Security for 802.11 wireless networks.
35
votes
7answers
3k views
Is there any security threat with open WiFi connection?
For a few days, my mobile device has been able to catch WiFi signals that are within its radius. It's not asking for a password to use the service.
So, I'm using the WiFi service whenever I need to. ...
26
votes
9answers
4k views
Is visiting HTTPS websites on a public hotspot secure?
It's often said that HTTPS SSL/TLS connections are encrypted and said to be secure because the communication between the server and me is encrypted (also provides server authentication) so if someone ...
22
votes
15answers
3k views
How to block or detect user setting up their own personal wifi AP in our LAN?
Recently, I found a user plug a USB Wifi stick on his desktop, and set up an AP without password.
How can we detect or block this via firewall rules or other approach?
21
votes
6answers
5k views
Sharing wifi at a business - Bad Policy?
Is it safe for a small business to let customers use their wifi while waiting?
My friend is starting up a small dentistry practice (1 dentist), and I'm setting up his computers/wifi as a favor. ...
20
votes
9answers
1k views
How can I ensure that I connect to the right wireless Access Point?
Under Windows/Linux, client side. How can I ensure that I'm not connecting to a rogue AP?
Thank you!
18
votes
4answers
2k views
Are MAC Address Filtering and SSID Hiding still worthwhile?
On a recent certification exam, I was presented with a question about ways to secure an 802.11 wireless network. It was a multiple-answer question, but the only two available answers that related at ...
18
votes
6answers
821 views
How to secure a WiFi network?
What do I have to do to secure a WiFi network? Is there any best practices?
I have been recommended to use WPA2 encryption on the router, is that enough? What can I do to improve the security even ...
17
votes
2answers
1k views
Strength of WEP, WPA and WPA 2 PSK
I know there are three method for wifi security. What are the relative strengths of the password encryption in WEP, WPA and WPA2 PSK?
17
votes
1answer
755 views
WPA significantly less secure than WPA2?
I understand at least theoretically WPA2 is more secure than WPA, but in practice does it make any difference which one you use? From what I know there are no known attacks for either except for ...
16
votes
6answers
1k views
Why isn't open WiFi encrypted?
As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
15
votes
5answers
2k views
Security impact of using a public password for free WiFi
We have a WiFi network that we want to be public and free.
Does having a password that is known to everyone provide any additional security advantage to the people using this network as opposed to ...
14
votes
1answer
2k views
Why can you bypass restricted WiFis by adding “?.jpg” to the URL?
I recently read an article on Hacking a commercial airport WLAN. It's basically about circumventing paid airport WiFi redirections (they redirect you to a certain URL when you type something in the ...
14
votes
6answers
683 views
Safe to make a VPN connection over coffee shop WIFI?
On my work laptop I regularly create a VPN connection that I use to remote desktop to our web server. Is this safe to do on a coffee shop where random people are connected to the same wifi network?
12
votes
4answers
894 views
Threat assesment for a captive portal
I am interested in setting up a captive portal on a wireless network.
From what I understand I would do this by initially having all guests in a temporary vlan, moving them to the real vlan when ...
10
votes
9answers
6k views
Tracking down a rogue access point
Over the course of about a month we have received multiple reports of a rogue access point attempting to intercept traffic. I suspect an attacker is using a wifi pineapple, or similar hardware ...
10
votes
3answers
3k views
How does FaceNiff work?
FaceNiff is an Android app that sniffs Facebook session ids. You must be connected to the same WiFi as the victim. It is said to be working even when WPA2 is present. How is it possible? I can decrypt ...
10
votes
1answer
2k views
Is WPA2 WiFi protected against ARP poisoning and sniffing?
Is WPA2 WiFi protected against ARP poisoning? If not, can the ARP poisoner decrypt the packets?
10
votes
5answers
5k views
Is my computer at risk of being hacked when using public Wi-Fi?
I'm sitting at a cafe, using their public Wi-Fi. I don't go on sensitive sites; I basically go to a music site and listen to a live stream, for which there's no login. I don't check my email or visit ...
