Skip to content

Public Wi-Fi hacks, evil twin hotspots, and juice jacking

Os números de emerxencia varían segundo o país. Esta páxina usa 911, o número dos Estados Unidos e Canadá. Moitos outros países usan 112, 999 ou outro número. Busca o número do teu país.

Os aeroportos, os hoteis, as cafeterías, os centros de conferencias, as bibliotecas e os centros de tránsito son os principais terreos de caza de dous ciberataques de proximidade física estreitamente relacionados: Puntos de acceso Wi-Fi de Evil Twin Rogue e Juice Jacking (portos de carga USB públicos comprometidos). Cando conectas o teu teléfono intelixente ou portátil a un punto de acceso sen fíos controlado por un atacante ou conectas o cable a un porto USB público modificado, entregas a un adversario unha rede directa ou unha ponte física para interceptar o teu tráfico, recoller as túas credenciais de inicio de sesión ou secuestrar as cookies da sesión de autenticación activa.

Se acabas de entender que escribiches o teu correo electrónico, o teu inicio de sesión corporativo ou os detalles da túa tarxeta de pago nunha pantalla de inicio de wifi sospeitosa de hotel ou aeroporto, ou se o teu teléfono apareceu un aviso "Confía neste ordenador" mentres estaba conectado a un quiosco de carga público, a contención inmediata pode impedir que un atacante te bloquee as túas contas. Esta guía ofrece pasos de recuperación inmediata de incidentes, explicacións técnicas dos ataques de hardware sen fíos e USB, auditorías de certificados do sistema operativo e protocolos de endurecemento de viaxes baseados na orientación da Axencia de Seguridade Cibernética e Infraestrutura (CISA) nos Estados Unidos, o Centro Nacional de Seguridade Cibernética (NCSC) no Reino Unido, a Comisión Federal de Comunicacións (FCC) e a Axencia de Ciberseguridade da Unión Europea (ENISA).

Fai isto agora

  1. Desconecta inmediatamente da rede wifi ou desconecta o cable USB. Desactiva a wifi por completo no teu portátil, tableta ou teléfono intelixente, ou tira fisicamente o cable de carga do porto USB público de inmediato.
  2. Esquece a rede wifi fraudulenta para que o teu dispositivo non se poida volver conectar automaticamente. Abre a configuración da wifi do teu dispositivo, selecciona o nome de rede sospeitoso (SSID) e toca Esquece esta rede (ou desmarca Conectar automaticamente) para que a túa radio deixe de transmitir sondas de conexión ao hardware do atacante.
  3. Cambia exclusivamente aos datos móbiles (4G/5G) para protexer as contas comprometidas. Non utilices nunca ningunha rede wifi pública local mentres restableces as túas credenciais. Usa a conexión móbil nativa do teu smartphone ou un ordenador independente e sen compromisos nunha rede de confianza.
  4. Revoga todas as sesións de inicio de sesión activas e rota os contrasinais para as contas expostas. Se escribiches un contrasinal nun portal cativo Wi-Fi falso ou iniciaches sesión nunha conta a través da rede fraudulenta, abre o panel de seguranza da conta, fai clic en Pechar sesión en todos os dispositivos/Revogar sesións activas, cambia o teu contrasinal a unha frase de acceso única e conxela calquera número de tarxeta de crédito ou débito que ingresaches.
  5. Auditoia e elimina calquera certificado raíz, perfís VPN ou regras de caixa de entrada non autorizados. Comprobe o almacén de certificados do sistema operativo e a configuración de xestión de dispositivos para verificar que o portal cativo non o enganou para que instalase un perfil de configuración malicioso e inspeccione a súa configuración de correo electrónico para detectar regras de reenvío automático non autorizadas.
  6. Reboot and inspect your mobile device if you tapped "Trust" on a USB kiosk. If you tapped "Trust This Computer" or enabled USB File Transfer/Debugging at a public charging station, enable Airplane Mode, check for unknown side-loaded apps or profiles, and report severe financial theft or extortion to law enforcement or your local emergency number (911 in the United States and Canada, 112 across the European Union, 999 in the United Kingdom, or see números de emerxencia).

Never install a certificate or profile requested by public Wi-Fi

No legitimate coffee shop, hotel, airline, or airport Wi-Fi network ever requires you to install a "Root Certificate," "Security Configuration Profile," or downloadable .exe, .dmg, .apk, ou .mobileconfig file to access the internet. Installing an attacker Root Certificate Authority (CA) allows them to decrypt and read 100 percent of your encrypted HTTPS banking, email, and corporate traffic in plain text.

