Around 8.7 million travellers who signed up for WiFi, car parking services and lounges in airports run by Manchester Airports Group (MAG) had their data stolen, including email addresses and phone numbers, postcodes and vehicle registration details. MAG operates airports in Manchester, London Stansted and East Midlands, and declined the demand to pay ransom.
The 8.7 million number is attention-grabbing, but it deserves some context. MAG has confirmed that the vast majority of those records are email addresses collected through airport WiFi sign-ups. A much smaller subset includes phone numbers, vehicle registrations, and postcodes from customers who actually completed parking or lounge bookings. No payment data, no passwords, no passport information. So despite this affecting airports, which is obviously a sensitive subject, the actual data sensitivity for most affected individuals is relatively low.
What’s more interesting to us from a technical standpoint is the attack path. MAG told The Register that attackers compromised one of their internal systems and then went on to steal files from a database hosted by a third party. That’s a pivot upstream into a data provider, not downstream into operational systems. What remains unclear is whether the data was exfiltrated directly from that third-party environment or whether it was pulled back through MAG’s network first. That distinction matters for understanding where detection controls failed and who was responsible for monitoring the egress.
The UK’s Civil Aviation Authority has a Cyber Assessment Framework for Aviation, developed with the NCSC, that mandates strict separation between IT systems and operational technology. We don’t know whether MAG was formally operating under that framework at the time of this incident, but I would be very interested to find out. Because the segmentation appears to have held here. Flight operations, baggage handling, terminal systems, etc., all were unaffected. The lateral movement went upstream toward a data provider, not downstream toward the systems that keep planes in the air.
“This data was initially collected because passengers needed a login, and somewhere along the way, the sensitivity of what was accumulating in that database stopped getting the same scrutiny as the network itself. Vehicle registration details, postcodes, and contact information across three major airports are a profiling dataset, and whoever held it for ransom understood its value better than the organization storing it did.”
This is why I use a VPN when I use public WiFi. In short, public WiFi cannot be trusted. You have to assume the same in order to keep safe.
Posted in Commentary with tags WiFi on March 2, 2026 by itnerd
Late last week a report surfaced about a new style of WiFi attack called AirSnitch. In short, this attack allows an attacker to bypass Wi-Fi encryption on most networks in order to access all of the traffic passing through the router. And worst yet, almost all routers are vulnerable to this attack.
Now there’s good news and bad news.
Here’s the bad news. If you are a victim of this attack, and now that this is out there there will be attacks, the attacker can create a full bidirectional man-in-the-middle attack. Meaning that they can view all traffic passing through the router. That even creates vulnerabilities when accessing websites secured with HTTPS which is used by online banking websites for example to secure your data from those who want to get access to it for evil reasons. That of course is very bad. And if you’re using public WiFi, this risk becomes worse. Thus my recommendation for that is to use a VPN when you use public WiFi.
The good news is that an attacker would first have to crack the password on the target WiFi network to pull this attack off. Which means that if you have a suitably complex password, you’ve made it a lot more difficult to be affected by this. So my first piece of advice is to change your password to be complex ASAP. Yes that can be a pain in the you know what, but it’s better to be safe than sorry.
Top tip: Don’t ever use AI to choose a complex password. Trust me on this and read this to understand why.
It will be interesting to see if the vendors named in this report address this new attack. Because if they don’t, my recommendation will be to move your infrastructure to vendors that do address this. Now fixes won’t happen overnight. But it will happen eventually. Thus you will get a very good idea as to who you can trust with this, and who you can’t.
Posted in Commentary with tags WiFi on April 15, 2023 by itnerd
One of most common types of calls and emails that I get is from someone that has gone out and spent a pile of money on a supposedly fast WiFi router, and they aren’t getting the WiFi speeds that the box says that they should be getting. Thus they figure that they need the help of someone like me to figure out why as the person thinks that they did something wrong when setting it up.
The good news is that in most cases, the person who emailed or called me most likely did nothing wrong. The bad news is that they’ve never going to get the WiFi speeds that the box that the router came says that they should be getting. Ever.
