A new twist on the 'free Wi-Fi' scam
As technology professionals you are undoubtedly aware of the various “Free Wi-Fi” scams that turn up from time to time, from the issues with Windows XP and access points to actual honey traps and unscrupulous operations that weren’t exactly free. But I heard today about a new scam from a client who does trade show operations.
Keep in mind that the majority of trade shows are on a much smaller scale than those we traditionally associate with IT, and that for non-IT products, the attendees are usually not exceptionally technically astute. So when the trade show operators promote free Wi-Fi for attendees and vendors it is usually accepted as a given that there will be some form of free Wi-Fi available, though there may be no better performance than the level offered by budget motels.
Featured
And as we all know, the most effective malware attacks often come in the form of social engineering; give someone something they expect to see and they will likely click on it and move on. And that is what this scheme is based on. I discovered this when a friend called me this morning to tell me about their experience at a mid-sized, industrial equipment, trade show.
It seems that someone was using the trade shows promise of free Wi-Fi to get users to connect to an unsecured and presumably well-sniffed network so that these unknown actors could acquire passwords and other related internet connected information. A little technical knowledge and a tool like Wireshark makes this information fairly easy to acquire.
The social engineering part was this; attendees to the trade show would be presented with a wireless access point with a name like “Free TradeShowName Wifi” and expecting the free Wi-Fi related to the tradeshow, would use that connection.
The only problem was that it wasn’t the actual tradeshow network connection. And it is unlikely that someone went to the trouble of setting up this spoof network with anything other than nefarious purposes in mind.
Other than letting people know the name of the actual tradeshow network and putting up appropriate signage, there is little tradeshow management can do. Even providing a secured password protected wireless network for vendors and attendees won’t stop some percentage of people from attaching to the “Free”, seemingly official, network. And no matter how much you tell users to be very careful when using public Wi-Fi access, there will always be those who think those admonitions don’t apply to them or simply don’t understand the problem.