Transcription complète de Is Hotel WiFi Safe?

over the years. 36 00:02:16,190 --> 00:02:17,670 We're talking way back, right? 37 00:02:17,670 --> 00:02:22,310 We've been always having this conversation about wifi on the show, and if you look 38 00:02:22,330 --> 00:02:28,370 back on our previous episodes, you'll see we're kind of talking about the same thing. 39 00:02:28,370 --> 00:02:33,170 Even though there's new attacks and there's kind of new methods, but the end of the day, 40 00:02:33,170 --> 00:02:37,730 the same advice still applies that we're going to talk about on this podcast today. 41 00:02:37,730 --> 00:02:42,130 It's because it's not all technology that has the risks. 42 00:02:42,130 --> 00:02:43,130 That's right. 43 00:02:43,130 --> 00:02:44,130 Yeah. 44 00:02:44,130 --> 00:02:45,130 That's right. 45 00:02:45,130 --> 00:02:48,130 So just to kind of frame everything, so I was kind of inspired by a couple of weeks 46 00:02:48,130 --> 00:02:54,630 ago, Microsoft released some details about an attack that they've been seeing more focused 47 00:02:54,630 --> 00:03:01,590 on Entra ID, which is kind of the central authentication system for Microsoft products. 48 00:03:01,590 --> 00:03:07,630 And there is a dub this attack called captive crunch, not captain crunch, like the cereal. 49 00:03:07,630 --> 00:03:12,110 I mean, a little confusing there, but captive crunch. 50 00:03:12,110 --> 00:03:17,070 And this malware campaign is essentially pretty widespread according to Microsoft. 51 00:03:17,090 --> 00:03:24,450 So this has been affecting hotel chains, large conference centers, you know, things like that. 52 00:03:24,450 --> 00:03:31,890 And what they found was that, you know, these are mostly state sponsored threat actors that 53 00:03:31,890 --> 00:03:33,330 are doing these things. 54 00:03:33,330 --> 00:03:39,450 But what happens is you'll be just like you normally do connect to the hotel wifi 55 00:03:39,450 --> 00:03:43,410 and you get this thing called a captive portal, which is, you know, some type of 56 00:03:43,430 --> 00:03:48,790 login or authentication to, you know, so not everybody can access the wifi network, but 57 00:03:48,790 --> 00:03:50,910 hotel guests specifically. 58 00:03:50,910 --> 00:03:55,710 And these vary by hotel chain, by the systems that they're using. 59 00:03:55,710 --> 00:04:01,950 But what's happening is that users will get this pop up for, hey, Microsoft found malware 60 00:04:01,950 --> 00:04:08,750 on your machine, you need to click here, or they'll be a prompt for your user credentials, 61 00:04:08,770 --> 00:04:15,050 like for your Microsoft login credentials with something saying, hey, you know, this is Microsoft 62 00:04:15,050 --> 00:04:16,050 tech support. 63 00:04:16,050 --> 00:04:20,690 We found this thing on your computer, you need to follow these instructions and all these 64 00:04:20,690 --> 00:04:26,290 things kind of vary, but it's one of those things of if you're not aware during that 65 00:04:26,290 --> 00:04:32,410 login process of

something weird like, why is the hotel asking me to scan my computer 66 00:04:32,510 --> 00:04:36,470 or why am I getting this Microsoft login prompt? 67 00:04:36,470 --> 00:04:39,630 It definitely is out of the ordinary. 68 00:04:39,630 --> 00:04:43,750 And I think that's the one trigger for a user, right? 69 00:04:43,750 --> 00:04:46,070 Is you're not seeing a hotel login page. 70 00:04:46,070 --> 00:04:49,430 That should be your first warning sign that something else is going on here. 71 00:04:49,430 --> 00:04:51,830 Yeah, it's an interesting problem. 72 00:04:51,830 --> 00:04:57,350 And as I was saying to you earlier, I started looking at this about 10 years ago 73 00:04:57,350 --> 00:05:00,510 after the Honey Stick project where I was dropping USB drives. 