At this point you’re likely saying “WTF? Seriously?” And the answer to that is “Yes. Seriously.” The thing to remember is that the speeds that are advertised on the box that your WiFi router came in are theoretical maximums which are likely derived in ideal conditions. As in inside a lab with no other WiFi networks within miles. The thing is that 99% of us don’t live in ideal conditions. Which means that 99% of us are having their WiFi networks competing with other WiFi networks. That alone will mean that you will take a speed hit regardless of how fast your WiFi router is. Then there’s your WiFi network having to deal with anything from cordless phones, baby monitors, walls and the like. That’s going to be another hit to your speed as well.
So why does all of that result in you take a speed hit over WiFi? Well, everything that I mentioned above is a form of interference. And how a WiFi router deals with interference is to negotiate a slower speed between itself and the client device, say your smart phone or laptop. Because pushing less data can make a wireless connection a lot more stable. And stability matters more than speed when it comes to WiFi routers.
Now if that’s not enough, there’s also the fact that the further you get away from your WiFi router, the slower your speed will get. That’s called path loss. And that path loss gets magnified depending on the WiFi band that’s in play. Specifically:
The 2.4 GHz band is can go the furthest, but is the slowest band in terms of speed. So you will get better stability the further that you go from the router. But you won’t be setting any WiFi speed records. And that speed will start to drop the further out you go.
The 5GHz band has a shorter range relative to 2.4 GHz signals. But is faster than the 2.4 GHz band. So you’ll get better speeds, but your speed will fall quickly the further away from the router that you get. And that speed will fall at a faster rate than the 2.4 GHz band.
Finally the new and cool 6GHz band is super fast, but has the shortest range of all of bands mentioned here. Which means that you need to be in a decent proximity to the router to get the gigabit or above speeds that this band is capable of. Or put another way, your speed will fall off even faster than the 5 GHz band.
The next thing that affects your speed is the fact that the devices that you are using might not support the same number of transmit and receive streams that router does. Here’s an example. I have an ASUS ZenWifi AX (XT8) mesh router. And it has the following transmit and receive streams per band:
2.4GHz 2×2: Meaning 2 transmit and 2 receive streams that has a maximum speed of up to 574 Mbps
5GHz-1 2×2: Meaning 2 transmit and 2 receive streams that has a maximum speed of up to 1201 Mbps
5GHz-2 4×4: Meaning 4 transmit and 4 receive streams that has a maximum speed of up to 4804 Mbps
Here’s why this matters to you. If you for example try to connect to the second 5GHz WiFi band with an iPhone 14 Pro which according to Apple’s specs is a 2×2 device which means it has two transmit and two receive streams, you will get less than half (if you’re lucky) of the 4804 Mbps speed as that band has four transmit and four receive streams. Meaning that your device is the bottleneck in terms of maximizing the speed that you could get.
Next up is the channel width. Here’s what pretty much every WiFi router has to play with in terms of channel width:
20 MHz
40 MHz
80 MHz
160 MHz
The bigger the number, the more space the router has to push data through. And that means faster speed for your devices. So the ideal situation is if you can use 160 MHz for everything. But, here’s the problem with that. Actually there’s two problems:
Your devices will likely not be able to leverage 160 MHz channel width at all, meaning that those devices can’t take advantage of that potential speed that it offers.
160 MHz is way more vulnerable to interference, making it next to unusable in a lot of use cases. In fact, when I investigate WiFi issues for a client, this is almost always the first thing that I check. And if I do find that the router is using 160 MHz, I set it back to 80 MHz and have the client try it. Their problems usually go away at this point.
And all of that assumes that 160 MHz is even available in your country. I say that because in some countries it isn’t available because it interferes with things like aircraft radar.
Sidebar: If you really want to go down the rabbit hole on this, click here for a really detailed discussion on this topic.
The final thing is how router companies advertise speed. And by extension, what’s printed on the box of the router that you’re interested in. Router companies promise insane speed numbers such as a maximum of 5400 Mbps of WiFi speed. The dirty little secret is that what they’re actually advertising is the maximum theoretical for all the bands added together, which is not how WiFi works as you’re typically connecting to a single band at a time.
