Beware of the ‘Evil Twin’ Wi-Fi scam

Sit back. Relax. And look out for hacking. That’s what airline pilots worldwide might as well be saying on the P-A during your next flight. An old tech scam was found flying high in a new home: passenger jets. Chris Chmura has the details.
Stay connected:
Follow us on Twitter: / nbcbayarea
Like us on Facebook: / nbcbayarea
Follow us on Instagram: / nbcbayarea
Follow us on TikTok: / nbcbayarea
Catch up on all the day's news:
www.nbcbayarea.com
Download our mobile app:
On iOS: nbcbay.com/R1BhqYM
On Android: nbcbay.com/rUcA97h
Watch us on OTT:
Add our channel on Roku: bit.ly/3ySK60j
Download our app on Amazon Fire TV: amzn.to/3FmmiEA

[@educated_guess]

Best advice is just stick to your phones mobile data. That is the safest route if you must use the internet while traveling.

[@kikinhugs11]

Yup

[@babybirdhome]

This is true, but it’s also not a 100% thing. Mobile hotspots are very common and cheap for doing evil twin. However, it’s not much more expensive or complicated to set up what is essentially just a cellular hotspot that acts just like your mobile carrier and do exactly the same thing, but without anyone connecting to any wifi hotspots - the device thinks it’s just talking to a cell tower on its mobile network just like normal.

[@dougsmith4602]

As an electrician, I tell people this all the time. Using a public wifi network is like sharing the same glass at a bar with strangers. You never know what they might have and now everyone who shared that glass is infected.

[@jessicapearson9479]

Most mobile hotspots require all devices who use it aside from the phone providing the hotspot, to enter a password.

[@Marynicole830]

I get like 5 gigs of hotspot. That runs out pretty quickly.

[@AliciaGuitar]

I am a software engineer and agree, this is INCREDIBLY easy and the bad guy does not need to even be a hacker with ANY skills

[@3DJapan]

Well he would need some skill to set up the password stealing bit. Probably not a lot but I wouldn't know how to do it.

[@jofie9582]

Wireshark is very easy to learn

[@shauny2285]

Not as sophisticated as the "man in the middle" scheme law enforcement uses.

[@PeterHonig.]

Agreed. This is one of the easiest ways to insert a malicious payload onto the client's machine. You don't even have to de-auth the client because they willingly connect to the spoofed site. This is why I NEVER use public WiFi.

[@lolwtnick4362]

@shauny2285 sophisticated...lmao. LE just sit on a city block and flip a switch with their interceptor and boom. Instant text readings and other things.

[@ApPersonaNonGrata]

This scam never left. It's happening every day, at most McDonalds, Walmart, and college campus, etc..

[@jamesroosa2924]

@@ApPersonaNonGrata this scam can happen there . But not on a plane with no signal. The scam artist is this news channel

[@dianetan5790]

Never knew thx

[@MoonDog991]

Technology is so unchecked it's ridiculously easy to scam people like this.

[@tcolondovich2996]

You don't have any idea how Wifi works, or your phone. I know I'm an IT major who went back to school for Electrical Engineering, but you don't have to be educated to NOT BE AN IDIOT.

[@Redwan777]

​@@tcolondovich2996Top comment didn't say anything wrong. It's hard to take YOU seriously "I am an IT major" Source: trust me bro

[@samholdsworth420]

If you are connecting to unsecured Wi-Fi you deserve to get hacked

[@JBMorris9]

@@tcolondovich2996The fault is on the phone providers for their weak authentication software. Sounds like they just check Wi-Fi name and nothing else to authenticate.

[@tcolondovich2996]

@@Redwan777 So you don't believe I have a Network Admin degree and have a strong background in IT? I could care less to prove it to you. You're upset that I believe it's NOT easy to scam people unless you're a moron, because you are one of those people.

[@camwha5904]

This is literally just a phishing attack through the captive portal. Not sure why that guy would bother doing that in an airplane of all places. Such low value targets and high chances of being arrested. That guy seems like a script kiddy. Easy solution to avoid this attack is just to only sign into accounts through the apps, not a website page.

[@Ronniejamesleo]

It's just cloning a access point. That's all it is.

[@John-ly4pu]

And just use dummy email account? Why use your real email or any important account for logging in a public wifi? These people…😢

[@-in-the-meantime...]

Their devices connected to him not the other way around he didn't really technically do anything wrong

[@erich84502b]

I always choose the FBI network

[@lynashmcmash4427]

*Enter your cop ID for access*

[@nickwinn]

FBI surveillance van 4 keeps showing up outside of my gym.

[@crystalthesocialworker]

I name my WiFi that to freak my neighbors out

[@reyray7184]

I call mine: NSA DATA port 16489

[@pamelahogan8265]

@@nickwinnI just noticed my air bnb has that FBI-Surveillance-van

[@littlebrit]

Reporting is pretty wrong. This is not a WiFi scam, but a phishing scam. Once you connect fake WiFi hotspot, scammer's server will direct you to captive portal where they ask users to enter their details to "connect to WiFi". WiFi are safe, use it, just be aware if you are being suddenly redirected to some other website, then stop using that WiFi hotspot. You guys really need to hire some IT new editor. Advice for airline - don't use captive portals but give free WiFi to all passengers.

[@John-ly4pu]

And just use dummy email account? Why use your real email or any important account for logging in a public wifi? These people…😢

[@lolwtnick4362]

Free wifi? Lmao. It's easy to set up and unsecured wifi to match.

[@kyletimbaker]

@@John-ly4pu I sounds like it wasn't requesting an email address, but rather, presented fake social media sign in options, asking the user to sign in using an existing account.

