01/27/2012 -

For convenience, wireless devices like laptops, tablets, and smartphones contain software that automatically connects to networks they remember. When a wireless device is turned on, it sends out probe requests, searching for familiar networks to connect to.

“This convenient feature is what gets you online without effort when you turn on your computer at home, or the office or coffee shops or airports that you’ve been to before. That feature is also a vulnerability,” says Darren Kitchen of San Francisco-based technology groupHak5.

Hak5 are the creators of the WiFi Pineapple, a device that allows hackers to access data from wireless devices by exploiting that vulnerability.

“Laptops are constantly looking for networks they remember. ‘Hey, I’m looking for my Linksys, or I’m looking for my Netgear, or I’m looking for my corporate network,'" explains Kitchen. "The pineapple replies and says ‘Yes, I am your corporate network.'”

In 802.11, there is no mechanism built in to the protocol for verifying that the SSID is the same SSID that you’ve connected to before, Kitchen says.

It’s essentially aWiFi honey-pot. “It’s super simple. You just turn it on and it connects back to you and it does ‘the thing’"--secretly gathering Web data, including passwords, and data that a device is sending and receiving using software called Jasager, German for “The yes man.”

Pineapples are the easiest way to become the man-in-the-middle when it comes to WiFi, Kitchen said. “You’re not trying to get on the network and place your self between the router and them, because you are the router.”

Hak5 has developed several pineapple devices in the past, but revealed its latest model at theShmoocon Hacker conference in Washington, D.C., on Friday.

12next ›last »