#1 Trusted Cybersecurity News Platform
Followed by 4.50+ million
The Hacker News Logo
Subscribe – Get Latest News
Cybersecurity

wireless security | Breaking Cybersecurity News | The Hacker News

Category — wireless security
Sonos Speaker Flaws Could Have Let Remote Hackers Eavesdrop on Users

Sonos Speaker Flaws Could Have Let Remote Hackers Eavesdrop on Users

Aug 09, 2024 IoT Security / Wireless Security
Cybersecurity researchers have uncovered weaknesses in Sonos smart speakers that could be exploited by malicious actors to clandestinely eavesdrop on users. The vulnerabilities "led to an entire break in the security of Sonos's secure boot process across a wide range of devices and remotely being able to compromise several devices over the air," NCC Group security researchers Alex Plaskett and Robert Herrera said . Successful exploitation of one of these flaws could allow a remote attacker to obtain covert audio capture from Sonos devices by means of an over-the-air attack. They impact all versions prior to Sonos S2 release 15.9 and Sonos S1 release 11.12, which were shipped in October and November 2023. The findings were presented at Black Hat USA 2024. A description of the two security defects is as follows - CVE-2023-50809 - A vulnerability in the Sonos One Gen 2 Wi-Fi stack that does not properly validate an information element while negotiating a WPA2 four-wa
New Wi-Fi Vulnerability Enables Network Eavesdropping via Downgrade Attacks

New Wi-Fi Vulnerability Enables Network Eavesdropping via Downgrade Attacks

May 16, 2024 Vulnerability / Network Security
Researchers have discovered a new security vulnerability stemming from a design flaw in the IEEE 802.11 Wi-Fi standard that tricks victims into connecting to a less secure wireless network and eavesdrop on their network traffic. The  SSID Confusion attack , tracked as CVE-2023-52424, impacts all operating systems and Wi-Fi clients, including home and mesh networks that are based on WEP, WPA3, 802.11X/EAP, and AMPE protocols. The method "involves downgrading victims to a less secure network by spoofing a trusted network name (SSID) so they can intercept their traffic or carry out further attacks," Top10VPN  said , which collaborated with KU Leuven professor and researcher Mathy Vanhoef. "A successful SSID Confusion attack also causes any VPN with the functionality to auto-disable on trusted networks to turn itself off, leaving the victim's traffic exposed." The issue underpinning the attack is the fact that the Wi-Fi standard does not require the network na
cyber security

Online Master's in Applied Intelligence

websiteGeorgetown UniversityCyber Security
More than 90% of respondents expressed concern over their team and tooling's ability to detect identity-based attacks. Learn about critical gaps in security programs and what environments pose the most risk to security teams. Download the Report.
Critical Infrastructure at Risk from New Vulnerabilities Found in Wireless IIoT Devices

Critical Infrastructure at Risk from New Vulnerabilities Found in Wireless IIoT Devices

Feb 09, 2023 Network Security / IoT Security
A set of 38 security vulnerabilities has been uncovered in wireless industrial internet of things (IIoT) devices from four different vendors that could pose a significant attack surface for threat actors looking to exploit operational technology (OT) environments. "Threat actors can exploit vulnerabilities in Wireless IIoT devices to gain initial access to internal OT networks," Israeli industrial cybersecurity company Otorio  said . "They can use these vulnerabilities to bypass security layers and infiltrate target networks, putting critical infrastructure at risk or interrupting manufacturing." The flaws, in a nutshell, offer a remote entry point for attack, enabling unauthenticated adversaries to gain a foothold and subsequently use it as leverage to spread to other hosts, thereby causing serious damage. Some of the identified shortcomings could be chained to give an external actor direct access to thousands of internal OT networks over the internet, security
cyber security

Permiso Security's 2024 State of Identity Security Report

websitePermisoThreat Detection / Identity Security
More than 90% of respondents expressed concern over their team and tooling's ability to detect identity-based attacks. Learn about critical gaps in security programs and what environments pose the most risk to security teams. Download the Report.
Critical Auth Bypass Bug Reported in Cisco Wireless LAN Controller Software

Critical Auth Bypass Bug Reported in Cisco Wireless LAN Controller Software

Apr 15, 2022
Cisco has released patches to contain a critical security vulnerability affecting the Wireless LAN Controller (WLC) that could be abused by an unauthenticated, remote attacker to take control of an affected system. Tracked as  CVE-2022-20695 , the issue has been rated 10 out of 10 for severity and enables an adversary to bypass authentication controls and log in to the device through the management interface of WLC. "This vulnerability is due to the improper implementation of the password validation algorithm," the company said in an advisory. "An attacker could exploit this vulnerability by logging in to an affected device with crafted credentials." Successful exploitation of the flaw could permit an attacker to gain administrator privileges and carry out malicious actions in a manner that allows a complete takeover of the vulnerable system. The company stressed that the issue only affects the following products if running Cisco WLC Software Release 8.10.151.
Researchers Discover New Ways to Hack WPA3 Protected WiFi Passwords

