How Hotel Wi-Fi Risks Compromise Microsoft 365 Accounts

For business travelers accessing public Wi-Fi, caution is paramount. Recent investigations reveal that threat actors are manipulating “captive” Wi-Fi gateways in hotels and conference centers, leading to the hijacking of Microsoft 365 accounts. This tactic, identified by ReliaQuest's Threat Research team, presents a significant risk for individuals unwittingly connecting to compromised networks.

By seizing control of a gateway, attackers can reroute users' traffic through their own infrastructure, allowing them to gather Microsoft 365 credentials without needing to access users' devices directly or deploy phishing techniques. ReliaQuest warns that this attack method operates below the typical defensive measures users assume to be in place, positioning it as a persistent threat to personal accounts.

Exploiting Trust Fundamentals

The technique at play involves DNS poisoning, a method where attackers inject false information to misdirect internet traffic to fraudulent sites. While this has previously affected smaller office routers, its application at public venues showcases a troubling evolution in targeting. Attackers typically gain access by leveraging weak or reused administrative credentials and exploiting exposed interfaces, such as SSH or SNMP.

Once they have admin access, attackers exploit the inherent trust in DNS, which resolves domain names into IP addresses for routing. A single compromised gateway allows traffic redirection for all users connecting to that network, making detection of such intrusions incredibly complex as the attack occurs outside the device's operational visibility.

During the campaign observed by ReliaQuest, four malicious domains were registered to impersonate Microsoft services, indicating a deliberate effort to deceive users into divulging sensitive information. The scope of this compromise stretched across various locations, including several U.S. cities, India, and Saudi Arabia, highlighting a widespread vulnerability that affects diverse industries from finance to healthcare.

DNS Security Measures: Not Enough

While switching to trusted DNS providers like Google or Cloudflare might seem like a solution, it doesn’t remove the risks posed by a compromised gateway. ReliaQuest explains that unencrypted DNS queries must traverse the untrustworthy hotel network, making them susceptible to interception or manipulation before reaching intended resolvers.

DNSSEC presents a partial solution by authenticating domain responses through encryption and digital signatures, helping prevent certain types of attacks. However, it doesn’t ensure confidentiality or protect against redirection attempts at the gateway level. Even with DNSSEC enabled, if the DNS queries are seen by an attacker, they can still manipulate or drop requests.

Implementing Full-Tunnel VPNs

To effectively mitigate these threats, it's advisable for enterprises to mandate the use of full-tunnel VPNs for all corporate devices. This setup secures all internet traffic, including DNS requests, through an encrypted connection to a trusted VPN server, thereby shielding devices from local network vulnerabilities.

However, implementing full-tunnel configurations isn’t always straightforward. It typically results in increased costs, potential latency, and heightened bandwidth demands, which can complicate matters for a mobile workforce. Moreover, some critical access controls should also be enforced to inhibit potentially unsecure authentication flows.

Best Practices to Enhance Security

Beyond full-tunnel VPN adherence, companies should consider additional security precautions:

• Limit Proxy Auto-Configuration (PAC) file retrieval to approved internal servers;
• Disable automatic Web Proxy Auto-Discovery (WPAD) settings that might be enabled by default, particularly in Windows environments;
• Implement encrypted DNS protocols such as DNS over HTTPS (DoH) or DNS over TLS (DoT) when always-on VPN isn't practical;
• Educate employees on the importance of verifying URLs and security certificates before entering credentials on public networks.

Prioritizing prevention over detection is essential in this evolving threat landscape. While tools like Microsoft Defender for Endpoint can signal breaches once they occur, timely detection often lags behind real-time attacks. Thus, adopting measures like encrypted connections and strict access protocols is critical in addressing these vulnerabilities before they escalate into significant breaches.