Episode 2: Honeypots, Evil Twins, and the Perils of Open WIFI

Speaker 1: However you're listening to this, imagine that you're listening to it on a subway car. It's a subway car in London, so, let's have a little fun and call it the tube. You're on the tube, and you're using the open WiFi to listen to this week's episode of Hacked. A bunch of British telecom companies actually offer free Wi Fi, so you're probably not the only person staring at a screen. Now, the average London two car holds around a 100 or so people, meaning that things are probably cramped. You're probably standing. And somewhere on this train, there's a person with a backpack, and in that backpack, there's a computer. So, fair question: why does any of this matter to you even remotely? Well, because on this particular day, on this particular train, your device, the one playing hacked right now, isn't connected to the train's open wifi. It's connected to a network being broadcast out of that person's backpack. A network is a fake. It's a doppelganger. And its whole reason for existing is to watch you. My name is Jordan Blumen. And I'm Scott Winder. And today, we are talking about the world of evil twins, honeypots, and the perils of open WiFi. Fi on this episode of Packed. So if you're like me, when you're traveling, an open WiFi network is like finding buried treasure. I think at home you get used to the certain level of connectivity, and losing that can be kind of a weird experience. So when you're traveling and you don't have data, and that little open network icon pops up, I automatically connect. And I'm assuming this is a huge mistake.

Speaker 2: It's not not a huge mistake.

Speaker 1: It's not smart, is it?

Speaker 2: Not overly.

Speaker 1: K. So if I'm connected to a Wi Fi network, can you see what I'm doing?

Speaker 2: Yeah. If you if you think about it, all of the information and communication between your device and and the Internet is happening through the air. So all I need to do is set up a device that listens to what's moving past it in the air.

Speaker 1: So you don't need to have actually set up the Wi Fi network that I'm connected to to be able to monitor that activity?

Speaker 2: No. I don't. Setting up the network affords me a much more expansive range of things to do. But if it's just public Wi Fi, you know, be it a library, a coffee shop, I can just literally sit there and listen to what's moving by.

Speaker 1: So when you say what's moving by, what are those things? What is what does that take the form of?

Speaker 2: So if you visit a website, say you go to bbc.co.uk, and you wanna check the news. You know, when you type that into the the address bar of your browser, it reaches out and says, hey, Internet. What is bbc.co.uk? And something called the domain name server returns back an IP address for the server, and then your your web browser creates essentially a tunnel or a connection to that server and says, hey. You know, I would like to see bbc.co.uk. Please send me the information. And then the server on bbc.co.uk bundles up the source code that is the website and sends it back to you.

Speaker 1: So when you go to a website, you're really requesting this little bundle of information, inside of which is the code that makes up the site itself. When you click on a new page, you're requesting another little package of these packets of information. These packets are what's flying over the air, and these packets are what a person watching you can see. So the next question naturally is, are there any packets of information that they can't see? Starting some new isn't just hard. It information that they can't see? Starting some new isn't just hard. It can be downright terrifying. You put a lot of work into a thing. You're not entirely sure it's gonna work out. You're taking a huge leap of faith. I've started a few things. Now I know I was right for believing in, you know, the idea, the product, despite all of those fears and hesitations. But boy, does it sure help when you have a partner like Shopify on your side. Shopify is the commerce platform behind millions of businesses around the world and 10% of all e commerce in The US. From household names like, well, hacked podcasts merch, to brands just getting started, you can get started with your own design studio with hundreds of ready to use templates. Shopify helps you build a beautiful online store that matches your brand style. Did I mention that that iconic purple shop pay button is used by millions of businesses around the world? I don't know why I wouldn't. I should. It's why Shopify has the best converting checkout on the planet. It also helps boost conversions, meaning less carts, sort of getting abandoned in the parking lot, and more sales for you. It's time to turn those what ifs into sign up for your $1 per month trial at shopify.com/hacked. Go to shopify.com/hacked. One more time, that's shopify.com/hacked.

Speaker 2: Yeah. Like, something that's more and more common and you'll see it in things like Facebook and and your your big services, your emails, your banking, is that you'll get the little lock or, like, an SSL encryption. That means is essentially that the the tunnel or the connection that you have to the server is actually encrypted. So the information that goes by isn't plain text. You have to be able to decrypt it, and that's much harder. Or you can do something called a man in the middle attack, which is a lot more complicated. But, essentially, you become the information broker, like, just to kind of hypothetically walk through that. If you're trying to connect to, say, your online bank and it's gonna be an encrypted tunnel, what I can actually do is hijack that tunnel, and then I have the encrypted tunnel to the bank server, and you have an encrypted tunnel to me. So when you send a piece of information to the bank, I get it, look at it, and then resend it along to the bank. So I just sit in the middle, which is why it's called man in the middle. And when they send information back, I literally get it, look at it, and then re encrypt it and send it to you.

