Security Issues in Public Hotspots

The security issues in public Wi-Fi LANs are different from those in corporate Wi-Fi LANs. The same goals are there: privacy, integrity, and so on. But because of the public nature of the network, there are some real additional threats. One of the underlying assumptions of corporate LANs is that there are only two groups of people using the network: those who are trusted and those who are untrusted. At the local level, most companies make no attempt to prevent one trusted person from attacking another. In other words, once you let two employees join the network, say George and Sue, you assume that they are both good citizens and will go about their legitimate business. You might have separate passwords for file access and so on, but you are not expecting George to impersonate Sue or Sue to try to hack into George's hard disk. If they were to do so, you would probably fire the offending party, who would then become part of the untrusted group.

The situation is quite different in a public hotspot. There are still two groups: those who can join and those who cannot. But the criterion for entry has nothing to do with trust; it just depends on whether you have paid your subscription fee. Unlike the corporate case, in this case you have to assume that one connected member may try to attack another.

Another difference between corporate and hotspot security goals is the motivation of the various participants. In a corporate LAN, it is generally assumed that the employees and employer share similar goals. The employer wants to protect the employees from attack and the employees (usually) have the interests of the company at heart. This is not the case in a wireless hotspot. The service provider just wants to get paid and doesn't really care whether you get hacked (except that it causes bad publicity for the business). The motivation of the service provider is to prevent fraud. The motivation of the users is to protect themselves, and they may not be concerned if a loophole allows them to let all their friends get access using the same account.

The third, and critical, difference between corporate and public access is that the network infrastructure behind the Wi-Fi LAN is not secure. In a corporate environment, the Wi-Fi LAN acts as a gateway between an insecure wireless world and a secure wired world. Behind the access points, the network is protected by locked wiring closets and server rooms (or in the case of smaller companies, the fact that the hub is on the boss's desk). In the public environment the backend network may be accessible to anyone, rather like an unprotected wireless network.

This difference in motivation places a greater responsibility on hotspot users to protect themselves. The rest of this chapter looks at the different ways in which hotspots are deployed and organized, but in most cases the differences are business related and do not help the security of the user. With this in mind, we look at some actions users should take before joining hotspot networks.