The WiFi Pineapple has long been the device people think of first when they think of Hak5. At DEF CON 33 in August, the company used its twentieth anniversary to show the Pineapple in a new form: a handheld called the Pager.
What was announced
Hak5 took pre-orders during the conference, including a limited Autograph Edition and a Founders Edition, with shipping expected later this year. Until now the Pineapple line has been something you set up and manage from a browser, like the Mark VII. The Pager is meant to be operated on the device itself, with its own screen and buttons.
Why the form factor matters
A wireless audit used to mean a laptop, a device and a place to sit. A self-contained handheld with audible and vibration alerts changes that. It can sit in a pocket during a walk through a building and report when something interesting appears.
That is useful for testers. It also means that the mental picture of an attacker with an open laptop in the car park is out of date, if it was ever accurate.
What does not change
New hardware does not change how Wi-Fi clients behave. The basic weaknesses that devices like this have always relied on are the same:
- Clients that remember open networks and join them again automatically.
- Users who accept a certificate warning to get on with their day.
- Enterprise Wi-Fi configured without strict validation of the server certificate.
- Networks where the Wi-Fi is only the first step, because everything behind it is reachable.
What to do now
- Clean up saved networks on managed devices, especially open ones such as hotel and café networks.
- Require certificate validation for WPA2/WPA3-Enterprise, set by policy and not left to the user. Client certificates (EAP-TLS) remove the password from the equation.
- Turn on Protected Management Frames wherever your clients support them. They are mandatory with WPA3.
- Look at what Wi-Fi can reach. Guest and corporate networks should be properly separated, and the corporate network should not be a free pass.
We will come back to the Pager once there is more experience from the field.