Why hackers love your Wi-Fi (and how to protect it)

Wi-Fi hacking is all fun and games until somebody hacks the Wi-Fi on a roller coaster. That’s a lesson one professional security researcher found out the hard way.

Several years ago at Disneyland, the roller coaster car he was riding was click-click-clacking its way along its track until it abruptly stopped. The hacker, who requested anonymity to avoid potential legal consequences, says he and other thrill seekers were alarmed and confused. Their ride was dead on its tracks, and nobody knew why.

As seconds stretched into long minutes suspended in the air above the park, the hacker remembered that he had in his backpack a WiFi Pineapple, which he’d been using for a penetration-testing gig earlier that day. The Pineapple can detect and intercept Wi-Fi traffic by pretending to be an access point for phones, tablets, laptops, and Internet of Things devices.

Wherever there’s Wi-Fi—from homes to airports to cafes to amusement parks—there are access points.

The hacker peeked into his backpack, where he saw the Pineapple was still on and running on battery power. He switched it off, and soon thereafter, the roller coaster started running again. And when he later looked at his Pineapple’s logs, he realized that the device had pretended to be not just an access point, but the Wi-Fi router itself.

Without his prompting, the pineapple had connected to the roller coaster’s Wi-Fi, sent out a shutdown signal, and turned off the real Wi-Fi router—and the ride.

“That’s a great example of everything around us running on Wi-Fi these days, and nobody is protecting things correctly,” says Wi-Fi expert Shannon Morse, co-host of the popular hacker podcast Hak5. “You even have rides at theme parks shutting down because they accidentally get Pineappled.”

Without taking proper precautions, connecting to Wi-Fi—the ubiquitous center of the connected home, office, hotel, and nearly everywhere between—is risky, experts say. Not only are your connected devices, from laptops to door locks, more vulnerable to hacks, but your Internet usage, from the sites you browse to the apps you rely on, are vulnerable to exposure.

Wi-Fi routers, which broadcast wireless Internet signals, have been known for years to be quite hackable. Protecting them can be difficult because the very factors that make Wi-Fi so popular also make it a security nightmare, Morse says.

“Wi-Fi is a huge convenience factor for customers and consumers, but it’s also a huge security and privacy problem” for many Internet professionals today, she says.

“As soon as you automatically connect to a known wireless-access point, or something that you think might be a known wireless-access point, you’re going to run the risk of being intercepted, having your data stolen, and [having your data] used against you.”—Shannon Morse, Wi-Fi expert, co-host of podcast Hak5.

Depending on how your device and the router are configured, the connection may happen automatically, especially in commercial chains like Starbucks or with semi-public networks like Xfinity’s “xfinitywifi” that use the same Wi-Fi router name everywhere.

Wi-Fi routers are constantly sending out small data beacons to see if any devices within range have previously connected to them. Devices such as laptops and phones are doing the same, probing the airwaves to connect to familiar routers.

“As soon as you automatically connect to a known wireless-access point, or something that you think might be a known wireless-access point, you’re going to run the risk of being intercepted, having your data stolen, and [having your data] used against you,” Morse says. “Or, you could run the risk of having somebody create a fake website that looks like your bank, and is able to steal your usernames and passwords” for that site.

And Wi-Fi routers that use their physical MAC address as part of the default administration password are easier to hack. Once a hacker guesses the router’s password, he or she could spy on the Internet traffic passing through it.

Despite risks in using unsecured Wi-Fi, recent technological advances enhance safety when connecting wirelessly to the Internet, Dan Tentler says.

“Manufacturers should be forbidden by law to hard-code passwords.”—Rene Weidlinger, Austrian security engineer and co-organizer, Security Forum conference

Tentler, founder of the San Diego-based security testing company Phobos Group, has more than a decade of Wi-Fi hacking under his belt. He says the 2006 introduction of Wi-Fi Protected Access II, or WPA2, began a long, slow march toward safer wireless connectivity.

Today, “for not a lot of money, you can get a lot of security,” he says. “I’m seeing Wi-Fi attacks less and less.”

That doesn’t mean that consumers should be using public Wi-Fi networks, which anybody can sign on to from a laptop or smartphone, without a safety net, he cautions. In addition to spying on your Internet traffic, hackers could track your location by monitoring which public Wi-Fi networks you log on to through sites like Wigle.net.

Using a virtual private network, or VPN, is a must, Tentler says. Many businesses provide one to their employees, but you can also purchase an annual VPN software license for less than $40.

Rene Weidlinger, a security engineer at an Austrian Internet service provider and co-organizer of the conference Security Forum, says that while the WPA2 update marks a “significant change in Wi-Fi technology,” users need to be wary of newer conveniences such as File Transfer Protocol (FTP), Universal Plug and Play (UPnP), and USB functionality built into routers because they “open your device to more threats.”

“Check the manufacturing date of the device and how long they provide updates,” says Weidlinger, who worries about the security risks presented by baking passwords directly into routers. “Manufacturers should be forbidden by law to hard-code passwords.”

The risks of getting hacked have exponentially increased, Morse says, thanks to the ever-expanding number of IoT devices, which rarely come with robust network security. Some vendors have built “smarter routers.” Others have developed physical router add-ons like the Cujo to create firewalls between networks and devices, but there’s an overriding problem when it comes to building safer Wi-Fi out of the box: convenience.

There are “a lot of things that I feel like wireless, as a whole, could fix,” Morse says, “but we just aren’t doing it because it would upset consumers.”

She advises consumers who have routers that can create guest networks to do so for their IoT devices, as well as for visitors, to isolate potentially risky IoT tech from your home computers, tablets, and smartphones.

Software may be eating the world, but for hackers, Wi-Fi is the cheap, easily broken glue holding it together.