Public Wi-Fi and USB charging incident response tree

flowchart TD
    Start["Suspected Public Wi-Fi or USB Charging Compromise"]
    ThreatType{"Which proximity vector occurred?"}
    WiFiBranch["Connected to Suspected Evil Twin Wi-Fi<br/>or Fake Captive Portal Splash Page"]
    USBBranch["Plugged Phone or Laptop Into Public USB Port<br/>or Used an Unattended Cable (Juice Jacking)"]

    WiFiAction1["1. Turn off Wi-Fi radio and tap 'Forget This Network'<br/>2. Switch to trusted 4G/5G cellular data"]
    WiFiPrompt{"Did you type credentials, payment card data,<br/>or install a profile/certificate?"}
    WiFiCompromised["ACTIVE CREDENTIAL / TRAFFIC COMPROMISE<br/>1. Revoke all active login sessions and refresh tokens<br/>2. Rotate passwords and check email forwarding rules<br/>3. Delete rogue Device Management profiles and Root CAs<br/>4. Freeze payment card and issue replacement number"]
    WiFiPassive["PASSIVE CONNECTION ONLY (HTTPS intact)<br/>1. Flush local DNS and ARP caches<br/>2. Enable audited VPN and Encrypted DNS (DoH/DoT)<br/>3. Monitor account login logs for 14 days"]

    USBAction1["1. Physically unplug USB cable immediately<br/>2. Do not use any cable left hanging in a kiosk"]
    USBPrompt{"Did you unlock the device and tap<br/>'Trust This Computer', 'Allow USB Debugging',<br/>or see rapid ghost typing on screen?"}
    USBCompromised["ACTIVE USB DATA OR HID KEYSTROKE BREACH<br/>1. Enable Airplane Mode to cut C2 network callbacks<br/>2. Check for rogue MDM profiles, accessibility apps, or shells<br/>3. Rotate passwords from a separate clean device<br/>4. Back up important photos/files and perform Factory Reset"]
    USBBlocked["OS USB RESTRICTED MODE PROTECTED DEVICE<br/>1. Reboot device to clear USB controller volatile state<br/>2. Charge using AC wall outlet brick or personal battery bank"]

    Start --> ThreatType
    ThreatType -->|Evil Twin Wi-Fi| WiFiBranch
    ThreatType -->|Public USB Port| USBBranch
    WiFiBranch --> WiFiAction1
    WiFiAction1 --> WiFiPrompt
    WiFiPrompt -->|Yes| WiFiCompromised
    WiFiPrompt -->|No| WiFiPassive
    USBBranch --> USBAction1
    USBAction1 --> USBPrompt
    USBPrompt -->|Yes| USBCompromised
    USBPrompt -->|No: Locked or Rejected| USBBlocked

How Evil Twin Wi-Fi and rogue captive portals work

An Evil Twin is a fraudulent wireless access point operated by an attacker using a laptop, a portable multi-radio auditing router (such as a Wi-Fi Pineapple), a Raspberry Pi, or a modified smartphone hotspot positioned inside a busy public venue. Under the IEEE 802.11 Wi-Fi standard, open public network names, known as Service Set Identifiers (SSIDs), have zero cryptographic authentication verifying who owns the name. Anyone sitting within 30 to 100 meters (100 to 330 feet) of you in a terminal lounge or hotel lobby can broadcast a wireless network named Airport_Free_WiFi, Starbucks_Guest, Marriott_Conference, ou Inflight_WiFi.

Because client devices automatically select the access point broadcasting the strongest radio signal (measured in decibels relative to a milliwatt, or dBm) for a matching network name, an attacker sitting 5 meters (16 feet) away from your table easily overpowers the legitimate ceiling router 25 meters (82 feet) down the hallway. Even if you are already connected to the real hotel Wi-Fi, attackers frequently transmit spoofed 802.11 deauthentication ("deauth") frames that momentarily kick your phone or laptop off the legitimate router, forcing your device to automatically reconnect to the attacker stronger Evil Twin signal without you noticing.

Once your device associates with the Evil Twin access point, the attacker controls your local Dynamic Host Configuration Protocol (DHCP) gateway and Domain Name System (DNS) resolver, placing them in an Adversary-in-the-Middle (AitM) position between your device and the internet.

