Public Wi-Fi hacks, evil twin hotspots, and juice jacking¶

Airports, hotels, coffee shops, conference centers, and transit hubs are prime hunting grounds for two closely related physical-proximity cyberattacks: Evil Twin rogue Wi-Fi hotspots and Juice Jacking (compromised public USB charging ports). When you connect your phone or laptop to an attacker-controlled wireless network or plug your cable into a modified USB port, you hand an adversary a direct physical or network bridge to intercept your traffic, harvest your login credentials, or hijack active authentication cookies.

If you just realized you typed your email, corporate login, or credit card details into a suspicious hotel or airport captive portal, or if your phone popped up a "Trust This Computer" prompt while plugged into a public charging kiosk, immediate containment can stop an attacker from locking you out of your accounts.

Dariet to tagad¶

1. Disconnect immediately from the Wi-Fi network or unplug the USB cable. Turn off Wi-Fi entirely on your laptop or smartphone, or physically pull your charging cord out of the public USB port right away.
2. Forget the rogue Wi-Fi network so your device does not auto-reconnect. Open your Wi-Fi settings, select the suspicious network name (SSID), and tap Forget This Network or disable Auto-Join.
3. Switch to a trusted cellular data connection (4G/5G) to contain compromised accounts. Do not use any local Wi-Fi network while resetting your credentials. Use your phone's cellular connection or a secondary uncompromised device.
4. Revoke all active login sessions and rotate passwords for any account you entered or used. If you typed a password into a fake captive portal or logged into an account over the rogue network, go to that account's security settings, click Sign out of all devices / Revoke active sessions, and change the password immediately.
5. Audit your email forwarding rules and multi-factor authentication (MFA) devices. Check your Gmail, Outlook, or corporate email settings for unauthorized auto-forwarding rules or newly added recovery phone numbers and authenticator apps.
6. Reboot and audit your mobile device if you clicked "Trust" on a public USB charger. If you tapped "Trust This Computer" or enabled USB File Transfer/Debugging at a public kiosk, disconnect from all networks, check for unauthorized configuration profiles or side-loaded apps, and prepare to back up important photos and perform a factory reset if malicious tampering is confirmed.

flowchart TD
    A["Suspected public Wi-Fi or USB charging compromise"] --> B{"Which threat occurred?"}
    B -->|"Connected to Evil Twin Wi-Fi or fake captive portal"| C["Turn off Wi-Fi immediately and tap Forget This Network"]
    B -->|"Plugged phone into public USB port: Juice Jacking"| D["Unplug USB cable immediately"]
    C --> E{"Did you enter passwords, payment data, or accept a certificate?"}
    E -->|"Jā"| F["Switch to cellular 4G/5G and revoke active sessions"]
    F --> G["Change passwords, freeze payment card, delete rogue root certificates"]
    E -->|"Nē"| H["Flush DNS cache, enable VPN or DNS-over-HTTPS, monitor logins"]
    D --> I{"Did you tap Trust This Computer or Allow USB Debugging?"}
    I -->|"Jā"| J["Enable Airplane Mode, remove unknown device profiles, factory reset if needed"]
    I -->|"No: Power only or blocked prompt"| K["Reboot phone to clear USB interface state and use AC wall adapter"]

How Evil Twin Wi-Fi and captive portal attacks work¶

An Evil Twin is a fraudulent wireless access point set up by an attacker using a laptop, a portable router (such as a Wi-Fi Pineapple), or a mobile hotspot to impersonate a legitimate public Wi-Fi network. Because Wi-Fi network names (SSIDs) are not authenticated by default on open networks, anyone sitting in an airport lounge or coffee shop can broadcast a network named Airport_Free_WiFi, Starbucks_Guest, vai Grand_Hotel_Conference.

If the attacker boosts their antenna signal closer to your table than the real ceiling router, your phone or laptop will automatically connect to the attacker's device. Once you are connected to an Evil Twin, the attacker sits in a Man-in-the-Middle (MitM) (also called Adversary-in-the-Middle or AitM) position between your device and the internet.

The three traps inside an Evil Twin network¶

1. Fake Captive Portal credential harvesting: When you join legitimate hotel or airport Wi-Fi, a browser pop-up (a captive portal) usually asks you to click "Accept Terms" or enter your room number. Attackers clone these splash pages and add a prompt stating: "Sign in with your Google, Microsoft 365, Apple, or social media account to activate free high-speed Wi-Fi," or ask for a credit card for a "$1 identity verification." Anything typed into that page goes straight to the attacker, often using real-time reverse-proxy tools to steal your Multi-Factor Authentication (MFA) session token at the same time.
2. DNS spoofing and SSL stripping: While modern HTTPS encryption protects most web traffic even over untrusted Wi-Fi, an attacker controlling your DNS server can redirect domains you type, downgrade unencrypted HTTP links, or trick you into installing a malicious Root Certificate Authority (CA) profile ("Install our hotel security profile to access the internet"). If you install an attacker's root certificate, they can decrypt and read all of your HTTPS banking, email, and work traffic in plain text.
3. Auto-join probe sniffing (KARMA/MANA attacks): If your phone or laptop has "Auto-Join" turned on for previously used open networks (like attwifi vai Hilton_Honors), your device constantly broadcasts probes looking for those names everywhere you go. Rogue access points listen for those requests and impersonate whatever network your device is asking for, connecting you silently inside your backpack or pocket without you ever opening your Wi-Fi menu.

