As an ethical hacker, I can’t believe the risks people routinely take when they access the internet in public

In the modern world we are all constantly connected, but this comes with risks. As most cybersecurity specialists will tell you, the biggest vulnerability in any system is the user – whether at home or work.

The most common ways in which hackers break into systems are via attacks on users such as phishing, rather than by breaching technical infrastructure. As much as 94% of all malware is delivered via email, while phishing is the primary means of attack in 41% of all incidents. This risk is also increasing, with 75% of security experts reporting an overall rise in cyberattacks year on year in 2023.

Many corporate IT teams have been spending heavily on training users to be more wary of such attacks. However, this has tended to focus on best practice in the workplace. In public areas, where people’s guards might be lowered, it’s quite a different story.

I’ve recently seen several examples of this for myself. As a certified ethical hacker with years of experience in cybersecurity and contributing to cybercriminal investigations, I can’t tell you how easy it is for these kinds of situations to be exploited by bad actors.

In the first incident, I was in a shop buying some household items. While I queued, staff were asking customers for email addresses to send them e-receipts for their items.

This might sound innocent, and it’s surely better for the environment than paper receipts, but it could easily be exploited by a savvy hacker who might be listening. Combined with contextual information such as location, item and cost, they could craft a phishing email that would probably fool most people. It could be an invite to complete a feedback survey, for instance, or a discount code for their next visit to the same store.

On another occasion I was at a live concert. While we waited for the show to begin, an individual in front of me was browsing his phone. From observing for just a short time, I ascertained his name, job, address, vehicle, phone number and even bank balance. Again, this could have been used by a hacker in a number of malicious ways, including posing as the individual to steal their identity or even coercing them to act against their employer, say by threatening to reveal sensitive information.

We therefore all need to be mindful of the information that we are exposing to strangers when we are in public. Equally, we need to think about what devices we are using, and what we are connecting them to.

Unsecured network risks

While at the same concert, I saw numerous people connecting to the stadium wifi, which was totally unprotected and required no authentication. When you log in to an unsecured network, it exposes your device to risks such as evil twin attacks.

Evil twin attacks involve the attacker creating a wifi hotspot, which can be set to any name they choose, such as “stadium wifi 2” or whatever. When an unprotected device connects to this network, the attacker can potentially steal the data they are transmitting.

It can also be used for other nefarious purposes such as snooping on confidential networks, injecting malware into downloads or “man-in-the-middle” attacks in which the hacker poses as the other person in a communication, again usually to steal information.

People can be exposed to similar threats on unsecured networks through another hacking ruse known as packet sniffing. This is where a hacker uses a program to monitor the data moving over the network and steal information.

You can avoid these risks by logging in from a virtual private network (VPN), not that I saw anyone doing that at the concert. More generally, people can protect themselves from identity theft by, for instance, having anti-phishing systems in their inboxes.

However, the easiest defence of all is to be alert to the risks and take sensible precautions in public. By protecting your data and devices, no matter where you are, you can avoid becoming one of the victims.

Christopher Patrick Hawkins does not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.