Os catro vectores de ataque técnico en wifi malicioso

Aínda que os modernos Transport Layer Security (HTTPS / TLS 1.3) e HTTP Strict Transport Security (HSTS) impiden que un operador de wifi malintencionado lea de forma trivial páxinas web cifradas en navegadores actualizados, os atacantes evitan HTTPS mediante catro mecanismos específicos:

  1. Recollida de credenciais Adversary-in-the-Middle (AitM) do portal cativo: Sempre que te unes a unha rede de hotel, aeroporto ou cafetería, o teu sistema operativo espera que unha ventá de inicio de sesión Portal cativo apareza automaticamente. Dado que os portais cativos funcionan antes de que se conecte a túa VPN, os usuarios están condicionados a confiar na caixa de inicio de sesión que apareza. Os atacantes albergan clons perfectos de píxeles de páxinas de inicio de sesión de hoteis, compañías aéreas, Microsoft 365, Google Workspace, Apple ID ou redes sociais que se executan detrás de marcos de proxy inverso en tempo real (como Evilginx2 ou Modlishka). Cando escribes o teu contrasinal de correo electrónico e o teu código de autenticación multifactor (MFA) de 6 díxitos no portal falso para "Desbloquear a Wi-Fi de alta velocidade gratuíta", o proxy inverso envía as túas credenciais ao provedor real e rouba a cookie de autenticación de sesión devolta directamente fóra do fluxo.
  2. Malicious Root Certificate Authority (CA) and MDM profile installation: A rogue captive portal may display a convincing corporate or hotel notice stating: "To comply with network security standards, please click Allow to install our temporary Wi-Fi SSL certificate / network profile." If you approve a root certificate or Mobile Device Management (MDM) profile, your operating system treats the attacker as a trusted Certificate Authority, enabling their proxy server to forge valid SSL certificates for any bank or email domain and decrypt all of your HTTPS traffic in real time.
  3. Preferred Network List (PNL) and KARMA/MANA auto-join sniffing: When Wi-Fi is turned on in your pocket or backpack, your phone or laptop periodically transmits probe requests searching for networks you joined in the past. If you have "Auto-Join" enabled for open networks (such as attwifi, xfinitywifi, Boingo_Hotspot, ou Hotel_Guest), os puntos de acceso deshonestos escoitan esas sondas de transmisión e xeran dinámicamente unha rede virtual que coincida co SSID que busque o teu dispositivo, conectando silenciosamente o teu portátil ou teléfono mentres está na bolsa.
  4. Movemento lateral da subrede local (intoxicación por SMB, AirDrop, mDNS e LLMNR): As redes wifi públicas que non se aplican a Illamento do cliente AP colocan o teu portátil no mesmo segmento de rede de área local de capa 2 que calquera outro estraño da sala. Os atacantes exploran os dispositivos veciños en busca de ficheiros compartidos de Windows Server Message Block (SMB) expostos, Escritorio remoto (RDP), Secure Shell (SSH), servidores web de desenvolvemento aberto (0.0.0.0:3000 ou :8080), or poison local Link-Local Multicast Name Resolution (LLMNR) and Multicast DNS (mDNS) queries to capture Windows NetNTLMv2 password hashes.

Comparing wireless connection methods by security level

Use this comparison table to evaluate your connection options when working away from home or the office:

Wireless Connection Type Cryptographic & Network Architecture Vulnerability to Evil Twin / AitM Interception Operational Recommendation
Personal Cellular Hotspot (4G LTE / 5G Tethered via WPA3) Hardware SIM/eSIM mutual authentication to carrier tower + personal WPA3-Personal encryption between phone and laptop Extremely Low Risk. Wi-Fi Pineapples cannot spoof 4G/5G carrier cryptography or crack a strong 16-character WPA3 hotspot password Gold standard for travel. Always tether your laptop to your own phone hotspot whenever cellular signal is available
Public Wi-Fi Using WPA3-Enterprise (802.1X / eduroam / Passpoint) Per-user TLS certificate or EAP-TTLS authentication verifying the server certificate before connecting Low Risk (provided you never click "Accept" on an untrusted server certificate warning during initial connection) Safe for university, enterprise, and verified Passpoint roaming networks; keep host firewall in Public/Stealth mode
Public Wi-Fi Using Shared WPA2-Personal Password ("Ask barista for password") Pre-Shared Key (PSK) written on a chalkboard or receipt; anyone in the shop knows the password Moderate-to-High Risk. Any attacker who knows the shared café password can run an Evil Twin with the same password or sniff traffic on the shared subnet Only use with an audited VPN (WireGuard / OpenVPN) + Kill Switch and Encrypted DNS enabled immediately after joining
Open Unencrypted Public Wi-Fi (Airport_Free_WiFi) Zero radio-layer encryption (unless Enhanced Open / OWE is supported); any nearby antenna can spoof the SSID High Risk. Trivial to clone with an Evil Twin router; captive portal pop-ups load before your VPN can establish a tunnel Avoid whenever cellular data is available; if forced to use on an airplane or basement, never enter credentials into the captive portal

