Surprising Wi-Fi Mystery: Are My In-Laws’ Credentials Being Spoofed by Neighbors?

I recently encountered an unusual and complex issue regarding Wi-Fi security that has left me both puzzled and concerned. With a background in Computer Science and experience in Cyber Security Consultancy, I thought I could handle any technical challenge. However, this situation took a twist I didn’t see coming, prompting me to seek some insights from a broader audience.

Currently, I’m living with my spouse’s parents in the UK, who rely on Virgin Media as their Internet Service Provider (ISP). They use a Hub 3 router, and unfortunately, the Wi-Fi SSID and password are still set to the factory defaults. This has been a problem, especially with several people residing in the house, leading to connectivity struggles.

To remedy this, I decided to invest in a high-performance router, aiming to switch the Hub 3 to modem mode and let my new device manage the Wi-Fi network. However, during this process, I stumbled upon a perplexing discovery: my phone was picking up a strong Wi-Fi signal from the Virgin router—even though it was turned off!

Curious, I used a Wi-Fi analyzer app to pinpoint the strongest signal locations in the house. To my surprise, the best signal was emanating from the back of the house, particularly in my in-laws’ bedroom. Notably, one side of the room received a significantly stronger signal than the other. My in-laws assured me that no secondary access point existed within their home, and a recent redecoration meant that there were no lingering devices hidden away.

As the situation unwrapped, it became increasingly evident that this connection must originate from the neighboring house. Intriguingly, the mysterious access point turned out to be a TalkTalk router rather than Virgin Media. Hence, it shouldn’t bear an SSID that starts with “VM,” but rather “TalkTalk.”

Further investigation revealed that my public IP address corresponded to a TalkTalk connection, raising more questions than answers. Whoever was operating this rogue access point had somehow secured it using my in-laws’ SSID and WPA2 password!

What could have led to this peculiar scenario? After pondering the circumstances, I formulated two theories:

Possible Innocent Scenario:

1. Some time ago, a former tenant from the neighboring house, possibly lacking funds for their own connection, obtained my in-laws’ Wi-Fi credentials—either through brute force, advanced packet sniffing