FBI's hotel Wi-Fi warning: Don't talk to strange pop-ups
Connecting state and local government leaders
The alert that travelers are being targeted through hotel Wi-Fi connections is short on details, but it serves as a reminder that the Internet can be a rough neighborhood.
The FBI, through the Internet Crime Complaint Center, has issued a warning that “malicious actors are targeting travelers abroad through pop-up windows while establishing an Internet connection in their hotel rooms.”
This is hardly earth-shaking news, but it is a reminder that the Internet can be a rough neighborhood and whenever you leave home it probably is a good idea to remember childhood warnings about talking to strangers.
The increasing power and functionality of mobile devices have accustomed road warriors and even casual users to the convenience of anywhere computing. Painful experience has demonstrated time and again that enterprise networks are rarely adequately secured, but once you step outside the perimeter the risks are likely to be even greater.
Related stories:
Why Androids are less secure than iPhones
Cyber threats in 2012: 5 pain points
The IC3 alert, which is frustratingly vague, warns only that the pop-up is for “a widely used software product...for which updates are frequently available.” Suffice it to say, clicking to accept the update installs malware.
Other than the fact that it is malicious, there is no word on what the malware does or what information, if any, is being targeted.
“The FBI recommends that all government, private industry, and academic personnel who travel abroad take extra caution before updating software products on their hotel Internet connection,” the alert states.
This is good advice, as far as it goes, but better advice is to not perform these updates over a public, untrusted network at all. In fact, if you are traveling with any sensitive data, or with a computer that later will be connected to a network with sensitive data, it makes sense to do as little as possible online.
Some experienced travelers have accepted the fact that traveling is risky, and they use what is effectively a throw-away computer while on the road, especially on overseas trips. The idea is to take nothing along that they cannot afford to lose — including data. They start with a clean box, put on it only what is needed, go online only when necessary, and wipe the device before reconnecting with anything at home. This is not as convenient as having the world at your fingertips, but it is safer.
Kapil Raina, director of product marketing at Zscaler, offered a short list of practical precautions for operating outside the perimeter:
- Update all software before leaving a known, safe location.
- Make sure you have up-to-date security software on all of your devices.
- If you must connect to a hotel Wi-Fi network, verify network names and log-in procedures with the front desk. Some hotels have physical cables you may opt for, but even these wired connections probably have wireless links. Consider using your mobile phone for the connection if possible.
- Use a virtual private network from any public location (this includes your hotel room). If you have to update software while on the road, you can do so slightly more safely.
- Never click on a pop-up. Ever. No reputable site requires a pop-up to work.
- Confirm security alerts through the vendor’s site, and from a different computer if possible.
If you believe you are infected, put your computer in hibernate or sleep mode until you can get expert help. Taking the system offline as fast as possible can help mitigate data loss or damage.
At the risk of being clichéd, be careful out there.