Step-by-step recovery if you used an Evil Twin network¶

If you realize you connected to a fake hotspot or typed sensitive data into a suspicious login screen, follow these steps in order over a trusted cellular connection:

1. Check and remove rogue certificates or device profiles¶

If the captive portal prompted you to click "Allow" or "Install" on a system prompt before giving you internet access, check your device immediately: - On iPhone / iPad (iOS / iPadOS): Open Settings > General > VPN & Device Management. If you see any configuration profile you do not recognize (outside of your employer's official MDM profile), tap it and select Remove Profile. Next, check Settings > General > About > Certificate Trust Settings and make sure no unknown root certificates are toggled on. - On Android: Open Settings > Security & privacy > More security settings > Encryption & credentials > Trusted credentials > User (menu names vary slightly by manufacturer). Remove any user-installed certificates installed during your session. - On Windows / macOS: On macOS, open System Settings > Privacy & Security > Profiles (and check Keychain Access > System Roots / Certificates). On Windows, press Win + R, tips certmgr.msc, and inspect Trusted Root Certification Authorities for newly added entries.

2. Atceliet aktīvos sīkfailus un pagrieziet uzlauztās paroles¶

If you signed into Google, Microsoft, Apple, or corporate SSO inside a fake captive portal, the attacker likely stole your session cookie along with your password. Simply changing your password may not kick them out if the session token remains valid: - Log into your account security dashboard from cellular data, view Where you're signed in / Active devices, and terminate every unfamiliar session. - Change your password to a unique passphrase and upgrade your MFA to a hardware security key or passkey (FIDO2/WebAuthn), which cryptographically binds to the real domain name and cannot be phished by a fake captive portal. See our guide on MFA pikšķerēšana un pretinieka vidējā apiešana.

3. Lock compromised payment cards¶

If an airport, inflight, or hotel Wi-Fi portal asked for your credit or debit card number and CVV code, open your mobile banking app immediately on cellular data, lock or freeze the card, and call the number on the back of your card to report it compromised and order a replacement with a new card number.

How Juice Jacking (malicious USB charging) works¶

Standard USB cables (USB-A, Micro-USB, and USB-C) contain both power pins (which carry electrical current to charge your battery) and data pins (Differential D+/D- and high-speed TX/RX lines designed to sync files, photos, and diagnostic commands with a computer).

Juice Jacking occurs when criminals tamper with the hardware behind a public USB wall port, airport charging pillar, hotel lamp USB slot, or rental car USB data port. By wiring a concealed microcomputer or malicious controller chip behind the faceplate, an attacker can attempt two categories of attacks when you plug your cable directly into the USB slot:

1. Data exfiltration and debugging abuse: If the port emulates a host computer and tricks the user into tapping "Trust This Computer" (on iOS) or enabling "File Transfer / MTP / USB Debugging" (on Android), the hidden computer can rapidly copy your camera roll, contacts, notes, and unencrypted local backups, or push malicious configuration payloads onto the device.
2. HID (Human Interface Device) keystroke injection and hardware attacks: Advanced malicious USB ports or counterfeit cables left plugged into public kiosks (such as O.MG Cables or Hak5 USB implants) contain tiny embedded Wi-Fi chips and microcontrollers inside the plastic connector head. When plugged into a laptop or phone, the cable pretends to be an external USB keyboard, typing hundreds of invisible terminal or PowerShell commands per second to open a remote backdoor.

Tālruņa un klēpjdatora sacietēšana pirms ceļojuma¶

Veltiet piecas minūtes pirms došanās uz lidostu, viesnīcu vai kafejnīcu, lai konfigurētu šos iestatījumus, lai jūsu ierīces automātiski aizsargātos.

