'Chameleon' Malware Spreads Like Common Cold: Researchers Develop Computer Virus That Infects Wi-Fi Access Points

Traditional malware require a user action -- like downloading a malicious file or clicking an infected link -- before it can infect a computer, but a study at the University of Liverpool developed a malware that can spread through computers like an organic airborne virus spreads through humans.

The researchers at the university’s School of Computer Science and Electrical Engineering and Electronics designed a malware called “Chameleon” that infects computers by exploiting the access points that homes and businesses use to connect to Wi-Fi networks. The Chameleon malware can also identify security weaknesses in Wi-Fi networks to quickly spread between homes and businesses.

Once the Chameleon malware attacked an access point, it collected and reported the credentials of all other Wi-Fi users connected to it. The Chameleon malware then searches for other Wi-Fi access points on the network to infect.

Densely populated areas have more access points in close proximity, meaning that just like an organic virus, the Chameleon malware can spread much faster in a city.

"It was assumed ... that it wasn't possible to develop a virus that could attack Wi-Fi networks, but we demonstrated that this is possible and that it can spread quickly,” Alan Marshall, a professor of network security at the University of Liverpool, said. “We are now able to use the data generated from this study to develop a new technique to identify when an attack is likely."

The malware got the name “Chameleon” from its ability to evade detection by modern antivirus software that only look for malware on the Internet or on the computer rather than the Wi-Fi network.

The researchers explained that because people often don’t protect their Wi-Fi connections with a strong password and encryption, they are increasingly open to an attack by hackers. Chameleon wasn’t able to infect access points that were sufficiently protected, but it was able to move on to others that are more open, such as free Wi-Fi networks in coffee shops.

The results of the research were published in the EURASIP Journal of Information Security and can be read in full here.

The Chameleon malware was created by the lab for a demonstration only and has not been found in the wild yet, but it’s likely just a matter of time before nefarious hackers use the research for criminal purposes.