1

Suppose you have a phone and/or computer that has WiFi capabilities and can connect to the internet through it. If that device(s) is not currently connected to an available network, can malware connect it and to the internet on its own?

2

In general, yes. Once a malware is properly inside a system, it has an access to that system higher or equal than yours. So it can do whatever you can, and possibly even more.

What if I JUST bought a new laptop and never connected to a router. BUT, my router has malware or a computer connected to my router in the same household has malware. Could the malware in my router or household computer somehow "turn" on my computer to the internet

This is a completely different problem. It too is possible, but requires hypotheses that are quite unlikely.

To start with, the infected computer must know about the newcomer. How can it?

  • You turn on the new laptop and navigate. The infected computer has what's called promiscuous access to the network and "sees" packets from a physical address (MAC) that it did not know about.
  • You do not navigate, but the malware performs routine scans of its network to find possible targets of opportunity.

Now it needs to turn it on. There's a facility to do that, Wake-on-LAN, but is it running on the newcomer? What if the laptop is WiFi and doesn't support the much more complicated and expensive Wake-on-WiFi?

But it could simply wait for someone else to turn the laptop on.

Finally it needs to seize control of the laptop. This is actually the easy part. A sophisticated enough malware would not act alone, but rather connect back to a command-and-control network, and the conversation could go like this...

  • malware: NEW POSSIBLE TARGET, MAC 00:11:22:33:44:55
  • control: MANUFACTURER IS KNOWN, EXPLOITS MIGHT EXIST. PERFORM PORTSCAN.
  • malware: PORTSCAN COMPLETED, RESULTS ATTACHED.
  • control: TARGET IS NIFTYWARE LAPTOP MODEL THX1138 RUNNING BUNNYOS 3.11. EXPLOIT ATTACHED.
  • malware: EXPLOIT UNZIPPED AND RUNNING. (and some seconds later...)
  • laptop : CONTROL, THIS IS NEW INSTANCE 019298 REPORTING FOR DUTY.

...and from that moment on, your laptop isn't really "your" laptop anymore.

And that's why you don't want an obsolete or vulnerable machine in your network, ever.

Update

But then I thought, maybe the WiFi is on, but if I never connected SPECIFICALLY to a network, then I couldn't pick up anything, right? Out of curiosity, shouldn't the WiFI be off?

Yes, and not necessarily. Yes, if you never connected to a network, the new laptop was never online and nobody could have reached it. (There have been reports of airgap bypassing but, to my knowledge, they either have never been substantiated, or refer to a different scenario - two already infected computers bypassing an airgap).

And no, on most new computers WiFi is actually on, but the "light" only refers to the capability, not to the actual connection or even presence of an access point. It just means that the laptop might connect if there is an active access point and you supplied the password.

On some high end laptops the light is blue when WiFi is on and e.g. green if there's a connection, and it maybe even blinks when data is exchanged. But it still means that the "default" blue light signifies nothing.

In your specific case a router "malware" almost invariably entails modifying the DNS mapping so that e.g. www.google.com is actually a site faking Google that prompts you to download malware. And a Mac malware is not at all likely to propagate on non-OSX computers. So you should be doubly protected (you were not connected to a network where nothing was likely to infect you actively).

There is one case in which this is not completely true: a malware's code cannot spread across OS boundaries, but its damage can. Case in point: a CryptoLocker/TeslaCrypt ransomware running on Windows will find your open shares on a Mac OSX, if they are open and writeable, and will encrypt the documents they contain. The Mac OSX will not be infected, but its documents will nevertheless be lost.

And that (that, and user errors, and hardware failures) is why you also want to have full and adequate backups.

  • Thanksm lserni I asked this question, because I VERY likely had malware on my Verizon Fios router and/or iPAD at home and bought a new laptop. The new laptop was turned on, but I never connected it to the Verizon router/home network, which requires a password. BUT, I saw the "WiFi" button thingy turned ON on my laptop!!! I only noticed this after about 2 hours of use and immediately turned it off. But then I thought, maybe the WiFi is on, but if I never connected SPECIFICALLY to a network, then I couldn't pick up anything, right? Out of curiosity, shouldn't the WiFI be off? – atrueidiot Oct 17 '16 at 5:13
  • (continued from above) ...I mean, why would the WiFi be in the "ON" position if you just bought a new computer? I guess I would have expected it to be "OFF" and in need of someone manually turning it on. In any case, if it was "ON" and the laptop was brand new and I never specifically gave a password to connect to my home network, then the malware from either my router and/or iPAD couldn't travel to my laptop is that right? I know I sound paranoid, but I just had to deal with a nasty infection so just want to make sure nothing infects my new laptop!!! – atrueidiot Oct 17 '16 at 5:15
  • updated answer... – LSerni Oct 17 '16 at 7:00
0

Yes. There are even situations known where malware can turn your phone on when it's off.

Malware can easily be programmed to connect back to internet when there is no internet connection.

  • What if I JUST bought a new laptop and never connected to a router. BUT, my router has malware or a computer connected to my router in the same household has malware. Could the malware in my router or household computer somehow "turn" on my computer to the internet - like connect my unconnected computer to the router/internet? – atrueidiot Oct 15 '16 at 12:57
  • @atrueidiot How on earth would a router or another computer connect to the new laptop if it is not on the network?? – schroeder Oct 15 '16 at 12:59
  • 1
    @schroeder I suggested that the computer was already infected, and than disconnected. And there are possibilities to infect air-gapped systems (view: Stuxnet) - but that's not the case here. – O'Niel Oct 15 '16 at 13:13
  • 1
    @atrueidiot There is a way where this might happen if the new device had connected to another wifi network in its past: the infected device mimics the name of the previously connected wifi network. The new device connects as though it was connecting to the other network. But the wifi would need to be on, broadcasting, and it would have to have connected to a network before. – schroeder Oct 15 '16 at 13:42
  • 1
    @O'Niel my comment was directed at atrueidiot – schroeder Oct 15 '16 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.