Step-by-step recovery after an Evil Twin Wi-Fi incident

If you connected to a suspicious public Wi-Fi network, saw browser certificate warnings (NET::ERR_CERT_AUTHORITY_INVALID), or entered information into a sketchy captive portal, perform these four technical remediation steps in sequence over a trusted cellular connection:

Step 1: Audit and remove rogue configuration profiles and Root CAs

Before changing any passwords on your device, verify that the attacker did not install a persistent Mobile Device Management (MDM) profile, rogue VPN configuration, or Root Certificate Authority that would allow them to watch you type your new passwords:

  • On Apple iPhone and iPad (iOS / iPadOS):
  • Open Settings > General > VPN & Device Management. Unless your device is managed by your employer IT department, there should be zero Configuration Profiles listed here. If you see any unrecognized profile, tap it immediately, select Remove Profile, enter your passcode, and restart your phone.
  • Next, open Settings > General > About, scroll to the bottom, and tap Certificate Trust Settings. Under Enable Full Trust for Root Certificates, verify that no user-installed root certificates are toggled on.
  • On Android smartphones and tablets:
  • Open Settings > Security & privacy > More security settings > Encryption & credentials > Trusted credentials and switch from the System tab to the User tab.
  • Calquera certificado que aparece na pestana Usuario instalouse manualmente no dispositivo. Toca calquera certificado non recoñecido e selecciona Eliminar/Desinstalar.
  • Comprobe tamén Configuración > Seguridade e privacidade > Máis opcións de seguranza > Aplicacións de administración do dispositivo e asegúrese de que ningunha aplicación descoñecida teña privilexios de administrador do dispositivo.
  • En portátiles Apple macOS:
  • Open System Settings > General > Device Management (or Privacy & Security > Profiles) and remove any unrecognized configuration profile.
  • Open Keychain Access, inspect System and login keychains under the Certificates tab, and delete any unfamiliar certificate marked with a blue + custom trust icon.
  • On Microsoft Windows 10 and 11 laptops:
  • Press Win + R, type certmgr.msc, and press Enter. Expand Trusted Root Certification Authorities > Certificates and delete any rogue root certificate you were prompted to install.
  • Open Settings > Network & Internet > Proxy and verify that Use a proxy server has not been pointed to an external attacker IP address or .pac script.

Step 2: Flush poisoned DNS and ARP network caches

When you connect to an Evil Twin router, the attacker DHCP and DNS server often hands your computer poisoned DNS records with long Time-To-Live (TTL) values so the redirect persists even after you switch networks. Clear your local network caches immediately: - On Windows: Open Command Prompt as Administrator and run ipconfig /flushdns followed by arp -d *. - On macOS: Open Terminal and run sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder. - On iOS and Android: Turn Airplane Mode ON for 30 seconds, then turn it off and reboot the phone. - In web browsers: Clear Cached images and files and Cookies and other site data for the past 24 hours.

Step 3: Terminate active session cookies and rotate passwords

If you logged into Google, Microsoft 365, Apple ID, social media, or any personal account inside the captive portal window or while connected to a network where a rogue certificate was active: 1. Changing your password alone is often not enough if the attacker reverse proxy stole your post-authentication session cookie or OAuth refresh token. 2. Log into each affected account security settings over cellular data, go to Active Sessions / Where You're Signed In / Devices, and click Sign out of all sessions. 3. Rotate the account password to a strong, unique 16-to-20-character passphrase stored in a password manager. 4. Check your email account Forwarding and Inbox Rules / Filters (in Gmail or Outlook) to confirm the attacker did not plant a silent rule auto-forwarding password reset emails or moving security alerts to Trash. 5. Upgrade your account Multi-Factor Authentication to a phishing-resistant Passkey or FIDO2 hardware security key (WebAuthn), which binds cryptographically to the genuine domain name.

