--- id: CP-543 slug: coworking-lockers-shared-wifi-screens lang: en title: Working in a coworking space description: "Shared Wi-Fi, curious neighbours, strangers asking questions: the risks of a coworking space and the reflexes an employee needs." canonical_url: https://startbrain.io/cyberpedia/en/articles/coworking-lockers-shared-wifi-screens/ markdown_url: https://startbrain.io/cyberpedia/en/articles/coworking-lockers-shared-wifi-screens.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Working in a coworking space", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/coworking-lockers-shared-wifi-screens/ (CC BY 4.0) wing: 5 theme: outsmart_social_engineering reflex: cr-048 schema: G5 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/coworking-lockers-shared-wifi-screens/ fr: https://startbrain.io/cyberpedia/fr/articles/coworking-casiers-wifi-partage-ecrans/ de: https://startbrain.io/cyberpedia/de/articles/arbeiten-im-coworking-space/ es: https://startbrain.io/cyberpedia/es/articles/trabajar-en-coworking/ sources: - "n": 1 title: Adversary-in-the-Middle, Technique T1557 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1557/ accessed: "2026-11-03" - "n": 2 title: Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1200/ accessed: "2026-11-03" - "n": 3 title: Avoiding Social Engineering and Phishing Attacks publisher: CISA url: https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks published: "2021-02-01" accessed: "2026-11-03" - "n": 4 title: Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1598/ accessed: "2026-11-03" - "n": 5 title: Recognize and Report Phishing publisher: CISA url: https://www.cisa.gov/secure-our-world/recognize-and-report-phishing accessed: "2026-11-03" - "n": 6 title: "Phishing attacks: defending your organisation" publisher: NCSC (UK) url: https://www.ncsc.gov.uk/guidance/phishing published: "2018-02-05" accessed: "2026-11-03" --- # Working in a coworking space In a coworking space, an employee shares a room, a connection and sometimes a desk with people they do not know. Neighbours change from one day to the next, and nothing shows who works for whom. This entry describes what the sources cited here say about the situations that arise there: a Wi-Fi network that others can imitate, a device plugged into the network, a stranger asking questions. These sources cover neither privacy filters, nor lockers, nor VPNs, so the entry says nothing specific about them. ## In 30 seconds - Where it happens: on the space's Wi-Fi or wired network, in the kitchen, at reception, anywhere a conversation starts. - What the attacker wants: to sit between your computer and the Internet to read or alter what passes through, or to gather information about you and your company through conversation. - The reflex: give no information about your company to someone you do not know is entitled to receive it, and verify their identity through a channel you choose yourself. - If it has already happened: tell your organisation's security staff right away, then change the passwords concerned. ## Straight answers ### Why does coworking change the risk? Because the setting is shared. The network is not your company's, the people around you are not colleagues, and a visitor draws no attention. The sources cited here describe general techniques (traffic interception, added hardware, social engineering) that find easy ground in this setting. ### What can someone do who gets in the middle of the network? MITRE describes the adversary-in-the-middle technique: the attacker positions themselves between two networked devices to collect information or act on what flows between them [1]. They can intercept credentials, including access tokens and session cookies [1]. Among the sub-techniques listed, one is named "Evil Twin" [1]. ### Can a stranger plug hardware into the network? MITRE describes it: adversaries can physically introduce an accessory, a network device or another device into a system or network to gain entry [2]. Among the capabilities cited is adding new wireless access points to an existing network [2]. The same page notes that public references to use by real attackers are scarce, while many penetration testing teams use it for initial access [2]. ### Can information be extracted from me without any hacking? Yes. CISA describes a social engineering attack as the use of human relationships to obtain or compromise information about an organisation or its systems [3]. The attacker can seem unassuming and respectable, claim to be a new employee, a repairer or a researcher, and even present credentials [3]. ### What if I think I have given away sensitive information? CISA advises reporting it to the relevant people in the organisation, including network administrators, who can watch for unusual activity [3]. The disclosed passwords must also be changed without delay, along with those of every