Silk Typhoon Hackers Use Fake Wi-Fi Captive Portals to Target Diplomats

[johny899]

Have you had that experience of using hotel or airport Wi-Fi, and clicked "Accept" on the login page? I have. Unfortunately, hackers, infamously known as Silk Typhoon, are using Wi-Fi login pages to deceive diplomats into revealing information. Scary, right?

I used to think that those disclaimers and login pages were meant to protect the user. Now it makes me realize that they can be fake too. It makes one wonder right? How many times have we had to consent to something just because it seemed safe?

What Did the Hackers Do?​

Silk Typhoon is a hacker group connected to China. They created fake wi-fi login pages (also called, captive portals). After a diplomat would utilize their fake wi-fi they would be able to:

• Steal usernames and passwords
• Install spyware to see everything they do
• Acquire secret information without the individual being aware

The fake pages resembled real things, and therefore did not cause any suspicion. This is why the attack was so successful.

Why Go for Diplomats?​

You may ask yourself, why not target regular people? Because diplomats are not doing regular stuff, they are dealing with serious matters - politics, security, and exclusive deals. If the hackers can get into their accounts, they can acquire powerful data.

And here's the scary thing, if trained diplomats can be caught up, what hope do we have?

What can we take away from this?

So we're not diplomats, but this type of attack reminds us to:

• Always pay attention when accessing public Wi-Fi Login Pages
• Use a VPN. This just keeps everything more secure
• Look at the URL. Fake pages can make small alterations to the URL, which change everything.

Most of us spend hours worrying about fake apps and fake links, but we hardly think about fake Wi-Fi logins. This is why this tactic was successful.

My Thoughts​

I travel quite a bit and I use public Wi-Fi quite a bit. I always thought the biggest problem was a slow connection. Now I realize the problem is with the login page.

Cybersecurity is much more than just strong passwords. Cybersecurity is also about being aware when things look "too normal".

Conclusion​

We have shown that the Silk Typhoon group utilized fake captive portals against diplomats for intelligence collection and data theft -- a simple and clever hack. For the rest of us: the lesson is simple: do not trust public Wi-Fi login screens without checking.