74 00:05:00,510 --> 00:05:05,570 I started exploring the possibility of doing a project called the Honey Point project where 75 00:05:05,570 --> 00:05:14,210 we would set up some rogue, but not malicious access points with free Wi-Fi, capture some 76 00:05:14,210 --> 00:05:20,290 data and just sort of see what was exposed and do a little experiment and report on that. 77 00:05:20,290 --> 00:05:25,410 And it turned out that technologically it was actually kind of hard to, you know, 78 00:05:25,430 --> 00:05:31,230 actually see anything because even 10 years ago, most important data streams were being 79 00:05:31,230 --> 00:05:35,710 encrypted and a lot of people using VPNs even then. 80 00:05:35,710 --> 00:05:37,710 So you couldn't really see much. 81 00:05:37,710 --> 00:05:41,030 It doesn't mean that we couldn't have done something, but I decided not to go forward 82 00:05:41,030 --> 00:05:44,870 with that one just because there wasn't a lot of free data available. 83 00:05:44,870 --> 00:05:49,590 We could have though, as you suggested, done something a little more on the social 84 00:05:49,590 --> 00:05:55,270 engineering side because when you set up one of these access points, you can 85 00:05:55,330 --> 00:05:59,490 create, as you said, a captive portal that can collect any information you want. 86 00:05:59,490 --> 00:06:04,290 You could, you know, you could typically, hotels always ask for your room number in 87 00:06:04,290 --> 00:06:10,050 your name or something, but there are other free Wi-Fi portals where they just 88 00:06:10,050 --> 00:06:13,050 ask for an email address and, you know, it seems like a fair exchange. 89 00:06:13,050 --> 00:06:15,890 I'll give you my email address and you can be free Wi-Fi, right? 90 00:06:17,130 --> 00:06:22,930 But you may immediately get an email, you know, that is a phishing email and 91 00:06:22,950 --> 00:06:25,830 trying to social engineer you from that point of view, but you could also get, 92 00:06:25,830 --> 00:06:32,350 as you said, those pop-ups that could try to download malware right to your computer. 93 00:06:32,750 --> 00:06:37,590 So it's more of a social engineering risk, really, than the technology risks 94 00:06:37,590 --> 00:06:39,750 that we all sort of assumed it would be. 95 00:06:40,190 --> 00:06:41,510 Yeah, you're exactly right. 96 00:06:41,510 --> 00:06:45,030 And the other thing I wanted to bring up is that a lot of people think 97 00:06:45,030 --> 00:06:48,270 that if I'm using a VPN, that's going to protect me. 98 00:06:48,870 --> 00:06:50,710 And that isn't always the case, right? 99 00:06:50,710 --> 00:06:57,710 Because a VPN is used for really hiding the web traffic that you are sending 100 00:06:57,710 --> 00:07:01,850 across the ISP that the hotel is using. 101 00:07:01,850 --> 00:07:06,010 Or even if you're using a VPN at home, your, your internet access provider, 102 00:07:06,010 --> 00:07:10,290 right, is they're unable to see your queries and what your, what websites 103 00:07:10,290 --> 00:07:12,490 you're going to and things like that. 104 00:07:12,730 --> 00:07:16,770 Now VPNs is a bigger issue altogether because there's been issues 105 00:07:16,770 --> 00:07:21,510 with some VPN providers are able actually to see what you're doing. 106 00:07:21,510 --> 00:07:26,110 And there's been court subpoenas and all these things of how much is logged, 107 00:07:26,230 --> 00:07:28,150 right, with these VPN providers. 108 00:07:28,470 --> 00:07:32,910 But it's really not protecting you from a malware type of attack where, 109 00:07:33,150 --> 00:07:37,270 like in this case, with the captive crunch malware, like you're still 110 00:07:37,270 --> 00:07:40,870 going to get a pop-up, like you're still going to get, if someone has 111 00:07:41,310 --> 00:07:45,190 attacked the actual hotel network in that captive portal system, 112 00:07:45,490 --> 00:07:50,330 turning your VPN on before that isn't really going to help you at all. 113 00:07:50,570 --> 00:07:54,170 Cause that's just protecting the information that you're sending. 