Can someone download files from your personal computer when you're using public WiFi?

Question

Scenario: You are using your laptop computer, connected to a public WiFi network at a Starbucks, airport, etc.

Question: Can a stranger connected to that same WiFi network download the files from you computer? Can the stranger look at your files?

Answer 1

Question: Can a stranger connected to that same WiFi network download the files from you computer? Can the stranger look at your files?

Yes, but it requires significant carelessness on the victim's part.

On Windows, for starters, you'd need to tell the system that the network you're connected is either Home or Work, not "Public". Since you should know you're in an airport, this is unlikely.

Then you should allow guest login (by default it isn't).

Alternatively, you must access some external unencrypted system supporting Windows authentication. The service should be outside the airport and allow logins from the Internet, and very few would allow it to run unencrypted.

Finally, that system and your own box must use the same user and password. This way, the password captured in the previous stage will also allow external logins on your system. OR you must have an easily guessable username, and the same password of some cleartext service you accessed.

Otherwise, the attacker might poison your DNS cache and "convince" your system that the Facebook server or the GMail server or what-have-you is actually inside his suitcase. Then he would either force a HTTPS connection (e.g. via a MitM attack, which you must ignore) or fake it in the clear (and you must not notice the fact that you're running in plain HTTP). This way, again, the attacker can get one of your passwords. If it is good for your system, or allows a password-retrieval attack on some other system, you (and/or your online banking account) are about to be pwn3d.

This is not the WiFi you were looking for

Actually the attacker needn't do much to gather access to your transmissions. He might have been the owner of the WiFi network all along, who just set up a rogue AP declaring itself to be "Airport Free WiFi". The fact that the AP name seems legitimate means nothing: there are systems already designed for this - buy one, charge it overnight, go to the airport and start trolling for fish. The system will optionally "massage" the data flowing through to ensure the maximum exploitability of passwords and credentials.

---

Once you are connected to a site you trust (or so you believe), you can be tricked into downloading and executing something that will give the attacker complete control, either directly (e.g. in Windows through WSH) or through some exploit.

On Linux the only relevant difference is that you should either share your disk or have remote administration port 22 (SSH) open. Both conditions are usually false in any sane distribution I know of.

But it's not just your files...

Having your disk safe is no guarantee for your online banking account, Dropbox, email etc. - the problem lies in credential thefts and/or impersonation; what is actually done with that comes after.

Which is why:

• You should avoid using unknown networks,
• If you do, use them through an encrypting VPN,
• Always keep system security high (only declare "Home network" your network in your home)
• Keep the system updated, with a suitable antivirus
• Never reuse important passwords for different sites
• Maintain situational awareness - notice things such as the "green lock" on HTTPS sites, small glitches in login screens that don't feel "right", and weirdnesses in URLs (e.g. "myonlinebank" becoming "myonIinebank")

Eternal vigilance is the price of liberty.

Answer 2

Potentially, they can capture personal information, poison your dns cache and many other pretty nasty things, but they can't download your personal files without a few things going wrong on your behalf first.

If for some reason they could capture your passwords being transmitted in plaintext, they could ssh to your computer, assuming you are allowing incoming port 22 connections(unlikely)

If they could force you to accept a malicious file, you could be open to a reverse proxy attack whereby the file you accept will automatically attempt to connect the attackers system, giving them access to your system.

These attack vectors are not easy to do, they are possible but generally security concious users and most system hardened defaults are pretty good at preventing such attacks. Hope it helps

Answer 3

You would want to avoid using public wifi for sensitive information, unless you can be assured of a solid and safe connection. There is a practice known as Man-in-the-Middle in which a user nearby at the public wifi location has configured his computer to appear as if you are connecting to the local service. In reality, you are connecting to his computer, which is passing your activities through a filter to collect sensitive and useful information. Once collected, your activities are then forwarded to the intended destination.

Answer 4

Yes they can, as with any internet connection, but you may find it easier to upload files to a shared location for them to download. The "push from device" ala stolen smartphone.

The safest way to allow someone to quickly download files from your device whilst on public wifi is to use your private network via VPN and share a folder on that network. This is the "road warrior" scenario.

Otherwise, they will need to know your IP address. Dynamic DNS with SSH for concurrent login will also work, but they will need permissions on the files. Dynamic DNS can be home grown, you could email the IP or drop it on a server, say.

You could also RDP/VNC to a machine on your private network, still a two step process if you are copying from the host device first. Giving them remote control of your device is also possible ala NetMeeting, but clumsy.

The least secure method would be to run a simple FTP server for them to access. Anyone can snort that. It may not bother you if it is only a shopping list or a fender bender happy snap.

Encrypted file + VPN + RDP/VNC will give you three layers, not counting the WiFi encryption.