While training to earn my OSCP certification, I was taught how to breach a WiFi network by taking advantage of several potential vulnerabilities (because the best way to defend against these attacks is to fully understand how they actually work). The first thing I wanted to do was discover how common these vulnerabilities actually were in the real world. I mean if they're so commonly known about, wouldn't router manufacturers just fix them? To my surprise, they're shockingly common.
How common is "shockingly"?
From the basic checking I've done around the St. George and Hurricane area, I'd say about 25% of the networks I looked at have vulnerabilities that would allow access in under 10 seconds (I can't say for 100% sure because that would be immoral and illegal to actually compromise them without permission from the owner), 25% are using passwords weak enough to be cracked by modern methods in under 10 minutes (from my experience in troubleshooting WiFi networks and noticing the passwords used by clients, family, and friends), and around 25% are using default passwords from certain manufacturers that utilize known processes in creating them (for example, all Netgear routers use a password made up of a noun and adjective with 3 random numbers at the end that can be cracked in under 1 hour, and a lot of TPLink routers utilize an 8 digit number that can be cracked in seconds). That leaves a mere 25% of networks that are properly secured, and I'd wager maybe .1% of those are aware of social engineering attacks that are capable of tricking them into simply giving their password away.
Under 10 seconds??
Virtually all commonly used range extenders and many Netgear and Linksys routers make up that first 25%. They're vulnerable to an attack that compromises a weakness in WPS that enables somebody to discover your password in seconds if the default settings are used. People trust the manufacturers to know the best settings for their network devices, so they leave them alone, and in doing so, they're opening up their personal data and home network up to anyone who wants access.
Easy fixes
The good news is that you don't need to replace any of your expensive network equipment if you want to be secure, you just need to make sure they're setup correctly. All of the compromises I've talked about can be fixed with some changes to their settings and a little education.
Not just for businesses anymore
A common job for my business customers is to be hired for something called "pen testing" or "penetration testing". They basically hire you to try and break into their network so they can find out about any vulnerabilities before any potential bad actors do. We now offer a version of this for people's homes. There's really no way of knowing whether you're secure or not until someone actually tests your setup, and for only $99 we'll test your network devices, discover their vulnerabilities, and most importantly, fix those vulnerabilities.