Researchers Discover New Ways to Hack WPA3 Protected WiFi Passwords

Aug 03, 2019
The same team of cybersecurity researchers who discovered several severe vulnerabilities, collectively dubbed as Dragonblood , in the newly launched WPA3 WiFi security standard few months ago has now uncovered two more flaws that could allow attackers to hack WiFi passwords . WPA, or WiFi Protected Access, is a WiFi security standard that has been designed to authenticate wireless devices using the Advanced Encryption Standard (AES) protocol and intended to prevent hackers from eavesdropping on your wireless data. The WiFi Protected Access III (WPA3) protocol was launched a year ago in an attempt to address technical shortcomings of the WPA2 protocol from the ground, which has long been considered to be insecure and found vulnerable to more severe KRACK attacks . WPA3 relies on a more secure handshake, called SAE (Simultaneous Authentication of Equals), which is also known as Dragonfly, that aims to protect WiFi networks against offline dictionary attacks. However, in less
Security Flaws in WPA3 Protocol Let Attackers Hack WiFi Password

Security Flaws in WPA3 Protocol Let Attackers Hack WiFi Password

Apr 10, 2019
🔥 Breaking — It has been close to just one year since the launch of next-generation Wi-Fi security standard WPA3 and researchers have unveiled several serious vulnerabilities in the wireless security protocol that could allow attackers to recover the password of the Wi-Fi network. WPA, or Wi-Fi Protected Access, is a standard designed to authenticate wireless devices using the Advanced Encryption Standard (AES) protocol and is intended to prevent hackers from eavesdropping on your wireless data. The Wi-Fi Protected Access III (WPA3) protocol was launched in an attempt to address technical shortcomings of the WPA2 protocol from the ground, which has long been considered to be insecure and found vulnerable to KRACK (Key Reinstallation Attack). Though WPA3 relies on a more secure handshake, known as Dragonfly , that aims to protect Wi-Fi networks against offline dictionary attacks, security researchers Mathy Vanhoef and Eyal Ronen found weaknesses in the early implementation
Li-Fi is 100 times Faster than Wi-Fi Technology: Real-World Tests Prove

Li-Fi is 100 times Faster than Wi-Fi Technology: Real-World Tests Prove

Nov 26, 2015
Yes, it's time to shift from Wi-Fi to Li-Fi — an alternative technology that is 100 times faster than the average speeds of Wi-Fi . Scientists have just field-tested the new wireless technology called Li-Fi for the first time and achieved marvelous wireless speeds that are 100 times faster than current WiFi speeds. What is Li-Fi Technology? Li-Fi is a new wireless technology that transmits high-speed data using light (i.e. Visible Light Communication or VLC) rather than radio bands. In short, Li-Fi is a Super-Fast alternative to Wi-Fi. Earlier this year, scientists achieved mind-blowing speeds of 224 gigabits per second (Gbps) in the lab using Li-Fi. It's believed that this technology has the potential to change everything about the way we use the Internet today. And Yes, it will. Test Results: Li-Fi is 100 times Faster than Wi-Fi An Estonian startup company called Velmenni took the technology out of the laboratories and into the real-
MIT Scientists: Now You Can See Through Walls with Wi-Fi

MIT Scientists: Now You Can See Through Walls with Wi-Fi

Oct 29, 2015
Forget about Superman's X-rays vision, you can now see through walls using WI-FI device only. Scientists at MIT's Computer Science and Artificial Intelligence Lab ( CSAIL ) have developed a device that uses WiFi signals to effectively see through walls and other obstacles, and identify which persons are standing behind it. Dubbed RF Capture , the new system is enhanced version of their previous methods of capturing movements across a house – technology used by mothers to see their baby's breathing and firefighters to determine if there are survivors in a burning building. How Does RF Capture Work? The working of RF Capture is actually quite simple and relatively straightforward. RF-Capture works by transmitting wireless signals that, upon hitting a person standing behind a wall, are reflected off various body parts and then back to the device for analysis to piece together the whole image of people. RF-Capture transmits radio waves that pass thro
Android Wi-Fi Direct Vulnerability Lets Hackers to Kick your Devices OFF

