I gave my WiFi password to a guest. I'm wondering how can he exploit this opportunity? Like, can he access my other devices localhost servers? Can he brute force to get the password of the router to change its settings, etc?
UPDATE: The device that is usually connected to the Router is my Ubuntu 14.04 desktop.
Giving the WiFi password away effectively gives full access to the local network. From there the guest might access the other computers inside the same network unless they have an additional protection. The guest can also try to brute force the router password, can mount man in the middle attacks with ARP or DHCP spoofing ....
Because of this better routers offer a separate guest WiFi with its own password and with a restricted environment where the user can only access the internet but not the internal network.
Although it is not one of the things you listed in your question, he can engage in illegal activity over the internet which, when investigated by the authorities will render your IP as the source. Which, depending on the country you live in, may land in you in a lot of trouble.
He/she could go to very bad websites, like child pornography or bestiality sites, he could make terrorism threats in the name of ISIS or threaten the president. They could also use your Wi-Fi to hack into the Pentagon or whatever! The point is that whatever they do, it is going through YOUR account. And you won't even know that it happened until the police or SWAT or department of homeland security comes to break down your front door and arrest you.
Those are much more likely scenarios than someone hacking your computer and are what you should be more worried about.
The bottom line is that you need to be in complete control of who uses your network at all times. And unless you really know then and trust them, be smart and be careful.
He can do anything you can do from on your network, which includes everything you mentioned, including finding holes in the IoT devices on your network.
Luckily, it's fairly difficult for him to use that position to start recording all the packets and saving them off (unless he hacks a router and can change the behavior of its switch or something).
Additionally to the other answers: Some security systems use your (external) IP-address. In case of a the router doing a NAT to the same IP(v4)-address (which is the common way), he can circumvent some security meassurements like POP_before_SMTP .
From my practical experience: Person A came to Person B. B gave A his wifi-password. A wanted to change something on his ISP-account (both had the same ISP) but he was logged in automatically by the ISP as B (authentification by IP-address) and A would have accidentally changed the account of B if he didn't see that the website showed the wrong name.
That's a big question and it's all about risk assessment. If you live in an urban area and don't trust the person you gave the password to, risk is high. If you think the person my want to use your network for nefarious reasons, you need to change your password. If the guest shares that password with anyone else, you are open to the motives of anyone who has that password and is in proximity to your network.
That being said, the wifi/router is only one layer of security that should be used within your home network. If it's the only wall you have to keep others out, then you need to change your password and think about using other security layers as well. The wifi/router is a relatively weak link in the security layers and usually only keeps honest people honest.
One issue of concern is others using your network for doing bad stuff. If guest was motivated to hack into the local school district to change their grades, your network would be an easy avenue to do this. When the hack is found out, your IP would be the first in line for the investigation. You run the risk of having your computer equipment seized by authorities until the investigation is completed. In more severe cases, your gear could be held as evidence and this would be a real inconvenience to anyone. So it's important to protect your local networks.
Giving your wifi password can compromise your security. Someone could sniff the network traffic on your network ounce they gained access to the encryption keys. If you are not using encryption on your online activity you are open to be sniffed up by a packet sniffer application such as wireshark. Depending on your router's security settings and what router you are using you can do exploits to login into the router's ip address via web browser to change settings or put worms on routers through some hacking processes. https://www.grahamcluley.com/2014/02/moon-router-worm/ Theoretically, you could put a virus on a router that could steal peoples data and to work as some kind of surveillance worm or some kind of fishing malware that won't be picked up by a conventional antivirus scanner.
Your exact risks vary.
As another security-related story, unrelated to Wi-Fi (but I'll tie this all in momentarily), when Comcast started providing cable-based Internet in the late mid 1990s, there were reports of people signing up for the service at home, and then having Windows detect printers from other people's houses. So if they went to Microsoft Word and printed out a document, they may need to be careful about which printer they print to, or else a nice neighbor might call them up and say, "If you're looking for that document, I know right where it is!" (Similarly, people with printers could get strange documents being printed.)
Now, I haven't heard of such reports lately, so I'm assuming that got very fixed a long time ago. There are two potential ways for that to be fixed. One is changes made by Comcast (most likely). The other possible way would be changes by Microsoft. I believe these reports came in before 1998, and affected Windows 95 users. Changes in Windows 98, ME XP, Vista, 7, 8, 8.10, and 10 make it far less likely that such changes affect people today.
Now, with that background story, to answer your question: your exact risks will likely vary based on details of your network. If you run a home-based network where every device uses Windows 7, and never added security to anything, and opened up file sharing without a password required, but you have Windows Firewall turned on to provide the maximum protection that it can, then you're likely to have different risks than if you run a network where every computer is running a version of Windows Server 2003, with services hardened so that file sharing is completely disabled, but the Windows Firewall is disabled. And if you actually have a mixture of different types of computers, you're likely to have a different range of risks.
Operating systems and other types of software programs are computer code, and differences in that code (such as different operating systems, or different versions of the operating systems) can be one way that risks can be different. Other details can be things like whether you are running certain types of services, such as a network-based SQL (database) server. Other details are what kinds of sensitive information you have, and how that information is stored. (For example, as a college instructor, I didn't tend to have other people's credit card number or social security numbers on my computer, but I did have the first names of some students on a computer I used. Information about my taxes were stored on another computer, using password-protected file transfer methods that I used with less frequency.
Without knowing more details about your entire network, a full list of vulnerabilities/risks cannot be provided. In a nutshell, the risks are that a person can appear to be on a local network that is under your control. That can lead to other potential vulnerabilities, some of which are described by some of the other answers in this thread. A lot of network defenses are designed to protect against people who are not on the local network, and those defenses may be less effective, while other defenses may be unaffected. As a summary, I can say that quite a few of the precise risks will depend on details that typically vary between different individual computer networks.
First, go to your router settings and change its default password to something secret. Your guest knows the default password of your router and can take control of your network that way.
Second, change your wireless network password. Your guest can use a packet sniffer to find out the mac address of other users connected to the same wifi network. Once he finds the MAC address he could mask his own MAC address and gain access to the wifi network that way.
Third, make your SSID invisible as it will hide your wifi from others and allows only the users who know your network exists to find and connect to it. Try some firewalls to protect your wifi connection. Block all unwanted MAC addresses connected to your network under Wireless Security or MAC address filtering. This will prevent any device that you do not approve from connecting to the network.
Don't share your passwords with strangers!