[@chewielewis4002]

their fix isnt easy either If I turn off wifi it turns itself back on a day later. Plus its dumb, they want you to only use cell data? GG to your phone bill

[@John-ly4pu]

@@kyletimbaker i keep a social media dummy account too, for marketplace purpose. There’s always a way not to give up real/personal info.. they can’t verify if it’s a dummy or not.

[@Jefuslives]

It's ridiculous that wifi devices like phones use the name and not a unique ID to "remember" networks.

[@MJ-gm7km]

Yeah, I’m really surprised to learn that. Absolutely ridiculous…

[@Monkey_D_Luffy56]

Yeah like WTF? I always thought that was the case until I saw this news

[@Jon-da-bad]

@@Jefuslives open source packet software can capture and manipulate anything that you transmit.

[@zuberkariye2299]

“Vulnerability in your phone WiFi” this ain’t vulnerability but rather Man in the Middle attack 😂😂😂

[@Typex96]

That's plain phishing tbh, not even man in the middle attack

[@zuberkariye2299]

@@Typex96 Here is a simple google search I just did and it gave me the same answer: An "evil twin AP attack" is a type of man-in-the-middle attack where a hacker creates a fake Wi-Fi access point that mimics a legitimate one, tricking users into connecting to it and allowing the attacker to intercept their data, like login credentials, while they are online; essentially acting as a "middle man" between the user and the real network

[@GorgieClarissa]

imagine being inside of a flying airplane still thinking you are connecting to ... the airport LOL

[@aspcia]

There's in-flight wi-fi. 🙃 #themoreyouknow🌈

[@That_droper]

@@aspcialol yeah 😂

[@zianeshkasparen4358]

In flight. He said the man used the airport wifi name.

[@dougaltolan3017]

When you are lazy and wet your phone to auto connect....

[@Redwan777]

Phone holder doesn't have to think. It's the phone that doesn't know where the WiFi was

[@alexk6275]

Maybe don't enter your email and social media credentials when prompted to join a wifi network, because literally no public wifi network has ever required this?

[@BitSmythe]

Hotels, cruise ships and others DO require that kind of login.

[@sleepydoctor4344]

not exactly. flew to china,Shanghai Airport and when you try to connect wifi it asks for even your passport number, phone number etc 'to register'.

[@maplenerd22]

Some places in fact DO requires this.

[@alexk6275]

@@maplenerd22 they require you to enter your email password to get wifi?

[@EhCloserLook]

Especially when you’re up in the sky and it says you’re connected to the airport’s WiFi 🙄

[@kellicos]

Also, When you are on an airplane, read a dang book! You can survive for a matter of hours or in some cases less than an hour without being connected. People used to do this all the time. 🙄

[@reginabillotti]

You can also download movies, music, and podcasts at home and not need to pay for airline wifi.

[@TheTibetyak]

@kellicos - I always have a book for travel. Half the people are amused and appreciative that books are "still a thing". The other half give me that look of, "Come on, Grandpa. It's the 21st century."

[@user-sf9gs2pg1b]

I have no cellular, I’m a relatively young college student and take public transit to college (1 hour commute). In that time, I read on my Kindle. Honestly, having no cellular has helped me so much mentally. I can pay attention way better and don’t feel like my phone is a need anymore. And reading is super fun, you just need to find a good book. Currently reading Heretical Fishing, it has 4.8 stars on Amazon (and I love the cover art). History type books are also good reads for people who aren’t a fan of fiction.

[@vacafuega]

​@@user-sf9gs2pg1b nice, thanks for the recommendation!

[@myopinion6092]

BEST ANSWER..Yet not even mentioned during the news program

[@IgniteIntellect]

3:29 Did he suggest turning on wifi only when you see a trusted network? How do you see the network without turning on the wifi in the first place?

[@NeoRaidenX]

I had the same thought. These "experts" are clowns. How about don't login to a network that didn't require a login before.

[@ideapage]

As I responded to another comment below, I have "Ask to Join Networks" set to "Off", and "Auto-Join Hotspot" set to "Never" in my iPhone. Problem solved.

[@louisegogel7973]

thank you for this

[@M_SC]

Can’t use the wifi at friends house then. What if you’re visiting someone?

[@MsBluebot]

@@M_SCthat’s different you know the people you can change the settings

[@ideapage]

@@M_SC You can turn it back on at a known Wi-Fi.

[@WhisperingPeace]

Exactly. There are too many default settings on devices that make those devices vulnerable to scams like this, as well as other areas of vulnerability such as auto-sharing.

[@westbccoast]

Never use public WIFI, put your phone in plane mode when you fly.

[@TreeStump-and-CheeseKetchupIT]

Airplane mode allows Wifi and Bluetooth, it only deactivates the cell network. You can buy full internet on an airplane and there's TV and Movies in their app, obviously you're using Wifi to connect to all of that.

[@westbccoast]

@@TreeStump-and-CheeseKetchupIT Pretty sure when you enable plane mode, it disable everything, you have to intentionally enable WIFI, at least on iPhone.

[@TreeStump-and-CheeseKetchupIT]

​@@westbccoast Well I want to check our flight map once in a while and see what they have for entertainment so I'll have to use Wifi. And I want Bluetooth for the earbuds. And I'm still in Airplane mode. Probably the phone manufacturers wasted a lot of time responding to users complaining "Airplane mode doesn't turn off WIfi and Bluetooth" so they just made it do that (despite 'In-flight Wifi' being widely advertised).

[@westbccoast]

@@TreeStump-and-CheeseKetchupIT Fair. I guess you have to make sure it is disabled and as this video suggests intentionally turn it on and off, a pain which most likely won't do. Also don't connect to a public WIFI is my general recommendation. What I suggest going one step further, carrying an old device with nothing on it to use for maps or connecting to WIFI, basically a dumb smart phone with no personal information on it.

