"Connect Automatically" box is checked for all the networks in range

Hi Omar,

I'm not Loreto, I am the OP of this thread, and you typed this response to my post, not Loreto's.

I appreciate you taking the time to write a detailed how-to for this problem.

However, it does not in any way solve the issue I originally posted about, not from a security standpoint at least.

Loreto was the Microsoft forum moderator who offered a suggestion on August 30, 2016.

I responded September 2nd, and explained that her solution did not address my concerns.

You responded to me, not Loreto.

I don't think you read what I wrote on September 2nd very carefully, because your solution suffers exactly the same shortcomings as the one offered by Loreto.

Manually blocking networks one-by-one is NOT in any way whatsoever an acceptable solution to this problem.

Why?

Well I've already said why. At least twice in this thread.

This solution only blocks networks after I have already identified them. If we are concerned about a malicious network trying to get my computer to connect to it automatically, that's too late.

This solution requires me to manually block networks one-by-one. Which is tedious at best and woefully inadequate to address the security issues presented by this.

Right now I have 47 networks in range. Let's say I block them all.

I guarantee you that tomorrow there will be networks within range which I did not identify today. So let's say I block those networks tomorrow.

The next day there will be more. On any given day most of the networks that appear within range are different than the day before.

As I mentioned in a previous post, I live in a very densely populated area. It's also a popular area for wardriving/warwalking.  Instead of wardriving (looking for open or vulnerable networks) a hacker with a black heart could easily begin to pwn Win 8 machines by setting up a malicious hotspot and letting Win 8 machines automatically connect to it. It doesn't need to stay connected for long. If I can get your machine to connect to my untrusted malicious network, I can potentially use that to pivot my attack and rootkit your own router within minutes, or install malware on your machine. You'd have to be watching all the networks in range to see my new hotspot appear, and you'd only have a few minutes to block me.

I am talking about my own observations at my own location. If I had written down every new network that appeared within range of me over the last two years, there would be thousands of them.

Your technique is essentially "blacklisting," -- identifying specific networks you do not want to connect to.

As a general principle of network security it is better to whitelist than to blacklist. In other words, it's better to identify specific networks you do trust, and block everything else, rather than allow all connections other than the ones you specifically forbid.

HI VF,

Thanks for contact and pointing out my mistaken assumption of your original post. A case of mixing up one thread with others posting for solutions to get rid of specific profiles plaguing them. Many apologies.

Your issue is entirely security related and an entirely legitimate concern. And your are right, as consumers the WIFI OEM's sell us NIC's/Adaptors assuming a world full of good co-operative 'white-hearts' to automatically connect to each other when the sick reality is a significant number of 'black-hearts' automatically receive our innocent wifi profiles through our machines constant active broadcasts and then harm us, then leave it to us to find solutions to their open access protocols.

I am in the middle of uploading over 100 auction listings on Ebay and as soon as this is done I will gladly investigate and respond back to you.

Apologies for confusion and thanks for correcting me.

Many regards.

Omar,

No problem, thank you for at least putting forth the effort and trying to address this issue.

Fwiw, for me this issue is purely academic now. I don't have any need for a solution, I'm done with Windows. I won't ever be using a Windows OS again. As I mentioned in another post here, both Linux and ReactOS have proven to me to be better alternatives.

Other people reading this might be curious about finding a solution however, and I wish you the best of luck in your investigations. Since my original post Windows 8 has been succeeded by Windows 8.1 and then by Windows 10. I'm not sure that people who are using later versions of Windows have experienced the same issue. This may be a legacy problem. Support for Windows 8 ended January 12, 2016 so it is already an OS doomed to history.

Hi VF,

Thanks for message. I share your frustration with Microsoft and on many occasions I have been left frustrated as well. But I realised a long time ago that its a simple lack of communication to users and many users have to investigate and find solutions and explanations themselves. I have investigated and address your concerns below:

‘Again, my concern is that the list of Networks which appears in the sidebar includes every network within range, and the option to "connect automatically" is selected by default for every network. I would like to know why’

Yes your right, seems stupid to set ‘auto connect’ as default for profiles deliberately set up as ‘OPEN’ which would cause your PC to automatically connect to a potential black-heart and be compromised because OPEN networks do not require (1) Access Configurations (knowing the SSID) and (2) Authentication (no need for knowing its security SSID encryption password because its already open and your gullible computer will walk through the open trap door). 