9
votes
4answers
275 views
How to use public WiFi safely?
The Dangers of Open Wi-Fi
How does one go about sending valuable information (for example inputting email username and password) over a free password-less public WiFi network?
The only option that I ...
9
votes
4answers
390 views
How should I tell an organisation that they are vulnerable when I wasn't given permission to check?
I was recently at a village hall (in the UK), some distance from where I live, for a party. I noticed that they had unsecured wi-fi with an SSID of NETGEAR. I assumed it was free wi-fi for users of ...
9
votes
2answers
341 views
Security of unencrypted wireless networks with authentication page
Some wireless networks, such as those offered by hotels and hotspots, are not encrypted (they don't require a pass phrase to connect) but have an authentication web page. For example, you connect to ...
9
votes
4answers
405 views
Wireless Activity Monitoring for PCI DSS Compliance
In an effort to be PCI DSS compliant, I took a trustkeeper.net questionnaire. I failed the question that asks
Is the presence of wireless access points tested for by using a wireless analyzer at ...
8
votes
5answers
1k views
Access to a router's GUI
During a recent visit to a coffee shop, I noticed that they hadn't bothered changing their default user name and password for their router.
I realise that someone could log on and be annoying to ...
8
votes
2answers
2k views
Can an attacker sniff Mac addresses on a wifi?
If an attacker turns on wifi but doesn't have the security key to connect to an access point in range, can he still sniff packets that travel between the access point and clients connected to the ...
8
votes
6answers
422 views
Doing a demo about open wireless networks exploiting with Firesheep
A collegue and I have been asked to do a demo where we show off stealing Facebook sessions with Firesheep. I've never used Firesheep before myself, but I reckon it should be a simple task.
I know the ...
8
votes
4answers
1k views
How can an access point spoof me into connecting?
I was reading through the answers of the question "How can I ensure that I connect to the right wireless Access Point?" and was wondering how it is possible for an access point to imitate another wifi ...
8
votes
4answers
2k views
Are WPA2 connections with a shared key secure?
This is something that has been bugging me for quite some time: when I have a wifi access point with WPA2 encryption and I give out the key, how secure are the connections? With WEP you could easily ...
8
votes
2answers
2k views
Can someone get my WPA2 password with honeypots?
Yesterday I went to my cousin's home and I saw that I'm not connected to his wireless (for internet access). Then I have looked up the list of wireless points. I have found his name and clicked it ...
8
votes
3answers
2k views
Do my Android apps use TLS or other encryption when connected to public Wifi? How can I tell?
I have an Android phone. When it's connected only to my carrier's 3G network I imagine it's reasonably secure against eavesdropping (although not invulnerable). However, at times due to lack of ...
8
votes
1answer
273 views
Can WiFi absorbing wallpaper absorb enough signal to provide a legitimate security benefit?
This French website reports that a wifi-absorbing wallpaper provides a security benefit. Is there any legitimate support for this, assuming that most rooms have windows, and signal can escape from ...
8
votes
2answers
333 views
How to implement secure device identification in a for-pay wifi router to prevent usage fraud?
After reading this question about how for-pay wifi routers identify specific devices it got me thinking about what a secure alternative might be. I know that certain research has focused on ...
7
votes
3answers
559 views
Why is WPA Enterprise more secure than WPA2?
In personal mode WPA2 is more secure than WPA. However, I have read that WPA Enterprise provides stronger security than WPA2 and I am unsure exactly how this is achieved.
7
votes
2answers
454 views
When are HTTP session cookies at risk over Wi-Fi?
If I'm using websites that do not use HTTPS, but I'm on a WEP-protected Wi-Fi network, are my cookies safe from being sniffed by third-parties?
Are cookies only at risk during login, or am I at risk ...
7
votes
2answers
736 views
What security risks do unauthorized mobile hotspot (MiFi) devices on company proprerty pose?
I'm having some difficulty determining how, or if, MiFi devices on property should be regulated. Personally, I see them as having little difference from any other rogue AP in the environment - the ...
