[NA] Personal computer security while traveling

Let'sgoflying!

Let'sgoflying!

Touchdown! Greaser!
Joined
Feb 23, 2005
Messages
21,872
Location
west Texas
Display Name
Dave Taylor
Home Airfield
KMRF
Im in a Wyndham hotel doing some work for my business from my laptop.
I was running Proton VPN, using the hotel wifi & accessing my business computer, and banking sites.
My cursor started moving and I saw files being opened when I was looking at some papers.
I struggled to fight for control of the cursor to shut it down and did so within 60 seconds.

I’m trying to change some bank pw’s using my phone right now & Ill call them in the morning.

What else should be done?
I’m actually seeing my IT guy about something else in the morning so I’ll leave the laptop off till we talk.
 
I never use the hotel's wifi, I set up a hotspot on my phone and connect the laptop (or tablet) that way. Everything has a VPN on them.
I'm paranoid.
It used to be on my job description to be paranoid, now it's just habit.

One option, and it's really PITA but incredibly effective - encrypt your hard drive. Only decrypt the files you need as you use them.
Backup the laptop frequently but....I'd wait until the IT guy does a very detailed and indepth analysis to make sure there's nothing left behind such as a worm or trojan. If you're running Windows you can look at all the stuff that's running in the Manager. If something doesn't look right, or is taking up a HUGE amount of CPU, (other than Windows) that may be an indication of evil software. But IT should be able to evaluate and deal with the problems.
 
Hotel WiFi is often given a bad reputation. The real problem with a hotel WiFi is someone can "listen" in to your network traffic and steal information. With many people using the same passwords on many things, this often gave bad actors access to everything due to the fact most websites used an insecure protocol. With people often having the same password on the computer as on websites, it made accessing the computer really easy.
Now by default, banks, and many other websites are required to maintain much higher levels of security. In addition, it is much easier to install and setup Windows/Mac with basic security protections. Therefore, as long as you have the basics installed, such as an AV tool, use a good VPN solution to add an additional layer of traffic protection, either use PassKeys (I detest them) or preferably a Password manager with MFA for accessing anything sensitive; you likely are well protected.

If someone has taken over your mouse, than it could be more than one issue:
1. If you have a wireless mouse, someone may have the same brand and you are cross controlling. I have seen this a number of times, cheaply made bluetooth mice/keyboard have very poor pairing and session management.
2. If your laptop is infected. Wipe it, and rebuild. You will never ever be able to truly verify that the system is clean.

Oh, and those using a Cell Phone based hot spot to protect yourself from the hotel WiFi. I helped a startup company evaluate a cell scanner, that could packet sniff all the traffic. My job was to look at the viability to turn the packet data into a dedicated IP stream per device. I developed a POC for this over a decade ago; it was not hard. (Target customer for the company was going to be police, shrug, they ran out of money along with a few other issues)

Tim
 
tspear said:
1. If you have a wireless mouse, someone may have the same brand and you are cross controlling. I have seen this a number of times, cheaply made bluetooth mice/keyboard have very poor pairing and session management.


Tim
Click to expand...

I'd want to rule that out first. Once upon a time, you could tether your phone to your laptop via USB for internet instead of hotspot. Try that and turning off all wireless functionality on the laptop?

Also... were you using a personal machine to remotely access your work computer?
 
It is spectacularly unlikely the hotel wifi is your problem. And you don't need the VPN either, except for a very specific need that you don't have. It's 2025, connection sniffing is a thing of the past.

Every connection your laptop is making is via a secure channel. The absolute most a malicious person on your network could know is where you are connecting to. They can't see the data being passed. They definitely can't commandeer the connection to take control of your work system. Your email, banking, Remote Desktop software all uses SSL on the connection making man in the middle attacks impossible.

A far more likely scenario is that someone was sitting at your desk at the office or also connected to the same desktop using the same Remote Desktop software you were using.
 
Bob Noel said:
was bluetooth on?
Click to expand...
Usually not.
Rarely, I turn bt on to connect to a speaker or camera, then I notice it goes auto-off b/c I always need to turn it back on.
I can check it when the computer is turned back on.
 
rwellner98 said:
A far more likely scenario is that someone was sitting at your desk at the office or also connected to the same desktop using the same Remote Desktop software you were using.
Click to expand...

100% guarantee it wasn’t that.
 
While you're at it... ask your info security team whether they think it's not an issue to use hotel wifi without a VPN.