[@homuraakemi9556]

​@@westbccoastThey have changed this recently for newer phones. These days it will leave Wi-Fi on

[@KellyAlbright-tg9kz]

Side note it's really lovely to see anchors who dress with class - no one looking like their clothing fits like a sausage casing. No garish colors and I don't see iguana pointed fingernails on this woman. Bravo!! Let me just drink in some class on the news for once.

[@tinman7249]

This trick has existed ever since Wi-Fi become mainstream. I am surprised they managed to caught the person though. The police likely found out how he stole the identities after the fact. It would be rather stupid to use this trick on an flight to/from silicon valley as there are often tech gurus on flight.

[@Theaksten]

Vector: Spoof Wi-Fi. Defence: Only connect to a Wi-Fi you know and trust. Are you eff'ing kidding me?

[@sashazor3o]

😂😂😂😂😂😂😂😂😂😂

[@novembercherry4]

I work at LAS and contracted to BA. The airport WiFi is free, so I’ll use it for my iPad most times even though I have data. When I get on the plane, I notice the WiFi goes away. I also notice the flight attendants have a horrible time closing out the flight at the end of boarding on their end because the WiFi and they have to come off the plane. There’s no airport WiFi on the plane, ever. And the plane’s WiFi isn’t turned on right then. They have to be close to the building to get the WiFi. Anyway, hope y’all don’t fall for this sort of thing in the future.

[@solandri69]

Forgetting WiFi hotspot names doesn't really protect you. If you need to connect to a known hotspot, and someone has set up a fake, you're just going to unknowingly connect to the fake even though you've had your phone forget it. The only real protection is a VPN (which will encrypt all data you send/get through that hotspot).

[@flashoflight8160]

This post should be the one on top or pinned to the top.

[@EffectiveMuscle]

A VPN won't help. He's not reading data packets. The victims are literally giving him their email and social account creds because they think they're being asked to log into a legit hotspot. This is social engineering tactic.

[@lekhakaananta5864]

VPN wouldn't save you from this attack, because it's combined with a phishing attack, by asking you to log in using a pre-existing social media account. If your VPN still allows you to connect to wifi by presenting you their wifi portal pages, you'll still see what you expect: a connection portal asking for login. If you fall for phishing, VPN wouldn't protect you. The origin of this problem is the unintended side effect of popularizing and normalizing universal logins, where apps would allow you to log in using some other service's credentials. We should not be logging into anything with 3rd party credentials. If an airport asks you to login via Google, this should be seen as a red flag, though unfortunately they don't want you to think it's a red flag. This vulnerability to phishing results from laziness of not wanting to implement your own authentication system.

[@babybirdhome]

To be fair, even without a VPN, you should still not be at any risk on a public wifi hotspot unless you have an unpatched device with a remote execution or remote privilege escalation vulnerability on it. If you’re still connecting to websites that aren’t encrypting the connection, you’ve got much bigger problems than your phone remembering a wifi hotspot. And to get the benefit of a VPN from your mobile device, you also need to make sure you’re using a high quality VPN service, because so many of them have crappy VPN clients that will either allow some traffic to be routed outside the VPN while you’re actively connected to it, or that will unreliably drop you and leave you connecting to things without being on the VPN and you not knowing any better. I mean, it does give you an extra layer of protection than not having one at all, but you do still have to be careful and diligent and make sure you’re using something that’s actually safe and reliable and doesn’t have ridiculous vulnerabilities like that, and so many of them do because it’s become such a money grab with BS marketing campaigns telling people what are effectively just blatant lies about what a VPN can and can’t do. It’s appalling, really.

[@dcwatashi]

What is the recommended VPN software for an iPhone

[@jdcrow6]

Only connect to networks you know and trust, yet the name of the bad network is identical to the name you know and trust??? Really?

[@philipphan261]

Agree. Did the reporter realize what he was saying?

[@coldfact.]

Exactly. I didn't get that.

[@filthforce]

the spoofed one is a phishing scheme.... if you connect to the one phishing for your details, you know you picked wrong

[@user-yg1dg6xm2g]

This video exaggerates the risk of your phone automatically connecting to a malicious network. Modern phones don’t just "magically" connect to an evil twin Wi-Fi without user involvement. Phones have security features like randomized MAC addresses and warnings for insecure networks, which reduce the likelihood of such attacks occurring without the user's active participation. Additionally, both Android and iOS treat all networks as untrusted by default, applying extra security measures, especially on public Wi-Fi networks. This further minimizes the risk of malicious connections. The real issue occurs when users choose to manually connect to a rogue network and then enter their personal information, which should be avoided. The real issue with these attacks is that people actively choose to connect to a rogue network and then willingly enter their personal data. It should be common sense not to input sensitive information like social media or email passwords on unfamiliar or suspicious networks. Users need to be more vigilant and cautious about which networks they connect to, especially when prompted for personal login details. Connecting to an unknown network and providing sensitive information is a significant risk, and recognizing these red flags is essential for protecting personal data.

[@James_Knott]

On Android, you can configure a WiFi connection to only connect manually. That is you have to specifically turn it on. I only connect to my home WiFi automatically.

[@shaggydawg5419]

I don't think it exaggerates at all. Most phones automatically reconnect to known/saved WiFi network if it's within range unless you do something to change the default behavior. I agree the real issue here is users willingly provide their existing email/social account credentials. I would question why airport WiFi network is still within range when the plane is airborne. It should be out of range when the plane is on the runway (especially at large airports).

