9. The Application of Cybersecurity: Principles and Practices 249 fore, people may join the fake network without realizing it. It is likely that they will still have Internet access and will see no obvious indicators of compromise. This is a manin-the-middle attack, and it puts the hacker that is running the evil twin in a place of authority. They can monitor the IP addresses the victim is visiting, read all unencrypted web traffic, and serve spoofed websites. Some devices can be tricked into connecting to an evil twin without the victim needing to take any action. Laptops and smartphones record past wireless credentials and will automatically reconnect to wireless networks that are remembered when they come within range. If an attacker knows the credentials of a remembered wireless network for a target, he may be able to spoof that wireless network and trick the victim into connecting to it. One important thing to note, evil twin attacks cannot be conducted over the Internet. They are local attacks because the hacker’s wireless signal must be in the physical proximity of the victims. This mitigates the risk compared to other cyber attacks that can originate from anyone on the Internet anywhere in the world. A best practice to bolster security when using a public wireless network, whether it is password protected or not, is to sign-in to a VPN (virtual private network) immediately after connecting to the network. VPNs create an authenticated and encrypted channel between the user and the VPN server, and the VPN server becomes the launching-off point for all web browsing. All traffic that flows to a VPN must still first go through the untrusted wireless router, but the traffic cannot be read or undetectably tampered with by the router. When using a VPN, the user shifts trust from the local Internet gateway to the VPN provider, mitigating the risks of attacks like the evil twin attack (more on VPN best practices below). An even better option than using a VPN is connecting to a personal mobile hotspot instead of public wireless networks. However, this requires the user to have access to a mobile hotspot through a cellular provider which can be expensive, and in some locations a cellular signal may not be available. 9.2.5 Online Safety “I am sending you out like sheep among wolves. Therefore be as shrewd as snakes and as innocent as doves.” - Matthew 10:16 Most cyber threats are invited in from online. People can be lulled into a sense of safety and anonymity online and forget to be vigilant. This section covers some basic online safety measures. 9.2.5.1 Avoid the Dark Alleys of the Internet In physical space, some places are scarier than others. Dark alleys are places where a person could be robbed or assaulted. Most people instinctively avoid dark alleys, sensing the potential danger. The dark alleys of the Internet are not so obviously dangerous because the visceral sense of being physically vulnerable is not present. Examples of such online places include websites promoting illegal or immoral activity such as those offering free downloads of copyrighted software like games, textbooks, music, and movies. Visitors
RkJQdWJsaXNoZXIy MTM4ODY=