We talk a lot about the dangers of using public Wi-Fi. But not everyone sees the potential for danger in blindly connecting to any old network. In particular, if you’ve been to the Genius Bar lately, your Apple device (Mac, iPhone, iPad, etc.) may be wandering around connecting to “known” networks with very common names and no security credentials, without having to approve the interaction. This puts you at much greater risk of someone being able to eavesdrop on your network traffic without you knowing.
Application security blogger Troy Hunt discovered this behavior, as he was using a device that shared the same names as the ones used by his local Apple store (“Apple Demo” or “Apple Store”). His wife’s computer automatically connected, despite their usual router being available and having a stronger signal.
This behavior is something that has been a part of how Apple devices handle network connections for ages – they don’t want you to be bothered by having to re-approve a connection every time you get on your usual networks, so you get connected to any router with a name it already knows, with the credentials you’ve already supplied. The problem is when the credentials don’t include some sort of security like a password – if someone else is also using that router name somewhere else, it could mean you get connected with a device you’d not meant to connect with.
There are a lot of ways to increase your security where public Wi-Fi is concerned. This is a good reminder, especially for those of us that do occasionally connect on the road, of a bit of long-term maintenance we need to do from time to time. It’s a good idea to periodically go into your Network settings, in the Advanced section under Wi-Fi, and delete networks you don’t regularly use. The entries to be concerned with in particular are networks that use default or not-terribly-specific names (like Linksys or Apple Demo, for instance) and those entries that list “None” under security.