Speaker 1: You said that if you set up the Wi Fi network, it afforded you more opportunities, more than just being able to watch these packets flying through the air. What exactly can you do if I've connected to a network that you specifically set up?

Speaker 2: It really depends on how much time I wanna invest into it. You know, some of the the most basic public Wi Fi hacks like this is you connect to my network, and I present you with a login page saying, okay. If you wanna log on to the Internet using this hotspot, you have to authenticate so that I can verify your traffic. Log in with Facebook. Log in with Google. Log in with something. But really, all I'm doing is stealing your login credentials.

Speaker 1: So if I'm connecting to a Wi Fi network out in the world and it's asking for me for any information, I should be prepared to accept the risk that that information might not be going to who I think it is. Yeah. It could be going to you.

Speaker 2: Could be going to me. It's not going to me, but it could be.

Speaker 1: That's a scary thought.

Speaker 2: And and, you know, there's a host of other things. That's just one small way to go about it. That's the easiest thing. I could set that up in an hour. If I wanted to spend days or weeks, I can create something called a honeypot network, which is literally an entire network that's set up to steal information from you without you knowing.

Speaker 1: How would you go about doing that?

Speaker 2: Well, I mentioned earlier something called domain name servers and DNS names. It's the thing that translates bbc.co.uk into an IP address. When you connect to my Internet, the standard thing that happens now is you send out something called a DHCP request. If you connect to Wi Fi, your phone, or your laptop will send out a request saying, hey. I'm on the network. What's my IP address? What's my setup configuration? You know, the DHCP protocol is there to, like, automatically configure network connections. So when your phone connects or your laptop connects to my network, I get to send you the configuration for the Internet for the network, and that includes what domain name server to use. And if I wanna set up my own domain name server, I've therefore put myself in the middle of all of your network connections. I can tell your computer where Gmail is, where Facebook is. And if I felt the need to, I could set up my own version of Gmail. I could set up my own version of Facebook. So when you go to log into it, it just gives me your login credentials, and you'd never even know.

Speaker 1: So if I'm connected to your network, if you put in enough time, it's not a matter of my connection to Google or Facebook or whatever being encrypted. It's a matter of I'm never even connecting to those websites.

Speaker 2: Yeah. I could even just add credibility to it, have the connections encrypted. So when you connect to my version of Facebook or my version of Gmail, it's encrypted, and you feel more secure about it.

Speaker 1: So I can trust that I have a secure connection to the hacker trying to steal my information.

Speaker 2: And it it even goes further as it always does depending on how much time I wanna set up. Because if you think about something like your phone and you think about something like traveling, so when you're abroad, chances are you don't have a data plan. So your phone's not on the Internet, but you still have your phone on you, and you stumble into a coffee shop in in Rome and you see a public Wi Fi network and you jump on it, the second that your phone realizes it has network, a ton of things happen on it. It, by itself, reaches out and tries to check the email. It logs you into Facebook. It checks your news feeds. It updates apps. It does all this stuff in the background without you even doing it. Once I'm in control of the network, it's not even about creating the right honey pots. It's about just leveraging the activity that's gonna happen on the network immediately.

Speaker 1: All these things that our devices do to make life a little bit more convenient where when we're connected to trusted networks, things like automatically checking email, automatically pulling notifications and all those things. If I'm connected to your weird honeypot

Speaker 2: I'm in control of them.

Speaker 1: Sketchy.

Speaker 2: So if you think about mail, mail's an obvious one. You know, the mail service that most people use today is called IMAP. And let's say that your phone has three email addresses. Your phone's gonna go out and connect to three different IMAP servers or maybe one. Once you're on my network, I'm in control of where those go. So I can literally send all of the IMAP traffic to my server, my Honeypot IMAP server. So your phone reaches out and says, hey. I wanna log in to Gmail. I need the email for jordan@hackpodcast.com. And my honeypot server says, okay. Give me your password. Your phone gives me your password. Boom. It's over. I've got your username and password. I return an error code so that your phone thinks that there was just a simple mistake, and you don't even know. And I've just gotten your email address and password.

