The hotel wifi is out to get you!!

According to this warning from the government, travelers are catching viruses from their hotel wifi. Should you be afraid?

No. Popups tricking you are a danger all the time, and all hotspots (whether at the hotel, or Starbucks, or the local bar) are always an increased danger. But they cite no evidence that hotels in particular are more dangerous.

That hotels are more dangerous is plausible. For example, some people have reported credible evidence of a hotel intercept browsing to give you more advertising, and some advertising networks are poor at filtering out malicious attacks. Combining these two, there may be a slightly higher incidence of infection at hotels. But only slightly, it's absurd thinking that hotels are a dramatically different threat, or that there's something special you should do to protect yourself at hotels that you wouldn't do everywhere.

The above advisory is especially deficient in it's recommendations of what you should do to protect yourself. People assume government agencies are more credible and more competent, but this advisory shows the reverse is true. The lack of evidence and bogus remedies demonstrate their incompetence.

---

Technical Details

The technical details are this: devices can change web pages as they pass through the device. The most common change is to append JavaScript to the end of a web-page (any web page) that does something interesting. That could be simply to do extra advertising, which was recently caught at a Marriot Hotel. Or, it could append code to steal passwords entered in the page, which repressive regimes like Tunisia were caught doing to their citizens. Or, it could popup a window telling somebody to download software.

It doesn't have to be the legitimate routers that do this (as it was in the Marriot or Tunisia cases). Instead, a hacker can create a hostile access-point, either an "evil twin" that pretends to be the same access-point right next to it (like one also named "Marriot Courtyard"), or simply an evil one with an independent name "Free WiFi".

This sort of evil access-point simply forwards traffic to the normal access-point, but changes things as described above. Hackers can buy $40 wall-wart access-points, re-flash them with a linux distro, and leave them behind in hotel rooms, coffee shops, airports, and so on. They'll likely earn more than $40 from hacking or advertising, so they don't mind the fact that eventually they'll get stolen.