Step 4: Freeze payment cards entered into captive portals

If you typed a credit or debit card number, expiration date, and CVV security code into a suspicious Wi-Fi portal: 1. Open your banking app immediately on cellular data and Lock / Freeze the card. 2. Call the fraud department number on the back of your card, report that the card details were compromised on a suspected phishing portal, and request a replacement card with a new 16-digit card number and CVV. 3. Ask the card issuer to reset any automatic Account Updater (Visa VAU / Mastercard ABU) tokens so unauthorized recurring billers cannot follow your new card number.

How Juice Jacking and weaponized USB cables work

Standard Universal Serial Bus (USB) connectors, including USB Type-A, Micro-USB, Apple Lightning, and USB Type-C, combine electrical power lines with bidirectional data transfer pins inside the same plug: - In a 4-pin USB 2.0 connection, Pin 1 (VBUS) carries +5 volts of DC power and Pin 4 (GND) provides electrical ground, while Pin 2 (D-) and Pin 3 (D+) levan sinais de datos diferenciais entre o ordenador host e o dispositivo conectado. - Nun conector USB tipo C de 24 pinos, xunto con catro VBUS pinos de alimentación e catro pinos de terra, o enchufe contén D+/D- pares de datos, catro SuperSpeed ​​de alta velocidade TX/RX carrís de datos (ata 40 Gbps) e Canle de configuración (CC1/CC2) pinos usados ​​para negociar a entrega de enerxía e os roles de host/dispositivo.

O Juice Jacking ocorre cando un adversario modifica o hardware oculto detrás dunha toma de carga USB pública ou deixa un cable de carga armado conectado a un quiosco público para que o usen os viaxeiros.

As tres clases de ataques físicos de carga USB

flowchart TD
    USBPlug["User Plugs Device Into Public USB Port or Unknown Cable"]
    AttackClass{"What malicious hardware is behind the port or inside the cable?"}
    Class1["1. MTP / PTP / ADB Data Exfiltration Host<br/>Hidden SBC (Raspberry Pi / microcontroller) requests<br/>file sync, photo access, or backup extraction"]
    Class2["2. BadUSB / HID Keystroke Injection Implant<br/>Cable head (O.MG Cable / Hak5) enumerates as a<br/>USB Keyboard + Wi-Fi AP and types shell commands"]
    Class3["3. Electrical Surge ('USB Killer') Capacitor<br/>Boosts 5V DC into -200V DC high-voltage pulses<br/>dumped directly into the device data lines"]

    Defense1["Mitigated if OS stays locked (USB Restricted Mode)<br/>OR if user taps 'Don't Trust' / uses a Data Blocker"]
    Defense2["Bypasses 'Trust Computer' prompts on unlocked screens<br/>because OS automatically trusts USB keyboards;<br/>prevented ONLY by never using unknown cables/ports"]
    Defense3["Destroys motherboard USB controller instantly;<br/>prevented by using your own AC wall charger or battery bank"]

    USBPlug --> AttackClass
    AttackClass -->|Data Host| Class1
    AttackClass -->|HID Keyboard| Class2
    AttackClass -->|Voltage Spike| Class3
    Class1 --> Defense1
    Class2 --> Defense2
    Class3 --> Defense3
  1. Exfiltración de datos e abuso de depuración (emparejamento MTP/iOS/ADB): Un ordenador oculto detrás da placa de parede USB actúa como anfitrión USB e inicia un enlace de datos sobre o D+/D- pinos. Se un viaxeiro desbloquea o seu teléfono e toca "Confía neste ordenador" (iOS) ou selecciona "Transferencia de ficheiros/MTP" ou "Permitir depuración USB" (Android), o ordenador oculto pode copiar fotos, contactos, mensaxes e copias de seguranza locais sen cifrar, ou cargar software espía lateral mediante Android Debug Bridge (ADB).
  2. Inxección de teclas HID (Human Interface Device) ("Cables BadUSB" e O.MG): Os atacantes deixan cables modificados (como Cables O.MG) conectados a tomas de aeroporto ou hoteis que teñen un aspecto e carga idéntico aos cables USB-C e Lightning auténticos de Apple, Samsung ou Anker. Dentro da carcasa do conector de plástico hai un microprocesador e un transceptor Wi-Fi. Cando se conecta a un portátil ou teléfono desbloqueado, o cable indica ao teu sistema operativo "Son un teclado de hardware USB estándar." Debido a que os sistemas operativos confían nos teclados sen mostrar un aviso "Confía neste ordenador", o cable escribe inmediatamente centos de teclas por segundo (abrindo o Terminal, o PowerShell ou as fiestras do navegador) cando se activa a través da Wi-Fi.
  3. Destrución de hardware eléctrico ("USB Killer"): Os cables ou portos modificados que conteñen conversores de impulso DC a DC en miniatura cargan capacitores da liña eléctrica de 5 voltios e descargan picos eléctricos de 200 voltios directamente cara abaixo polos pinos de datos, fritindo permanentemente o chip controlador USB e a placa lóxica.

