1.3 - Best Practices for Public Networks

Adversary Classification by Skill Level

Low-Skilled Adversaries

These attackers don't have the technical chops to build their own tools, so they rely on pre-built malicious software made by more advanced attackers.

What they look like:

Use purchased or free tools, downloading ready-made exploit kits from forums or the dark web

Target known vulnerabilities that already have patches out there

Can't adapt when their tools get blocked

Follow tutorials and use automated tools without really understanding how they work

Example: someone with minimal coding skill buys a $50 ransomware kit off an underground forum. It comes with pre-built malware, a dashboard to track infections, and deployment instructions. They target small businesses running outdated Windows systems. Once those businesses patch up and add real security software, the attacks stop working completely because the attacker can't modify the malware.

Common tools: automated phishing kits with fake login pages already built, point-and-click exploit frameworks like Metasploit, DDoS-for-hire services, credential stuffing tools.

High-Skilled Adversaries

These attackers have serious technical knowledge and deep understanding of vulnerabilities. They're the most dangerous threats out there.

What they look like:

Write custom malware tailored to specific targets

Modify existing exploits to get around new defenses

Find zero-day vulnerabilities before anyone else knows about them

Get past intrusion detection, firewalls, and antivirus

Pivot quickly when one method gets blocked

What's a zero-day? It's a previously unknown vulnerability, meaning developers have had zero days to fix it. These are extremely valuable since no patch exists and security systems don't recognize the attack pattern yet.

Example: a state-sponsored group finds a vulnerability in widely used VPN software that lets them remotely execute code. They build a custom exploit that slips past every existing security product since there's no signature for it yet. They use it to get into government networks for six months before anyone notices.

Other advanced capabilities: reverse engineering commercial software to find flaws, building polymorphic malware that changes its own code to dodge detection, custom encryption to hide command and control traffic, chaining exploits together to escalate privileges and move around a network.

Telling them apart: look at the tools and the vulnerability. An attack that uses a purchased, ready-made tool against a known vulnerability (one that already has a patch) points to a low-skilled adversary. An attack that uses custom or modified malware, adapts when it gets blocked, or exploits a zero day points to a high-skilled adversary.

Adversary Motivations

Adversaries have a variety of motivations, including greed (financial gain), a desire for recognition, dedication to a cause or personal beliefs (ideology), revenge, and politics. Knowing the likely motive helps defenders figure out who might target them and what they're after.

Financial gain: ransomware demanding crypto payments, banking trojans draining accounts, credit card skimmers, cryptomining malware.

Recognition and reputation: defacing high-profile sites, leaking data for attention, competing for status in underground forums, publishing vulnerabilities before vendors can patch.

Ideological causes (hacktivism): environmental activists disrupting industrial companies, political groups defacing government sites, animal rights activists leaking research documents, privacy advocates exposing surveillance programs.

Revenge: fired employees sabotaging systems on their way out, ex-partners leaking private info, students attacking school networks after getting in trouble, customers targeting businesses after disputes.

Political objectives: intelligence agencies running espionage, military disrupting enemy infrastructure, political campaigns spreading disinformation, nations sabotaging rivals' critical infrastructure.

Wireless Network Attacks

Evil Twin Attacks

An evil twin is a fake wireless access point that copies a real one. Victims connect without realizing it, letting the attacker intercept everything.

Here's the setup in more detail: the adversary sets up their own wireless access point (WAP), the device that broadcasts a Wi-Fi network, and gives it a service set identifier (SSID), the network's name, that's similar or identical to the target network's. The adversary's network is called the evil twin. Anyone who picks it by mistake sends their network traffic through the adversary's device.

How it works:

The attacker figures out the target network's name (SSID)

They set up their own access point with the same or a very similar name

They boost their signal or get physically close so their fake network looks stronger

Devices auto-connect to the strongest matching signal, or users pick it manually thinking it's legit

All traffic through the evil twin flows through the attacker's device

Example: a coffee shop offers free Wi-Fi called "CoffeeHouse_Guest." An attacker sits in the parking lot running an evil twin with the same name and a stronger signal. Customers' phones connect automatically, and as they browse and check email, the attacker grabs login credentials, session cookies, and credit card numbers off unencrypted sites.

SSID tricks: identical names (Airport_WiFi vs Airport_WiFi), subtly changed names (Starbucks vs Starbucks_Free), or generic trusted-sounding names like Free_Public_WiFi.

What gets captured: login credentials on unencrypted sites, session cookies for account hijacking, unencrypted emails, uploaded or downloaded files, browsing history and search queries, unencrypted messaging.

What the attacker can't read: traffic that uses an encrypted protocol like HTTPS. The evil twin still carries that traffic, but the attacker only sees scrambled data, not the passwords, messages, or pages inside it. Since most websites and apps now use HTTPS, attackers who want passwords often add another trick, like a fake sign-in page.

Fake captive portals: a captive portal is the sign-in page some public Wi-Fi networks show before they let you online. An evil twin can show a fake one that asks for an email and password, or for your login to another online platform. Whatever the victim types goes straight to the attacker. Encryption doesn't help here, because the victim is typing the password into the attacker's own page.

Jamming Attacks

A jamming attack is a denial of service attack where an attacker floods the radio frequency with interference, blocking legitimate wireless communication.

