Questions tagged [wireless]
Wireless security topics including 802.11, Bluetooth, and others.
469
questions
1
vote
0
answers
207
views
Is the keystream recovered by tkiptun-ng the same key used to encrypt all data frames between the client and the AP?
Looking at the manual for tkiptun-ng,(http://www.aircrack-ng.org/doku.php?id=tkiptun-ng) The output saves the keystream in the example near the end of the program. Is this the same keystream used to ...
0
votes
1
answer
589
views
Which key is actually used for encrypting data traffic in WPA after the 4WHS?
Some sites say that the PTK is used for encrypting the data between the client and the WAP while others say that the PMK is used instead. Which one is true?
From what I understand, this can have very ...
6
votes
3
answers
4k
views
How to setup a Virtual Wireless Router?
I need to teach some students about cracking WEP and WPA passwords, as I don't have a real wireless router to use, is there any VM that I could use to simulate a wireless network? Like a Virtual ...
0
votes
1
answer
2k
views
What are the roles of PSK and GTK in a WPA setting?
I understand that PTK is ultimately the key that is used to encrypt traffic between a device and the WAP after the 4WHS and that the PMK is directly related to the 'passphrase' of the wireless network....
6
votes
1
answer
13k
views
What's the difference between pixie attack and other attacks on WPS?
I have been studying about the brute-force attack on the WPS PIN, and I understand that because the last digit is the check digit, and that the PIN is divided into two halves in M4 and M6 messages, ...
1
vote
2
answers
2k
views
Why are cryptographic algorithms implemented in the data-link layer in wireless networks?
Could someone please tell me why cryptographic algorithms are placed in the data-link layer for wireless networks?
0
votes
1
answer
2k
views
Fear of mac Spoofing. Two Mac addresses appearing on Router page with only 1 digit variation
I have tried looking into Info Sec's posts for a related issue but couldn't find a solution as my problem is a bit specific.
I have been having connectivity issues, and as paranoid as I can get, i ...
1
vote
2
answers
1k
views
Is there any way to send malicious keystrokes to wireless keyboard USB dongle?
I have read many blogs on how to intercept wireless keyboard keystrokes. Similarly is there any way where we can send keystrokes to any keyboards USB receiver module? can we kick out the existing ...
5
votes
6
answers
5k
views
Can one steal data using electric wire?
If I would like to keep my work secret in my computer and I don't use Internet, is it possible for a cracker to steal my data via electric wires or a wireless connection?
0
votes
2
answers
142
views
When I receive data in this scenario, how many times is it encrypted?
Right now I'm using a Web browser under the following circumstances:
I am making this post over HTTPS
I am connected to a password-protected Wi-Fi network with WPA/WPA2, EAP-PEAP, and MSCHAPV2 ...
10
votes
3
answers
4k
views
How safe is a standard wireless keyboard from a MITM attack?
And are there any mitigations except using a wired keyboard?
2
votes
1
answer
4k
views
What does SSI signal does mean in captured packets in wireshark?
In the packet captured below, captured by wireshark
does the SSI Signal in dBm represents the power at which the sniffing network adapter (say USB network adapter wlan1 on Raspberry Pi3) received ...
2
votes
1
answer
345
views
Deauth as a protection
In the case that there is an ongoing attack in my network, where the attacker is using WLAN to access my network and I recognize it, would it be possible to send a broadcast deauth in my network to ...
3
votes
1
answer
6k
views
How to prevent WiFi jammer attack? [duplicate]
How can I prevent a WiFi jammer attack on my wireless network?
For example if I send a deauth (deauthentication) packet with aircrack-ng on Kali Linux for a specific client, he/she can't use WiFi.
...
2
votes
1
answer
5k
views
Security of Wi-Fi vs Bluetooth
I am preparing a project for a client. It is a wireless device to be used inside a factory so the workers can interact with the factory without having to go to a terminal. In order to connect the ...
1
vote
1
answer
1k
views
Capture Handshake with WPS disabled
I just got into exploring network cracking. Honestly, just to learn how the process works.
I am not curious about cracking the handshake as much as capturing it.
It seems when I set up a test ...
3
votes
1
answer
1k
views
Why do public wifi networks often have a click screen to join? [closed]
At many if not most coffeeshops and other public Wi-Fi locations, even though Wi-Fi is free and not password protected, there are click screens with "join" buttons that need to be tapped to access the ...