114 00:07:54,370 --> 00:07:58,850 And by the way, that is still all encrypted through the use of HTTPS, 115 00:07:59,210 --> 00:08:04,330 which I know we've talked about that in the past where before, way back 116 00:08:04,330 --> 00:08:08,890 in the day, because Scott and I are old, we remember where you could 117 00:08:08,890 --> 00:08:14,850 use a tool called SSL strip, which would basically force a captive 118 00:08:14,850 --> 00:08:19,710 portal or, you know, another system into plain text, essentially. 119 00:08:19,710 --> 00:08:24,150 So then you could intercept what people were doing on a hotel network 120 00:08:24,870 --> 00:08:25,870 very easily. 121 00:08:26,110 --> 00:08:31,110 And today that is much harder to do from an attacker perspective. 122 00:08:31,590 --> 00:08:31,870 Yeah. 123 00:08:31,870 --> 00:08:35,950 And you probably have seen, I've seen this many times, you go to a hotel 124 00:08:35,950 --> 00:08:38,830 and there'd be four or five Wi-Fi hotspots, right? 125 00:08:39,190 --> 00:08:43,390 And one of them will say, you know, Hilton guests or whatever. 126 00:08:43,730 --> 00:08:46,810 And then you'll see one

that's saying, Hilton free Wi-Fi. 127 00:08:47,530 --> 00:08:48,850 And what are you going to pick? 128 00:08:48,850 --> 00:08:49,130 Right. 129 00:08:49,570 --> 00:08:51,730 If you're cheap, you're going to pick the free one because it doesn't 130 00:08:51,730 --> 00:08:53,570 have any codes needed to get in. 131 00:08:53,970 --> 00:08:58,570 And that sounds like a pretty good, you know, scenario for attacking somebody. 132 00:08:59,010 --> 00:08:59,330 Yeah. 133 00:08:59,330 --> 00:09:02,110 So that's, that's a great point, Scott, is, you know, be aware 134 00:09:02,110 --> 00:09:05,650 of the hotel network you are connecting to because, yeah, 135 00:09:05,650 --> 00:09:10,450 somebody could easily put up a fake portal or a fake access 136 00:09:10,450 --> 00:09:13,710 point and redirect traffic through, through them. 137 00:09:14,030 --> 00:09:15,550 That is totally plausible. 138 00:09:15,910 --> 00:09:19,750 Now, the biggest thing I hear from a lot of people is like, Oh my gosh, 139 00:09:19,750 --> 00:09:22,350 should we even use hotel Wi-Fi? 140 00:09:22,830 --> 00:09:27,070 And like we always talk about this goes back to your threat model, right? 141 00:09:27,110 --> 00:09:29,950 Depending on who you are and what you do and what types of 142 00:09:29,950 --> 00:09:34,190 activities you're using the internet for, you may want to, you 143 00:09:34,190 --> 00:09:39,270 know, purchase one of those hotspot devices or what, like what I do 144 00:09:39,290 --> 00:09:43,570 when I travel, I use my phones built in personal hotspot. 145 00:09:43,930 --> 00:09:48,490 Not that I don't trust the Wi-Fi network, but I actually find that 146 00:09:48,490 --> 00:09:52,770 the speed and the quality of that connection over my mobile phone 147 00:09:52,770 --> 00:09:56,770 is actually better than a lot of these crappy Wi-Fi networks. 148 00:09:56,930 --> 00:10:00,290 I mean, it was a thing that a lot of people were scared to do 149 00:10:00,290 --> 00:10:03,090 just because of the cost of mobile data years ago, but now 150 00:10:03,090 --> 00:10:05,770 it's pretty much, you know, included in every plan. 151 00:10:05,770 --> 00:10:09,050 So the cost shouldn't really be an issue anymore. 152 00:10:09,290 --> 00:10:10,610 I do the same thing. 