Providing reliable, affordable, and secure Internet connectivity in rural areas remains a major challenge. Pay-for-use Wi-Fi hotspots are emerging as a scalable solution to provide affordable Internet access in underserved and rural regions. Despite their growing adoption, their security properties remain largely unexplored. In this paper, we present a security analysis of these hotspot ecosystems based on Wi-Fi surveys and practical attack validation. We first perform a Wi-Fi survey conducted in two countries, namely the Philippines and India, to understand the deployment and adoption of such systems in practice. Our results suggest that Piso-WiFi pay-to-use hotspots are particularly widespread in rural regions of the Philippines, and that India's PM-WANI initiative is slowly gaining traction. We then perform a security assessment of these deployments and demonstrate two practical attacks: hijacking another user's paid connection; and rogue hotspots. We analyze the root causes of these vulnerabilities, introduce threat models tailored to pay-for-use hotspot deployments, and outline practical security improvements, including a secure caching architecture. Our findings highlight security challenges in emerging rural connectivity infrastructure and provide directions toward more secure and scalable deployments.

翻译：在农村地区提供可靠、经济且安全的互联网连接仍是一项重大挑战。按使用量付费的Wi-Fi热点正逐渐成为向欠发达及农村地区提供可负担互联网接入的可扩展解决方案。尽管其应用日益广泛，但其安全特性在很大程度上尚未被深入探究。本文基于Wi-Fi调查和实际攻击验证，对这些热点生态系统进行了安全分析。我们首先在菲律宾和印度两个国家开展了Wi-Fi调查，以了解此类系统在实际中的部署和应用情况。结果表明，Piso-WiFi这类按使用量付费的热点在菲律宾农村地区尤为普遍，而印度的PM-WANI计划正在逐步推进。随后，我们对这些部署进行了安全评估，并展示了两种实际攻击：劫持其他用户的付费连接以及伪造热点。我们分析了这些漏洞的根本原因，引入了针对按使用量付费热点部署的威胁模型，并概述了实际安全改进措施，包括一种安全的缓存架构。我们的发现突显了新兴农村连接基础设施中的安全挑战，并为实现更安全、更可扩展的部署提供了方向。