 ’So far, every network that has been identified within range is password protected. Since I do not have the password for any network other than my own, my computer will not actually be able to connect to any of them, even if it does attempt to connect automatically. ‘However, what happens if a non-password protected network appears within range? It would seem that Windows 8 is going to attempt to "connect automatically" to any network it identifies as being within range, regardless of whether I have ever connected to it in the past. If someone with malevolent intent wished to exploit a Windows 8 machine, it would appear that they would only need to set-up a non-password protected wi-fi network and lure every Windows 8 machine within range to connect to it. Or perhaps use something like the WiFi Pineapple device to troll for any Windows 8 machine that will connect to it and effect a Man-In-The-Middle attack. Hopefully you can understand that connecting to an unknown, untrusted network is a bad idea. Windows 8 seems intent to do exactly this by default.

After a lengthy investigation, I am glad to inform you that this security issue was a problem in the past but your Windows 8 machine is well protected from this issue (explained in detail below).

AUTOMATIC CONNECTIONS AND BROADCASTING OR NON-BROADCASTING (HIDDEN) WIFI PROFILES

Hidden networks are termed NON-BROADCASTING networks. The operating protocols of WIFI connections under Windows 8 and higher is that connection is MANUAL i.e you have to deliberately click on a network to connect to it and re-using this same network is termed AUTOMATIC CONNECTION. In relation to hidden/unsecured/non-broadcasting network profiles, Windows 8 warns you of these in-range/out-of-range unsecured networks by the small ‘shield’ logo (Windows Defender) right next to the unsecured wifi profile list when you click the ‘Available’ wifi profiles (under SETTINGS). The list of secure profiles list have no shield logo and require you to enter SSID details.

This connection principle works in reverse. Non-broadcast networks (hidden) do not broadcast their SSID, so they do not appear in the list of available wireless networks by default on Windows-based wireless clients. Therefore, users need to know the SSID of hidden networks/profile and create a preferred wireless network with the SSID of the non-broadcast network MANUALLY. After the preferred wireless network has been created with the correct SSID, the Wireless Auto Configuration facility in Windows will be able to connect to it. Therefore your machine CANNOT connect to a hidden network profile that it does not know about. Its the same for the hidden blackheart, if he wants to connect to your machine then his machine has to send your machine a Beacon Frame message with a NULL SSID value, when your machine receives this then your machine adds this blackheart profile to its wireless ‘Available’ network list with the title “Unnamed Network” or “Other” because the Blackheart has given his profile a NULL SSID. However, Windows Defender then attaches its small ‘shield’ next to it warning you this is unsecured network. 

Getting back to your issue, at this point WINDOWS 8 gives you 2 OPTIONS which is normal ‘CONNECT’ button (this is a ONCE-ONLY CONNECTION and the profile your connecting too will not be remembered) or ‘AUTOMATICALLY CONNECT’ which saves the profile as the MAIN wifi network you want to connect to FOREVER including at START-UP (until you change to another). Microsoft changed Windows 8 so that it maintains an ordered list of your preferred networks based on yourexplicit connect and disconnect actions, as well as the network type. For example, if you manually disconnect from a network, Windows will no longer automatically connect to that network. If you decide to connect to a different network (while you are connected to a network), Windows will move the new network higher in your preferred networks list. Windows automatically learns your preferences in order to manage this list for you.  Therefore Windows will only ever connect to a network that you have deliberately connected to before, nut only at your command. If you do end up seeing this sneaky pofile then use the NETSH commands I posted to exterminate it.

Therefore the ‘CONNECT AUTOMATICALLY’ is Microsoft geek language for connect by me MANUALLY choosing this network and REMEMBER this network as my main NETWORK, while CONNECT is connect by me MANUALLY but ONLY ONCE AND DO NOT SAVE THIS PROFILE, and not its ordinary English language AUTOMATICALLY CONNECT (as you have correctly reasonably interpreted and caused you no end of worries).