153 00:10:10,610 --> 00:10:14,130 And the only time I would use a free one is if, you know, the 154 00:10:14,130 --> 00:10:16,010 mobile data coverage is really weak. 155 00:10:16,850 --> 00:10:19,690 And, you know, you can get something stronger locally, but 156 00:10:20,010 --> 00:10:23,650 then I would use a VPN and I would also double check, you 157 00:10:23,650 --> 00:10:26,530 know, any important portals or you're going to enter 158 00:10:26,530 --> 00:10:30,330 information on because you can still see an, you know, a 159 00:10:30,330 --> 00:10:33,970 TLS encryption logon icon or whatever it is, right, that 160 00:10:33,970 --> 00:10:36,610 they show you when you're on a secured page, but that 161 00:10:36,610 --> 00:10:38,170 doesn't mean you're on the legitimate page. 162 00:10:38,230 --> 00:10:41,510 It only means that you've got SSL or TLS turned on. 163 00:10:41,830 --> 00:10:44,070 I mean, I think the biggest piece of advice too is if you just 164 00:10:44,070 --> 00:10:47,710 see anything strange, like, you know, popups or certificate 165 00:10:47,710 --> 00:10:52,150 warnings or these types of things on a hotel network, you 166 00:10:52,150 --> 00:10:55,510 should probably disconnect as soon as possible, right? 167 00:10:55,510 --> 00:10:57,350 Like, because that is not normal. 168 00:10:57,350 --> 00:10:59,590 You should not be seeing certificate errors. 169 00:10:59,830 --> 00:11:03,750 You should not be seeing popups saying, this is 170 00:11:03,750 --> 00:11:07,270 Microsoft support, install this thing, right? 171 00:11:07,290 --> 00:11:10,970 Or like your point, Scott, about if you're, if you put in an 172 00:11:10,970 --> 00:11:13,570 email address into a portal and then all of a sudden you're 173 00:11:13,570 --> 00:11:17,210 getting these weird email messages, this happens at 174 00:11:17,250 --> 00:11:18,650 airports too, right? 175 00:11:18,930 --> 00:11:22,970 If that system was compromised, you need to be aware of that. 176 00:11:22,970 --> 00:11:26,610 So again, I think the message is just being more aware 177 00:11:26,730 --> 00:11:30,090 of anything strange that happens during that login 178 00:11:30,090 --> 00:11:33,130 process and obviously you're not going to get, you 179 00:11:33,130 --> 00:11:36,890 know, Microsoft scan malware requests. 180 00:11:37,330 --> 00:11:40,250 As soon as you log into a hotel network, that is not normal. 181 00:11:40,770 --> 00:11:43,330 So yeah, really important information, I think, for 182 00:11:43,330 --> 00:11:43,970 being able to know. 183 00:11:44,210 --> 00:11:45,410 Just something to be aware of. 184 00:11:45,410 --> 00:11:48,170 I mean, I know we're coming towards the end of travel 185 00:11:48,170 --> 00:11:50,250 season, you know, the end of summer is here. 186 00:11:50,250 --> 00:11:52,930 I know we've got Labor Day this weekend or by the time 187 00:11:52,930 --> 00:11:55,250 you listen to this episode, it will be Labor Day when 188 00:11:55,250 --> 00:11:58,130 this episode is released in the US, but it's always 189 00:11:58,130 --> 00:12:02,450 good to have kind of these travel tips around how 190 00:12:02,450 --> 00:12:05,130 tell you how to use Wi-Fi more securely, hotel 191 00:12:05,130 --> 00:12:06,250 network or not. 192 00:12:06,550 --> 00:12:06,990 All right. 193 00:12:06,990 --> 00:12:08,950 So I think that's all we have time for today, but Scott, 194 00:12:08,950 --> 00:12:12,590 I wanted to give you a chance to plug the book again. 195 00:12:12,590 --> 00:12:12,950 The book. 196 00:12:12,950 --> 00:12:13,390 Yes. 197 00:12:13,590 --> 00:12:14,070 Yeah. 198 00:12:14,110 --> 00:12:14,470 Cool. 199 00:12:14,510 --> 00:12:15,070 Let me just see. 200 00:12:15,070 --> 00:12:15,870

