Wireless security topics including 802.11, Bluetooth, and others.

learn more… | top users | synonyms

0
votes
0answers
9 views

Weird problem on airbase-ng

The situation is pretty simple, I'm trying to create a rogue AP, am I missing something? No matter what I do I get the same error message: I tried using different bssid and essid's with the ...
1
vote
0answers
5 views

Netgear Administratrive distance

Not sure if this is the right stackexchange forum though I am using Netgear WNR1000v2 running firmware version 1.1.2.58. Open authentication is enabled, so no password is required, and only used for ...
0
votes
1answer
20 views

Does wireless card need to be on same channel as AP to sniff beacon frames?

OBJECTIVE Essentially, my goal is to emulate something like airodump-ng wlan0 Here is a link just in case ... airodump-ng Collects raw 802.11 frames Displays nearby access points and data ...
0
votes
0answers
22 views

Mobile access is blocked on wireless router [closed]

My corporate wireless router has blocked mobile devices to connect to it and access internet. I can connect my laptop to the wireless and get internet access. But I want to use internet on my mobile ...
1
vote
3answers
7k views

Do i need to have Airpcap?

Hi I am learning system security in an online course, in a practical experiment I tried to monitor the traffic through my router using wireshark1.10.3 but i have a feeling that it only sensing traffic ...
-1
votes
1answer
59 views

Using old router as wi-fi extender/extra security on shared network?

I just moved into a building with three apartments, all of which split an internet subscription. There is only one router, however, in one of the other apartments. For security/privacy purposes, I'd ...
1
vote
2answers
48 views

Sniffing packet on wireless connection (airodump-ng)

Short Question: Is it important for a sniffing device to be in the broadcasting range of a client (NOT THE ROUTER) to sniff its packets? Complete Scenario: I assume that a wireless sniffing tool, ...
5
votes
1answer
600 views

What are the security implications of pairwise master key caching in Wireless Networks?

I'm currently investigating WPA2 enterprise security options, and I'm curious about PMK Caching. I've found lots of vendor information about it, and understand that the client does not need to ...
1
vote
2answers
176 views

Attacker knows what I do online and even has screenshots from my computer - how?

What can be achieved by hacking the Wi-Fi connection? Can you then use that to access somebody else's computer remotely, i.e., from their own house instead of across the street from me? I think ...
0
votes
0answers
17 views

Get BSSID of LAN Router using Scapy

Objective Get the BSSID of the access point my machine is connected to using Scapy Attempts p = sr(ARP(op=ARP.who_has, psrc="192.168.254.5", pdst="192.168.254.254")) p[0].summary() ----------------...
0
votes
1answer
94 views

airodump-ng mon0 device

My laptop is in monitoring mode. I need to get the details of a client that makes probes and not include other bssid and their station. I run sudo airodump-ng -w s3 --bssid 74:de:2b:45:ed:d4 mon0 ...
0
votes
2answers
49 views

How secure is LAN wireless 802.11 if password is used with access point?

I've read a book on computer networks, and among other subjects the author touched WiFi security. It was said that WiFi has some serious security flaws and that there is even free publicly available ...
2
votes
1answer
212 views

How to configure Kismet to redetect same BSSIDs in a loop?

So I am working on a tool to detect any wifi device using Kismet. When I use Kismet, it works fine, but my problem is, it detects a device once, and until the MAC changes, it wont detect it again. ...
25
votes
2answers
15k views

What is the difference between Promiscuous and Monitor Mode in Wireless Networks?

In Wireless Networks, you can put your wireless card in Promiscuous or in Monitor Mode. What is the difference between these two modes ?
1
vote
0answers
20 views

How does deauth protection (IEEE_802.11w-2009) work?

I read a Wikipedia article on IEEE_802.11w-2009 and I wonder how does it work with WPA2. In other words, how do I turn it on in my Linux kernel? If I enable it both in it and in an OpenWRT router, am ...
9
votes
1answer
1k views

Is Bluetooth 4.0 traffic encrypted by default/design?

I wonder if the BLE (v4.0) traffic is encrypted by default or by design, or is it just optional? If the former, is the traffic encrypted using a key derived just from the pairing pin or is there some ...
1
vote
1answer
36 views

What does it mean when airodump-ng shows 0 beacons?

I have one particular AP that shows 0 Beacons in airodump. I can see the beacons in all the other AP without a problem. So is it even possible for AP to not send beacon frames?
3
votes
4answers
318 views

Is a computer more vulnerable if wireless is left on when booting?