The math gets them to 5378 Mbps, and I am guessing that it got rounded up to 5400 Mbps by some marketing human because 5400 Mbps sounds better. But the problem with that is that this is completely misleading for the consumer and leaves them with the impression that they should be getting faster WiFi speeds than they will actually get. I honestly wish that router companies would stop doing this as they are doing a great disservice to the consumer by using these numbers.
That’s a lot to take in. But let’s cut to what you might expect to see in the real world. And to illustrate what you might get in the real world, I will use my own environment. Now as mentioned above, I use the ASUS ZenWifi AX (XT8) mesh router which is a pair of nodes that that have a 2.4 GHz band, and two 5 GHz bands. I use the second 5GHz band for my wireless backhaul as that’s the faster of the two based on the fact that it has four transmit streams and four receive streams that should give me a maximum speed of 4804 Mbps. That means that by diving into my router’s configuration web page, I can figure out very easily if I am getting anywhere near 4804 Mbps that ASUS claims that I can get. Here’s what I am actually getting:
So this isn’t anywhere near the 4804 Mbps that I should be getting, which is not a surprise to me as I have to compete against 30 to 40 WiFi networks that are around me at any time which is sure to cause WiFi speeds to nosedive. There’s also the fact that the two nodes are about 20 feet apart with a concrete wall in between them which doesn’t help in terms of getting a fast connection. The bottom line is that this is the best maximum speed that the two nodes can do between each other.
But how about devices that connect to my network over WiFi? Here’s what my MacBook Pro gets in terms of the best possible speed that either of the nodes can provide:
Pro Tip: If you’re trying to figure you what you should get in terms of a maximum speed, which is what I am doing here, look at the speed that the individual bands as provided by the router manufacturer, and compare them to what speed your computer connects to the router at. This article can help you with that.
Keep in mind that this was taken three feet away from one of my nodes. So on the surface, seems good as it is the best case scenario that I can get given the fact that the 5GHz band in question maxes out at that speed because of the two transmit and two receive streams that it has. But let’s do a speed test out to to the Internet using my MacBook Pro and see what results we get:
I have a 1.5 Gbps down / 940 Mbps up (which actually runs 1.6 Gbps down / 1.05 Gbps up most of the time) Internet connection. And this was taken three feet away from the ASUS node that has the Bell Canada hardware plugged into it. So this may seem disappointing, but it actually isn’t. Ignoring the fact that the only truly accurate speed test is from the router itself or with a wired client plugged into the router, this is in line with other routers that I have tested in this environment. Meaning that the fact that my network has to deal with so many other WiFi networks means that this speed is lower than what I might get in a “cleaner” environment. It also means that while my MacBook Pro can in theory connect to WiFi at 1200 Mbps, in reality I am highly unlikely to see that speed.
Let’s say you do some similar testing, and you believe that your WiFi network is possibly underperforming. That’s when a call to a professional might be advised. If you have the data from your testing at hand, a professional should be able to draw some early conclusions before coming on site to confirm them. And that will help you to resolve whatever issue you have faster. But you should temper your expectations accordingly. You’re never going to insanely fast speeds from your WiFi. You’re only going to get the speeds that your environment allows. And hopefully this article will help you to understand the various factors that influence the speeds that you get.
Wi-Fi blocking violates Section 333 of the Communications Act, as amended. The Enforcement Bureau has seen a disturbing trend in which hotels and other commercial establishments block wireless consumers from using their own personal Wi-Fi hot spots on the commercial establishment’s premises. As a result, the Bureau is protecting consumers by aggressively investigating and acting against such unlawful intentional interference.
I for one am overjoyed with this because WiFi in hotels is not only hit or miss, but it’s sometimes rather expensive to use. Thus it sometimes makes using my iPhone 5s as a mobile hotspot an attractive option. Hopefully when some hotel chain tries to push the FCC on this, which they will, the FCC really takes them to the metaphorical woodshed.
When I am out and about, I try not to use WiFi just anywhere. If required, I will use the Instant Hotspot feature which is part of the larger Continuity feature set that is built into OS X Yosemite and iOS 8.1 to get online. The reason being is that just because WiFi is open and available, it doesn’t mean that you should use it.