:popcorn:
 
DaleB said:
While you're at it... ask your info security team whether they think it's not an issue to use hotel wifi without a VPN.

:popcorn:
Click to expand...
Why?
I was using a vpn and plan to continue to do so.

“I was running Proton VPN,”
 
Who uses remote desktops anymore? I haven’t even seen a work desktop in a decade. In that time we’ve gone from fully loaded to VM and full circle back to fully loaded laptops.

As for VPN usage, I don’t have a choice. If my machine connects to any wireless network VPN is forced by policy.
 
TCABM said:
Who uses remote desktops anymore? I haven’t even seen a work desktop in a decade. In that time we’ve gone from fully loaded to VM and full circle back to fully loaded laptops.

As for VPN usage, I don’t have a choice. If my machine connects to any wireless network VPN is forced by policy.
Click to expand...
The most common use case for desktop sharing is software licensed to a particular machine.

The second most common is organizations that manage desktops but not laptops, or differently from laptops.

It's absolutely true that it's tons less common than it used to be. But it's still surprisingly common. The use cases I know firsthand are engineering software for semiconductors. We have licenses from vendors that cost 50K or more per license and are bound to a desktop. They want students at our university to have access to the tools so that they enter the workforce with a bias towards software they are familiar with, but don't want to change the mechanism by which the software is secured. So we use remote desktops to allow the students to access the software.

DaleB said:
I know, I was just wondering if they'd agree with the assertion above that it's unnecessary.
Click to expand...
Unnecessary for this use case. Proton is useful for hiding your location, but that's about it. And even for that, it's only partially useful.

Corporate VPNs can be useful in several ways, but broadly they are for tunneling into a data center, not because of risks of exposing the connection itself to man in the middle attacks or network sniffers.
 
Not all vpns are created equal. Certain vpn protocols are more secure than others.

It’s like saying something is password protected and ignoring the strength of the password
 
This is horrifying. Tuning in to hear the punchline. I'm pretty blase' about my laptop use of hotel connections, but my ears are perked up. The situation described would freak me the F out. :/
 
rwellner98 said:
Corporate VPNs can be useful in several ways, but broadly they are for tunneling into a data center, not because of risks of exposing the connection itself to man in the middle attacks or network sniffers.
Click to expand...
They can also be useful if the laptop isn't secured and has a lot of garbage ports open to the local network. Which also isn't as much of a problem now as it was in the past. It's also a different problem, but some VPN software solves it.
 
rwellner98 said:
Unnecessary for this use case. Proton is useful for hiding your location, but that's about it. And even for that, it's only partially useful.

Corporate VPNs can be useful in several ways, but broadly they are for tunneling into a data center, not because of risks of exposing the connection itself to man in the middle attacks or network sniffers.
Click to expand...
I would be very hesitant to put a Windows laptop, especially a consumer grade machine that isn't corporate managed and lacks things like real-time scanning tools, on an unsecured wifi network. Or on an unmanaged/unknown wired network, for that matter. Sure, some of them have client isolation and are run by people who know what they're doing and don't have any criminal intent. Then there are the other ones.

Lindberg said:
They can also be useful if the laptop isn't secured and has a lot of garbage ports open to the local network. Which also isn't as much of a problem now as it was in the past. It's also a different problem, but some VPN software solves it.
Click to expand...
That, right there, is one of the reasons.

I don't know how far I'd trust one of the commercial VPNs, and would not trust any of the "free" VPNs - ever - anywhere. I was reading an article not long ago about hundreds of malicious "free" VPN apps getting pulled from the Android app store. I run my own VPN, and our devices connect to it any time they're not on our home wifi network. That way we also get the benefit of our PiHole DNS no matter where we are.
 
schmookeeg said:
This is horrifying. Tuning in to hear the punchline. I'm pretty blase' about my laptop use of hotel connections, but my ears are perked up. The situation described would freak me the F out. :/
Click to expand...
Its being scanned today.
He already checked a variety of, um ‘tasks, or other things on a list of recent computer activities’, the terms of which escape me, and found nothing terrible.
Thereafter he is going to scrub it and reinstall the OS & apps.
Apparently the data will be scanned and reinstalled too although it can’t / is very unlikely to contain executables?

No activity on my bank accounts; they’ve all been notified too.

One delightful concept I learned is that someone can be roaming around your computer in the background and you’d have no idea, ie the cursor wouldn’t move or fail to respond, like I saw,

I recently read The Cuckoo’s Egg, which makes all this damn scary.
 
