card

New Wi-Fi vulnerabilities expose Android and Linux devices to hackers

18.03.2024
338

A recent discovery by cybersecurity researchers has revealed critical vulnerabilities affecting both Android and Linux devices, potentially exposing them to unauthorised access and data breaches through compromised Wi-Fi networks.

The Threat:

Two vulnerabilities, identified as CVE-2023-52160 and CVE-2023-52161, reside within widely used open-source software: wpa_supplicant (present in Android) and Intel's iNet Wireless Daemon (found in Linux devices). These flaws allow attackers to:

  • Forge malicious Wi-Fi networks: Hackers can create fake networks mimicking legitimate ones, tricking users into connecting and exposing sensitive data like passwords and financial information. "One possible such scenario might be where an attacker walks around a company's building scanning for networks before targeting an employee leaving the office", the researchers said.
  • Bypass Wi-Fi network passwords: This vulnerability grants attackers unauthorised access to secure networks, potentially compromising connected devices and data.

Affected Devices:

  • Android devices: Users running versions of wpa_supplicant prior to 2.11 are susceptible.
  • Linux devices: Systems utilising iNet Wireless Daemon versions 2.12 and earlier are vulnerable, particularly those configured as wireless access points.

Mitigation Strategies:

  • Android users: Manually configure the CA certificate of saved enterprise networks. While technically involved, this step is crucial for immediate protection.
  • Linux users: Update your system to the latest available version as soon as possible. Major distributions like Ubuntu and Debian have already released patches.

More tips: Why you should encrypt your Wi-Fi network and how to do it.

General precautions:

Exercise caution when connecting to public Wi-Fi networks, avoiding suspicious or unsecured connections and making use of VPN service, as it encrypts your network, making it impenetrable by hackers.

Additional Considerations:

While patches are being developed for both vulnerabilities, users must take immediate action to minimise potential risks. Regularly updating software, browsing with expert VPN, and maintaining strong network security practices are essential measures to safeguard against evolving cyber threats.