45,724 Networks, One Flipper Zero: Mapping the Wireless Threat Landscape of NI - Mario Burns

Nearly one in ten WiFi networks across Northern Ireland is still advertising WPS - a protocol the Wi-Fi Alliance deprecated in 2012 due to well-documented cryptographic weaknesses. Most network owners have no idea. This talk presents the findings of an independent, passive wireless survey of 45,724 networks across Northern Ireland, conducted using commodity hardware: a Flipper Zero with an ESP32-S2 WiFi Dev Board running Marauder firmware, paired with Kismet and an Alfa adapter. No networks were accessed, probed, or interacted with - every data point was gathered from publicly broadcast beacon frames using a strictly passive methodology compliant with the Investigatory Powers Act 2016, the Wireless Telegraphy Act 2006, and the Computer Misuse Act 1990. The numbers tell a stark story. Of the 45,724 networks observed, 4,460 (9.75%) were actively advertising WPS, and 555 (1.2%) were completely open with no encryption at all. The A26 corridor alone - a single arterial route - yielded 12,730 networks in one survey pass. Default SSIDs from major ISPs were widespread, suggesting factory configurations left untouched. Affected networks were identified near healthcare facilities, schools, legal practices, financial services offices, and government buildings. The talk walks through three realistic attack scenarios grounded in these findings. First, WPS PIN brute-force against a healthcare-adjacent network using CVE-2011-5053 (the Viehbock half-PIN weakness that reduces the keyspace from 100 million to roughly 11,000 combinations) and CVE-2014-9494 (Pixie Dust offline recovery). Second, passive eavesdropping on open networks near educational institutions. Third, evil twin deployment targeting default-SSID networks around financial services. Each scenario is mapped to real-world precedent - from the TJX breach to the GRU close-access WiFi operations documented in the 2018 OPCW indictments. I will also present a case study from my own bug bounty research: a WPS PIN vulnerability discovered in BMW in-vehicle hotspots broadcasting persistently from production vehicles on public roads. The affected access points were detectable at over 100 metres using the same commodity hardware - more than 33 times the range BMW's own documentation states the feature should operate at. This finding, submitted through a responsible disclosure programme, demonstrates that the WPS problem extends beyond fixed infrastructure into the automotive IoT space. The session closes with a sector-by-sector risk assessment for Northern Ireland and a set of practical, actionable recommendations: immediate steps (disable WPS, close open networks), short-term measures (network segmentation, WPA3 migration, 802.1X), and strategic changes (regulatory enforcement, public awareness). Every recommendation is grounded in the data presented. Attendees will leave with a clear understanding of how easy it is to map wireless infrastructure at scale using cheap, legal, passive tools - and why the results should concern anyone responsible for network security in Northern Ireland or similar regions. No specialist equipment or deep wireless expertise is required to follow along.