The Free Wi-Fi at the Conference
Ahmed is at a two-day industry conference. The hotel charges €15/day for Wi-Fi. In the lobby he sees an open network called Conference_Guest_Free with no password. He connects and logs into his company webmail, checks his online banking, and downloads a 'conference schedule' app from a link a stranger shared in a chat group. The app asks for permission to read his contacts and send SMS. That evening his bank sends an alert about a login from another country.
1. Explain how connecting to an unknown open network can lead to a compromised account, even if the site uses HTTPS.
Read the worked answer
An open network lets an attacker on the same network attempt several things:
- Evil twin: the network may be a fake hotspot run by an attacker who controls DNS and can serve a lookalike login page.
- Captive-portal phishing: a fake 'sign in to continue' page harvests credentials directly.
- Traffic analysis and downgrade: HTTPS protects content, but metadata (which sites, when) leaks, and misconfigured sites or apps may fall back to HTTP.
So HTTPS helps but does not make an untrusted network safe. The safe pattern is: avoid sensitive logins on untrusted networks, or use a trusted VPN and MFA.
2. The downloaded 'schedule' app asked for contacts and SMS permissions. Assess the risk and what Ahmed should do.
Read the worked answer
The permission request is a red flag. A schedule app has no legitimate need to read contacts or send SMS.
- SMS send permission can be abused to send premium-rate messages or spread links to his contacts.
- Contacts read enables data harvesting and further phishing.
Ahmed should:
- Not grant the permissions; better, not install an app from an unknown link.
- Uninstall it if already installed.
- Review which apps already have SMS/contacts access and revoke anything unnecessary.
- Treat the bank alert as a possible consequence and contact the bank directly using the number on the card, not a link in the alert.
3. Ahmed's bank alert arrived by SMS with a link to 'verify the login'. How should he respond?
Read the worked answer
Do not tap the link. SMS links are a common phishing vector and the alert may itself be the attack.
Correct response:
- Open the bank's app or type the bank's address manually.
- Call the number printed on his card.
- If the login was not his, report it and change credentials from a trusted network.
Reasoning: a genuine alert and a phishing message can look identical. The safe rule is to verify through a channel you chose, not one the message supplies.