Kaspersky GReAT recorded 84,588 signals with 69,473 unique Service Set Identifiers (SSIDs) in busy locations and World Cup zones across Mexico City, Guadalajara and Monterrey.
Scope and method: wardriving across three host cities
The research team from Kaspersky GReAT conducted passive wireless reconnaissance in areas around the 2026 FIFA World Cup stadiums, airports and high‑traffic tourist zones. The assessment focused on Mexico City (including the stadium, airport, Zócalo, Paseo de la Reforma, Colonia Roma, La Condesa, Polanco and Coyoacán), Guadalajara (stadium, airport, city center, Zapopan, Providencia, Avenida Chapultepec, Colonia Americana, Tlaquepaque and Andares) and Monterrey (stadium, airport, Fundidora Park, Cintermex, downtown, Barrio Antiguo, MacroPlaza and the San Pedro financial district). The team used passive observation only and filtered out networks categorized as mobile hotspots (cars or cell phones) so results reflect stationary access points and deployments.
SSID naming: defaults, personal identifiers and BSSID-derived names
SSID analysis showed wide reuse of default naming conventions: roughly 34% of detected networks retained manufacturer- or ISP-provided default SSIDs, while 66% used customized identifiers. Invisible SSIDs were almost non‑existent (0.0047%). The assessment identified sequential naming patterns (137 sequential SSIDs in total, represented by 33 unique sequential structures, about 0.16% of networks) and numerous customized SSIDs that contained family names, professions, addresses or internal department references. More than 30% of networks in all three cities reused the physical MAC address (BSSID) as the visible SSID, exposing hardware OUI information that can be used for vendor fingerprinting.
Vendor and ISP concentration: homogenous platforms and recognizable providers
The analysis found a strong concentration of equipment from a limited set of manufacturers, with Huawei Technologies and MediaTek-based devices among the most commonly observed platforms. Mexico City’s infrastructure was the most diverse; Monterrey and Guadalajara showed a higher concentration of SOHO or residential-grade hardware. ISP-associated deployments were evident in recurring SSIDs such as “Infinitum,” “Totalplay” and “Izzi,” and those provider-related identifiers combined with consumer hardware manufacturers suggested standardized, large-scale ISP deployments. A significant portion of networks still fell into an “UNKNOWN/CUSTOM” category when SSID and manufacturer data did not expose an identifiable ISP pattern.
Security posture: WPA2 dominance, persistent open networks and widespread WPS
Encryption adoption skewed toward modern standards: WPA2 was the dominant authentication mechanism (Mexico City 81.19%, Monterrey 79.19%, Guadalajara 77.59%). Despite that, insecure open networks remained materially present — the report summarizes the situation as “every 6th open access point (17%)”: 16.5% in Mexico City, 18.5% in Guadalajara, and 17.2% in Monterrey. Grouping networks into Secure (WPA2/WPA3), Insecure (Open/WEP), Weak (WPA) and Unknown produced an overall “secure” proportion of roughly 82% of access points, while insecure open deployments ranged between 10% and 12% in aggregate; Guadalajara had the highest open proportion at 12.46% and Mexico City the highest secure proportion at 83.54%.
Wi‑Fi Protected Setup (WPS) exposure was substantial: 45% of all detected access points advertised WPS capabilities. City breakdowns were Mexico City 46.61%, Guadalajara 43.45% and Monterrey 40.93%. Crucially, many networks classified as secure by encryption still exposed WPS: among WPA2/WPA3 deployments roughly half had WPS enabled (Mexico City 53.7%, Guadalajara 50.9%, Monterrey 47.5%). The report emphasizes that encryption strength alone does not eliminate attack surfaces when WPS and other legacy features remain enabled.
Spectrum, signal quality and congestion in dense urban zones
The wireless landscape was heavily concentrated in the 2.4 GHz band: more than 95% of detected networks operated in 2.4 GHz. Channel allocation clustered on the traditional non‑overlapping channels 11, 6 and 1 (25.2%, 22.5% and 19.5% of access points respectively). Channel 11 was the single most utilized channel and in Mexico City accounted for more than 25% of detected deployments, including the majority of VERY_HIGH congestion classifications. Mexico City showed the highest proportion of heavily congested channels (~7%), Guadalajara nearly 5%, and Monterrey about 3.29% in the HIGH congestion category. Signal quality analysis found many weak or very weak signals — Monterrey had the highest percentage of very weak signals at approximately 50% — though beacon stability was high: over 96% of access points were classified as stable, consistent with permanent deployments rather than transients.
What this means for technologists, policymakers, and travelers
- Technologists and security teams: the report’s recommendations focus on disabling WPS, removing default SSID conventions (including BSSID‑derived names), promoting WPA3 migration and optimizing channel allocation with more use of 5 GHz to reduce 2.4 GHz congestion.
- Policymakers and procurement leaders: the assessment points to infrastructure homogeneity (recurring ISP templates and a small set of vendors) and recommends encouraging migration to WPA3-capable hardware and strategies to reduce spectrum saturation in urban venues.
- Travelers and event organizers: the report highlights persistent open networks, the risk of rogue “evil twin” hotspots, and additional public‑environment hazards such as malicious QR codes, public USB charging systems and shared kiosks; it recommends traffic encryption, cautious browsing behavior and use of security solutions.
In sum, Kaspersky GReAT’s wardriving across Mexico City, Guadalajara and Monterrey documents a wireless environment that pairs broad adoption of WPA2/WPA3 with enduring operational exposures: default naming, BSSID leakage, WPS prevalence, channel crowding and pockets of open access. The combination of predictable deployment templates and public identifiers, the report argues, materially eases passive reconnaissance and opportunistic targeting — a set of conditions the authors urge to be addressed as part of World Cup‑era preparations.
https://securelist.com/wardriving-assessment-in-mexico-fifa-world-cup-2026/119996/