7
votes
3answers
537 views
Why don't wifi managers remember mac addresses for hotspots to defeat the jasager attack?
So I just learned about the jasager attack, via the wifi pineapple and it struck me immediately that it wouldn't work at all if network managers (privately) associated MAC addresses with hotspots and ...
7
votes
2answers
8k views
In inSSIDer, what is the difference between WPA2-CCMP and RSNA-CCMP?
inSSIDer shows my wireless network as RSNA-CCMP. The settings on the wireless router (Linksys E2000) do not at all seem to suggest an "RSNA" security option. The security filtering options in ...
7
votes
2answers
463 views
Any advantage to securing WiFi with a PSK, other than to keep out unauthorized
As I understand WiFi with a PSK, such as WPA(2)-PSK or WEP, anyone on the same network can decrypt anyone elses packets because everybody has the same key.
In which case, if you are not going to ...
7
votes
3answers
469 views
Public wifi security protocols
I should apologise first- this post could seem a lot to ask for, but I am starting to go around in circles. I am interested in securing my laptop for when I use public wireless hotspots, as I am a ...
7
votes
1answer
1k views
Bypassing hidden SSID and MAC filtering “protection”
I was browsing over this question and had some follow up questions from a practical perspective.
What tools will show the SSID of an AP with the SSID set to hidden or broadcasting disabled? I have ...
7
votes
3answers
6k views
How to best set up public WiFi without giving access to the rest of my network?
For reference, this is just for my home network. Anyway, I have quite a few of my neighbors ask me to share my internet with them. I'd really like to eliminate this "here's the password" portion ...
6
votes
2answers
2k views
Dictionary Attack on Wifi
I know a few people with pretty weak passwords. What kind of systems exist to prevent dictionary attacks? Would it make sense to restrict the number of connection attempts in a certain timeframe?
...
6
votes
6answers
9k views
If someone hacks my wi-fi connnection, what can they see and how?
I have two questions on wifi security:
If someone knows my wifi password (be it WEP or WPA) what can they
see on my screen? Do they just see URLs I visit, or can they see
everything in my ...
6
votes
3answers
1k views
Is it possible to get all the data I send through wifi?
Is it possible, that the network administrator (wpa2 wifi network) can log all the data the users send and then get password out of it?
I know it is not possible to get the password if I'm surfing ...
6
votes
2answers
4k views
The new CCMP attack against WPA/WPA2 PSK
The use of Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP) for WPA/WPA2 PSK is being attacked. This is a trivial attack (offline brute force) against the initial ...
6
votes
1answer
143 views
Wireless auto-join on laptops
Maybe I have the wrong idea but this is a question that has been floating in my head for some time.
Whenever you use an iPhone (or a Mac, Apple products seem to be more prone to this because it ...
6
votes
2answers
2k views
Preventing deauthentication attacks
I am helpless against some kiddy with backtrack who repeatedly uses aireplay-ng to deauthenticate legitimate users on my Wifi work network.
I captured and analyzed the network traffic on my Wifi work ...
6
votes
2answers
467 views
Would an unnecessarily long password degrade performance of a WPA2 wireless network?
My friend wants to keep his home network super-secure, due to some trouble that he's had with unwelcome Wi-Fi intruders. So, naturally, he devised an ultra-long WPA2 passphrase (on the order of 100+ ...
6
votes
2answers
301 views
What risks does WPA carry?
A family member of mine would like to be able to play old PSP games online. Unfortunately the device does not support WPA2, and my network is strictly WPA2 AES secured. What are the risks involved in ...
6
votes
6answers
528 views
Can my WIFI Home router be brought down to cause me to connect to a fake AP?
I am wondering if this scenario may happen - described from the users point of view: Being connected to my home router, the connection suddenly breaks. So I go to the wireless network adapters drop ...
6
votes
2answers
635 views
The Dangers of Open Wi-Fi
I know that the first response to a question titled like so is "seriously?". I know the answers exists, but I am just trying to put everything together.
Using and/or having an open Wi-Fi network is ...