[@freesoul2005]

@@shaggydawg5419if ur providing data on ssl, nobody can steal that data. Man in the middle attack is not possible in ssl, unless u live in north korea

[@user-yg1dg6xm2g]

@@shaggydawg5419 They do indeed 'reconnect' to a known network, but not to one they've never encountered before. If it's really that easy for a scammer to trick your phone into 'reconnecting' to their fake network for the first time, then this problem would be much bigger than what's being described in the news report. Even then, there are additional safeguards, like WPA2 or WPA3 encryption, that make it more difficult for an attacker to trick your device into connecting. For this attack to work, the scammer would need access to more detailed network credentials, not just mimic the Wi-Fi name (SSID).

[@jonathandpg6115]

@@freesoul2005it's not about man in the middle it's about phishing. You are redirected to a fake website that looks like the real one. When you own the wifi network you can redirect people to where you want so you have to be double sure it isn't a phishing scheme. You are correct though that the VPN advice is bull.

[@dude4729]

NEVER NEVER log in to a public or free wifi . Use common sense , as simple as that .

[@ParadoxicalSerenity]

Even if you use a public WiFi, use a vpn and a dns ad blocker. You're good to go. Additionally, click forget network whenever you use a public network or let alone. Use mobile data and always keep your location switched off

[@revemb4653]

So it’s illegal when he steals data but not when AT&T or google does it

[@mcsy98]

The difference is the presence of terms and conditions

[@3DJapan]

It would be if they did.

[@nationsnumber1chump]

Not them but the airlines pay them for the data 😂

[@JzLyfe]

Do us a favor and slap yourself for us 🤦‍♂️ you agree to the terms and conditions when purchasing such products and making accounts. You should read the terms sometime. They even ask you in some cases to opt out of sending data for so called research purposes or to recommend You stuff based on what you search. If you don't agree to any of that then get rid of your phone and any tech you use. Apps are very notorious for this especially if you download a random one or a random QR code.

[@c.v.v]

why do some people wake up to live a life of crime

[@DutchVai]

....so that they don't have to wake up as early as you ?

[@iamlorddems3859]

my guess. it's so easy

[@elementneon]

to survive

[@Ronniejamesleo]

Greed the laziness of not wanting to work. Lack of morals.

[@digitalchemist3867]

this world shall know pain.

[@rosameryrojas-delcerro1059]

Um, Don't people know that the airport WIFI only works for a certain distance away? Just like the library you can't use it on a plane either.

[@OptimusOne]

Most people are not tech-savvy especially the elderly.

[@rosameryrojas-delcerro1059]

@@OptimusOne I think the elderly are (in many cases) WILLFULLY not tech savvy, some are just stubborn, insufferable know it alls who don't listen because "it will never happen to them". Thankfully, my dad (retired boomer) used to work in IT for most of my life so he is just fine and won't let my mom (technophobe) muck anything up either. My grandfolks are all gone, so that isn't an issue for us anymore.

[@c.v.v]

in realty most people don't reason and think like that.. it's called natural trust

[@DiandraStarShine]

I'm somewhat relieved to know how many of us are aware of such facts and I pointed this out in my very frustrated and long reply to this video a few minutes ago. but it also concerns me how innocent so many people are about internet/financial security, including those under the age of 40! and I'm no expert, not by far, but right after I learned of how scammer thieves robbed millions of not just their traditional fiat money funds but also Bitcoin + blockchain minted artwork I realized I had to be able to sleep at night [already an issue, anyway]..but point being I waited to invest on my tiny budget and sacrificed how much I could invest. in exchange for waiting, for taking time OUT, to study how best to secure my future investments. which led to me investing less in funds to start with because I knew I had to invest in at least one 'cold storage' hardware solution to protect the already small amount I was dealing with. and I mean, I don't have the kind of budget or level of acquisitions of art on blockchains that the likes of the MoMA or Sotheby's is now dealing with [for instance] but it THEY lose a bit of their funds and/or NFT artwork they're still going to be ok. but if everyday people like me who have nowhere NEAR that kind of a budget lose out, we'll be much more affected than those who breathe that rarefied wealthy person's air who would, yes, be upset about any losses but who would not suffer a lifestyle change that would ruin their experience of how they are living on this planet.🌏😐

[@babybirdhome]

It’s not like they’re actively choosing to connect to the hotspot - the phone saves legitimate hotspots and when you turn off airplane mode, if one of those hotspots is still within range, it’ll connect to it automatically without the user even seeing anything or knowing it happened.

[@chaundadon2612]

Or … just a wild and crazy thought, put the phone down, turn the WiFi off and smell the roses……

[@Jon-da-bad]

Kali and a raspberry pi. This has been around for decades.

[@ryshellso526]

"Wifi-pineapple"... 😂😂😂

[@jiminswriter4209]

Always use mobile data for sensitive information unless you are on your private network.

[@lizp.9513]

And a VPN.

[@Simply418]

Never join a unsecured wifi.

[@Jane-yg3vz]

Being on an unsecured wifi isn't a problem as long as you stick to https sites. Just don't enter any info to connect to the wifi.

[@jonathandpg6115]

@@Jane-yg3vzI mean some will require an email so I use a burner email

[@redeocsirb4787]

@@Jane-yg3vz Respectfully, there is a lot more happening than just the websites you visit. WiFi is a communication standard which carries a lot of different information as well as constantly checking the quality of the connection. The very act of being connected opens you up to many Man-in-the-Middle attacks. A similar type of attack can capture your own private network passphrase by capturing the handshake between your device and a router by kicking everything off the network while broadcasting a copy at a higher signal strength. Wireless communications are absolutely fascinating but dangerous by nature. Anyone with enough time and tools can take anything without being noticed.