In more technical terms, the adversary floods the area with a strong electromagnetic (EM) signal in the same frequency range as the wireless network. That signal drowns out the legitimate traffic between the access point (AP) and its users, so devices can't connect or stay connected.

How it works:

Figure out which frequency band the network uses (2.4 GHz or 5 GHz)

Use radio transmitters or jamming equipment to broadcast a powerful signal on that same frequency

The jamming signal is much stronger than the real Wi-Fi signals, so devices can't pick out actual traffic

Devices lose connectivity or can't connect at all

This counts as a denial of service because it stops legitimate users from accessing the network, just by making the airwaves unusable rather than breaking into the access point itself.

Example: during a corporate presentation, an attacker parks outside with a portable radio jammer targeting 2.4 GHz. Within seconds every Wi-Fi device loses internet. Cloud apps stop working, wireless presentation systems fail, IoT devices drop off. This goes on for an hour, completely disrupting business without ever touching the actual network.

Other uses: disrupting a competitor's operations, blocking security cameras from uploading footage, interfering with emergency comms, creating a diversion during a physical break-in, sabotaging events or conferences.

Detecting jamming is hard since it's tough to tell apart from environmental interference or equipment malfunction without specialized tools.

War Driving

War driving is driving or walking around scanning for wireless signals to map out networks, spot weak security, and find where signal leaks outside a building.

How it works:

Attacker sets up a vehicle with a laptop, wireless adapter with an external antenna, and GPS

While moving, software detects beacon frames from access points

It logs each network's name, security type, signal strength, and GPS location

The attacker builds a map and picks out vulnerable targets

What gets gathered: security type (open, WEP, WPA2, WPA3, with WEP being easy to crack), how far the signal reaches beyond the building, device manufacturer and model (which may have known flaws), default network names suggesting unchanged settings, and exact locations.

Example: an attacker drives through a business district and finds a law firm's Wi-Fi reaching 50 meters into the parking lot, still on outdated WEP encryption, broadcasting the default name "Linksys_Guest." They park in the lot, crack the weak encryption in minutes, and get into the firm's internal network from outside the building.

Tools used: Kismet, NetStumbler, WiFi Pineapple, or even smartphone apps that map networks during regular travel.

This matters because it lets attackers find weak targets, plan attacks from outside physical security, and spot unauthorized rogue access points.

Protecting Against Wireless Attacks

Verify Network Names Exactly

Always double check that the network name matches exactly before connecting. Even a tiny spelling difference can mean it's an evil twin.

Ask staff to confirm the exact network name

Look for official signage, posters, table tents, or receipts listing it

Compare character by character, like Airport_WiFi vs Airp0rt_WiFi (zero instead of the letter O)

If you see two very similar networks, assume one is fake

Example: at a hotel you see three options, HiltonGuest, Hilton_Guest_Free, and HiltonLobby. You check with the front desk, who confirm the real one is HiltonGuest. You avoid the other two, which are probably evil twins.

Avoid Unprotected Wireless Networks

Open networks need no password, which usually means the Wi-Fi connection itself isn't encrypted either, so anyone nearby can capture the traffic and read any of it that isn't protected by its own encryption.

Why they're risky: no Wi-Fi encryption means anything not already encrypted (like DNS queries or sites that still use plain HTTP) travels in plain text, no authentication means anyone can join, they're easy for attackers to copy since there's no password to fake, and they're common in airports, cafes, and public transit.

How much is actually exposed: most internet protocols are encrypted on their own now. Websites use HTTPS and most apps encrypt their traffic, so passwords and messages usually stay protected even on open Wi-Fi. Some data is still exposed, though, like DNS queries. A DNS query is your device asking a server for the IP address of a website ("where is example.com?"), and it's often sent unencrypted, so anyone watching can see which sites you're looking up even if they can't see what's on them. The more sensitive your activity, the more it makes sense to skip unencrypted Wi-Fi and use one of the safer options below.

Safer options: use cellular data instead, ask if there's a password-protected network available, use your phone's hotspot, or just wait until you're on a trusted network before doing anything sensitive.

Example: at the airport you see "Airport_Free_WiFi" with no password. Instead of connecting, you use your phone's data or wait until you're on your hotel's secured network before checking your bank account.

Use a VPN

A VPN creates an encrypted tunnel between your device and a VPN server, so all your traffic is protected even on a sketchy network.

How it helps:

Data gets encrypted on your device and only decrypted at the VPN server

Anyone watching the local network just sees encrypted traffic, not what sites you're actually visiting

Your real IP is hidden behind the VPN server's IP

Even on an evil twin, the attacker can't read your encrypted traffic

The Wi-Fi owner and your internet service provider can't view your traffic either, only that you're connected to a VPN

Types: commercial services like NordVPN, ExpressVPN, or ProtonVPN, corporate VPNs provided by your employer, or built-in VPN protocols you configure manually.

Example: a business traveler connects to hotel Wi-Fi and turns on their company VPN before opening anything. All their traffic, browsing, email, downloads, gets encrypted. Even if the hotel network is compromised, an attacker just sees indecipherable encrypted data.

Limitations to keep in mind: you're trusting the VPN provider itself, since they can see your unencrypted traffic, there's a performance hit from the extra routing, it doesn't stop malware or phishing, and you need strong encryption (AES-256) with no DNS leaks for it to actually work.

When you really need one: accessing work stuff from public places, banking on untrusted networks, traveling internationally, or really any time you're on public Wi-Fi.

Back Next