An unsecured database for a hotspot finder app on Android left the Wi-Fi passwords of thousands networks exposed. The app, which has been downloaded over two million of times, allows users to upload network passwords for others to use. Security researcher Sanyam Jain discovered that the network names, geolocation, basic service set identifiers and passwords were being stored on a server in plain text, without encryption. These records included home Wi-Fi networks alongside public hotspots, potentially giving hackers unauthorised access to change DNS servers or steal passwords and data. The database has since been taken offline.
An unsecured database for a hotspot finder app on Android left the Wi-Fi passwords of over two million networks exposed. The app, which has been downloaded thousands of times, allows users to upload network passwords for others to use. Security researcher Sanyam Jain discovered that the network names, geolocation, basic service set identifiers and passwords were being stored on a server in plain text, without encryption. These records included home Wi-Fi networks alongside public hotspots, potentially giving hackers unauthorised access to change DNS servers or steal passwords and data. The database has since been taken offline.