Comparando métodos de carga públicos e defensas de hardware

Método de carga Nivel de risco de seguridade e hardware Explicación técnica Protocolo de boas prácticas
1. O teu propio adaptador de parede de CA ("ladrillo eléctrico") conectado a unha toma eléctrica de 110 V/230 V CA Seguro (Risco dixital cero) As tomas de parede estándar de corrente alterna (CA) de dúas ou tres puntas levan só enerxía eléctrica de 50/60 Hz e teñen cero vías de datos dixitais Leva sempre o seu propio cargador de parede de CA compacto e o seu propio cable na maleta de man
2. Your own portable battery power bank (10,000 to 20,000 mAh) Seguro (Risco Externo Cero) You control both the battery pack and the cable; recharge the power bank overnight from a hotel AC wall outlet Manteña un banco de enerxía portátil cargado no peto ou na mochila para aeroportos e tránsito
3. Public USB port using your own cable + a verified physical USB Data Blocker ("USB Condom") Low Risk A pass-through adapter sits between the public USB port and your cable; inside the adapter, the D+/D- e TX/RX data pins are physically absent, passing only VBUS (+5V) and GND Buy a reputable, transparent-housing USB-A or USB-C data blocker and always use it with your own cord
4. Wireless Qi / MagSafe inductive charging pad in a public lounge or hotel Low Digital Risk Inductive coils transfer power electromagnetically without wired USB data pins Seguro para recargar batería se non hai toma de CA preto, sempre que non se acepten ventás emerxentes NFC
5. Plugging your own cable directly into a public USB-A or USB-C kiosk port High Risk Directly connects your device D+/D- data pins and USB controller chip to unknown electronics behind the faceplate Avoid. In a true life-safety emergency with 1% battery and no AC brick, power your phone completely OFF before plugging it in
6. Using an unattended "free" charging cable already hanging out of a public port Perigo crítico Alta probabilidade de un cable de implante de inxección de teclas HID armado (cable O.MG) ou hardware de aumento de voltaxe Nunca conectes un cable USB descoñecido ou desatendido ao teu teléfono, tableta ou portátil

Recuperación paso a paso tras un sospeitoso incidente de Juice Jacking ou USB

Se conectaches o teu teléfono ou portátil a un porto USB público ou a un cable descoñecido, avalía o que pasou na túa pantalla e sigue o nivel de recuperación correspondente:

Escenario A: a pantalla permaneceu bloqueada ou tocaches "Non confíes"

Os modernos iOS (desde iOS 11.4.1) e Android (Android 9+) inclúen unha defensa integrada chamada Modo restrinxido de USB ou Predeterminado USB de só carga. Cando conectas un teléfono bloqueado a un servidor de datos USB, o sistema operativo mantén as liñas de datos USB loxicamente desconectadas e só consume enerxía eléctrica ata que desbloqueas a pantalla e tocas explícitamente "Confiar" (e introduce o teu código de acceso por segunda vez en iOS) ou cambia a notificación USB a "Transferencia de ficheiros."

Se nunca tocaches "Confiar" e non utilizaches un cable descoñecido mentres a pantalla estaba desbloqueada: 1. Desenchufe o cable inmediatamente. 2. Apaga o teu teléfono completamente, agarda 30 segundos e acéndeo de novo para borrar a memoria volátil do controlador de porto USB. 3. Cambia a unha toma de corrente de parede ou un banco de baterías.