1. Izmantojiet tālruņa personīgo tīklāju, nevis publisko Wi-Fi: Ikreiz, kad izmantojat mobilo sakaru tīklu, pievienojiet klēpjdatoru tālruņa mobilajam tīklājam (aizsargāts ar WPA3 šifrēšanu), nevis pievienojieties viesnīcas vai kafejnīcas Wi-Fi tīklam. Mobilajos tīklos tiek izmantota aparatūras SIM/eSIM kriptogrāfiskā autentifikācija, ko nevar triviāli klonēt ar Evil Twin maršrutētāju, kas ir aizrautīgs.
2. Saglabājiet revidētu VPN ar ieslēgtu Kill Switch: ja jums ir jāizmanto publiskais Wi-Fi (piemēram, lidmašīnā vai pagraba konferenču zālē bez mobilā signāla), ieslēdziet cienījamu virtuālo privāto tīklu (VPN), izmantojot WireGuard vai OpenVPN pirms atverat jebkuru lietotni vai pārlūkprogrammu, un iespējojiet Slēdžus, ja tiek bloķēta VPN tuneli **Kill ir bloķēts VPN.
3. Iespējot šifrētu DNS (DNS over-HTTPS vai DNS over-TLS): konfigurējiet pārlūkprogrammu un operētājsistēmu, lai izmantotu šifrētu DNS (piemēram, Cloudflare). 1.1.1.1 vai Quad9 9.9.9.9), tāpēc negodīgs Wi-Fi maršrutētājs nevar izlūkot vai izkrāpt domēna nosaukumus, ko meklē jūsu ierīce, taču ņemiet vērā, ka jums, iespējams, uz 30 sekundēm būs jāizslēdz šifrētais DNS, lai ielādētu likumīgu viesnīcas caurlaides portāla pieteikšanās lapu, pirms to atkal ieslēdzat.
4. Iztīriet saglabātos atvērtos Wi-Fi tīklus un atspējojiet automātisko pievienošanos: dzēsiet vecos atvērtos tīklus (Airport_Free_WiFi, Hotel_Guest, xfinitywifi) no saglabāto tīklu saraksta, atspējojiet opciju Ask to Join Networks un iestatiet klēpjdatora ugunsmūri uz Publisko/Slepeno režīmu (bloķējot ienākošo failu koplietošanu, AirDrop no sadaļas "Visi" un lokālā tīkla atrašanu).
5. Ieslēdziet bloķēšanas režīmu vai papildu datu aizsardzību, ja esat augsta riska mērķis: Žurnālistiem, vadītājiem, juristiem un aktīvistiem, kuri ceļo pa augsta riska sabiedriskā transporta mezgliem, ir jāiespējo Lockdown Mode (Apple ierīcēs) vai Papildu aizsardzība (Android/Google), kas pilnībā atspējo vadu USB datu savienojumus, kamēr ierīce ir bloķēta.

Bieži uzdotie jautājumi¶

Vai VPN aizsargā mani no Evil Twin Wi-Fi tīkla?¶

Cienījams VPN šifrē visu interneta trafiku, kas atstāj jūsu ierīci, tāpēc Evil Twin operators nevar nolasīt jūsu datu straumes vai nolaupīt nešifrētus savienojumus. Tomēr VPN nevar jūs aizsargāt, ja manuāli ievadāt savu e-pasta paroli vai kredītkartes numuru viltotā portāla uzplaiksnījuma lapā pirms VPN savienojuma izveides, kā arī neaptur ļaunprātīgu programmatūru, ja manuāli instalējat negodīgu saknes sertifikātu.

Kā es varu noteikt, kura lidosta vai kafejnīca ir īstais Wi-Fi tīkls?¶

Jūs nevarat pārbaudīt Wi-Fi tīkla autentiskumu, tikai apskatot nosaukumu savā izvēlnē, jo uzbrucējs var nosaukt Evil Twin tīklāju identiski reālajam tīklam. Vienmēr pajautājiet darbiniekam precīzu tīkla nosaukumu un paroli, izvairieties no tīkliem bez WPA2/WPA3 paroles šifrēšanas, ja iespējams, un nekavējoties ieslēdziet savu VPN, tiklīdz tiek izveidots savienojums.

Ko darīt, ja es pievienoju tālruni lidostas USB portam, redzu "Uzticieties šim datoram" un pieskarsities "Neuzticēties"?¶

Ja pieskārāties “Neuzticēties” (vai ignorējāt uzvedni, kamēr ekrāns bija bloķēts) un nekavējoties atvienojāt tālruni, operētājsistēma bloķēja USB datu līniju pievienošanu jūsu krātuvei. Vienkārši pārstartējiet tālruni, lai iztīrītu tā pagaidu USB kontrollera atmiņu un pārslēgtos uz standarta maiņstrāvas kontaktligzdu vai portatīvo akumulatora banku.

Vai nomas automašīnas USB porti ir droši, lai tiem pievienotu tālruni?¶

Auto nomas informācijas un izklaides sistēmas automātiski sinhronizē jūsu kontaktpersonu sarakstu, zvanu žurnālus, īsziņas un Bluetooth ierīču identifikatorus, kad pievienojat informācijas paneļa USB datu portu un piešķirat atļauju. Tā vietā, lai izmantotu automašīnas datu USB portu, pievienojiet 12 voltu cigarešu piesmēķētāja automašīnas adapteri papildu strāvas ligzdai vai izmantojiet fizisku USB datu bloķētāju un pirms transportlīdzekļa atgriešanas izdzēsiet savu profilu no automašīnas informācijas un izklaides izvēlnes.

Saistītie ceļveži¶

• MFA pikšķerēšana un pretinieka vidējā apiešana
• Data breach response and password leaks
• Darbs attālināti un droši no viesnīcas
• Lidostas izkrāpšana un tranzīta drošība
• Globālie neatliekamās palīdzības numuri