29

Scenario: You are using your laptop computer, connected to a public WiFi network at a Starbucks, airport, etc.

Question: Can a stranger connected to that same WiFi network download the files from you computer? Can the stranger look at your files?

  • 5
    yes. I once accidentally entered the wrong computer when trying to copy a file from my friend's laptop while we're connecting to the same public wifi at a cafe. Guess what? The owner put their adult videos in the public documents folder. Of course it's due to the carelessness as mentioned below. You can find more information in security.stackexchange.com/q/36263/89181 security.stackexchange.com/q/14927/89181 – phuclv Mar 26 '18 at 9:57
  • 2
    @LưuVĩnhPhúc: You mean "their" as in they'd filmed them?! – Lightness Races in Orbit Mar 26 '18 at 17:01
  • The answer depends on the operating system and what all services and daemons are being run. – can-ned_food Mar 26 '18 at 20:16
  • @LightnessRacesinOrbit I mean "their" as their possessed file, not the recorded movie of their own (because even I don't know whose laptop is that) – phuclv Mar 27 '18 at 3:19
  • @LưuVĩnhPhúc: Jokes – Lightness Races in Orbit Mar 27 '18 at 12:07
51

Question: Can a stranger connected to that same WiFi network download the files from you computer? Can the stranger look at your files?

Yes, but it requires significant carelessness on the victim's part.

On Windows, for starters, you'd need to tell the system that the network you're connected is either Home or Work, not "Public". Since you should know you're in an airport, this is unlikely.

Then you should allow guest login (by default it isn't).

Alternatively, you must access some external unencrypted system supporting Windows authentication. The service should be outside the airport and allow logins from the Internet, and very few would allow it to run unencrypted.

Finally, that system and your own box must use the same user and password. This way, the password captured in the previous stage will also allow external logins on your system. OR you must have an easily guessable username, and the same password of some cleartext service you accessed.

Otherwise, the attacker might poison your DNS cache and "convince" your system that the Facebook server or the GMail server or what-have-you is actually inside his suitcase. Then he would either force a HTTPS connection (e.g. via a MitM attack, which you must ignore) or fake it in the clear (and you must not notice the fact that you're running in plain HTTP). This way, again, the attacker can get one of your passwords. If it is good for your system, or allows a password-retrieval attack on some other system, you (and/or your online banking account) are about to be pwn3d.

This is not the WiFi you were looking for

Actually the attacker needn't do much to gather access to your transmissions. He might have been the owner of the WiFi network all along, who just set up a rogue AP declaring itself to be "Airport Free WiFi". The fact that the AP name seems legitimate means nothing: there are systems already designed for this - buy one, charge it overnight, go to the airport and start trolling for fish. The system will optionally "massage" the data flowing through to ensure the maximum exploitability of passwords and credentials.


Once you are connected to a site you trust (or so you believe), you can be tricked into downloading and executing something that will give the attacker complete control, either directly (e.g. in Windows through WSH) or through some exploit.

On Linux the only relevant difference is that you should either share your disk or have remote administration port 22 (SSH) open. Both conditions are usually false in any sane distribution I know of.

But it's not just your files...

Having your disk safe is no guarantee for your online banking account, Dropbox, email etc. - the problem lies in credential thefts and/or impersonation; what is actually done with that comes after.

Which is why:

  • You should avoid using unknown networks,
  • If you do, use them through an encrypting VPN,
  • Always keep system security high (only declare "Home network" your network in your home)
  • Keep the system updated, with a suitable antivirus
  • Never reuse important passwords for different sites
  • Maintain situational awareness - notice things such as the "green lock" on HTTPS sites, small glitches in login screens that don't feel "right", and weirdnesses in URLs (e.g. "myonlinebank" becoming "myonIinebank")

Eternal vigilance is the price of liberty.

