Researchers have developed a new drone that exploits security flaws to detect Wi-Fi networks inside buildings. The device can fly near a building, then use the inhabitants’ Wi-Fi network to identify and locate all Wi-Fi-enabled devices inside in a matter of seconds. Experts say it’s an example of the privacy risks inherent in many Wi-Fi devices. “Wi-Fi and the closely related short-range technologies like Bluetooth are all radio technologies, which means that they have signals that can be identified, located, recorded, tracked, or jammed,” Mike Parkin, an engineer at cybersecurity company Vulcan Cyber, told Lifewire in an email interview. “There is an inevitable tradeoff between mobility and security with mobile technology like this. While better encryption has made it harder for an attacker to know what’s being said, the nature of Wi-Fi means they’ll know who’s talking and where they are.”
Droning On
The drone, invented at the University of Waterloo in Canada, uses a loophole the researchers call “Polite Wi-Fi.” Even if a network is password protected, smart devices will automatically respond to contact attempts from any device within range. The drone sends several messages to a device as it flies, then measures the response time on each, enabling it to identify the device’s location to within a meter. “Using similar technology, one could track the movements of security guards inside a bank by following the location of their phones or smartwatches,” Ali Abedi, a professor of computer science at Waterloo and the drone’s inventor, said in a new release. “Likewise, a thief could identify the location and type of smart devices in a home, including security cameras, laptops, and smart TVs, to find a good candidate for a break-in.” The team that built the drone said anyone with the right expertise could easily create a similar device. “On a fundamental level, we need to fix the Polite Wi-Fi loophole so that our devices do not respond to strangers,” Abedi said. “We hope our work will inform the design of next-generation protocols.” In the meantime, he urges Wi-Fi chip manufacturers to introduce an artificial, randomized variation in device response time, which will make calculations like the ones the drone uses wildly inaccurate.
Staying Safe
Matthew T. Carr, the head of research and technology at Atumcell, a cyber security company, told Lifewire via email that Wi-Fi is inherently vulnerable to eavesdropping, even on fully up-to-date and patched systems. He said that Wi-Fi relies on devices using the network to be “honest” about their own identities. “Attackers can gain unauthorized access by pretending to be legitimate,” he added. If possible, avoid using public Wi-Fi, Carr said. Instead, use your phone as a hotspot over its cellular connection. “Your phone will act as the modem and router, which means no one will be able to eavesdrop,” he added. “Cellular data services are much more secure, and they are much faster than they were years ago.” You might want to turn off the Wi-Fi on your phone, too, so it doesn’t inadvertently connect to an insecure network. Most people know that connecting to a public Wi-Fi network may be unsafe, but many may not realize their device might automatically connect to a Wi-Fi network unless they adjust their settings, Emma McGowan, an online privacy expert for the cybersecurity company Avast, said in an email interview with Lifewire. “Installing a VPN, or a virtual private network, is one of the fastest and simplest ways you can stay safe and completely private when tapping into different Wi-Fi networks,” McGowan added. “VPNs encrypt the data that passes between your computer and your internet service provider, which can help prevent potential hackers from seeing your online activity.” If you must use public Wi-Fi, make sure your own device is fully updated and patched, Carr said. “Don’t wait to apply patches to your operating system and apps because when unpatched phones are coupled with Wi-Fi’s own vulnerabilities, your data could be compromised easily.” But, Mark Lambert, vice president of products at cybersecurity company ArmorCode, software solutions, said in an email that software solutions won’t always help. “Any device with cellular, Bluetooth, or Wi-Fi connectivity is open to being compromised,” he said. “You should always turn off these capabilities when not in use, disable ‘discovery features,’ and never connect to a source you are unfamiliar with.” Correction 11/14/2022: Add the correct bio link for the source in paragraph 8.
