Security for 802.11 wireless networks.

learn more… | top users | synonyms

6
votes
2answers
4k views

Wireless hardware with limited range?

I have never used wireless networking at home, but am considering it. Does anyone make wireless hardware designed for single-room connectivity? Several sources have recommended WPA2, but I'd still ...
6
votes
2answers
3k views

Is it safe to log into my bank website over a public wifi?

Is it safe to log into my bank website over a public wifi (like a coffee shop)? I apologize if this is a really dumb question. I realize that the connection between the browser and bank servers ...
6
votes
2answers
9k views

The new CCMP attack against WPA/WPA2 PSK

The use of Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP) for WPA/WPA2 PSK is being attacked. This is a trivial attack (offline brute force) against the initial ...
6
votes
2answers
159 views

Protection of eduroam credentials

Recently my educational institution officially switched over from the their own wireless network to eduroam. If I understand correctly from the FAQ, credential authentication is performed on the ...
6
votes
2answers
15k views

Detecting the presence of wifi devices

Is it possible, with a normal wifi adapter, to detect present wifi devices in the surrounding? Let's say, is it possible to detect an Iphone with wifi switched on in the range of my wifi adapter? ...
6
votes
3answers
4k views

How do WPA/WPA2 cracking programs know when the PMK/PTK is correct?

I'm doing some pen-testing on my home wlan with aircrack-ng and it got me wondering how programs like these(eg. aircrack-ng, cowPatty, pyrit etc) really work. Specially, when performing a ...
6
votes
1answer
193 views

Wireless auto-join on laptops

Maybe I have the wrong idea but this is a question that has been floating in my head for some time. Whenever you use an iPhone (or a Mac, Apple products seem to be more prone to this because it ...
6
votes
4answers
12k views

Wifi penetration testing: Why aireplay-ng de-authentication does not work?

I am trying to pentest the security of the password of my wireless network. It is a WPA2 with pre-shared-keys. My current computer is connected to the wifi router and I try to de-auth my own machine. ...
6
votes
2answers
2k views

Does WPA2 Enterprise mitigate evil twin attacks?

One of the dangers of using WPA2-PSK is the possibility that an attacker may setup another wireless network with the same SSID and even use the same access point MAC address via MAC spoofing. The ...
6
votes
2answers
760 views

What risks does WPA carry?

A family member of mine would like to be able to play old PSP games online. Unfortunately the device does not support WPA2, and my network is strictly WPA2 AES secured. What are the risks involved in ...
6
votes
2answers
350 views

Can network admin detect port scan on a certain host?

Say, my laptop is connected to a large WiFi network with many other users. If a port scan is run on my IP by somebody else on the same WiFi network, is it possible for the network admin (or anybody) ...
6
votes
3answers
197 views

Getting automatically logged in to others session via Wi-Fi

Recently, I experienced a very strange behaviour on our Wi-Fi network: we share a Wi-Fi network using a simple router. One of us pays the bills and he's the one, who got the management account from ...
6
votes
3answers
882 views

wlan security - why is it not possible to protect against deauthentication flooding

Wireless security (Wikipedia) describes security issues due to the fact that wi-fi deauthentication packets are unencrypted: Weak PSK passphrases can be broken using off-line dictionary attacks by ...
6
votes
2answers
595 views

Discovering IP or Mac address of mobile devices passing by.

Is it possible for someone to discover the IP and/or MAC address of my mobile device, even if I do not attempt to connect to their network?
6
votes
2answers
325 views

How to Man-in-the-middle a whole network?

When performing a MiTM attack, you generally need to specify the router's IP address and the "victim" IP address. I'm trying to demonstrate to a business owner why he needs to secure his network, but ...
6
votes
2answers
5k views

How effective is the iOS “Send All Traffic to VPN” setting at deterring Wifi-based attacks?

iOS version 5 and newer has a setting for VPNs to "Send All Traffic" over that VPN. I think that sending all data to a trusted VPN target would ensure privacy of all communication sent over that WiFi ...
6
votes
1answer
11k views

Bypassing a captive portal with tor

I know that NSXTS and Iodine can be used to bypass a captive portal by taking advantage of permissive DNS firewall rules. What I have found recently is that simply by using Tor, I can also bypass a ...
6
votes
1answer
155 views

How does WifiKill work?

