Is Hotel WiFi Safe to Use? A Cybersecurity Expert Explains the Risks

As a cybersecurity expert who has traveled extensively over the last decade, one of the questions I get asked most often is whether it‘s safe to use hotel wifi. Many people assume that a large hotel chain would have better wifi security than your favorite coffee shop hotspot, but the truth is that hotel wifi is rarely any more secure than other public wifi. In this article, I‘ll explain the technical reasons why hotel wifi is risky, the most common threats you may face, and what you can do to protect yourself.

But first, some sobering statistics. A recent survey by security firm Symantec found that 87% of U.S. consumers have used hotel wifi, and over 75% used public wifi to access sensitive information like banking or shopping accounts. Perhaps most alarming: 60% of consumers think their data is safe when using public wifi. The reality could not be more different. According to a 2019 study by Coronet, over 44% of U.S. hotel wifi had been vulnerable to hacking within the last year. Let‘s dive into the technical reasons why hotel wifi is so prone to hacking.

The Inherent Risks of Hotel WiFi

To understand why hotel wifi is risky, it helps to know how wifi works. Wifi is a wireless networking protocol that allows devices to communicate and share an internet connection. When you connect to hotel wifi, you are connecting to their wireless access point, which is connected to the hotel‘s router and broader network infrastructure. All the data sent between your device and the websites you visit travel through the hotel‘s network before reaching the public internet.

The hotel‘s wifi network therefore has complete visibility into your browsing data if that data is not encrypted. Additionally, anyone else connected to the same hotel wifi network may be able to intercept your data transmissions using hacking tools. But aren‘t most wifi networks password-protected? Yes, but that doesn‘t make you safe. The vast majority of wifi hotspots, including hotel wifi, use an outdated encryption protocol called WPA2-PSK (pre-shared key). WPA2-PSK is vulnerable to several well-known hacking methods:

• KRACK attack – Key Reinstallation Attack exploits a flaw in the way devices connect to WPA2 wifi to allow hackers to intercept and decrypt wifi traffic
• Brute-force attacks – Hackers can use powerful offline computing to guess weak wifi passwords by trying millions of character combinations
• Evil Twin AP – Attackers can fool your device into connecting to a malicious access point that looks like a legitimate wifi network but is actually controlled by the hacker
• WiFi Pineapple – A small, inexpensive hacking tool that can create a fake wifi network, intercept wifi connections, and track the wifi networks your device has previously connected to

So as you can see, even password-protected hotel wifi networks are vulnerable to multiple types of attacks. I‘ll explain exactly how these attacks work in more detail shortly. But it gets worse. Even if you visit a website using HTTPS encryption, the hotel can still see and record the domains you visit (just not the specific pages and content). This metadata alone may be enough to build an uncomfortably detailed profile of your browsing habits.

How prevalent are these wifi attacks in the wild? According to a report by the Identity Theft Resource Center, a record 1,579 data breaches occurred in 2017, many of which involved compromised public wifi networks. Coronet‘s 2018 report on wifi security found that hackers can break into hotel wifi in less than 1 minute, and a 2019 survey of RSA Conference attendees revealed that 60% had seen wifi related security incidents in the past year. Clearly, the threats are very real. Let‘s take a closer look at how each type of attack works.

Common Hotel WiFi Hacking Tactics

Evil Twin Access Points

Perhaps the most devious wifi hacking method is the Evil Twin attack. Here‘s how it works: a hacker sets up a malicious wifi access point that exactly mimics a legitimate wifi network in the area, like "Marriott Guest Wifi." When your device scans for available wifi, it sees the hacker‘s fake network and may automatically connect to it if you‘ve used that network name before. Even if your device doesn‘t auto-connect, you may still fall victim by accidentally choosing the fake network from the list of available hotspots.

Once you connect to the hacker‘s Evil Twin network, they have full visibility into any unencrypted data you send, and can execute other attacks like redirecting you to malware sites or providing fake "security" updates. Evil Twin attacks are incredibly tricky because there‘s no way to tell from the network name alone if you‘re connecting to the real hotel wifi or an impostor.