account where the same one was used [3]. ## How it works Two families of risk mix in a shared space: those that go through the network and those that go through people. On the network side, MITRE explains that the attacker abuses features of common protocols, such as ARP or DNS, to force a device to communicate through a system they control [1]. They can also change a victim's DNS settings to divert them from legitimate sites or push malware to them [1]. Another route is to negotiate a weaker version of a communication protocol or an encryption algorithm [1]. Plugged-in hardware is part of the picture too. The DarkVishnya group, cited by MITRE, physically connected a Bash Bunny, a Raspberry Pi, netbooks and cheap laptops to the targeted organisation's environment to reach its local network [2]. On the people side, information gathering has a name: MITRE speaks of phishing for information, whose goal is to collect data from the victim rather than to run malicious code [4]. It goes through emails, instant messages or other exchanges, and can also direct the victim to a phone number where the attacker tries to collect confidential information [4]. The attacker often poses as a source with a reason to ask, and sometimes sends several messages that look urgent [4]. CISA adds a mechanism that coworking favours: if the attacker does not get enough information from one person, they contact another in the same organisation and rely on what the first said to appear credible [3]. A harmless answer given at the coffee machine can therefore serve as a foothold for the next question. ## What you do - Verify the identity of anyone claiming to come from a legitimate organisation, directly with that organisation [3]. - Be wary of unsolicited calls, visits or messages about employees or internal information [3]. - Give no personal information and no information about your company, including its structure or networks, unless you are certain the person is entitled to receive it [3]. - Take certificate errors seriously: MITRE recommends training users to distrust them, because an attacker can use their own certificates to intercept HTTPS traffic [1]. - Check that a site's address begins with "https" rather than "http" before sending sensitive information to it [3]. - Turn on multifactor authentication: with a second factor, an attacker cannot access an account with the stolen password alone [6]. - If a message looks suspicious, click no link and call no number it contains. Look for another way to reach the company or the person, for example their official website [5]. - Report the incident, even if you clicked: the NCSC states that knowing sooner makes it possible to limit the damage, and that users must know in advance how to report, because their compromised device may deprive them of their usual means of communication [6]. ## Pitfalls The first pitfall is politeness. A stranger can seem friendly and legitimate, and CISA notes that they may even present credentials to back up their identity [3]. A badge or a name dropped therefore proves nothing. The second is urgency. Among the signs of phishing, CISA lists pressing or emotional language, with serious consequences announced if there is no immediate reply [5]. It adds that spelling mistakes are no longer a reliable sign, because some emails now have perfect grammar [5]. The third is the fake address. A sender address can imitate a company's by altering or omitting a few characters [3], and CISA gives the example of an address like "amazan.com" [5]. Sender spoofing can fool humans as well as automated tools [4]. The fourth is contact through another channel. A call can go through voice over IP, which makes it easy to falsify the caller's identity [3]. A displayed number is therefore not enough to confirm who is calling. Finally, fear of punishment holds back reporting. The NCSC states that users who fear reprisals do not report their mistakes in time, or at all [6]. ## Sources 1. MITRE ATT&CK, "Adversary-in-the-Middle, Technique T1557 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1557/ (accessed 3 November 2026) 2. MITRE ATT&CK, "Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1200/ (accessed 3 November 2026) 3. CISA, "Avoiding Social Engineering and Phishing Attacks", 1 February 2021. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (accessed 3 November 2026) 4. MITRE ATT&CK, "Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1598/ (accessed 3 November 2026) 5. CISA, "Recognize and Report Phishing". https://www.cisa.gov/secure-our-world/recognize-and-report-phishing (accessed 3 November 2026) 6. NCSC (UK), "Phishing attacks: defending your organisation", 5 February 2018. https://www.ncsc.gov.uk/guidance/phishing (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/coworking-lockers-shared-wifi-screens/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.