0
votes
1
answer
3k
views
WPS Why Can't Pin be Bruteforced Offline
I don't totally understand how the WPS protocol works but why cannot a user get the hash of the WPS pin from the router and crack it in the same way a WPA2 handshake is cracked? (Not pixiewps but ...
0
votes
1
answer
238
views
In Real-Time, where do we deploy Extensible Authentication Protocol(EAP) in Wireless Networks?
I have heard that the EAP protocol has authentication capabilities for wireless networks too. But I am not able to get how it is deployed in real time as I know that whenever I need to connect to my ...
3
votes
1
answer
53k
views
Router detecting port scan and ack flood attack
Over the past few days, I'm noticing that the log of my wireless router is showing an ACK flood attack from various IP addresses. I use a D-Link DIR-600L. I've searched through the internet, also ...
2
votes
0
answers
322
views
Getting the current time from wifi networks without connecting [closed]
In a microcontroller powered by a solar cell we need to have the current time. When the sun decrease the micro-controller switch off and all the volatile data vanish. When the sun increase the micro-...
29
votes
1
answer
75k
views
EAP-TLS vs EAP-TTLS vs EAP-PEAP
I'm having troubles understanding the differences between the 3.
As far as I understand, with EAP-TLS, the client (peer) and the server (authenticator) both need a certificate. The authentication is ...
2
votes
1
answer
1k
views
Few questions about group keys family in WPA/WPA2
In my previous question I learnt something about Group Temporal Key (GTK), but after searching the internet I have another questions:
1. How is Group Master Key (GMK) derived? What is GMK derived ...
0
votes
1
answer
987
views
Wireless - why can't i view ARP broadcasts in monitor mode on encrypted networks?
I'm running a packet capture on my test client (running in managed mode) and also on my attacking machine (running in monitor mode).
It is my understanding that 802.11 networks using WEP encryption ...
4
votes
1
answer
974
views
Sniff wireless (Wi-Fi) trafic with Wireshark
I have a wireless card (AWUS036H) in monitor mode (with airmon-ng start wlan0) on my Debian machine. In Wireshark, in "capture options", all my interfaces are in promiscuous mode.
The test network is ...
0
votes
1
answer
102
views
Wireless devices with default configurations
I have the idea of deploying a product using a Raspberry Pi alike (CHIP) however I am concerned of the security issues getting a wireless device into people's homes
The device will be:
Using all the ...
1
vote
1
answer
76
views
Does it affect the probability of successful trasmission if a jammer hops channels?
Suppose an attacker tries to jam a wireless communication. There are 10 channels available and the legitimate sender chooses one of them of transmission randomly every 1s. If it transmits data for 5s ...
3
votes
2
answers
2k
views
Windows 10 Wi-Fi vs Airplane Mode Security
Does Windows 10 Airplane Mode provide the same level of security/protection as turning off Wi-Fi?
I know that turning on Airplane Mode disables Bluetooth; however, as far as connecting to the ...
1
vote
1
answer
150
views
Wireless Adapter + Arduino 'Bug'
First, I am new to ethical hacking. And also I just realized that I need a wireless adapter for wireless attacks. I'm currently mastering Python, and some basic knowledge in Bash and Arduino.
What I ...
1
vote
1
answer
3k
views
WPS. Output messaging translation to "human readable"
I'm trying to test the wifi security of my router at home. It has WPS activated. I know WPS should deactivated, I'm only testing...
Reaver is "spitting" a lot of messages, the question is:
What is ...
2
votes
1
answer
1k
views
airodump-ng mon0 device
My laptop is in monitoring mode. I need to get the details of a client that makes probes and not include other bssid and their station.
I run sudo airodump-ng -w s3 --bssid 74:de:2b:45:ed:d4 mon0
...
1
vote
1
answer
4k
views
Are iPhones immune to deauth attacks?
I was today rumbling a bit with wireless security, and more specific in creating Fake Access-Points to make Wi-Fi users enter their password on a phishing-page (by using the Fluxion tool).
One of the ...
3
votes
1
answer
214
views
Are there any signs for an end-user of cellular calls being routed through a Stingray device?
The Stingray is a small device that mimics cellular towers. From the user's endpoint side, is there any way to detect you are being routed through a rogue cellular tower?