Man-in-the-Middle Attacks

A Man-in-the-Middle (MitM) attack is a type of wifi eavesdropping where a hacker secretly relays and alters the communication between your device and the websites you visit. The attacker intercepts your data packets before forwarding them to the real destination, like a malicious mailman opening and resealing your letters before delivering them. MitM attacks allow hackers to steal login credentials, spy on email messages, and alter unencrypted web traffic to inject malware.

There are a few ways hackers can execute MitM attacks on hotel wifi:

• ARP spoofing – Hacker sends forged Address Resolution Protocol messages to link their MAC address with the hotel wifi router‘s IP address, allowing them to intercept data packets
• WiFi Pineapple – Plugs into the hotel network and creates a new wifi hotspot that tricks devices into connecting and routing traffic through the Pineapple
• Fake SSL certificates – Hacker uses forged security certificates to impersonate an HTTPS site and intercept traffic before passing it to the real site

Shockingly, a 2018 study by threat intelligence firm IntSights found MitM attacks on hotel wifi networks increased by 500% from the previous year. This highlights the importance of using a virtual private network (VPN) when on hotel wifi, which I‘ll discuss in detail later.

WiFi Packet Sniffing

Packet sniffing, also known as wireless eavesdropping, involves using software to intercept and decode the individual wifi data packets being transmitted between devices and access points. Since wifi signals are just radio waves, anyone physically near the network can tune into the right frequency and "sniff" the raw data packets traveling over the air.

Packet sniffing doesn‘t require actually connecting to the target wifi network. All you need is a wifi card set to monitor mode and packet analyzer software like Wireshark or Kismet. Older wifi encryption protocols like WEP are particularly vulnerable to packet sniffing, but even WPA2 wifi can be cracked with enough time and computing power.

While packet sniffing can‘t directly steal private info from encrypted HTTPS web traffic, it can still collect revealing metadata like DNS lookups, device MAC addresses, and overall traffic patterns. This info could be used to profile targets for phishing attacks or infer general browsing habits. According to security firm Pwnie Express, 21% of IT security professionals said they‘ve seen packet sniffing attacks in the past year.

WiFi Malware Distribution

Another way hotel wifi can be dangerous is if hackers have compromised the hotel‘s network infrastructure with malware. Once the network equipment and servers are infected, the malware can be used to distribute more malware to devices connected to the network. Cybercriminals often use "wormable" malware that can spread automatically to new devices like a disease.

The malware could be disguised as software updates to trick you into installing it. Or it may exploit vulnerabilities in your operating system to infect your device without any interaction. Malware like keyloggers and info-stealers can then steal sensitive data from your device. The 2017 NotPetya ransomware attack that caused billions in damages started by infecting computers on an unsecured hotel wifi network. More recently, travelers at high-end hotels in Asia were targeted by malware spread through the hotel wifi.

Will a VPN Protect You on Hotel WiFi?

By now, you‘re probably wondering if there‘s anything you can do to protect yourself on hotel wifi. One common piece of security advice is to use a virtual private network or VPN. A VPN creates an encrypted tunnel between your device and a remote VPN server, making all your internet traffic private and shielding your real IP address. Essentially, a VPN allows you to access the internet through the VPN provider‘s secure network infrastructure rather than the hotel wifi.

So will a VPN keep you completely safe on hotel wifi? The short answer is no, a VPN is not a panacea. While a trustworthy VPN will prevent hackers on the hotel wifi from snooping on your web traffic, it does NOT protect against several key threats:

• Evil Twin attacks and rogue access points – VPNs operate at the network/session layer and do not verify the identity of wifi hotspots. You could still mistakenly connect to a hacker-controlled Evil Twin AP even when using a VPN.
• Local network attacks – A VPN encrypts your traffic as it leaves the local network, but it does not secure the wifi connection between your device and the hotel‘s router. An attacker on the local network could still sniff unencrypted traffic or use ARP spoofing to intercept data before it reaches the VPN.
• Malware – A VPN provides no protection against malware acquired through malicious websites, emails, or compromised hotel wifi. Once malware infects your device, it can steal data locally without going through the VPN.

