As an ethical hacker, I can’t believe the risks people routinely take when they access the internet in public

Christopher Hawkins, Lecturer in Cyber Security & Computer Science, writes for The Conversation

Chris Hawkins Conversation article

By protecting your data and devices, no matter where you are, you can avoid becoming a victim of cybercrime [[AberCPC/Alamy]

In the modern world we are all constantly connected, but this comes with risks. As most cybersecurity specialists will tell you, the biggest vulnerability in any system is the user – whether at home or work.

The most common ways in which hackers break into systems are via attacks on users such as phishing, rather than by breaching technical infrastructure. As much as 94% of all malware is delivered via email, while phishing is the primary means of attack in 41% of all incidents. This risk is also increasing, with 75% of security experts reporting an overall rise in cyberattacks year on year in 2023.

Many corporate IT teams have been spending heavily on training users to be more wary of such attacks. However, this has tended to focus on best practice in the workplace. In public areas, where people’s guards might be lowered, it’s quite a different story.

I’ve recently seen several examples of this for myself. As a certified ethical hacker with years of experience in cybersecurity and contributing to cybercriminal investigations, I can’t tell you how easy it is for these kinds of situations to be exploited by bad actors.

In the first incident, I was in a shop buying some household items. While I queued, staff were asking customers for email addresses to send them e-receipts for their items.

Woman on her phone
‘Yes to the discount code.’ Insta_photos

This might sound innocent, and it’s surely better for the environment than paper receipts, but it could easily be exploited by a savvy hacker who might be listening. Combined with contextual information such as location, item and cost, they could craft a phishing email that would probably fool most people. It could be an invite to complete a feedback survey, for instance, or a discount code for their next visit to the same store.

On another occasion I was at a live concert. While we waited for the show to begin, an individual in front of me was browsing his phone. From observing for just a short time, I ascertained his name, job, address, vehicle, phone number and even bank balance. Again, this could have been used by a hacker in a number of malicious ways, including posing as the individual to steal their identity or even coercing them to act against their employer, say by threatening to reveal sensitive information.

We therefore all need to be mindful of the information that we are exposing to strangers when we are in public. Equally, we need to think about what devices we are using, and what we are connecting them to.

Unsecured network risks

While at the same concert, I saw numerous people connecting to the stadium wifi, which was totally unprotected and required no authentication. When you log in to an unsecured network, it exposes your device to risks such as evil twin attacks.

Evil twin attacks involve the attacker creating a wifi hotspot, which can be set to any name they choose, such as “stadium wifi 2” or whatever. When an unprotected device connects to this network, the attacker can potentially steal the data they are transmitting.

It can also be used for other nefarious purposes such as snooping on confidential networks, injecting malware into downloads or “man-in-the-middle” attacks in which the hacker poses as the other person in a communication, again usually to steal information.

People can be exposed to similar threats on unsecured networks through another hacking ruse known as packet sniffing. This is where a hacker uses a program to monitor the data moving over the network and steal information.

Wifi logo in digital illustration
Connecting now … Alexander Supertramp

You can avoid these risks by logging in from a virtual private network (VPN), not that I saw anyone doing that at the concert. More generally, people can protect themselves from identity theft by, for instance, having anti-phishing systems in their inboxes.

However, the easiest defence of all is to be alert to the risks and take sensible precautions in public. By protecting your data and devices, no matter where you are, you can avoid becoming one of the victims.

This article is republished from The Conversation under a Creative Commons license. Read the full article: 'As an ethical hacker, I can’t believe the risks people routinely take when they access the internet in public' at The Conversation

The Conversation

Christopher Hawkins

Lecturer

Chris is a PhD researcher and Certified Ethical Hacker. His main area of interest is in Ethical Hacking and the breach of computer systems, as well as wider Cyber Security and Law Enforcement.

Latest news


Naser Rashid in his graduation cap and gown

People person finds his calling

A University of Staffordshire graduate is making positive changes to people’s lives after qualifying as an ODP

Hand holding a phone

Beacon app to form part of trial on student wellbeing

An app used by University of Staffordshire students is to form part of a trial on the impact of wellbeing interventions.

Stacie Chorlton-Lythgoe in her graduation cap and gown

Graduate aims to give children a sporting chance

A mum-of-three is using her passion for sport to help children lead happier and healthier lives

in the UK for Quality Education

Sustainable Development Goal 4, Times Higher Education Impact Rankings 2024

for Career Prospects

Whatuni Student Choice Awards 2023

for Facilities

Whatuni Student Choice Awards 2023

for Social Inclusion

The Times and The Sunday Times Good University Guide 2023

of Research Impact is ‘Outstanding’ or ‘Very Considerable’

Research Excellence Framework 2021

of Research is “Internationally Excellent” or “World Leading”

Research Excellence Framework 2021

Four Star Rating

QS Star Ratings 2021