[@maplenerd22]

@@Jane-yg3vz Man in the middle attacks are a thing. Joining an unsecured wifi is not recommended by security professionals.

[@ForestNinjaZero]

@@Jane-yg3vz Ensure that you don't permit the compromised gateway to intercept/spoof DNS requests and/or certificate authorities, or the attacker will be able to capture your SSL certificates and decrypt all messages.

[@RobertojavierSilvaharth-ub3pz]

I remember a gizmo that would allow people to make free long distance calls by using the beeping code of the 80's. They stop that quite quick 'cause the phone company was loosing money, and guess who had shares in that business.

[@snurchy]

Reminds me of Captain Crunch, John Draper.

[@kbhasi]

There was a presentation by The 8-Bit Guy about "phone phreaking", and what you described is one form of that. He showed a photo of the 'gizmo' in his presentation, and showed a tool someone made for the Commodore 64 which achieved the same thing but in software as it could automate the dialling process. I do remember him mentioning that the trick stopped working when the backend equipment running the phone lines were switched to digital.

[@christopherdollbaum8819]

The last time I flew Delta, there are 3 CHOICES of wi-fi starting with the word "Delta". I asked the flight attendant who pointed one of them out - but said nothing about the other two.

[@BensonPeace]

#crackassetsupport - You've Done Amazing Work! Good for you that you're standing up to those thugs. We must take all necessary measures to protect the public, especially the elderly, from these scumbag con artists. Well deserved, my friend. For keeping us secure you should be awarded the Nobel Peace Prize, dude.

[@jswp5]

Thank god they arrested him, it would be terrible if some random guy stole my data. I only want Google, KZbin, Twitter, Facebook, and Microsoft to be able to steal my data!

[@dougaltolan3017]

Trivvial for the airline to protect its customers. There should only be 1 hot-spot on the plane, if any others are detected : warn the passengers.

[@Jacklal24]

News gives partial info only. To forget a wifi network you must connect to it first.

[@eldermcnamara3631]

That’s exactly why I pay for “Unlimited Data” on my phone so I won’t have to worry about connecting to so “random” WiFi … there is no need for my WiFi to be on a airplane that’s for sure

[@benhetland576]

And for that there are IMSI catchers instead, essentially doing a similar thing on the mobile frequencies that this reported thing does on the wifi ones.

[@ILoveTinfoilHats]

Yeah because you can use that on a plane 🙄 think before you type

[@jamesroosa2924]

@@ILoveTinfoilHatshow does one have service but not the other? Mobile wifi? It’s the future already ? No 5g though? This is a scare tactic

[@ILoveTinfoilHats]

@@jamesroosa2924 you are thousands of feet in the sky. Even if you were allowed to use mobile data you would not get a signal. The onboard WiFi is on the plane, it comes from satellite aboard the plane and moves with you. Totally different technologies

[@jamesroosa2924]

@@ILoveTinfoilHats exactly. What is the “eViL tWiN” connected to ? The only scam here is from the news agency

[@yolyprog2561]

Thank you for reporting this

[@username_redacted_1987]

As an IT professional, ten seconds into this video, I said to myself, "let me guess, these people are creating a hotspot on their phone and naming it the same as the airports, and then allowing other passengers to connect to this 'wifi' in an effort to steal private data". Holy shit, a minute later into this video, I couldn't have been more on freaking target.

[@synchronium24]

Was the plane still on the runway? I don't understand how some airport randos WiFi signal would make it to a plane in the air.

[@username_redacted_1987]

@@synchronium24 It's not that some "airport rado's wifi signal made it to the plane in the air". The person that created this Evil Twin wifi quite literally made a mental note to himself of the name of the free wifi connection that is found in the airport. Then when he boarded the plane, he turned on his hotspot on his phone, and named that hotspot as the same name as the wifi connection that was found in the airport, and created it without any password requirements. Then when other passengers on the airplane see that same wifi name, they're fooled into thinking that the wifi connection is coming from the Airport/Airline, and connect to it, not realizing it is some random guy on the same plane with those passengers, that created the fake imitation wifi name/access, and therefore fooling all the passengers on the plane to connect to it. Thats how these people steal others' data.

[@gamechep]

Wait, so this means our devices when connecting using Wi-Fi do so using only the SSID (the network name), and not also the physical address of the Wi-Fi? That's a serious vulnerability! How did they miss this at the Wi-Fi Alliance?

[@MichaelGilmoreTV]

Bottom line, BEFORE cellphones, we survived. Just READ a book or perused a magazine and turn your damn phone off. It’s like a drug to consumers. I got my first cellphone (same iPhone) at 50 and I’m 58.

[@JESUSCHRISTISMYLORDANDSAVIOUR]

They can fix this by not allowing nearby wifi networks have the same or similar names.

[@saucecastillo460]

If they were on the plane & trying to connect to airport Wi-Fi, that's on them. Also, I can't ever remember being asked for anything other than the Wi-Fi password. Not my email or password. This is a scam for the rubes

[@tetee6789]

The video states the phone automatically connected to the internet because it had same name, I'm not sure what to think of this, seems impossible to me

[@dahamsta]

Try actually watching the video before commenting.