Escenario B: tocaches "Confía neste ordenador", activaches a depuración USB ou viu a escritura pantasma

Se desbloqueaches o teu teléfono e tocaches "Confiar" nunha estación de carga pública, activaches Depuración USB de Android ou conectaches un cable descoñecido a un teléfono ou portátil desbloqueado e viu que se escribiu rapidamente un fantasma: 1. Desconecta o cable e activa inmediatamente o Modo avión (ou desactiva a wifi e os datos móbiles) para evitar que calquera carga útil en segundo plano inxectada se poña en contacto cun servidor de comando e control externo. 2. En iOS/iPadOS: - Ao tocar "Confía neste ordenador" xera un rexistro de sincronización criptográfica que permite que o ordenador host acceda a copias de seguranza, fotos e ferramentas de programador. - Para revogar todos os ordenadores de confianza nun iPhone de inmediato, abre Configuración > Xeral > Transferir ou restablecer iPhone > Restablecer > Restablecer localización e privacidade (que borra todos os emparellamentos de ordenadores USB de confianza) e verifica Configuración > Xeral > VPN e Xestión de dispositivos para ver calquera perfil ou aplicación de programador recentemente instalado. - Se sospeitas dunha instalación de spyware, fai unha copia de seguranza só das túas fotos e documentos en bruto e realiza un Borrar todo o contido e a configuración completo, despois activa o Modo de bloqueo (Configuración > Privacidade e seguridade > Modo de bloqueo). 3. En Android: - Abre Configuración > Sistema > Opcións de programador (se está activado), toca Revogar autorizacións de depuración USB e desactiva Opcións de programador. - Comprobe Configuración > Aplicacións > Ver todas as aplicacións, Configuración > Accesibilidade e Aplicacións de administración de dispositivos para calquera aplicación descoñecida instalada durante a sesión USB. - Se se autorizou a depuración USB nun porto non autorizado, fai unha copia de seguranza de fotos e contactos importantes e realiza un Restablecemento de datos de fábrica.

Lista de verificación de endurecemento de viaxes de cinco minutos para teléfonos e portátiles

  • 1. Borra as redes Wi-Fi abertas gardadas e desactiva a unión automática: Elimina os nomes xenéricos das redes abertas (Airport_Free_WiFi, Hotel_Guest, Starbucks, attwifi) da túa lista de redes gardadas e desactiva Solicitar unirse a redes e Unirse automaticamente a punto de acceso.
  • 2. Configura unha VPN auditada cun Kill Switch estrito: Instala un cliente VPN respectable usando WireGuard ou OpenVPN e activa o Kill Switch para que todo o tráfico de Internet quede bloqueado se o túnel VPN cae.
  • 3. Activar DNS cifrado (DNS-over-HTTPS / DNS-over-TLS): Habilitar DNS seguro/DNS privado no teu navegador e sistema operativo usando Cloudflare (1.1.1.1 / one.one.one.one) ou Quad9 (9.9.9.9 / dns.quad9.net). Se o portal cativo dun hotel non se pode cargar inicialmente, desactiva o DNS seguro durante 30 segundos para facer clic en "Aceptar termos" e, a continuación, activa o DNS seguro e a túa VPN inmediatamente.
  • 4. Bloquear o uso compartido de rede local: Establece os perfís Wi-Fi de Windows en Rede pública, activa Firewall + Modo Stealth de macOS e configura AirDrop en Só contactos ou Recepción desactivada.
  • 5. Activa os modos de protección de datos USB: no iPhone/iPad, verifica que Configuración > Face ID e código de acceso > Accesorios estea activado DESACTIVADO (ou activa o Modo de bloqueo para viaxes de alto risco). En Android, activa Protección de datos USB e mantén desactivadas Opcións de programador.

Preguntas frecuentes

Does turning on a VPN completely protect me if I connect to an Evil Twin Wi-Fi hotspot?

A reputable Virtual Private Network (VPN) with an active Kill Switch encrypts all network traffic leaving your device inside a WireGuard or OpenVPN tunnel, preventing an Evil Twin operator from reading your traffic or spoofing DNS lookups once the VPN is connected. However, a VPN **cannot** protect you from two traps: first, captive portal splash screens open *before* your VPN connects, so if you manually type your email password or credit card number into a fake captive portal page, you hand that data straight to the attacker; second, if a portal tricks you into installing a malicious Root Certificate or configuration profile, the attacker can still compromise your device. Never enter sensitive credentials into a captive portal, and turn your VPN on the second you click past the basic "Accept Terms" button.

Isn't HTTPS (the padlock in my browser) enough to keep me safe on open public Wi-Fi without a VPN?

