It has been reported that that a popular hotspot finder app for Android exposed the Wi-Fi network passwords for more than two million networks. The app allowed anyone to search for Wi-Fi networks in their nearby area. The app allows the user to upload Wi-Fi network passwords from their devices to its database for others to use.
A hotspot finder app exposed 2 million Wi-Fi network passwords – TechCrunch https://t.co/693T8xJraK
— Jim Nitterauer 🇺🇸🇺🇦🇮🇱 (@JNitterauer) April 22, 2019
Experts Comments:
Tim Mackey, Senior Technical Evangelist at Synopsys:
Monique Becenti, Product and Channel Specialist at SiteLock:
The app allows users to have unauthorized access to public and private Wi-Fi networks, allowing network owners to offer their Wi-Fi credentials for public connections without prompting them for permission. Users are often more vigilant about their security when using public networks as they are more widely known to be unsecured connections. However, people tend to let down their guard when using their home networks. If bad actors access a user’s home network, they could alter router settings and direct traffic to malicious websites, or even worse, attackers could have the ability to steal sensitive information such as bank logins or credit card data from a residential router.
Network owners should think twice about who they share their residential or business Wi-Fi credentials with. The risks of widely sharing these passwords highly outweigh the benefits, as users offering their own routers leave their personal traffic and the traffic of the users vulnerable to man-in-middle attacks. Users should only use their own devices when connecting to Wi-Fi networks, they should also keep in mind a VPN is a great tool to encrypt their traffic, however, it will not protect them from a router modified by an attacker. Network owners who think their Wi-Fi networks were abused by this app should immediately change their passwords and reach out to their router manufacturer to report the security vulnerability.”
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.