[@jonathandpg6115]

@@tetee6789It's not impossible, it exists and is an old scam. The biggest issue and the actual security threat that no ones mention is phishing, which a VPN wouldn't protect you against

[@TreeStump-and-CheeseKetchupIT]

@@dahamsta This is a scam for the rubes

[@saucecastillo460]

@@dahamsta not sure what you're crying about, but I'll explain since it seems like you might be one of those rubes I've been hearing so much about. If they were on airport WiFi before boarding, then got on the plane & got automatically connected to the fraud WiFi, that's still a them issue. You should ALWAYS turn off WiFi when you leave a place, so your device isn't exposed. But if you watched the video, you would've seen when it talks about people being asked for THEIR email & password. You gotta be kinda slow to do that. Plus, they never said they were on airport WiFi, got on the plane, forgot to turn off/disconnect & they were automatically connected to the fraud WiFi. They had to manually connect to the fraud WiFi, using what they thought was the airport's WiFi, on the plane. That's something a rube would do. And since your comment seems a lil salty, I'm guessing this happened to you. I don't scam people, so no need to get mad at me. Have the day you deserve.

[@MykeB-lk7cd]

This level of courage is mind-blowing! Even facing danger, they pushed on to expose scammers. Major respect to #crackassetsupport If the FBI had even a bit of your dedication and brilliance, imagine how safe the USA would be. Keep rocking!

[@PerMejdal]

This report was not as bad as they use to be. Here are my advise: * Your data is already encrypted. What you need to be aware of, is that the information you type in to the Wi-Fi login screen, goes the person controlling the network. * Buying a VPN is a waste of money, and a false sense of security. You are just moving your connection to a 3-party, the data will still be as encrypted or unencrypted when it go to the Internet. Only exception is VPN's original use case: Use your work VPN, to access work data/systems. * It is correct to remove a guest Wi-Fi network from your mobile device, when you done using it, or disable automatic join. So your device does not automatically connects to a network spoofed with the same name.

[@DiandraStarShine]

NO IDEA WHY HE DIDNT SAY: if the airplane has taken OFF which means you're NO LONGER AT THE AIRPORT, there should NOT be an option to log back into the airport's free wi-fi. meaning IF they begin the habit of keeping it OFF by default then they can check the list & choose a safe option [and I'm not sure which safe options regarding available on regular commercial airplanes [vs. private planes &/or satellite service but I digress...] but what I REALLY want to pint OUT is the last thing the reporter SAID was login ONLY to wi-fi one recognizes as safe - but that is obviously VERY BAD ADVICE because even IF they had wi-fi set to NOT automatically connect to a phone remembered and/or most recent connection there would still be *some people* who wouldn't be aware enough to NOT login to the fake airport wi-fi with the same name as the real one. because remember, there are people of all ages + all levels of security awareness who are, understandably, choosing to use wi-fi vs. their DATA from their phone plan when on the ground. and here's the last thing I'm going to say about this [ok, for now, anyway]: when *on the ground* in addition to having a VPN [& vet/compare VPN ratings on neutral websites] also NEVER use public wi-fi to login to sensitive websites you make use of. meaning either WAIT until you get home or are on other family/close family friend wi-fi you KNOW - without a doubt - that is as safe as your home, password protected wi-fi? otherwise ONLY use your DATA option IF, for ANY reason you need to login to your most sensitive accounts when not at home regarding: social media, bank, payment processors, centralized crypto accounts/crypto wallet accounts, whatever..just NEVER use wi-fi you have to take such actions. and frankly, even regarding family & close family friends there are *maximum* households I trust to use their wi-fi, if in a pinch. because I know how security educated/internet security conscious those head(s) of households are. but EVEN though that's true - and not a reflection on them, they're really wonderful people - but unless there was a zombie apocalypse or alien invasion, something of that magnitude, I'd *STILL definitely* use my DATA option just to be able to sleep better that night. and for anyone who is actually believing it's possible to be 'too paranoid' about protecting their financial funds just to an EASY search for news articles & videos about how many people have lost a large portion or ALL their life traditional fiat currency or crypto funds/savings because - NOT because their accounts were literally hacked [very rare for that to happen to the average private citizen] but - rather BECAUSE they didn't know WHAT to do + what NOT to do in order to prevent themselves from unknowingly handing over their money to thieves laying in wait for yet another innocent person to make one or many mistakes. people, PLEASE, study UP on internet security, esp. regarding email, social media & financial accounts,. as there are many - an uncountable - number of articles written for everyday householders that can help people to be safe. and if one is not a strong or patient reader, no worries because there are also plenty of audios & videos than can help, too.

[@logitwood1232]

I always use a VPN, even at home and on my mobile data. Nothing is really secure without one nowadays.

[@TheHipisterDeer]

Yep I use a VPN on my home network too, I got really tired of my ISP constantly spying on me.

[@filthforce]

i got one because i got 8/10 lifetime copyright strikes on my IP ayy

[@impeachemall693]

Important! Can also happen anywhere!

[@NakedSageAstrology]

Not just at airports, your neighbors are jerks and do this too, I busted my neighbor doing this to my network.

[@coldfact.]

How can I tell. I believe my wifi is being affected by someone right around me. Im targeted & have seen many games being played!

[@coldfact.]

How can I tell?

[@eliakimbenishchayil]

One more thing we have to watch out for, will it never end. Abolish money and eliminate the incentive for people to do these things.

[@ugammichael2431]

SCAM ALERT Exceptional works #crackassetsupport-l'm glad you're battling these jerks out there. We must take every precaution to safeguard the elderly and the general public from these disgusting scam artists! You've earned it!! You deserve the Nobel Peace Prize for keeping us safe brother.

[@HeyItsAvi90]

huh? DOesnt the phone connect to the special address of the airport wifi, having the same name wont make it connect unless the people actively connect to the new hotspot?

[@GeneralTso-x2q]

There is no "special address". It's all SSID (name) based. A mobile device will try to reconnect to the same name once the plane is in the air.

[@jofie9582]

@@GeneralTso-x2qit’s called a MAC address.

