The Dangers of
Your WiFi

The Setup: A Normal Tuesday

It's 09:15. A patient walks in for a routine scale-and-polish. They sit in your waiting room, pull out their phone, and ask your receptionist for the WiFi password. Your receptionist recites it without a second thought — it's been the same password for three years, printed on every appointment card.

That patient connects. Their phone handshakes with your AP, gets an IP from your DHCP server, and is now a fully routed node on the same broadcast domain as every other device in your building. Including your Carestream CS3600 intraoral scanner. Your Dentrix workstation. Your billing server. Your NAS.

Why Practices Are Especially Vulnerable

Dental and medical practices sit in a uniquely dangerous position. They hold protected health information (PHI) — some of the most valuable data on the criminal market, worth up to 40× more than a payment card number — yet most run with the security posture of a home network. Clinical imaging systems, patient management software, and billing portals often run on Windows 10 workstations that haven't been patched since the software vendor last visited. SMB shares are open. RDP is enabled. Default credentials are still in place on network printers and IP cameras.

And crucially — in South Africa, POPIA (Protection of Personal Information Act) places legal obligations on you as the Responsible Party for that data. A network breach that exposes patient records is not merely an IT problem. It is a regulatory event with mandatory reporting obligations to the Information Regulator and potentially significant financial penalties.

Step One: Passive Recon Before You Even Connect

An attacker doesn't even need your WiFi password to start learning about you. From the car park — or any location within radio range — they can run passive wireless reconnaissance without transmitting a single packet.

Tools like Kismet and Wireshark in promiscuous mode go further. Unencrypted or weakly encrypted traffic — multicast DNS (mDNS), NetBIOS name broadcasts, UPnP announcements — leaks device names, operating systems, software versions, and sometimes hostnames that directly identify clinical systems, all before a single authentication has taken place.

Step Two: Active Network Enumeration

Once connected — with the password from your reception desk, or from the WiFi card on your waiting room table — the attacker begins active enumeration. This is where the damage compounds rapidly. Every device on an unsegmented network is discoverable, and most clinical environments have devices that were never designed to face a hostile network.

Host Discovery: Finding Every Device

That output above is not hypothetical. It is a representative composite of what I have found during practice assessments. Windows 7 running clinical imaging software is not unusual — Carestream, Planmeca, and other vendors have historically locked practices to specific OS versions for driver compatibility, and upgrade cycles lag years behind patch schedules. Windows 7 reached end-of-life in January 2020. It no longer receives security updates. Any known vulnerability from the last six years is permanently unpatched and permanently exploitable.

Service Enumeration: What's Running and How Old Is It?

ARP Poisoning & Traffic Interception

On a flat network, an attacker can perform ARP cache poisoning — sending forged ARP responses to make the router think the attacker's machine is a legitimate host, and vice versa. This positions the attacker in a man-in-the-middle (MitM) position, allowing them to intercept, read, and modify all traffic between selected devices and the gateway — including unencrypted HTTP sessions to practice management portals, internal web admin pages for printers and NAS devices, and any clinical software that communicates over plain TCP.

Nessus: The Same View Whether You're Inside or Outside

This is the part that surprises most practice owners when I demonstrate it. Nessus Essentials — the free tier of one of the world's most widely used vulnerability scanners — is available to anyone. And when it comes to what it can see on your network, there is functionally no difference between someone connecting via your waiting room WiFi and someone running a scan from inside your building on a physical cable.

Once an attacker has a routed IP address on your network — whether via WiFi or Ethernet — Nessus sees the same hosts, the same open ports, the same running services, and returns the same vulnerability findings. The physical medium is irrelevant. Network access is network access.

Lateral Movement: From Patient Phone to Patient Records

This is the attack chain that matters most. An attacker doesn't need to immediately target your most sensitive system. They can start anywhere — even from a patient's compromised phone — and work their way across the network. Each compromised device becomes a launching pad for the next attack.

The Car Park Threat: You Don't Need to Come Inside

Here is the thing that most practice owners fail to internalise: physical presence in your building is not required for any of the above.

Modern 802.11n/ac/ax access points have a typical indoor range of 30–50 metres. In open air — like a car park — signal propagates further. A standard laptop WiFi card can comfortably associate with most practice APs from a car parked outside. A Alfa AWUS036ACH USB adapter with a directional antenna extends effective range to 200–300 metres. An attacker sitting in their car, in your car park, on their laptop, is network-equivalent to a patient sitting in your waiting room.

WPA2 Is Not As Safe As You Think

WPA2-Personal (the PSK mode virtually every practice uses) has a well-documented offline cracking attack. When any device connects to your network, a 4-way EAPOL handshake is transmitted over the air. An attacker can passively capture this handshake — or force a re-authentication by sending a single deauth frame — and then take the handshake offline for dictionary and brute-force attacks. Tools like hashcat running on a mid-range GPU can test billions of password combinations per second. A weak password ("Practice@2021", "Dental123", the street address) falls quickly.

The PMKID attack, published in 2018, is even more convenient — it doesn't even require capturing a client handshake. An attacker can derive the cracking hash directly from the router's beacon frames. No client needs to connect. No one needs to be in the building.

Hardening Your Network: What You Must Do

The good news: the gap between a fatally vulnerable practice network and a defensible one is not enormous. You do not need enterprise-grade hardware or a full-time security team. You need the right architecture and a handful of non-negotiable configuration changes.

The Non-Negotiable Hardening Checklist

The Bottom Line

Sharing your WiFi password with patients is not a small kindness — it is an access grant to a node on your clinical network. Every unpatched system, every default credential, every open SMB share that exists on that network is now reachable by anyone who has ever sat in your waiting room. And they don't need to be in your waiting room at all. They just need to be close enough to connect.

The attacker in this scenario doesn't need to be sophisticated. They need nmap, Nessus Essentials, and the password from your reception desk. The entire attack chain described in this article uses free, publicly available tools that appear in every penetration testing course on the internet. The tools are not the problem. The flat, unsegmented network is the problem.

VLAN segmentation, strong passwords, WPA3, disabled SMBv1, changed default credentials, and quarterly Nessus scans. Those eight things, implemented properly, close the majority of the attack surface described above. They cost almost nothing compared to the cost of a breach, a ransomware payment, an Information Regulator investigation, or the reputational damage of telling your patients their medical records were compromised because you shared the WiFi password.