How a Wi-Fi Pineapple Can Steal Your Data (And How To Protect Yourself From It)

An anonymous reader writes: The Wi-Fi Pineapple is a cheap modified wireless router enables anyone to execute sophisticated exploits on Wi-Fi networks with little to no networking expertise. A report in Motherboard explains how it can be used to run a Wall of Sheep and execute a man-in-the-middle attack, as well as how you can protect yourself from Pineapple exploits when you're connected to public Wi-Fi. "... it's important that whenever you are done connecting to a public Wi-Fi network that you configure your phone or computer to 'forget' that network. This way your device won't be constantly broadcasting the SSIDs of networks it has connected to in the past, which can be spoofed by an attacker with a Pineapple," reports Motherboard. "Unfortunately there is no easy way to do this on an Android or an iPhone, and each network must be forgotten manually in the 'Manage Network' tab of the phone's settings. Another simple solution is to turn off your Wi-Fi functionality when you're not using it -- though that isn't as easy to do on some devices anymore -- and don't allow your device to connect to automatically connect to open Wi-Fi networks."

nothing new here.

[anthony_greer]

MITM wifi attacks and hotpot impersonation have been a thing for the better part of a decade now, what does this bring to the table that malicious actors didn't already have?

Re:

[AmiMoJo]

This brings nothing new. The same old solution from over a decade ago works just as well - connect to a VPN.

Android supports this, I'd be surprised if iOS didn't as well.

Re:nothing new here.

[ctilsie242]

Even on iOS, VPNs are trivial. Some VPNs even offer an app which can allow you to select the closest server group, install a profile, and have the VPN auto configure when on Wi-Fi, with the ability to whitelist a few trusted SSIDs.

I'm amazed that Apple or Google hasn't offered their own VPN service where you just flip a switch, ensuring no matter what hanky-panky the AP/ISP does, the worst they can do is slow down or block traffic, not change it.

I decided to go with a VPN always when telcos started actively adding X-UIDH headers on HTTP exchanges. That, and Phorm with ads injected via traffic in flight.

Re: nothing new here.

[ccady]

>> with the ability to whitelist a few trusted SSIDs. That's what I just learned here. You can't trust an SSID, even your own. They will be spoofed. You must *always* use a VPN.

Re:nothing new here.

[mjwx]

MITM wifi attacks and hotpot impersonation have been a thing for the better part of a decade now, what does this bring to the table that malicious actors didn't already have?

Yes, but now it has a Web 2.fucking.0 name, a marketing slogan and can be encased in a plastic pineapple. Cant you see how this is completely different?

Re:

[chispito]

Yes, but now it has a Web 2.fucking.0 name, a marketing slogan and can be encased in a plastic pineapple. Cant you see how this is completely different?

Actually it had all that nearly a decade ago, too [youtube.com].

Re:

[Applehu Akbar]

Hotpot impersonation, the bane of holiday cookouts across the nation.

Re:

[Iconoclysm]

The big controversy around this is the ease of use, anyone can use it, even those with very little understanding of how to do what they're doing. Also, the price - under $100.

I'm not buying it

[dhaen]

So this is a product adverisment?

Re:

[hcs_$reboot]

Quite obvious. $99

Re:

[wierd_w]

Especially since you can construct something much smaller, with COTS parts, for less than half that.

(psst... hacked zsun + USB battery pack. Other than N, and maybe really loud antennas, it can do anything this thing does. Total price: retail ~35$)

Re:

[hcs_$reboot]

There are even small and good stuff in shops, that accept openwrt joyfully, for 1/4 of that price.

Obligitory

[forkfail]

Pen Pineapple Apple Penetration.

Already fixed

[PReDiToR]

Wi-Fi Privacy Police [google.com].

Take a look, I'm not connected with the project.

From F-Droid

[Pseudonymus Bosch]

F-Droid [f-droid.org].
A problem is that the function of disabling wifi to out-of-place SSIDs requires to enable location services.

Re:

[smooth wombat]

No, that is too difficult. It means people will miss five seconds of texts which are coming through.

Re:

[Oswald McWeany]

No, that is too difficult. It means people will miss five seconds of texts which are coming through.

Texts come through perfectly fine without Wi-Fi. Messaging doesn't use Wi-Fi.

SSID Broadcast

[Anonymous Coward]

Only the SSIDs of hidden networks need to be broadcast, not all SSIDs of the listed networks.

Re: SSID Broadcast

[Anonymous Coward]

THIS.
On Windows you even get a warning when connecting to hidden SSID networks, for exactly this reason.

Re: SSID Broadcast

[Anonymous Coward]

Or the god damn WiFi spec could have the router send its public key on connect and if it doesn't match the phone's stored public key, fail. Otherwise, communicate using the public key. If the router sends a public key it doesn't have the matching private key for, it can't decrypt anything anyway.

Try making it clear

[Bohnanza]

One thing that would help is if you actually told people what is going on. If you warn people of a possible "Wall of Sheep" attack from a "Wifi Pineapple" you are telling them nothing at all.

Re:

[freeze128]

If the Wi-Fi Pinapple listens passively for clients trying to connect to their 'remembered' Wi-Fi hotspots, then why can't the cell phones also do that? Why do they need to shout "Hey, here are all the access points that I have connected to in the past"?

Re:

[dissy]

Why do they need to shout "Hey, here are all the access points that I have connected to in the past"?

It's part of the spec, not so much wifi specifically but DHCP and DNA protocols.

The idea was when you first connect to a wifi network, you use ARP at layer 2 and broadcast a DHCP request to get a valid IP to begin using layer 3.
When you are disconnected "briefly" and reconnect later, that IP is likely to still be valid for use.

Using DNA (direct network attachment), you can broadcast the previously used router MAC, device MAC, and SSID to verify you are on the same local link, and can begin reusing your prev

Great!

[140Mandak262Jamuna]

All intel chips are vulnerable. OK let me switch to mobile and avoid intel.

All WiFi devices are vulnerable. OK I am going to turn off wi-fi and use only mobile data

Next?

Rouge Cell towers, stingrays, ...

ALL OUR BASES ARE BELONG TO THEM

Re:

[Anonymous Coward]

and laws aren't going to help you because stingrays should already be illegal...

Re:

[DontBeAMoran]

Rouge cell towers

Well, just connect to the blue or green ones. Problem solved.

Damn fruits

[nospam007]

Apple WiFi dangerous, Pineapple WiFi dangerous ...

I guess I'll stick to WiFi Vegetables.

Another reason to miss my Windows Phone

[Colin Castro]

I could set it up to only connect to wifi at certain locations, it was such a battery saver. I mean like now I can set my iPhone to connect to only known networks (even though that is how this attack works) etc etc, but having the geofencing was sweet.

Breakthrough security method

[Murdoch5]

How about not connecting to WiFi hotspots? With mobile data being plentiful, you simply don't need to hook up to WiFi hotspots, which completely removes the need to forget them :)

Re: Breakthrough security method

[Anonymous Coward]

This is a very geographically limited solution. Cheap, quality mobile data is far from ubiquitous even in the us, let alone globally.

Re:

[Dog-Cow]

Cheap, quality mobile data is far more accessible outside the US than in. You seem to be living in a bubble.