0
votes
1
answer
354
views
How can someone determine where a wireless router/SSID originated? [duplicate]
Someone hacked my wifi. I beefed up security. They now have renamed their SSID with a derogatory SSID including my apartment number. I want to find where they are so I can confront them. Is that ...
0
votes
3
answers
849
views
Weird problem on airbase-ng
The situation is pretty simple, I'm trying to create a rogue AP, am I missing something? No matter what I do I get the same error message:
I tried using different bssid and essid's with the ...
5
votes
1
answer
2k
views
How Hole 196 actually works ? What WPA parameters does it exploit?
While dealing with wireless set I came across the term Hole 196. Got to know that preventions too. But can it still bypass Client isolation and standard preventive approach if packets are crafted at ...
0
votes
1
answer
189
views
Security better between WPA/WPA2 and AP Login Webpage
I silly wonder if we can stand outside and sniff password login webpage in protocol HTTPS or not? And attacker can brute force the WPA or WPA2 but if they change AP:set non-password and redirect ...
0
votes
1
answer
149
views
Wireless Access Point CONF? Edit [duplicate]
Is it possible that for instance I have one access point that it requires a password for authorization to access to modem and internet.
I want to edit this step like a user when he/she click to the ...
3
votes
1
answer
853
views
What information can WiFi devices leak without actually connecting?
Mr Paranoid walks from one secure location to another. Mid-journey, he panicks -- his wireless device (laptop, iPad, or other common consumer electronics) is turned on! If it sent any information to ...
2
votes
1
answer
3k
views
WPS PBC Security
On my router I have a WPS button (PBC) that enables anyone to connect during a short time frame.
There is no 4 numbers PIN anywhere on the router or on the instruction manual, and I can't find any ...
1
vote
1
answer
518
views
Prevention against De-Auth Attack for Handshake Capturing [duplicate]
As far as I know about De-authentication attack, the attacker sends de-auth packets to both router and the victim asking the victim to disconnect and reconnect. But I wonder what would happen if I ...
1
vote
0
answers
110
views
What happens when an attacker sends fake nonce in TKIP handshake?
The TKIP handshake is halfway completed; the access point and station have exchanged the first two messages. Now, before the access point can send the third message to the station an attacker sends a ...
1
vote
2
answers
984
views
scans for WIFI access points
PCI DSS requirement 11.1:
"Implement processes to test for the presence of wireless access points (802.11), and detect and identify all authorized and unauthorized wireless access points on a ...
1
vote
0
answers
292
views
mdk3 beacon pwning not detected by other devices
I'm new to wireless security. I'm trying to pwn beacon frames to announce a new access point using mdk3. However, when I run the command I get the following result where the MAC address is not ...
2
votes
1
answer
1k
views
Strange behavior when injection wifi packets with aireplay-ng [closed]
When I'm testing packet injection with aireplay-ng I can witness a strange behaviour on my Lenovo T510i. Several blogs report my wireless device to be capable of packet injection. But then look at ...
1
vote
1
answer
1k
views
What information does a wireless access point have about connected devices?
Which information about a connected device leaks to the access point it is connected to? What's the minimum amount of information that must be supplied to successfully connect, apart from the password?...
0
votes
2
answers
426
views
Wireless EAP-TLS implementing on Medical Wireless Device
I am new to PKI, digital certificates etc and will be the first time to connect a medical wireless device to a wireless network using EAP-TLS.
I am connecting a medical wireless device to our customer'...
0
votes
2
answers
730
views
Does wireless card need to be on same channel as AP to sniff beacon frames?
OBJECTIVE
Essentially, my goal is to emulate something like airodump-ng wlan0
Here is a link just in case ... airodump-ng
Collects raw 802.11 frames
Displays nearby access points and data
GAMEPLAN ...
4
votes
1
answer
1k
views
Arp replay for cracking WEP key IN Aircrack-ng
I'm pretty new to all of this so it might be a little stupid question... but why do we need to wait to capture an arp packet from a client to the AP? Can't we just send a 'fake' arp request to the AP ...
4
votes
2
answers
352
views
Achieving 'frequency separation' in wireless networks
A popular recommendation from security providers is to ensure wireless networks achieve 'frequency separation' from other wireless networks.
What does 'frequency separation' mean in technical terms ...