspot has been cost. Until recently. Since early 2020, the cost of unmetered data plans has been tumbling. An unmetered data plan gives you a secure connection without the risk of incurring crippling data charges. It removes the security threat of a Man In The Middle attack at a reasonable cost.
Do you really know what information employees have access to?
The secondary risk for organisations is what information and data do employees hold on their devices that is at risk of being hacked while on public networks? In an article recently published by Adam Boynton, Wandera, he discusses the disconnect between what IT believe users have access to and what users actually can access: “A recent study found that IT staff believe just 19% of employees are capable of accessing customer records on mobile devices. In reality, 43% of employees have access to that data. Even worse, IT says just 8% of employees can access confidential or classified documents. In reality, that figure stands at 33%.” *
We are now well and truly in the data protection danger zone – with security breaches carrying fines averaging between 250k-400k!
With so much at stake it is critical for businesses to understand MITM attacks in order to identify the best solution to protect company assets and reputation.
Listen to our webinar to find out more
Intercity in conjunction with Wandera recently released a webinar on this topic, if you would like to find out more, listen now - Beyond Mobile Data Management -The next Step to Secure & Manage Mobile Data
* Can you really afford not to invest in mobile security? Adam Boynton
