Wardriving assessment across Mexico: Preparing for the 2026 World Cup

What Happened

Researchers analyzed public Wi-Fi networks in three Mexican cities hosting the 2026 World Cup to understand potential security risks for visitors. They found that while most networks use modern encryption, about half still have a vulnerable feature called WPS enabled, and many networks remain completely open. This matters because attackers can easily set up fake Wi-Fi hotspots (evil twins) or eavesdrop on unencrypted traffic to steal personal information. Users should be extremely cautious when connecting to public Wi-Fi, use a Virtual Private Network (VPN) to encrypt their traffic, and avoid networks with suspicious names.

Key Takeaways

• Approximately 82% of detected networks use WPA2/WPA3, but around 50% of these secure networks still have vulnerable WPS enabled.
• 10-12% of all detected wireless networks remain completely open and insecure.
• Over 30% of networks reuse their physical MAC address (BSSID) as the visible SSID, facilitating hardware fingerprinting.
• Heavy reliance on the 2.4 GHz spectrum (channels 1, 6, 11) causes significant congestion in dense urban areas.
• Threats like 'evil twin' rogue access points pose significant risks to users connecting to public Wi-Fi during the upcoming World Cup.

Affected Systems

• Public Wi-Fi Networks
• SOHO Routers
• Mobile Devices
• Corporate Endpoints on untrusted networks

Attack Chain

Attackers can exploit the identified wireless misconfigurations by deploying rogue access points ('evil twins') in high-density tourist areas. Unsuspecting users connect to these malicious networks, allowing the attacker to perform adversary-in-the-middle (AitM) attacks. Through this position, threat actors can intercept unencrypted traffic, harvest credentials, or distribute malware to connected devices. Additionally, attackers can exploit WPS vulnerabilities on legitimate routers to gain unauthorized network access.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

The article focuses on a passive wardriving assessment and does not provide specific detection rules or queries.

Detection Engineering Assessment

EDR Visibility: None — EDR solutions do not typically monitor local Wi-Fi spectrum or detect rogue access points directly, though they may detect post-exploitation malware dropped via AitM attacks. Network Visibility: Low — Detecting rogue APs or passive sniffing requires dedicated Wireless Intrusion Prevention Systems (WIPS), which are rarely deployed to cover remote users on public networks. Detection Difficulty: Hard — Detecting evil twins or passive sniffing on public networks is notoriously difficult without specialized wireless monitoring hardware in the physical vicinity.

Required Log Sources

• WIPS alerts
• MDM network logs
• VPN connection logs

Hunting Hypotheses

Control Gaps

• Wireless Intrusion Prevention Systems (WIPS)
• Endpoint VPN enforcement on untrusted networks

Key Behavioral Indicators

• Unexpected SSL certificate warnings on endpoints
• Multiple access points broadcasting identical corporate SSIDs with different MAC addresses

False Positive Assessment

• Low

Recommendations

Immediate Mitigation

• Verify against your organization's incident response runbook and team escalation paths before acting.
• If applicable, enforce Always-On VPN configurations for corporate endpoints connecting to untrusted networks.

Infrastructure Hardening

• Consider disabling WPS functionality on corporate and remote-worker wireless routers.
• Evaluate changing default SSIDs and avoid using BSSID/MAC addresses in network names to prevent hardware fingerprinting.
• Where operationally feasible, migrate to WPA3-capable infrastructure and disable legacy wireless protocols.

User Protection

• Consider deploying endpoint security solutions that warn users about insecure or open Wi-Fi networks.
• Implement strict certificate validation to prevent adversary-in-the-middle attacks.

Security Awareness

• Consider training employees on the risks of connecting to public Wi-Fi networks, especially in high-density tourist areas.
• Educate users on identifying potential 'evil twin' networks and the importance of using VPNs.

MITRE ATT&CK Mapping

• T1557 - Adversary-in-the-Middle
• T1040 - Network Sniffing
• T1590 - Gather Victim Network Information