Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I use WPA2 encryption. But I know even that can be cracked with the aircrack suite. And a lot of users may not use strong passwords. I've read that while cracking WIFI keys the only noticeable difference is the rate of traffic. So is there a way to detect whether my network is under attack from such tools ?

P.S: A solution without the use of IDS will be appreciated. Also, are most IDS' able to detect these attacks ?

share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

Yes, if they are trying to break into your network in a particularly obvious way, but no for the general method of attacking WPA2 with a weak pre-shared key.

If they are trying to brute force into your network by repeated attempted logins (e.g., exploit the flaws of WPS - Wifi "Protected" Setup ), you can listen in on the network traffic, you would see the large fraction of unsuccessful login attempts. (Or even easier your wireless AP logs failed wifi login attempts).

This would require setting up wireshark on a computer that has a wifi card that can listen in promiscuous mode to the traffic. I've heard that this cannot be done in windows (not a windows user so I am not sure of this), so you may have to use linux or a Mac.

Granted most attacks on WPA2 do not work like this (excluding those on WPS). Most attacks work by observing someone else's successful WPA2 handshake (listening in promiscuous mode) to a given access point (knowing the BSSID). Then locally run take that handshake through a password cracking program until they find a match. This cracking is done entirely by eavesdropping and offline cracking, so would not be detectable.

However, these attacks are computationally expensive and will only work in practice against weak passwords or slightly stronger passwords with a common SSID (like NETGEAR / linksys / default / dlink / wireless / Home) where someone may have precomputed a rainbow table to speed up the attack (so its best to change your SSID to something unique). So if you have a passphrase that is high entropy (not likely to be in any dictionary attack), these offline attacks against your network will be unsuccessful.

share|improve this answer
    
"Weak" is really relative. While I typically use pretty long passphrases, when we start talking about wireless there is a very strong tendency toward "weak" passphrases just because of how we use them. If you are just going to use it with laptops and workstations, no problem. If, however, you plan to join your phone to it, your wife, kids and guests will hate you when you tell them the password/phrase is j(I@l*$l"!ajjJiJWDOWAJ8(%. For this reason, even in business, we tend to do a bad job. The real "right" solution to this is WPA2 with EAPOL/802.1X and certificates. –  David Hoelzer Jul 14 '13 at 2:10
    
@DavidHoelzer. Yup, a preshared password is weird. My passphrase for an private key/cert or encrypted file? 80+ bit high entropy random passphrase. My WPA2 password? Meaningful short (~8 words) English sentence based on an inside joke containing rare/fake words (like 'fisticuff' or 'nanopenis'), not based on a quote (complex enough that I'm comfortable; easy enough my wife will use it). This is easier than maintaining an authentication server when I just don't want neighbors on my home network (not concerned about eavesdropping unencrypted traffic) as HTTPS should be used for secrets. –  dr jimbob Jul 14 '13 at 2:41
    
The bigger threat is that my passphrase is not secret. Devices will store WiFi passwords in clear-text, or at least reversible encryption; anyone get access to your computer for a few seconds can extract the passphrase. Furthermore, some devices (android phones, chrome OS for example) will by default sync these wifi passwords to the cloud for you. So if you share your wifi password with anyone who uses one of these devices, its likely they have those share settings on their phone, so your password isn't really secret anymore. Granted setup is easier (as it syncs to all devices). –  dr jimbob Jul 14 '13 at 2:43
add comment

Unfortunately, if someone is attacking your key it can all be done very passively. As an attacker all that I need to observe is the five way handshake used to perform the initial authentication when joining the network, thereby obtaining the current group key. Here's a video that discusses/demonstrates: http://www.youtube.com/watch?v=u-dqi23oaS8&feature=c4-overview&playnext=1&list=TLrF5jHoe-gO8

If I'm patient I can just sit with my sniffer waiting for you to reboot a computer or wait for a computer to join. At that point I really have everything necessary to break the key.

If I'm less patient I can speed this process up. At the same time, however, I am making myself more visible. If I begin to fire deauthentication packets at hosts then they will temporarily lose connectivity. When they automatically reconnect I once again can obtain the handshake. However, this does allow you to have an indicator that someone is at a minimum messing with you or possibly even trying to break your key; several disconnects despite no change in signal strength.

Ultimately, breaking the key is all done offline. This means that there are very few indications. If after breaking the key the attacker is passive, simply gathering data, there is no way to detect him since he is not radiating any RF.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.