Speaker 3: Thinking about refreshing the carpet in your home? Now's the time to do it. For a limited time at The Home Depot, get 10% off installed carpet projects on trusted brands brands, like Lifeproof, Lifeproof with PetProof Technology, Home Decorators Collection, and Traffic Master. Plus, with installation starting at just 49¢ per square foot, upgrading your space is more affordable than ever at The Home Depot. Offer valid, 06/11/2026 through 06/28/2026. Exclusions apply for licenses. See homedepot.com/license numbers.

Speaker 1: If I understand correctly, if I'm connected to someone else's Wi Fi network and and you're within range of me, you can see all of the information I'm sending flying through the air. If I connect to a Wi Fi network that you set up, you can make it so that that information is either all going to you or it's all going through you first. Is there any way I can connect to the Internet in a way that you can't see what I'm doing and get in the middle of it?

Speaker 2: It'd be tough.

Speaker 1: That's a really ominous answer.

Speaker 2: It's the truth.

Speaker 1: If I plug a cable into a wall

Speaker 2: It's still possible, but it's it's a totally different process. You know, being hard lined in means that there's a lot more physical infrastructure where anytime you're on Wi Fi, it's literally just flying through the air.

Speaker 1: So the lesson here is just avoid public Wi Fi. When you're traveling, just accept that you don't have a connection. Don't use public Wi Fi. Only use trusted open net like, only use networks provided by trusted sources.

Speaker 2: That'll definitely reduce your risks. Trusted networks are better ways to go, but it doesn't mean that you're always gonna get the network you'll you think you're gonna get.

Speaker 1: How am I not getting the network I think I'm getting if I'm connecting to the network named public library Wi Fi?

Speaker 2: Well, if you've ever set up a wireless network, you know that you can name it whatever you want. And you can do something called an evil twin, which means that you essentially set up another wireless router in a public space, in your backpack, wherever, that literally broadcasts under the same name. And as long as the connection is a little bit stronger, often what will happen is devices will end up connecting to you.

Speaker 1: So when I'm connecting to a Wi Fi network from what I think is a trusted source, you're saying I need to, like, physically look around the room I'm in first and make sure Scott Winder isn't sitting there with a backpack looking around with a sketchy look on his face.

Speaker 2: I don't think that's gonna help because it's not gonna be me first and foremost. I am a law abiding citizen. But Don't I know it. But the reality of it is is that it can be anyone and it happens. It's really quite easy to set up a evil twin router. I can literally walk into a Starbucks and become Starbucks's public Wi Fi. And if I've got my honeypot network set up, I'm getting all of that information.

Speaker 1: So just don't use the Internet?

Speaker 2: No.

Speaker 1: Except to listen to episodes of Hacked, Which brings us back to that person, the one with the backpack from the start of the show. The one broadcasting the evil twin network, the British version of you is unknowingly connected to. So we learned that that's one way of doing things. But as we discussed, at the end of the day, using Wi Fi is still just sending these little packets of information flying throughout the air. Anyone with the know how can just kind of reach out and grab them. Where those packets are going is another story entirely. Thanks for listening to this week's episode of Hacked. We've been getting tons of awesome feedback from people, and we appreciate everyone who's reached out in support. Shout out to Greg, Andy, the folks at Newsreel, and anyone else who contacted us. It would mean a lot to us if you would rate and subscribe to us on your podcasting app of choice, And if you feel like it, follow us on social media. This episode has been produced by Sticks and Stones, art and design by Mathias Smale. Thanks for listening, everyone.

Speaker 4: Visible puts the ultimate wireless hack in the palm of your hand. You get unlimited five gs data and hotspot designed to keep you connected. All powered by Verizon's five gs network. Plans start at $25 a month or get the premium Visible Plus Pro plan and save $10 on your first month with promo code hack. Tap the banner to switch today. Terms apply. See visible.com for plan features and network management details.

Speaker 5: The right window treatments change everything. Your sleep, your privacy, the way every room looks and feels. At blinds.com, we've spent thirty years making it surprisingly simple to get exactly what your home needs. We've covered over 25,000,000 windows and have 50,005 star reviews to prove we deliver. Whether you DIY it or want a pro to handle everything from measure to install, we have you covered. Real design professionals, free samples, zero pressure. Right now, get up to 45% off-site wide, plus get a free professional measure at blinds.com. Rules and restrictions apply.

Speaker 6: There's a new way to sweet greet. Meet wraps. Handheld, hearty, and made for life on the move. With bold chef crafted flavors, fresh ingredients, and over 40 grams of protein, they're built to satisfy without slowing you down. Try wraps today in the app or at order.sweetgreen.com, available at all participating locations.