WHAT IF I MANUALLY (AUTOMATICALLY) CONNECT TO AN UNSECURED NETWORK IN FUTURE?

Even before you can connect to any other network (including your smartphone to access it as a hotspot), Windows enables you to prevent any NETWORK SHARING. If you have set up your machine not to SHARE, then no other network (both PRIVATE [OTHER DEVICES IN YOUR HOUSE] AND PUBLIC) can access your files or send you files with malicious attachments/code because blocking sharing will force other USERS/BLACKHEARTS trying to access your files to know the USERNAME and PASSWORD you have set. Each Windows OS (7, 8.0, 8.1 ect) has different ways of going about this but it all comes under NETWORK AND SHARING CENTRE and all relates to the issue of NETWORK DISCOVERY options and you should TURN-OFF ALL PUBLIC FILE SHARING AND ALL PUBLIC DISCOVERY OF YOUR NETWORKS AND TURN ON 128-BIT ENCRYPTION OF ANY OF YOUR SENDING WI-FI PACKETS. Check to see if your current active network is PUBLIC or PRIVATE:

a. Open ‘Network and Sharing Centre’.

b. Look at your current active network (WIFI adaptor and your ISP provider name) and it should say clearly PUBLIC or PRIVATE.

C. If PRIVATE then file sharing and access to your machine is only possible on your own PRIVATE network. If PUBLIC then you have switched on NETWORK DISCOVERY and other public devices and networks can see and discover yours.

ROUTER IS ADVERTISING ITS SSID?

You probably already know how to stop it but for others then access its settings and uncheck ‘BROADCAST SSID’ by typing 192.168.1.0 or 192.168.1.1 in your Browser. And while your at it change the CHANNEL NUMBER to something else that your neighbours are not using. 

BUT MY MACHINE IS ROAMIING AND LOOKING FOR OTHER NETWORK PROFILES TO CONNECT TO?

Only if you DO NOT HAVE AN ACTIVE CONNECTION. Once you click and are connected to your home Router then that is the end of the road for roaming connections because WIndows assigns the current active network profile as the PREFERRED’ network and will ALWAYS connect to this at start-up and only list other profiles in case you change your mind (showing you which ones are in-range and secure/unsecure). Every network you connected to is SAVED in your machines PROFILE list and the ones it has connected to BEFORE will always be available for AUTOMATIC CONNECTION because you have entered these profiles SSID NAME AND PASSWORD, BUT ONLY IF YOUR MAIN PREFERRED CONNECTION IS UNAVAILABLE (hone wifi). However, even if yours is not available and your Machine lists the ones you have connected to before then you still need to click on CONNECT AUTOMATICALLY to connect to them (if your going to use this connection frequently such as a Hotel) or click CONNECT (if its a one-off connection). Once you connect to these others and do not want to connect again then go to ‘MANAGE WIFI’ click on ‘FORGET THESE PROFILES’ and they will be removed from saved list (that is why the list of profiles you have NOT CONNECTED TO DO NOT APPEAR under this list (i.e. your neighbor wifi profiles, only the ones you have connected to). 

BUT WHAT ABOUT WHEN I AM NOT AT HOME AND MY MACHINE IS FLOODED WITH UNSECURED NETWORK PROFILES HARASSING MY MACHINE? 

Well for different OS there are different methods, but for WINDOWS 8 then do following steps (because I am responding VF who WAS using Windows 8):

1. Open the Control Panel.
2. Open “Network and Internet”.
3. Select “Intel ProSet/Wireless Tools”.
4. Select “Settings…” under “Intel Wifi HotSpot Assistant”.
5. Remove all check boxes.
6. Close out of the dialog box.

We have all been victims of Microsoft's incorrect geek terminology. 

Hope this helps. 

Many regards.

I too have this same problem...it happened within the last month..I've had a few updates. I can't find a way to get rid of this and I keep getting kicked off line many times a day...thanks