Sean Gallagher set up his laptop as a Wi-Fi hotspot broadcasting the network name (SSID) “attwifi”. After killing off the settings for his preferred networks on his iPhone, Gallagher turned on the Wi-Fi, and it connected to the fake “attwifi” hotspot without prompting.
When I killed the “attwifi” network after a few seconds, my iPhone promptly demonstrated the further risks of auto-connecting—it automatically reconnected with another network in the list of trusted networks on my phone: a hotspot called “xfinitywifi.”
I had used an Xfinity hotspot while waiting for an appointment a few days earlier, and suddenly I was logged into a hotspot running on my neighbor’s cable modem.
That means that if someone were to set up a malicious Wi-Fi access point called “xfinitywifi,” devices that have connected to Xfinity’s network before could automatically connect without alerting the user or asking for the password. Alternatively, using a “honeypot” tool such as PwnStar, an attacker could spoof both the “xfinitywifi” SSID and the Xfinity login page—stealing their Xfinity credentials in the process.
PwnStar includes the ability to redirect devices connecting to a Web page on the attacking system, record credentials, and then pass the victim on to Internet access as if nothing had happened—meanwhile launching man-in-the-middle attacks against the client (as I demonstrated for myself using an SSID called “notxfinity” to deter any of my neighbors from trying to connect to it).
Hotspot 2.0 is a new set of protocols to enable cellular-like roaming. A variety of partnerships are developing nationwide and world-wide, including:
- The “CableWiFi” network identifier (SSID) allows devices to auto-connect to a “CableWiFi” hotspot when in range. Comcast alone will install eight million Xfinity WiFi hotspots by the end of the year available in public locations across the country, from shopping centers, commuter stations, parks and sporting venues. Xfinity Homes will now contain two SSIDs, enabling consumer cable WiFi boxes to “share” their WiFi, helping the MSOs compete with mobile carriers.
- Facebook Wi-Fi is a partnership between Cisco and Facebook that allows Wi-Fi users to log into access points, using Facebook credentials. Facebook said it had 819 million monthly mobile users (73%) out of its total 1.15 billion users in Q2 2013. It’s primarily driven by advertising revenue.
- Europe’s Fon WiFi community. Uses a $59 Fonera WiFi router. Fon claims to have the largest Wi-Fi network in the world, with over eight million hotspots as at July 2013.
- Boingo launched “Passpoint Secure” networks at more than 20 airports throughout the United States using the Cisco Hotspot 2.0 network. Cisco, AT&T and Accuris partnered to bring a Hotspot 2.0 network to MWC 2014 this year.
- iPass has launched a cloud-based Business Traveler Service 2.0, marking iPass’ transformation into a cloud company utilizing a Software-as-a-Service delivery model, coupled with an app based approach. The service is available at 3,000 airports, 22 airlines, hotels and public areas worldwide. A single log-in enables users to obtain automatic access and authentication on smartphones, tablets and laptops in over 120 countries.
- Google is considering deploying Wi-Fi networks in cities covered by Google Fiber. The disclosure is made in a document Google is circulating to 34 cities that are the next candidates to receive Google Fiber in 2015.
- Google is apparently planning to offer subsidized, commercial-grade Wi-Fi hardware to small and medium-sized businesses, reports TechCrunch, including doctors’ offices, restaurants, and gyms. A Hotspot 2.0 feature would streamline signing in. The hardware would be the only cost involved, and use the businesses’ existing Internet connections, unlike the Google-provided Wi-Fi networks running at Starbucks.
- Cloud4Wi released a new software development kit (SDK) to enable third-party developers to design apps for its Wi-Fi marketplace platform, to deliver greater network value to organizations with Wi-Fi. Cloud4Wi is launching the new SDK at Cisco Live, Cisco’s annual IT and communications conference, at Moscone Center in San Francisco this week.
- Ruckus Wireless has announced their virtual SmartCell Gateway (vSCG) as a followup to the Smart WiFi Access Management Service (SAMS) it unveiled last month for small and midsized businesses. It’s designed for mobile and cable network operators, managed service providers, and large enterprises that want to move their WLAN management to the cloud.
- Meraki’s real-time cloud management enable administrators to manage networks from the cloud.
- PowerCloud Systems adds additional cloud management functions for a variety of access points, including Ubiquiti.
- Tanaza provides cloud management capabilities to Ubiquiti devices such as UniFi, PicoStation and other Wi-Fi Access Points.
Related Dailywireless articles include; Ad-Sponsored WiFi Initiatives from Gowex & Facebook, Comcast Creates Hotspot 2.0 National Network, WiFi & Hotspot 2.0 at MWC, Hotspot 2.0 Moves Out, NYC & Cable Provide Hotspot 2.0 Service, Cities of San Jose and Santa Clara Get Free WiFi, Free Google WiFi for NYC Chelsea Neighborhood, Cloud4Wi: Cloud-Managed, Geo-enabled Hotspots, Cloud-based WiFi: $100 a Pop , Meraki Cloud Managed Security, Cisco: 200 Mobile Providers Delivering Wi-Fi, Time Warner Cable to Double WiFi Hotspots in 2013, AT&T: 40,000 Small Cells, Microsoft Sponsors Free WiFi in NYC & SF, Chicago Announces Free WiFi in Parks, Hotspot 2.0, Cellular/WiFi Roaming Gets Real, Street light Provides Wi-Fi, Cell Coverage, Hotspot 2.0, Intel: Basestation in the Cloud, Clearwire: On the Hot Zone, Sprint to use LightRadio for Small Cells,