The concern for me would primarily be your work computer/network, not the laptop. If you have single factor VPN into your office, turn that off and fire your IT guy, maybe not in that order. What you need to be concerned about is your corporate data, and hopefully you have offline backups of that somewhere. Agree with the above that the hotel wifi likely has nothing at all to do with this. More likely is that someone compromised your VPN, and was doing the standard thing of recon of your system, stealing anything halfway important, and setting up ransomware.

Current weak points being exploited right now for small businesses are probably - malware delivered by links sent in email, phishing email that trick employees into revealing credentials including MFA, outdated perimeter network gear, and single factor remote access. Single factor auth that's internet facing doesn't work any more, and MFA that uses software based auth, email, or SMS is questionable at best. For remote access you really want a hardware device for MFA. Good security isn't impossible, but these days it's not easy.

Wish you the best on this.
 
Let'sgoflying! said:
Im in a Wyndham hotel doing some work for my business from my laptop.
I was running Proton VPN, using the hotel wifi & accessing my business computer, and banking sites.
My cursor started moving and I saw files being opened when I was looking at some papers.
I struggled to fight for control of the cursor to shut it down and did so within 60 seconds.

I’m trying to change some bank pw’s using my phone right now & Ill call them in the morning.

What else should be done?
I’m actually seeing my IT guy about something else in the morning so I’ll leave the laptop off till we talk.
Click to expand...
I have a few thoughts here.

It’s not clear which computer you think was being controlled. It seems like you mean the laptop, but hitting the power button would be a far easier way to shut it down than “struggling to control the cursor”, so I’m confused. Also, it seems unlikely that you could win that fight long enough to go through the shutdown process.

I’m also struggling with “saw files being opened”. What does that mean? If someone was running applications to see your data, it was certainly an unsophisticated attack. They wouldn’t be likely to be looking at your files in that manner. But again, it’s unclear whether these files were “being opened” on the laptop, or the Remote Desktop - which makes a big difference. If they were being opened on the desktop, then that may signify the attacker was clumsily trying to access that remote data without transferring the files, but seems unlikely.

Sounds more like annoyance malware or even a hardware / software failure of the trackpad. The only way someone could remotely control the laptop is if there was remote access running on it, whether intentionally or maliciously. If intentional, you certainly should turn that off when you are not using it, however, in that case the following paragraph applies here also.

Opening a business computer up to remote access is IMO very risky and you better know really well what you are doing and be using up to date methods including but not limited to multiple factor authentication. But that does not appear from your description to be where the issue was. If it was, then shutting down your laptop didn’t help a bit.
 
Let'sgoflying! said:
My cursor started moving and I saw files being opened when I was looking at some papers.
Click to expand...
The Hotel WiFi had nothing to do with it, VPN or not.

If this is a corporate computer, it is possible someone from the IT department logged in (though unlikely). More likely you clicked on a link at some point and someone loaded (basically) a Remote Desktop App onto you machine. Make sure your IT department does a thorough scan of your machine. Or even better, have them back up your User Data and just reinstall the image. More of a pain for you to tweak all of your personal settings, but a good way to know they didn't miss any thing.
 
rwellner98 said:
It is spectacularly unlikely the hotel wifi is your problem. And you don't need the VPN either, except for a very specific need that you don't have. It's 2025, connection sniffing is a thing of the past.

Every connection your laptop is making is via a secure channel. The absolute most a malicious person on your network could know is where you are connecting to. They can't see the data being passed. They definitely can't commandeer the connection to take control of your work system. Your email, banking, Remote Desktop software all uses SSL on the connection making man in the middle attacks impossible.

A far more likely scenario is that someone was sitting at your desk at the office or also connected to the same desktop using the same Remote Desktop software you were using.
Click to expand...
Yep. The latter is how our IT used to "update" our boxes. They'd legit just grab control. No warning. Bear in mind that we often viewed export-controlled and some classified or otherwise restricted stuff. I yanked my ethernet cable, called the IT people, and asked for the credentials of the people working. That BS stopped that day.
 
MIFlyer said:
with all due respect, if his security team is allowing a non-managed personal device to remote desktop a work PC, I wouldn't ask them anything.
Click to expand...
Remote access from non-managed devices via RDP is a bad plan, agree. Remote access via RDP and single factor auth is an insane plan. I personally wouldn't fire a company for implementing the former, but I absolutely would for either implementing or not correcting as soon as they were aware of the latter.
 
You must log in or register to reply here.
Back
Top