3 min read

Don't Play the Attacker's Game, Use a VPN on Public Wi-Fi

Silviu STAHIE

November 25, 2021

Ad One product to protect all your devices, without slowing them down.
Free 90-day trial
Don't Play the Attacker's Game, Use a VPN on Public Wi-Fi

A VPN solution could be all that stands between your data and a determined criminal. The scenarios in which a VPN makes all the difference are not always transparent to regular users. People would use it much more often if they only knew what they expose themselves to every single day.

The need for a VPN (virtual private network) is a simple one, for the most part. It's one of the safest ways to connect to another place on the internet in a way that makes it very difficult for anyone to intercept the traffic.

The traffic itself might seem worthless at first glance. After all, what can an attacker do after intercepting a Google search, for example? In reality, we're sending and receiving a lot of precious data. We use credentials to log in to services. We enter credit card details on shopping websites, we upload files to the cloud, and much more. Any of this could be of value to a cybercriminal.

Just the possibility of someone intercepting our traffic should be enough to keep us on guard, but how can we know that we're exposed or that we can fall victim?

Public Wi-Fis, the hidden danger of free internet

How often do we connect to a free Internet hotspot because it's cheap or convenient? Whether we're out for a coffee, working on a project, or simply walking about, we find ourselves in need of an internet connection. Lo and behold, there's free Wi-Fi in the area.

The trappings of a free Wi-Fi network are all too familiar to security experts, but people seem to welcome them with open arms. Users don't often consider that criminals can set up a Wi-Fi network to steal data using free internet as bait.

Not only is it possible, but it has also been done. Until billions of websites make significant changes, it will remain a problem. The only solution until then is a VPN.

SSL stripping is the way

Let's take an example of a common situation that can happen to anyone to show why we should use VPN solutions when connecting to the internet: an attacker sets up a Wi-Fi network that he completely controls. A user connects to the Wi-Fi and starts browsing a website, looking to buy something. Usually, the connection between the user and the website is encrypted, so even if the attacker gets that data, he can do nothing with it.

The attacker forces the user to connect to the internet through a proxy server he controls. The connection between the user and the attacker's proxy is not encrypted, but the connection between the website and the proxy is. As far as the website is concerned, this is a legitimate connection.

This is where the attacker's magic happens. The proxy forces the user to downgrade to an unencrypted version of the website, which means all the data the victim now sends is in plain text. And that includes passwords, usernames and credit card numbers. Everything is laid bare. Unless the user is paying attention and sees that the usual lock icon is no longer present, there's no difference between the two websites.

The solution

Ideally, all websites communicate in an encrypted manner with the users accessing them. However, many of them don't enforce it, and oftentimes the initial handshake happens through unencrypted channels before the switch to encryption. Simply put, it will take a long time for the practice of SSL stripping to become ineffective.

Until then, users have two options. Completely avoid public Wi-Fi or use Bitdefender Premium VPN. The user connects remotely to a secure server, and the traffic is encrypted. Even if the attacker somehow manages to go through with the SSL stripping process, the connection between the user and the VPN remains encrypted, so any data he might capture will be worthless.

Online security is something that most people take very seriously when working from the comfort of their own homes or office. Why not do the same when connecting to unsafe public networks?

tags


Author



Right now

Top posts

The Holiday Guide to Tech Support: Fixing the Family Computer

The Holiday Guide to Tech Support: Fixing the Family Computer

November 24, 2021

2 min read
Bitdefender Celebrates 20 Years of Cybersecurity Leadership

Bitdefender Celebrates 20 Years of Cybersecurity Leadership

November 04, 2021

3 min read
Bitdefender Study Reveals How Consumers Like (and Dislike) Managing Passwords

Bitdefender Study Reveals How Consumers Like (and Dislike) Managing Passwords

October 26, 2021

3 min read
What are drive-by download attacks and how do you prevent them?

What are drive-by download attacks and how do you prevent them?

October 25, 2021

2 min read
Criminals Can't Wait to Add Your IoT Device to Their DDoS Networks

Criminals Can't Wait to Add Your IoT Device to Their DDoS Networks

October 22, 2021

2 min read
Six in 10 Consumers Faced a Cyber Threat in 2021, New Bitdefender Study Reveals

Six in 10 Consumers Faced a Cyber Threat in 2021, New Bitdefender Study Reveals

October 20, 2021

3 min read

FOLLOW US ON

SOCIAL MEDIA


You might also like

Phishers Targeting Victims with ‘Free’ PCR Test for Omicron COVID-19 Variant Phishers Targeting Victims with ‘Free’ PCR Test for Omicron COVID-19 Variant
Filip TRUȚĂ

December 03, 2021

2 min read
WordPress Plugin Vulnerability Affected More than 80,000 Websites; Patch Is Now Out WordPress Plugin Vulnerability Affected More than 80,000 Websites; Patch Is Now Out
Silviu STAHIE

December 03, 2021

1 min read
Man charged with Ubiquiti data breach and extortion was employee assigned to investigate hack Man charged with Ubiquiti data breach and extortion was employee assigned to investigate hack
Graham CLULEY

December 03, 2021

2 min read