How is possible for Wifi Kill to block someone from using Wi-Fi, even if you don't have access to the router settings and you even don't use MITM (I think)?
5
votes
7answers
2k views

What security risks exist in cell phone apps' data transfer?

Smartphones apps transfer various types of data over the provider's data network (or wifi, if enabled). What security risks are there in this transfer, and how can the risks be mitigated? I'm not ...
5
votes
4answers
7k views

Does setting a WiFi AP to channel 14 avoid the most common detection methods used in Europe or the Americas?

The legally allowable band for WiFI in the US covers channels 1-11. Europe goes to 13, Japan to 14. I suspect that most tools use the WiFi driver of the machine and only scan for the channels it is ...
5
votes
1answer
2k views

How are shopkeepers getting the MAC address of wifi enabled smartphones?

It is clear that some big malls are tracking all the wifi-enabled mobile phones before they are connected to the network... How can this be done? I have a similar issue... how to get the MAC address ...
5
votes
3answers
4k views

How to detect whether my network's key is being attempted to be cracked?

I use WPA2 encryption. But I know even that can be cracked with the aircrack suite. And a lot of users may not use strong passwords. I've read that while cracking WIFI keys the only noticeable ...
5
votes
2answers
1k views

Does a TMSI change often enough to prevent tracking?

A company called Path Intelligence has a product called Footpath which uses the TMSI, WiFi MAC address, and bluetooth MAC address to track phones as they move through stores. However, I don't see ...
5
votes
2answers
621 views

intrusion detection on own hotspot?

Is it possible to detect failed logins on the hotspots you create with your windows/linux laptops? So you can detect some dumb brute force/guessing attempts? For example, a log like this: TIME DATA - ...
5
votes
2answers
3k views

How is user authentication sent in a public wifi? Radius/802.1x/EAP etc

I visit the airport, I pull out my laptop and connect to a network (no password needed). I open up my browser and i am presented with a screen saying I need to pay to use the network. If I pay, I ...
5
votes
2answers
2k views

How eavesdropping will be performed how can I prevent from eavesdropping

I believe that eavesdropping in a man in middle attack and the message is passing from the client to server the man sitting at ISP or network hackers can look at what message I am sending. Heard that ...
5
votes
3answers
2k views

Two SSIDs on same Access point- not good?

If I were to offer two networks (one for trusted users and one to visitors) on one physical access point, is this dangerous because a visitor could compromise the trusted network across via the ...
5
votes
1answer
8k views

Is brute-forcing the only way to crack WPA?

I don't know much about how WPA algorithms work internally. Is brute-forcing an AP the only way to crack WPA? (or to get associated with AP) Another question is about Reaver-WPS, what if an access ...
5
votes
2answers
2k views

Wifi pineapple “Karma”

If a WiFi pineapple does a karma attack and a client connects to it, would you get the password (for the original WiFi) or would the client just connect to you? Is there anyway to stop it?
5
votes
1answer
2k views

Hotspot with same SSID, how does authorization work?

My university has a wireless network I log into with my username and password. It's using PEAP. My phone and laptop automatically connect to this SSID when they detect the network. If someone sets up ...
5
votes
1answer
1k views

Stealing WiFi Internet connection

I received a mail about illegally sharing copyright-protected material on the Internet; I never did it. I checked my router's configuration and noticed that the MAC address of one of the connected ...
5
votes
2answers
9k views

Estimated cost to make a brute-force WPA2 attack feasible

It's been shown that a brute-force attack on WPA2-Personal is possible in a reasonable amount of time. These successful attacks appear to be limited, however, to researchers who have the budget to ...
5
votes
2answers
2k views

What is the best way to protect a captive portal againt MAC spoofing

What is the best way to protect a captive portal againt MAC spoofing? The MAC Address appears one of the only ways to distinguish wireless clients from one another, anything one authenticated client ...
5
votes
4answers
3k views

MDK3 warns about WPA2 downgrade - how do I find the key in Wireshark?

While stress testing my router using MDK3, I got the message "REALLY BIG WARNING!!! Seems like a client connected to your target AP leaks PLAINTEXT data while authenticating!!" I viewed the tool ...
5
votes
2answers
1k views

WiFi security using IEEE 802.1X - how secure is it?