Gustav Nipe, president of Sweden’s Pirate Party’s youth wing illustrated this recently. During the Sälen security conference, he set up a WiFi hotspot named “Öppen Gäst” (“Open Guest”) without any kind of encryption. In short order, a large amount of unsuspecting high profile guests associate with the network. According to Nipe, he was able to track which sites people visited as well as the emails and text messages of around 100 delegates, including politicians and journalists as well as security experts. Here’s what he had to say on the matter:
“The security establishment was in Sälen pushing for more surveillance, but then leading figures go and log on to an unsecure W-Fi network,” he told The Local.
“It is very embarrassing because the data we collected showed that some people were looking at Skype, eBay and Blocket and stuff like that, or looking for holidays and where you could go and hike the forest. This was during the day when I suppose they were being paid to be at the conference working.”
Well, that’s a wee bit embarrassing. But this comment shows what the real danger is:
“The scary part is that with unsecure networks like these you can end up getting access even to secure servers because people so often use the same passwords for different sites. So we could have got into the government’s server or used other information to track people in their everyday lives.”
He says that he won’t be revealing which sites were visited by specific experts. But he has already sparked criticism in Swedish newspapers and on social media, with some angry comments saying that Nipe breached Sweden’s Personal Data Act. So this could end badly for him personally, but it does highlight the risks of using just any open WiFi hotspot.
Posted in Commentary with tags WiFi on January 15, 2015 by itnerd
You might recall this story that detailed a group of hotels who wanted to block external WiFi signals including Marriott Hotels who got slapped by the FCC for doing so. Well, Marriott has backed off of that because it couldn’t take the heat from the travelling public. Here’s what the BBC wrote:
“Marriott International listens to its customers, and we will not block guests from using their personal wi-fi devices at any of our managed hotels,” the company, which is based in Bethesda, Maryland, said in a statement.
I’m very happy about this as my perception is that Marriott knew that they weren’t supposed to this and they were hoping they’d get away with it. Based on their statement, they’re acting like it’s an honest mistake so that they don’t lose face. I for one am happy that corporations like Marriott get not so subtle reminders they aren’t the ones defining what’s legal and what isn’t.
Back in August, Marriott, business partner Ryman Hospitality Properties and trade group the American Hotel and Lodging Association asked the FCC to clarify when hotels can block outside Wi-Fi hotspots in order to protect their internal Wi-Fi services.
In that petition, the hotel group asked the agency to “declare that the operator of a Wi-Fi network does not violate [U.S. law] by using FCC-authorized equipment to monitor and mitigate threats to the security and reliability of its network,” even when taking action causes interference to mobile devices.
This came about because of Marriott International blocking WiFi that didn’t belong to them. That earned the hotel chain a US $600,000 fine when the FCC found out about it. Thus they and other hotels want the rules changed in their favor.
My take? This is driven by one thing. Money. Not security, reliability, or anything else. The problem is that it takes away choice. Consider this. Hotels provide phones. Should they have the right to block cell phone services and force you to use their in room phones so that they can make a buck?
Of course not.
Providing one service on a premise does not grant one a monopoly on all ancillary services provided on that premise. The FCC needs to shoot this out of the sky and ensure that proposals like this never see the light of day again.
It was a Petro Pass location which in Petro Canada speak means it’s a truck stop. That explains why I had to eliminate gasoline from my search parameters:
There was no ability to fill anything other than an 18 wheeler. It wasn’t designed for cars.
But it did have a store. Though it isn’t open on weekends. It’s only open Monday to Friday.
So I was starting think that this was a bust. But when I checked to see if there was any open access points on my iPhone 5S, I found that there was an open access point called “Petro Canada Free WiFi”. After I connected to it, I opened my browser and got this:
I then got this:
Then I was able to surf the net and check my e-mail for free. What’s noteworthy, I was able to do this from outside the store in the truck parking lot which was a good distance from the store. So Petro Canada clearly intends this to be used by truckers whilst they are parked.
Now when I originally stumbled onto this, I figured that you could use their WiFi to get e-mail and the like while you’re filling up your car or you’re taking a break during a long road trip. That would have set themselves apart from every other fuel retailer. Sadly this doesn’t seem to be the case. While these truck stops are near major highways which makes them useful to take a break on a road trip or to grab a drink if the store is open, you’ll have to fuel your car elsewhere. Thus I don’t know how useful these locations truly are. But at least you have another option if you need WiFi during your travels.