| improve this answer | |
  • 2
    @Matty good point. What I meant is that if you ever declare a home network, that should only be your home network. But you're better off not trusting even that (what with network printers that might be reachable from outside and/or download malicious OTA packages etc. - it's been known to happen: esecurityplanet.com/network-security/…) – LSerni Mar 26 '18 at 9:56
  • 2
    Yes, but it requires significant carelessness on the victim's part. Or extreme professionalism and preparedness of the attacker. – VL-80 Mar 26 '18 at 13:39
  • 2
    "Alternatively, you must access in the clear some external system supporting Windows authentication." What does "in the clear" mean? Honestly, that entire paragraph and the one after it don't make a lot of sense to me; can you provide an example of the kind of attack you're describing? – Anthony Grist Mar 26 '18 at 13:56
  • 1
    @AnthonyGrist He means unencrypted. I agree that the wording is a little confusing. The scenario being described is that you access a resource on an unencrypted channel, thus sending your username and password in plaintext, and that same username/password combination is the one which grants the attacker access to your machine because you've reused the password. – Jon Bentley Mar 26 '18 at 14:54
  • 1
    @LSerni In fairness to you, I understood "in the clear" to mean "unencrypted", but perhaps it's not as common an idiom in English as I think it is. :) – Dan J Mar 27 '18 at 3:34
2

Potentially, they can capture personal information, poison your dns cache and many other pretty nasty things, but they can't download your personal files without a few things going wrong on your behalf first.

If for some reason they could capture your passwords being transmitted in plaintext, they could ssh to your computer, assuming you are allowing incoming port 22 connections(unlikely)

If they could force you to accept a malicious file, you could be open to a reverse proxy attack whereby the file you accept will automatically attempt to connect the attackers system, giving them access to your system.

These attack vectors are not easy to do, they are possible but generally security concious users and most system hardened defaults are pretty good at preventing such attacks. Hope it helps

| improve this answer | |
  • 2
    What about the shared folders allowing access to Everyone ? – user6900 Mar 26 '18 at 2:41
  • @user6900 That would only apply if you have file sharing enabled. By default Windows will not enable file sharing on a network designated as "public". If you change that option, or choose to label the public Wi-Fi network as "private", well... – Bob Mar 26 '18 at 4:07
  • 2
    I see this all the time when I get onto public hotspots, and have wandered through other people's documents in amazement. It seems that people enable file sharing and leave some defaults in place which share a lot more than they realize. Or maybe they shared so much more when on a private network because it's easier, and forgot about it. Either way, there is no question that this happens. A lot. Oh I should add that this was on OS X, don't know about Windows. – JVC Mar 26 '18 at 16:01
  • good call, actually my answer was, unknowingly only for *nix based systems, I havent ventured to the windows dark side for a few years now, an certainly wouldnt consider public airport wifi with windows defaults. – Sean Davey Mar 27 '18 at 11:02
2

You would want to avoid using public wifi for sensitive information, unless you can be assured of a solid and safe connection. There is a practice known as Man-in-the-Middle in which a user nearby at the public wifi location has configured his computer to appear as if you are connecting to the local service. In reality, you are connecting to his computer, which is passing your activities through a filter to collect sensitive and useful information. Once collected, your activities are then forwarded to the intended destination.

| improve this answer | |
0

Yes they can, as with any internet connection, but you may find it easier to upload files to a shared location for them to download. The "push from device" ala stolen smartphone.

The safest way to allow someone to quickly download files from your device whilst on public wifi is to use your private network via VPN and share a folder on that network. This is the "road warrior" scenario.

Otherwise, they will need to know your IP address. Dynamic DNS with SSH for concurrent login will also work, but they will need permissions on the files. Dynamic DNS can be home grown, you could email the IP or drop it on a server, say.

You could also RDP/VNC to a machine on your private network, still a two step process if you are copying from the host device first. Giving them remote control of your device is also possible ala NetMeeting, but clumsy.

The least secure method would be to run a simple FTP server for them to access. Anyone can snort that. It may not bother you if it is only a shopping list or a fender bender happy snap.

Encrypted file + VPN + RDP/VNC will give you three layers, not counting the WiFi encryption.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.