[@nepps617]

Biggest shock in this video, people still trusting public WIFI networks. In general I keep my phone off in public, any missed calls can just go to voicemail. I’m happy I’m old enough to have experienced life before cellphones and the need to constantly be connected. I’ll take my old school portable dvd player and a book if I have a long flight.

[@NakedSageAstrology]

An added note, simply forgetting the Wi-Fi network is not a solution to the problem because the real issue is a lot of people thinking this is their main Wi-Fi network trying to sign in, they end up typing their real Wi-Fi network passwords into those fields thereby giving the hackers their Wi-Fi passwords, what they really need to do is change their Wi-Fi password altogether.

[@robr177]

Boy, that is all kinds of wrong. It has nothing to do with the WiFi password - these are open networks - no password required to connect, which also means no encryption.

[@NakedSageAstrology]

@@robr177 My friend I am a network engineer.

[@metalandy]

I never use wifi. I keep it off. I have unlimited data so have no need for it. With that, I feel safe and no one can snoop over my shoulder.

[@amen_ra6926]

These "man in the middle" exploits aren't new. They've been around since the early days of wifi. If you're out in public and browsing and do not see the padlock in the browser, you're not in a secure network. Use a VPN when using public wifi if you can. Countries like China prohibit the use of them since their wifi is state run. I only use the encrypted secure wifi where I work or at home. The rare times I used any "public" or other were the Southwest and Embassy Suites. Neither asked for any credentials. On SW, you can only watch in-flight content. There is no browsing. With Embassy Suites, I take my ROKU and use the wifi for streaming so there I have to get a code to activate the service. I generally never use public WiFi.

[@aquicktake]

keeping wifi off is just common sense. it increases your battery life by about 10-15% because your phone isn't constantly "hunting" for wifi networks in the background. I never have it on unless I am connecting to a specific network for a specific reason.

[@Viewer20222]

Not sure why people still use WiFi on their phones as most carriers and plans are now affordable that you can just use your own mobile data plan as most are unlimited now a days.

[@juanitadudley4788]

Only connect to a wifi connection you trust. If it's a copycat wifi connection, how can you know the difference if it mimics legit wifi?

[@shiina_mahiru_9067]

Afaik, airport wifi doesn't work on the apron in general (and that makes sense; airports don't expect people to saty on the apron long enough to justify the cost to install hotspots to cover every inch of it). You might get some if your seat is closed enough to the terminal

[@amzarnacht6710]

One would think that wi-fi would all have a unique digital fingerprint that no one but a computer sees or can read regardless of its name and the two must match for the device to automatically reconnect...

[@smcdonald9991]

This piece is full of mistakes and half-truths. 01:47 "Once passengers switched to airplane mode, they connected.." Hmmm, no. He doesn't seem to understand what airplane mode even is. It means that WiFi, cellular and Bluetooth are disabled.

[@johnhanley2431]

The evil twin has been around for as long as I can remember. Today, you barely need any security computer skills to download software and buy gadgets to be a relatively good hacker. My advice is to never connect to public WiFi. I don't trust the employees behind those networks.

[@LWRC]

The evil twin WiFi from a person's cell phone will have a very weak signal compared to a regular WiFi network!

[@babybirdhome]

Not if it’s being operated by a competent hacker. The purpose of evil twin is to steal wifi connections from the legitimate hotspot - legitimate hotspots will only be operating within legal power limits. An evil twin won’t necessarily be complying with those laws, so they can often be the stronger signal, so as to steal more connections than the genuine hotspot.

[@Redwan777]

Truth nuke: People don't care!

[@mamacindyrogofsky495]

I don't use the Internet on my phone in public. I just use it at home.

[@mariatolentino4516]

I don't use airline wifi. I like the movies on a Japanese airline.

[@waldo1967]

1:41 Airplane Mode does not connect your phone to anything. That reporter apparently doesn't understand basic phone functions.

[@ashleyjohansson230]

Im studying IT now and caught that also, was going to make a comment about it but then saw you already said it 🎃

[@warrenschrader7481]

Actually, airplane mode on certain devices do let you continue using the WiFi. What happens is that it shuts down the internet from cell service. That would then prompt passengers to "login" to the wifi to continue receiving the internet.

[@freesoul2005]

Wrong

[@propperstuffproductionspsp122]

He also said keep it off, and only turn it on when you see a network or Hotspot you know or trust😂 😢but if you keep it off how would you see a network you know or trust?😅🎉🎉???? Asking for a friend

[@kenmore01]

​@@propperstuffproductionspsp122You have to turn it on, but don't connect to something you shouldn't be able to connect to like the airport wifi which is now 100 km behind you. Make sure you connect to what's in the plane's literature. Same for restaurants. This only worked because people didn't pay attention and their phones automatically connected to wifi which was named the same as what they were connected to at the airport. You would want to double check that you're connected to the airplane's wifi.

[@midnightkitty8172]

Just turn your phone OFF. I mean powered down, disengaged, un - connected! Don't worry, you'll survive without it for a few hours, it'll be good for you to have a break and live in the moment for a change.

[@vndragonslayer1]

they wont. they need their daily dose of drug from zuck

[@LarsLarsen77]

What's happening on your phone is still happening now.

[@lindenbree9188]

Yeah, sitting on an airplane for hours, real character-building life altering stuff there. Can't believe people would choose to miss out on such enrichment by using their phone

[@roachtoasties]

The reporter at the end said only turn Wi-Fi on when you see a network you know you trust. That makes no sense. You can't see Wi-Fi networks available unless you turn on your Wi-Fi. Then after you do that, you'll see the available networks, and there might be evil ones using the names of networks you trust. You're still doomed.

