Millions Of WiFi Routers Are At Risk Of Hacking

Millions of home Wi-Fi networks are currently at risk of being hacked, a British security company has claimed. But not everyone is convinced it’s an issue. Weaknesses exist in how saved passwords in the browsers Google Chrome and Opera interact with Wi-Fi over unencrypted connections.

That's according to SureCloud researcher Elliott Thompson, who discovered the alleged vulnerabilities and reported them earlier this year.

Thompson claimed that hackers could exploit the weaknesses to hijack a home’s Wi-Fi, steal information from computers connected to the network and even implant malware.

“The hacker would be able to join the WiFi network, access shared files, access 'internet of things' devices which trust the local network [and] view what websites everyone is visiting,” Thompson told Newsweek. “If those websites are unencrypted, the hacker could attempt to implant malware onto the device to steal passwords or access webcams from the computers on the network.”

But there appear to be some major caveats to such an intrusion. According to SureCloud, in order to compromise a home network, the cybercriminal would need to be within Wi-Fi range of the router. 

Additionally, the victim’s device would need to be using the Chrome or Opera browsers that have the router’s login credentials to an open network saved. If so, researchers said they could use software exploits to steal credentials in a minute. 
And it also requires user interaction. In the proof-of-concept attack, the target would need to click a page pop-up that appeared to be their Wi-Fi router’s admin menu for it to work.

SureCloud criticised the fact that Chrome browsers save Wi-Fi router administration credentials and re-enter them automatically—an auto-fill process that is designed for convenience. Obtaining router details could be used to capture the Wi-Fi network password (PSK), SureCloud said.

“Nearly every single home router that uses a web management page [would be impacted],” Thompson claimed. “There are likely hundreds of millions of routers fitting these criteria in use.

“The router is not the only requirement for exploitation,” the security researcher conceded. “It is in combination with saved credentials, Chrome being in-use and the operating system remembering an open Wi-Fi network. These are all criteria that many people will meet.”

A real-world problem? 
But external independent cybersecurity expert Robert Pritchard told Newsweek he remained unconvinced the alleged issue reported by SureCloud was a problem at all.

“The vast majority of Wi-Fi networks these days are encrypted, meaning this attack would not be viable,” Pritchard said. “Even if you can find an unencrypted Wi-Fi network, you would still have to find a victim on said network who is actively using Chrome or Opera, and who had the administrator credentials for the network router saved in the browser.

“Against unencrypted networks the attack hardly seems necessary—there is nothing to stop the attacker joining the network, intercepting traffic or doing any number of malicious things.”
Responding, SureCloud researcher Thompson said: “The target device in the demonstration is connected to a secure, WPA2 protected network, then using the Karma attack the target is brought onto a fake unsecured network to begin the next stage of the attack.

“The first Karma stage of this attack is well known, we have built upon that. The attack is demonstrated to work against WPA2 networks encrypted with a strong pre-shared key (PSK), this is what makes the finding significant. The attack doesn’t require intercepting any traffic.”

SureCloud said it disclosed its findings to Google’s Chromium project on March 2, 2018. Chromium, which maintains the Chrome browser, said the password feature was “working as designed” and that it would not be updated in light of the alleged security weaknesses.

In a statement on Wednesday 5th Sept, Google said: “Security is a core tenet of Chrome and we are committed to providing our users with a secure web experience.

“We appreciate the security community for working with us to bring any concerns to our attention. We’ll study this closely and see if there are improvements to make.”

Users can protect home networks by clearing their Chrome browser's saved passwords, deleting saved open networks and not allowing automatic reconnection to networks, SureCloud said.

Newsweek

You Might Also Read: 

WiFi Can Spy on You:

 

« UK Fallout From The Massive Breach At Equifax
Has Demand For Cyber Security Skills Hit Crisis Point? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Cortado Mobile Solutions

Cortado Mobile Solutions

Cortado Mobile Solutions is the manufacturer of the mobile device management solution Cortado MDM.

Mocana

Mocana

Mocana provides a software platform that allows you to develop, test and distribute more secure IoT devices and services.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

D3 Security

D3 Security

D3's Smart SOAR platform is at the forefront of the security automation revolution, helping clients around the world to rapidly identify, analyze, and resolve advanced threats.

Keepnet Labs

Keepnet Labs

Keepnet Labs is a phishing defence platform that provides a holistic approach to people, processes and technology to reduce breaches and data loss and presents anti-phishing solutions.

ReFirm Labs

ReFirm Labs

ReFirm Labs provides the tools you need for firmware security, vetting, analysis and continuous IoT security monitoring.

Japan Cybersecurity Innovation Committee (JCIC)

Japan Cybersecurity Innovation Committee (JCIC)

JCIC is an independent and not-for-profit thinktank to establish a secure and safe digital society.

Rogers Cybersecure Catalyst

Rogers Cybersecure Catalyst

Rogers Cybersecure Catalyst helps Canadians and Canadian companies seize the opportunities and tackle the challenges of cybersecurity.

Startupbootcamp Fintech & Cybersecurity

Startupbootcamp Fintech & Cybersecurity

Startupbootcamp is the world’s largest network of multi-corporate backed accelerators helping startups scale internationally.

Findcourses.co.uk

Findcourses.co.uk

Findcourses is a dedicated education search engine designed to make it easy for our learners to search and find exactly what they need from our community of trusted training providers.

Qrator Labs

Qrator Labs

Qrator Labs is a leader in DDoS attack mitigation, helping organizations protect their websites from the most harmful, sophisticated DDoS attacks.

Suresecure

Suresecure

Suresecure are a specialised consulting company providing Strategic IT security consulting, Managed Security Services, and Incident Response Management.

Coralogix

Coralogix

Coralogix are rebuilding the path to observability using a real-time streaming analytics pipeline that provides monitoring, visualization, and alerting capabilities without the burden of indexing.

Semgrep

Semgrep

Semgrep is a fast, open-source, static analysis tool for profoundly improving software security and reliability.

DIGISOC

DIGISOC

DIGISOC, a leader in Latin America in Cybersecurity solutions, combines machine learning with human intelligence to be effective in detecting cyber threats.

Prompt Security

Prompt Security

Prompt Security provides an LLM agnostic approach to ensure security, data privacy and safety across all aspects of Generative AI.

turingpoint

turingpoint

turingpoint GmbH is a tech enabled boutique consultancy. It was founded by security experts with a focus on cyber security and software solutions.