Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/20/2019
11:01 AM
50%
50%

WeWork's Wi-Fi Exposed Files, Credentials, Emails

For years, sensitive documents and corporate data have been easily viewable on the coworking space's open network.

WeWork's weak Wi-Fi security has been leaving sensitive data accessible on its open network for years. That may have compromised both organizations that work in WeWork spaces as well as those that have never entered WeWork but do business with companies that use its offices.

A Fast Company report back in August highlighted poor security practices by the real estate firm, which rents out coworking spaces to mostly small businesses. A new report from CNET takes a deeper dive into the extent of WeWork's oversight and implications for its customers.

The findings come from Teemu Airamo, who according to CNET evaluated WeWork's Wi-Fi security in 2015 before moving his digital media company into one of its Manhattan offices. He was able to view hundreds of other companies' financial records and devices on the building's network; upon alerting the community manager, he found out WeWork already knew this was possible. Attempts to bring the Wi-Fi security issue through the ranks to WeWork's upper management proved fruitless.

WeWork Wi-Fi is protected by a password, which CNET says appears in plaintext on the WeWork app. Multiple WeWorks in New York, and some in California, share the same password.

Over the past four years, Airamo has continued to run regular Wi-Fi scans on the WeWork network. His scans show 658 devices exposing an "astronomical amount" of data: financial records, business transactions, client databases, emails from other companies, driver's license and passport scans, job applications, contracts, lawsuits, banking credentials, and health data.

Read more details here.

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "The 20 Worst Metrics in Cybersecurity

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
dwood-bishopfox
50%
50%
dwood-bishopfox,
User Rank: Author
9/20/2019 | 12:11:50 PM
Due diligence is important
When you rely on third party infrastructure you assume the risks that come with it. When looking at adopting collocation type services you should definitely be asking questions around security posture and if you can review the service providers vulnerability assessments - do it. It's just like adopting cloud services. Your data in the cloud is actually just your data in someone else's computer and you shouldn't blindly trust the service. This is why services like AWS have the shared responsibility model - the same should be true for any type of service. If you're relying on third party infrastructure to run your business you need to do your due diligence. WeWork should have known better and it sounds like at least someone there was aware of the issues but ultimately nothing was done, which could be considered gross negligence from a legal perspective.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/14/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Lock-Pickers Face an Uncertain Future Online
Seth Rosenblatt, Contributing Writer,  8/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-4662
PUBLISHED: 2020-08-14
IBM Event Streams 10.0.0 could allow an authenticated user to perform tasks to a schema due to improper authentication validation. IBM X-Force ID: 186233.
CVE-2019-20383
PUBLISHED: 2020-08-13
ABBYY network license server in ABBYY FineReader 15 before Release 4 (aka 15.0.112.2130) allows escalation of privileges by local users via manipulations involving files and using symbolic links.
CVE-2020-24348
PUBLISHED: 2020-08-13
njs through 0.4.3, used in NGINX, has an out-of-bounds read in njs_json_stringify_iterator in njs_json.c.
CVE-2020-24349
PUBLISHED: 2020-08-13
njs through 0.4.3, used in NGINX, allows control-flow hijack in njs_value_property in njs_value.c. NOTE: the vendor considers the issue to be "fluff" in the NGINX use case because there is no remote attack surface.
CVE-2020-7360
PUBLISHED: 2020-08-13
An Uncontrolled Search Path Element (CWE-427) vulnerability in SmartControl version 4.3.15 and versions released before April 15, 2020 may allow an authenticated user to escalate privileges by placing a specially crafted DLL file in the search path. This issue was fixed in version 1.0.7, which was r...