[@Δυσνομία]

If you're going to do a man in the middle attack while on a commercial airliner at 35,000 feet over the ocean, don't name your new open Wifi Access point "McDonald's Free Wifi" or "Walmart Wifi" :-p

[@Justin-uc8sc]

What kind of advice is this? Living in fear so you should check your wifi every time you go out? That’s like being told not to drive in case someone hits you or wearing a bulletproof vest every time you step outside.

[@adeyemi9860]

Also, disable Auto-Join, or Connect Automatically.

[@laprimanerda7333]

Forgetting the network names isn’t going to do much when this is a phishing attack. Wiping the saved networks only prevents you from getting on the same fake twice, not avoiding it in the first place. If it’s a rando on a flight, you may only ever encounter that fake once but the damage will already be done by the time you “forget” it. If a network wants login info like your email or social passwords, make sure it’s the actual network you want. I use a password manager and try to avoid those partner login portals entirely. Don’t put your login information for an unrelated account into any website or portal that you are not sure about.

[@3DJapan]

I don't use public Wi-Fi. I have unlimited data so it's very rare that I wouldn't have access.

[@amiralions2681]

Thanks for publishing this story.

[@aroundandround]

1:56 That explanation doesn’t make sense coz the passwords would go over SSL, so the evil twin WiFi is little different from your ISP that can also see all traffic bytes but can’t decipher any sensitive information or control your online accounts.

[@hybridPeople358]

I don't even connect my work phone to my home network. I don't trust people anymore.

[@vandavis000]

I refuse to use any wifi. Too. Risky

[@SteveSabbai]

1. I never use public Wi-Fi. 2. I never do any financial transactions on my phone/tablet. I only do them at home on my PC with my ISP. 3. I never "save" passwords. I write them down on a 3x5 card. 4. My passwords are at least 20 random characters. 5. Trust no one on the internet.

[@James_Knott]

"I never "save" passwords. I write them down on a 3x5 card." You're supposed to use Post it notes and stick them on your monitor! 🙂

[@audreyk-wn1zw]

Lol! 😂

[@karmasutra4774]

I save all my passwords digitally and haven't had issues, but I tether to phone if I need to log into a financial account when traveling

[@dirtmcgirt7125]

@@James_Knott No man. Be smart. Put the note under the keyboard.

[@Fernandez218]

i hate to be offensive but this is the internet: 0:05 first time I see this person Jessica Aguirre. I thought I was looking at the Joker for a second. the lines extending the smile at the edges. Does she have a condition or something? or did she mess up her makeup?

[@madamenicoleNY]

Crazy. Maybe fillers?

[@Fernandez218]

@@madamenicoleNY idk. it does kind of look like botox there at the sides. too many of these people with money think that the botox makes them look better when it makes them look silly.

[@reyesarg]

NFC card readers / WiFi hackers / Air Marshalls who take bags. I don't feel safe anymore. Why would someone want to impersonate me? I am of no significance.

[@ZoomZoomMX3]

Keeping wifi and Bluetooth off when not in use saves battery life a lot

[@sharon94503]

NEVER use a Hotspot.

[@RokushoHasashi]

I always use my phone data on my phone and never the public wifi because your personal info is exposed to hackers and data thieves.

[@spikehawley6682]

Turn off your auto connect..

[@Splucked]

Long list of public wifi networks? 😂 Not a chance! Mobile data. I live on my computer at home. When I'm outside I only use the internet if I absolutely have to. Dodging walking idiots with their faces in their phones requires too much attention.

[@pamelah6431]

You just said they use the same name as a wifi you "know & trust," so how do you know you aren't clicking on an imposter?

[@chezchezchezchez]

So why isn’t there a built-in feature with WiFi IDs/names, where there’s a hidden Long identification number that goes along with “ Wi-Fi_free_airport”?? If this companion number does not match up with what it remembers, it rejects the connection. It seems so unsecure that they allow us to be able to happen in the first place.

[@PrestonVanLoon]

There is, but that can be spoofed too

[@rockdisappeared9203]

3:00 the whole point of the video is about how they mimic the WiFi networks you recognize and trust. What makes it so insidious.

[@indianiecworld]

Forgetting the unsecured network should be a default setting in every phone

[@witta505]

I turn mobile data, wifi and all other networks off 99% of the time. Hard-wired ethernet is the safest way to go.

[@aperson1181]

you can do similar "tricks" with Bluetooth, so disable it too.

[@filthforce]

i mean, you can spam someone's bluetooth, on iOS you can crash a phone without doing damage.... someone could technically send you spam.... not much beyond that

[@trueloveingod2691]

The scams are everywhere now…

[@jamesroosa2924]

Hold on, so only one dude on the plane has mobile data? And it’s fast enough to support the whole plane?? Lol. Ok

[@kentpass]

Get ready for increase air fares. They are going to need to make up the revenue somewhere

[@j.mccarthy3008]

Good to know!! Thanks. I usually don’t travel that much anyway and prefer to just read a book I downloaded.

[@Remy2947]

I never use public wifi because of something like this happening to me.

[@noctisarcanus7894]

How can you say "public wifi you trust"? Yoy can't trust any public wifi! The only wifi you can trust is your own private network. If you need to use internet in public places just use your mobile data but if you're waiting for a long period of time like on airports or during a long flight and need entertainment, just have some pre-downloaded media in your devices like e-books, movies or series so you don't need internet for that. Nothing beats a portable console like a Nintendo Switch so you don't drain your phone or tablet battery that fast and you only use mobile data for minimal stuff like checking e-mails and sending messages.

[@troymyck6519]

No bond. Jail! End of the problem!