To be clear, I still highly recommend using a VPN, especially on hotel wifi. It‘s a crucial layer of security. But it‘s not a silver bullet. You need to combine a VPN with other defenses for maximum protection. Alarmingly, a 2019 survey by Google found that 65% of people did not use a VPN when connecting to public wifi. Don‘t be one of them.

How to Stay Safe on Hotel WiFi

Now that you understand the risks of hotel wifi and why a VPN alone isn‘t enough, let‘s look at specific steps you can take to protect yourself:

1. Use cellular data instead of hotel wifi for sensitive tasks.
4G LTE and 5G cellular networks are far more secure than even password-protected hotel wifi. The data encryption, device authentication, and network architecture are more robust. If you need to check your bank account, shop online, or conduct business, try to use your smartphone‘s cellular connection or a dedicated mobile hotspot. Save hotel wifi for general web browsing.

2. Connect to hotel wifi using your phone, not your laptop.
Mobile operating systems like iOS and Android tend to be more secure against network-based attacks compared to laptops. Smartphones have stricter app sandboxing, less local attack surface, and cellular failover. If you need to use hotel wifi, connect your phone but not your laptop if possible.

3. Always connect to websites with HTTPS.
If you do need to login to accounts or transmit sensitive info over hotel wifi, only use websites secured with HTTPS encryption. Look for the padlock icon in your browser address bar. HTTPS encrypts the contents of your web traffic so it can‘t be read by hackers on the network. Avoid any websites that don‘t use HTTPS.

4. Use a reputable VPN with the most secure settings.
While not a complete solution, a quality VPN is still a critical defense on hotel wifi. Choose a vetted VPN provider and make sure to use OpenVPN or WireGuard VPN protocols with AES-256 bit encryption. Avoid PPTP which has known security flaws. Enable the VPN kill switch if available.

5. Confirm the official hotel wifi SSID and network certificate.
To avoid connecting to an Evil Twin access point, ask the hotel staff for the exact spelling of their official wifi SSID. On your device, check that the network certificate matches the hotel‘s name. If you get any security warnings about the wifi certificate, disconnect immediately.

6. Keep your devices and software updated.
This should go without saying, but make sure your laptop and smartphone operating systems, browsers, and wifi drivers are updated to the latest versions. Enable automatic updates. Older software often has vulnerabilities that can be exploited by hackers on public wifi. Updates patch these security holes.

7. Disable wifi auto-connect and use strong passwords.
Go into your device wifi settings and turn off the option to automatically connect to known networks. This prevents your phone or laptop from connecting to a malicious wifi hotspot without your consent. If you do need to connect to hotel wifi, make sure the network uses WPA2 encryption and has a strong password.

Here is a quick comparison of the security features of hotel wifi alone, with a VPN, and cellular data:

As you can see, hotel wifi alone provides negligible security. Adding a VPN is a significant improvement but still falls short of cellular data in some key areas. The ideal setup is to avoid transmitting sensitive data on hotel wifi entirely, use a VPN if you must connect, and rely on cellular data for your most important online activities.

The Bottom Line: Be Cautious & Proactive

I know this has been a lot of technical information to digest. But the key takeaway I want to leave you with is this: hotel wifi is never going to be as secure as your private home or corporate network. There are simply too many variables outside of your control, from the network equipment to the dozens of strangers sharing the wifi with you. Treat hotel wifi as a public network, because that‘s exactly what it is.

This doesn‘t mean you need to completely avoid hotel wifi. For casual email checking and web browsing, it‘s generally okay if you stick to basic security practices like using HTTPS sites and not transmitting info you wouldn‘t want a stranger to see. But for banking, business, shopping, or anything requiring a login, try to use your cellular data connection instead. And no matter what, use a VPN whenever you connect to hotel wifi or any public hotspot.

I hope this deep dive into hotel wifi security has opened your eyes and equipped you with the knowledge to protect yourself. It may take some extra effort, but it‘s far better than dealing with the fallout of hacked accounts and identity theft. If you have any other questions about wifi security, VPNs, or staying safe online, I‘m happy to help. Drop a comment below and I‘ll do my best to respond. Stay vigilant out there!