I was on the Petro Canada website tonight checking my Petro Points balance when I noticed something new. Petro Canada is offering WiFi at some of their locations. I am guessing that the logic is that you can grab your e-mail or surf the web while you fill up. How handy. You simply have to use this search utility to find a location along your intended route that has WiFi. When I tested this, I found 4 locations within 50 kilometers of my home in the the west end of Toronto and they all seem to be locations that are suited for trucks rather than for the average Joe or Jane in a car looking to check their e-mail. In the interest of seeing how useful this could be for you, I’ll head out to a few of these locations and report back with my findings this weekend.
Posted in Tips with tags WiFi on October 7, 2014 by itnerd
Here’s a question that hit my inbox a few minutes ago:
A question for you. I have a router that is capable of doing both 2.4 GHz and 5 GHz. Which one should I be using?
Thank you!
Thanks for the question. The answer is that it depends based on your situation. Each band has advantages and disadvantages. With 2.4 GHz you get better range which is useful in a large environment, but you are more likely to suffer from interference from items like baby monitors, cordless phones, Bluetooth devices, and other WiFi routers that are on the 2.4 Ghz band. But with 5 GHz you get shorter range due to the fact that the greater the frequency, the shorter the range. But you’re less likely to have interference problems. Thus it might be ideal for apartments and densely populated areas where everyone and their dog has a WiFi router.
Another consideration is performance. The 2.4 GHz band is fine for those who access the Internet for simple browsing and email. These applications do not take too much bandwidth and work fine at a greater distance because they are not as time sensitive. If however you do a lot of online gaming or your do Netflix, then you want to try to get your devices onto the 5 Ghz band.
Finally, you want to make sure that your router is capable support both bands at the same time. That it gives you the flexibility that you might need to fit whatever your use case is to get the best wireless Internet access in your environment.
Around 8.7 Million travellers’ info stolen at 3 UK airports
Posted in Commentary with tags Hacked, WiFi on August 29, 2026 by itnerdAround 8.7 million travellers who signed up for WiFi, car parking services and lounges in airports run by Manchester Airports Group (MAG) had their data stolen, including email addresses and phone numbers, postcodes and vehicle registration details. MAG operates airports in Manchester, London Stansted and East Midlands, and declined the demand to pay ransom.
Denis Calderone, CTO, Suzu Labs:
The 8.7 million number is attention-grabbing, but it deserves some context. MAG has confirmed that the vast majority of those records are email addresses collected through airport WiFi sign-ups. A much smaller subset includes phone numbers, vehicle registrations, and postcodes from customers who actually completed parking or lounge bookings. No payment data, no passwords, no passport information. So despite this affecting airports, which is obviously a sensitive subject, the actual data sensitivity for most affected individuals is relatively low.
What’s more interesting to us from a technical standpoint is the attack path. MAG told The Register that attackers compromised one of their internal systems and then went on to steal files from a database hosted by a third party. That’s a pivot upstream into a data provider, not downstream into operational systems. What remains unclear is whether the data was exfiltrated directly from that third-party environment or whether it was pulled back through MAG’s network first. That distinction matters for understanding where detection controls failed and who was responsible for monitoring the egress.
The UK’s Civil Aviation Authority has a Cyber Assessment Framework for Aviation, developed with the NCSC, that mandates strict separation between IT systems and operational technology. We don’t know whether MAG was formally operating under that framework at the time of this incident, but I would be very interested to find out. Because the segmentation appears to have held here. Flight operations, baggage handling, terminal systems, etc., all were unaffected. The lateral movement went upstream toward a data provider, not downstream toward the systems that keep planes in the air.
Seemant Sehgal, CEO and Founder, BreachLock:
“This data was initially collected because passengers needed a login, and somewhere along the way, the sensitivity of what was accumulating in that database stopped getting the same scrutiny as the network itself. Vehicle registration details, postcodes, and contact information across three major airports are a profiling dataset, and whoever held it for ransom understood its value better than the organization storing it did.”
This is why I use a VPN when I use public WiFi. In short, public WiFi cannot be trusted. You have to assume the same in order to keep safe.
Leave a comment »