How's that look there? 201 00:12:16,590 --> 00:12:17,430 Oh, there we go. 202 00:12:17,590 --> 00:12:18,110 Very nice. 203 00:12:18,110 --> 00:12:20,870 It's a little bit cropped, but yeah, there's my, my 204 00:12:20,870 --> 00:12:24,670 first version of the cover and title, the digital 205 00:12:24,670 --> 00:12:27,670 legacy tree, ensuring your loved ones can access the 206 00:12:27,670 --> 00:12:29,390 digital accounts they need after you die. 207 00:12:29,590 --> 00:12:31,630 The title may actually change a little bit based 208 00:12:31,630 --> 00:12:32,230 on feedback. 209 00:12:32,430 --> 00:12:34,750 I have quite a few people doing reviews now, but 210 00:12:34,770 --> 00:12:37,050 I'm really interested, especially in, you know, 211 00:12:37,130 --> 00:12:41,090 security experts or financial planners, estate planners 212 00:12:41,810 --> 00:12:43,570 who have, you know, a lot of experience in these 213 00:12:43,570 --> 00:12:43,810 areas. 214 00:12:43,810 --> 00:12:47,290 I'd really love to get more stories and feedback on 215 00:12:47,290 --> 00:12:50,090 that, but a couple of interesting, you know, quotes 216 00:12:50,090 --> 00:12:54,890 I just love to relay from early beta readers saying 217 00:12:54,890 --> 00:12:57,450 things like, this is a remarkable resource. 218 00:12:57,450 --> 00:12:59,370 I've recommended all my family members to get 219 00:12:59,370 --> 00:13:00,530 a copy of it for their use. 220 00:13:00,530 --> 00:13:02,890 Looking forward to seeing you get this published. 221 00:13:03,550 --> 00:13:06,630 Also, I keep getting, keep being impressed with your 222 00:13:06,630 --> 00:13:08,630 detail, which is very nice to hear. 223 00:13:08,630 --> 00:13:12,110 So yeah, so yeah, if you're interested, Tom, I'll put 224 00:13:12,110 --> 00:13:15,070 the link in the, in the show notes, but it's 225 00:13:15,070 --> 00:13:16,950 securityperspectives.com. 226 00:13:17,030 --> 00:13:19,230 You go there, you can find the link to the 227 00:13:19,390 --> 00:13:22,190 digital legacy tree, a book and tools. 228 00:13:22,350 --> 00:13:24,350 And yeah, congratulations on that. 229 00:13:24,350 --> 00:13:24,790 It's great. 230 00:13:24,790 --> 00:13:27,590 I love seeing it take off and you've been getting 231 00:13:27,590 --> 00:13:29,550 good feedback and that's great. 232 00:13:29,550 --> 00:13:31,630 So we'll continue to give that. 233 00:13:31,690 --> 00:13:34,170 Hope to publish this in the next month or two. 234 00:13:34,170 --> 00:13:37,090 Um, it's, it's going to be self published and you know, 235 00:13:37,090 --> 00:13:40,970 it's, I think it'll be pretty straightforward. 236 00:13:40,970 --> 00:13:43,450 In fact, I'm going to be probably offering free 237 00:13:43,450 --> 00:13:46,690 versions of the, the Kindle version for a while 238 00:13:46,690 --> 00:13:48,130 until I get some reviews. 239 00:13:48,130 --> 00:13:50,330 So stay tuned for how you can get that. 240 00:13:50,930 --> 00:13:51,690 All right, everyone. 241 00:13:51,730 --> 00:13:53,930 Well, thank you again for listening and 242 00:13:53,930 --> 00:13:56,610 subscribing and sharing the podcast with your 243 00:13:56,610 --> 00:13:57,610 friends and colleagues. 244 00:13:57,610 --> 00:13:58,770 It's much appreciated. 245 00:13:59,010 --> 00:14:00,810 We love getting feedback by the way. 246 00:14:01,070 --> 00:14:03,030 If you have feedback about this episode, you 247 00:14:03,030 --> 00:14:06,030 can drop a comment in our YouTube video for 248 00:14:06,030 --> 00:14:08,670 this, or you can send us an email at feedback 249 00:14:08,670 --> 00:14:10,150 at shared security.net. 250 00:14:10,510 --> 00:14:13,670 So until next time, stay safe, stay secure 251 00:14:13,710 --> 00:14:14,950 and stay private. 252 00:14:14,990 --> 00:14:16,550 Thank you for listening or watching. 253 00:14:16,790 --> 00:14:19,870 If you liked this episode, hit subscribe, share 254 00:14:19,870 --> 00:14:21,990 it with your friends and colleagues or jump 255 00:14:21,990 --> 00:14:24,710 into our community at shared security.net 256 00:14:24,710 --> 00:14:27,310 slash supporter to keep the conversation going. 257 00:14:27,430 --> 00:14:29,590 Thanks again, and we'll see you next week 258 00:14:29,590 --> 00:14:32,090 for another episode of shared security.