Android Wi-Fi Direct Vulnerability Lets Hackers to Kick your Devices OFF

Jan 27, 2015
Security researchers from Core Security has reportedly found a Denial of Service ( DoS ) attack vulnerability in Android WiFi-Direct. Android's WiFi-Direct is a wireless technology that allows two devices to establish a direct, peer-to-peer Wi-Fi connection without requiring a wireless router. Smartphones have been able to support Wi-Fi Direct for a while now. According to the advisory , the remotely exploitable denial-of-service vulnerability is affecting a wide number of Android mobile devices when it scans for WiFi Direct devices. If exploited, the vulnerability would let an attacker force a reboot of a device. " An attacker could send a specially crafted 802.11 Probe Response frame causing the Dalvik subsystem to reboot because of an Unhandle Exception on WiFiMonitor class ," advisory states. The Android WiFi-Direct vulnerability (CVE-2014-0997) affects: Nexus 5 - Android 4.4.4 Nexus 4 - Android 4.4.4 LG D806 - Android 4.2.2 Samsung SM-T310 - Android
Multiple Cisco Wireless Gateways Vulnerable to Remote Attacks

Multiple Cisco Wireless Gateways Vulnerable to Remote Attacks

Jul 17, 2014
Multiple Cisco Wireless Residential Gateway products have a security vulnerability in the web server that could allow a remote attacker to hijack the devices remotely. Cisco announced that a number of its Wireless Residential Gateway products are vulnerable to a remote-code execution attack , which is exploited by sending a specially crafted HTTP request to the web server running on the affected device. According to Cisco, the flaw is due to the incorrect input validation for HTTP requests, which could allow an attacker to exploit a buffer overflow and run arbitrary code on the device. The bug is about as serious as they come, giving remote, unauthenticated attackers access to the affected machines. " Successful exploitation of the vulnerability may cause the embedded web server to crash and allow the attacker to inject arbitrary commands and execute arbitrary code with elevated privileges, " the Cisco advisory says, and until now, " There are currently no known workarou
Open Wireless Router Let You Share Your Internet with the World

Open Wireless Router Let You Share Your Internet with the World

Jun 23, 2014
In this era of mass surveillance, we have always learned from security folks to protect and encrypt our communication and networks, especially widely open private Wi-Fi networks. It is always recommended to use a strong password and encryption on Wireless Routers in an effort to safeguard the privacy and security of our web communication and personal data. Quite the contrary, a group of activists says opening up your home Wi-Fi network could not only enhance your privacy, but actually increase it in the process. A new movement dubbed as " Open Wireless Movement " is encouraging the users to open-up their private network or at least a small portion of the available bandwidth to strangers. It really sounds quite annoying! Isn't it? In this case any unknown can consume a large part of your network bandwidth or can use your network to perform illicit activities, and it will come as a great boon for those cyber thieves who are in wake of finding such open networks to carr
Chameleon Virus that Spreads Across WiFi Access Points like Common Cold

Chameleon Virus that Spreads Across WiFi Access Points like Common Cold

Feb 26, 2014
Do you know, A Computer viruses could go Airborne over WiFi networks? Security researchers at the University of Liverpool  in Britain have demonstrated a WiFi virus that can spread between computer networks just like the ' common cold ' spreads between Humans. They have created a proof-of-concept which can infect the entire wireless network instead of a single computer at a time,  that replaces the firmware of the vulnerable Access Point (AP) with a virus-loaded version, and then propagates itself to the next victim on the WiFi network . The  WiFi  based virus named as ' Chameleon ', that can self-propagate over WiFi networks from access point to access point,  but  doesn't affect the working of the Wireless Access Point. This Virus is able to identify WiFi access points that are not protected by encryption and passwords, according to the research paper . It can badly hit less-protected open access WiFi networks available in coffee shops or airp
Overlooked Old Vulnerabilities Lead to Major Data Breaches, Says TrustWave

Overlooked Old Vulnerabilities Lead to Major Data Breaches, Says TrustWave

Oct 30, 2010 Cybersecurity / Data Protection
A recent report suggests that focusing too much on new security threats might make companies overlook older, more commonly exploited vulnerabilities. The report by TrustWave is based on data from over 1,900 penetration tests and more than 200 data breach investigations for clients like American Express, MasterCard, Discover, Visa, and several large retailers. The analysis shows that major global companies are hiring "vulnerability chasers" who look for the latest vulnerabilities and zero-day threats while ignoring the most common ones. As a result, companies are being compromised by old, well-known vulnerabilities rather than new attack methods. For example, the top three ways hackers accessed corporate networks in 2009 were through remote access applications, trusted internal network connections, and SQL injection attacks. These attack methods have been well-known for years. SQL injection vulnerabilities, for instance, have been known for at least 10 years but are still c
Expert Insights / Articles Videos
Cybersecurity Resources