My company's set-up involves a single AP (TPlink) that is configured to authenticate clients using RADIUS. All works well, but: on a regular WPA/WPA2 network, once you have the PSK, you are able to ...
5
votes
3answers
1k views

What does WEP access point show during aircrack-ng attack?

I bought an old, used WRT-54G () which strangely enough, was running DD-WRT v24-sp2. Weird what turns up at yard sales. I want to try the "aircrack-ng" WEP cracking procedure on it. The criteria ...
5
votes
2answers
956 views

How to detect infected machines on my wifi?

I currently live in a building with around 40-50 other tenants (mostly students) and we all share one connection to the Internet using one of 3 wifi routers that are spread throughout the building. ...
5
votes
1answer
961 views

Can I isolate a specific computer on my network?

My brother gets malware infections practically every week. Apparently he had a infection over the past 24 hours, I only noticed it because I checked the router logs and saw a massive amount of network ...
5
votes
1answer
698 views

Measuring SNR to detect jammers in Wi-Fi networks

I'm trying to figure out a way to detect a Wi-Fi 2.4 GHz signal Jammer. I am not looking into locating the location of the jammer but rather detect the jamming signal. How do i do so using only ...
5
votes
1answer
580 views

What is this hotspot doing to my traffic?

I'm currently staying at a Four Seasons resort using their Wifi. I noticed that while surfing all non-https sites, my webpage seems to be forced into a frame. For example, here is what google's ...
5
votes
1answer
2k views

ARP-poisoning on wireless network - no packets

I've started working with ettercap and ARP-poisoning; however, I've sumbled upon some problems. I've executed the following command: ettercap -i wlan0 -w log -T -M arp:remote /192.168.1.254/ ...
5
votes
2answers
167 views

Does a WPA2-PSK authentication only succeed if both parties know the pre-shared key?

Normally people think of WiFi authentication as the client proving to the AP that it knows the pre-shared key. But does the AP also prove to the client that it knows the pre-shared key? Is it ...
5
votes
1answer
4k views

What makes PINless Wi-Fi Direct using WPS on Android secure?

I've read from Wikipedia that Wi-Fi direct uses WPS (Wifi Protected Setup), and I know that in Android (at least what I have which is 4.0.1 on Galaxy S3) uses the WPS method of the "push button" to ...
5
votes
2answers
254 views

Why doesn't the 802.11 standard implement TLS for wireless handshakes between clients and routers?

Why aren't wireless handshakes sent using TLS? It seems like it would be relatively simple to implement, perhaps having the vendor insert the private key into the routers. That way WPA/WPA2/WEP ...
5
votes
3answers
554 views

Why does switching to “n-only” help preventing attacks on WPS?

I just cracked the ap of a friend of mine (Linksys E4200) and we were looking for a way to rid him of the vulnerabilty. Unfortunately the E4200 does not disable WPS when you tell it to (via web gui). ...
4
votes
5answers
4k views

Is MAC address filtering effective on a wifi router? [closed]

I want to improve the security of my home wifi. My neighbor wants to crack my Wi-Fi password with a nutcracker. I tried to activate the protection by MAC address, but now my laptop and smartphone ...
4
votes
5answers
6k views

Does using WPA2-Enterprise just change the attack model vs WPA2-PSK?

As far as I can tell based on the reading I've done so far, WPA2-Enterprise uses the same encryption and security algorithms and methods as WPA2-PSK, with the addition of using another service for ...
4
votes
3answers
8k views

How does WEP wireless security work?

I want to know more about how WEP (Wired Equivalent Privacy) protocol for wireless security. From this Wikipedia article I have got a basic Idea. But what is the initialize vector? Is some kind of ...
4
votes
4answers
727 views

What particular concerns should one bear in mind when wardriving?

I'm considering starting a neighborhood-wide wardrive, with the objective of raising awareness to the risks of running unsecured wireless networks. Right now, I'm still in the planning stages of this ...
4
votes
2answers
870 views

How to know if I'm under a MITM attack

If I am connected in a public WiFi, is there any way to know whether I am under attack or not while browsing sites using SSL? For example, if I visit facebook.com and the URL starts with "https://", ...