Hotspot Finder App Exposes 2 M Wi-Fi Network Passwords
A highly popular hotspot finder App for Android has exposed over two million Wi-Fi network passwords.
WiFi Finder, the popular hotspot finder app that’s downloaded by thousands of users and used to locate and connect with Wi-Fi hotspots, has exposed more than two million Wi-Fi network passwords from its unprotected database. Security researcher Sanyam Jain, who is a member of the GDI Foundation, has found the database and has then reported his findings to TechCrunch.
TechCrunch reports, “The app, downloaded by thousands of users, allowed anyone to search for Wi-Fi networks in their nearby area. The app allows the user to upload Wi-Fi network passwords from their devices to its database for others to use…That database of more than two million network passwords, however, was left exposed and unprotected, allowing anyone to access and download the contents in bulk.”
Attempts that were made to contact the developer, who is believed to be based in China, proved futile. However, the host, DigitalOcean, on being informed of the data exposure, acted promptly and took down the database within a day of reaching out.
The exposed database contains Wi-Fi networks-related records like the names of the Wi-Fi networks, their precise geolocation details, the BSSID (Basic Service Set Identifier) and the Wi-Fi network passwords stored in plaintext.
The TechCrunch report observes, “Although the app developer claims the app only provides passwords for public hotspots, a review of the data showed countless home Wi-Fi networks. The exposed data didn’t include contact information for any of the Wi-Fi network owners, but the geolocation of each Wi-Fi network correlated on a map often included networks in wholly residential areas or where no discernible businesses exist.”
Users of the WiFi Finder app don’t have to obtain permission from the network owners for accessing the networks. This means that as a result of the data exposure, the Wi-Fi networks were exposed to unauthorized access. Any attacker who accesses such a Wi-Fi network could modify router settings, change the DNS settings and thus point unsuspecting users to malicious websites. The attackers, upon accessing a Wi-Fi network, would also be able to read the unencrypted traffic transmitted across the network, thereby making it possible for them to steal passwords and other confidential data.
The TechCrunch report points out that tens of thousands of Wi-Fi passwords that were exposed are for U.S-based Wi-Fi networks.
Related Resources:
How to Know If Someone Is Stealing your Wi-Fi
0 Comments