Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If a WiFi pineapple does a karma attack and a client connects to it, would you get the password (for the original WiFi) or would the client just connect to you? Is there anyway to stop it?

share|improve this question

The client just connects to you. The Pineapple simulates an open wifi network, it can't simulate a password protected network. To get the password the Pineapple would require information to complete the handshake which is unknown to the device.

share|improve this answer

Karma primarily works against "Open" wireless networks (things like hotspots) where there is no encryption or authentication at the wireless networks. Encrypted wireless networks have handshakes that prevent basic MITM attacks, unless the attacker already knows the shared key.

In terms of stopping the attack, really the only foolproof way to do that is don't connect to any open networks, only connect to encrypted wireless networks. If that's not an option, ensure that the first thing you do after connecting to the network is establish a VPN tunnel to a system that you trust and then send all traffic over that connection. The attacker can try to MITM the VPN connection but once you've connected to that you should be relatively ok.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.