Modern HTTPS (TLS 1.2/1.3) and HSTS prevent a passive eavesdropper on café Wi-Fi from reading the contents of your encrypted banking or email tabs. However, relying solely on browser HTTPS without a VPN or encrypted DNS leaves gaps on an Evil Twin network: an attacker controlling the router can see every domain name your device queries via unencrypted DNS and Server Name Indication (SNI), can block or redirect domains that lack strict HSTS preloading, can intercept background apps that fail to validate SSL certificates properly, and can probe open ports on your device over the local subnet. Combining HTTPS with a personal hotspot or VPN provides defense in depth.

How can I tell which coffee shop, hotel, or airport Wi-Fi network is the genuine one?

You cannot verify a Wi-Fi network authenticity just by looking at the network name (SSID) or signal bars in your Wi-Fi menu, because an attacker Evil Twin router can copy the exact spelling and broadcast a stronger signal right next to your table. Before connecting, ask a staff member for the exact network name, whether it requires a WPA2/WPA3 password, and what the splash screen looks like. If a hotel or café captive portal asks you to log in with your Google, Microsoft, Apple, or Facebook password, or asks for a credit card number at a venue advertising free Wi-Fi, disconnect immediately.

What if I plugged my phone into an airport USB port, saw "Trust This Computer," and tapped "Don't Trust"?

If you tapped **"Don't Trust"** (or ignored the prompt while your phone stayed locked) and unplugged the cable right away, your phone built-in USB Restricted Mode / Charge-Only protection blocked the hidden computer behind the USB port from mounting your storage or reading your files. However, the fact that a wall USB charging port triggered a *"Trust This Computer"* prompt proves that the port is wired to an active USB data host rather than a simple power transformer. Unplug immediately, notify venue security of which port triggered the prompt, reboot your phone to clear its USB controller state, and switch to an AC wall outlet or power bank.

Are rental car USB ports and infotainment systems safe to plug my phone into?

When you plug your smartphone directly into a rental car dashboard USB data port or pair via Bluetooth, the car infotainment head unit often automatically downloads and stores a local copy of your contact list, recent call history, text messages, GPS favorites, and unique device MAC identifiers. Unless you manually delete your device profile from the car system settings before returning the keys, future renters can browse your synced data. When driving a rental car, either plug your own 12-volt cigarette-lighter power adapter into the auxiliary power socket, or put a physical **USB Data Blocker** between the car USB port and your charging cord.

Can my phone get hacked over Juice Jacking if I power the phone completely off before plugging it into a public USB port?

Powering your smartphone completely off before plugging it into a public USB port eliminates software-level data exfiltration and keystroke injection risks, because the main operating system kernel is not running, the user data partition remains encrypted in the **Before First Unlock (BFU)** state, and no USB data or keyboard drivers are loaded. Note that on iPhones, plugging a powered-off phone into a charger automatically boots the phone back up to the locked BFU lock screen, as long as you do **not** type in your passcode or unlock the phone while it is plugged into the public USB port, the encrypted storage remains locked and inaccessible over USB. Even so, using your own AC wall brick or a USB data blocker is safer because it also protects against electrical voltage-spike devices.

Fontes comprobadas

  • Cybersecurity and Infrastructure Security Agency (CISA, Estados Unidos): * Lista de verificación de seguranza cibernética de dispositivos móbiles e de seguranza de redes sen fíos para viaxeiros*.
  • Centro Nacional de Seguridade Cibernética (NCSC, Reino Unido): WiFi pública: como estar seguro en redes non fiables e orientación sobre a mobilidade empresarial.
  • Comisión Federal de Comunicacións (FCC, Estados Unidos): Alerta ao consumidor: "Juice Jacking" - Consellos para evitar o malware e o roubo de datos nas estacións de carga USB públicas e Consellos de seguridade sen fíos e Bluetooth.
  • Axencia Nacional de Seguridade (NSA, Estados Unidos): Mellores prácticas para protexer as redes sen fíos e a seguridade dos dispositivos móbiles para o teletraballo e as viaxes.
  • Axencia da Unión Europea para a Ciberseguridade (ENISA, Unión Europea): Directrices sobre a protección de dispositivos móbiles, puntos de acceso Wi-Fi e acceso remoto.
  • National Institute of Standards and Technology (NIST, Estados Unidos): Directrices para protexer redes de área local sen fíos (WLAN) (NIST SP 800-153).

Guías relacionadas