Attack Techniques: Fake Captive Portals

When a device first joins a network, the upstream network hardware has full control over its traffic and can allow/block any packets sent from the device from reaching the Internet. Many public networks (typically Wi-Fi, but sometimes wired, located in hotels, coffee shops, mass transit, schools, etc.) require that the user accept Terms of Use or otherwise interact with a webpage before gaining broader/unrestricted access to the network. The restricted client is called a “captive” and the webpages to allow removal of the access limitation are called Captive Portals, the subject of a previous post. When Windows detects that a network is blocking internet access with a Captive Portal, a link is provided to launch the captive user’s default browser: The captive browser is navigated to a non-secure HTTP url, and the network is expected to intercept the non-secure request and redirect to the Captive Portal webpage. The Attack Over the last few years, there have been a series of attacks…