Can Malware/Hacker Connect a Device to Internet that's NOT Already Connected?

Question

Suppose you have a phone and/or computer that has WiFi capabilities and can connect to the internet through it. If that device(s) is not currently connected to an available network, can malware connect it and to the internet on its own?

Answer 1

In general, yes. Once a malware is properly inside a system, it has an access to that system higher or equal than yours. So it can do whatever you can, and possibly even more.

What if I JUST bought a new laptop and never connected to a router. BUT, my router has malware or a computer connected to my router in the same household has malware. Could the malware in my router or household computer somehow "turn" on my computer to the internet

This is a completely different problem. It too is possible, but requires hypotheses that are quite unlikely.

To start with, the infected computer must know about the newcomer. How can it?

• You turn on the new laptop and navigate. The infected computer has what's called promiscuous access to the network and "sees" packets from a physical address (MAC) that it did not know about.
• You do not navigate, but the malware performs routine scans of its network to find possible targets of opportunity.

Now it needs to turn it on. There's a facility to do that, Wake-on-LAN, but is it running on the newcomer? What if the laptop is WiFi and doesn't support the much more complicated and expensive Wake-on-WiFi?

But it could simply wait for someone else to turn the laptop on.

Finally it needs to seize control of the laptop. This is actually the easy part. A sophisticated enough malware would not act alone, but rather connect back to a command-and-control network, and the conversation could go like this...

• malware: NEW POSSIBLE TARGET, MAC 00:11:22:33:44:55
• control: MANUFACTURER IS KNOWN, EXPLOITS MIGHT EXIST. PERFORM PORTSCAN.
• malware: PORTSCAN COMPLETED, RESULTS ATTACHED.
• control: TARGET IS NIFTYWARE LAPTOP MODEL THX1138 RUNNING BUNNYOS 3.11. EXPLOIT ATTACHED.
• malware: EXPLOIT UNZIPPED AND RUNNING. (and some seconds later...)
• laptop : CONTROL, THIS IS NEW INSTANCE 019298 REPORTING FOR DUTY.

...and from that moment on, your laptop isn't really "your" laptop anymore.

And that's why you don't want an obsolete or vulnerable machine in your network, ever.

Update

But then I thought, maybe the WiFi is on, but if I never connected SPECIFICALLY to a network, then I couldn't pick up anything, right? Out of curiosity, shouldn't the WiFI be off?

Yes, and not necessarily. Yes, if you never connected to a network, the new laptop was never online and nobody could have reached it. (There have been reports of airgap bypassing but, to my knowledge, they either have never been substantiated, or refer to a different scenario - two already infected computers bypassing an airgap).

And no, on most new computers WiFi is actually on, but the "light" only refers to the capability, not to the actual connection or even presence of an access point. It just means that the laptop might connect if there is an active access point and you supplied the password.

On some high end laptops the light is blue when WiFi is on and e.g. green if there's a connection, and it maybe even blinks when data is exchanged. But it still means that the "default" blue light signifies nothing.

In your specific case a router "malware" almost invariably entails modifying the DNS mapping so that e.g. www.google.com is actually a site faking Google that prompts you to download malware. And a Mac malware is not at all likely to propagate on non-OSX computers. So you should be doubly protected (you were not connected to a network where nothing was likely to infect you actively).

There is one case in which this is not completely true: a malware's code cannot spread across OS boundaries, but its damage can. Case in point: a CryptoLocker/TeslaCrypt ransomware running on Windows will find your open shares on a Mac OSX, if they are open and writeable, and will encrypt the documents they contain. The Mac OSX will not be infected, but its documents will nevertheless be lost.

And that (that, and user errors, and hardware failures) is why you also want to have full and adequate backups.

Answer 2

Yes. There are even situations known where malware can turn your phone on when it's off.

Malware can easily be programmed to connect back to internet when there is no internet connection.