Normally I switch off wireless on my laptop before I shut it down but I forgot to do this last night. So this morning, after I booted up the laptop, I saw the wireless notification on the bottom right ...
0
votes
2answers
187 views

Detecting access point model

Is there any way to detect the model (brand, reference, ...) of a reachable wireless access point without having to connect to it? I've tried sniffing packets with Wireshark, but I can't get the ...
6
votes
1answer
10k views

How does Dumpper program get default WPS without bruteforcing them?

Today I tried a program called Dumpper and the program showed me default WPS of all of my neighbor access points without bruteforcing them, see screenshot below: I had to cover BSSID and ESSID of ...
0
votes
0answers
115 views

Security of an IoT network using AES (LoRaWAN)

I am studying the security of LoRaWAN. Here is a simplified architecture of the network: As you can see, there are two keys: one for the network security (no mitm, no modificatiof the messages). ...
-1
votes
1answer
77 views

Deauthenticate ALL wlan networks/clients in range [closed]

I need to deauthenticate all clients in all networks within the range of my wlan-adapter. Aireplay-ng allows only to focus a single network. Are there any programs or scripts i can use for this ...
-1
votes
3answers
212 views

Who can spy on my wifi usage and websites I visit?

I'm using a WPA/WPA2 encrypted WiFi. Who can view what I'm doing? Also how? Can the person that pays for the WiFi look up exactly what I am doing (e.g. look up exact messages I've sent on Facebook)?...
0
votes
1answer
48 views

What are attack vectors for attacking tethering smartphones?

Are there any attack vectors for attacking tethered wireless networks (mobile hotspot), other than for normal wireless networks? Assuming the tethered wirless network uses state-of-the-art encryption+...
4
votes
1answer
70 views

What's the difference between pixie attack and other attacks on WPS?

I have been studying about the brute-force attack on the WPS PIN, and I understand that because the last digit is the check digit, and that the PIN is divided into two halves in M4 and M6 messages, ...
2
votes
3answers
86 views

Wireless network risks? [closed]

What are the security risks associated with installing a Wi-Fi (802.11) network in-comparison to a wired network for internet connection?
1
vote
0answers
38 views

What information about a user can wireless carriers access?

What is the maximum amount of imformatiom about a user and the user's phone that can be obtained by a wireless carrier on a GSM network? Here is a list of the things I know, but are there more? IMEI,...
1
vote
0answers
39 views

Are there security concerns with Bluetooth low energy?

In the first versions of BLE specifications, there was a huge security flaw during the pairing allowing an attacker to perform a MITM attack. Since Bluetooth 4.2, the pairing use ECDH, so there isn't ...
4
votes
1answer
176 views

Is it possible to hack WPS PIN of routers that lockout exponentially after failed tries?

I have been interested in Wireless hacking lately, and I can do dictionary attacks, and some other type of attacks. Though, I wanted to hack my ASUS RT-N12D1 router's WPS PIN. ASUS doesn't alllow to ...
14
votes
6answers
2k views

Why do coffee shops not use WPA/WPA2? Would it solve many problems if they did?

So I'm looking into public WiFi security in places such as hotels, coffee shops etc. It seems the current standard is just to use open wi fi connections in many of these locations. I would assume this ...
1
vote
1answer
641 views

802.11 Authentication/Association and WPA/WPA2 authentication (Four-way handshake)

So I have read that 802.11 standard requires stations and APs to go through the authentication and association before communication can take place. I also know that WPA/WPA2 has its own authentication ...
1
vote
1answer
56 views

What is the difference between capture traffic from inside and outside of my network?

I'm thinking to use Wireshark tool to packet capture in my Wireless network. I read something that tells I can capture from inside or outside of my network, just making my wifi board working in "...
2
votes
3answers
2k views

Can a wireless headphone (bluetooth) contain malware?

Can a wireless (bluetooth) headphone store data? Also, if it can, then can someone put malware in it? I assume that the device must necessarily be able to store some sort of data, since it has buttons ...
6
votes
1answer
131 views

How safe is a standard wireless keyboard from a MITM attack?

And are there any mitigations except using a wired keyboard?
0
votes
0answers
11 views

aireplay-ng can't replay packets

I am using the command: aireplay-ng -3 -b 12:34:56:78:90:12 -h 34:56:78:90:12:34 wlan1mon but I can't replay any packets. I have set the correct channel for wlan1mon and I also have spoofed the ...
0
votes
0answers
58 views

Is it possible for an attacker to log keystrokes of a bluetooth or wireless keyboard [duplicate]

Bluetooth and wireless keyboards are sending keystrokes wirelessly. Could this mean that an attacker (or spy) can log the keystrokes by monitoring the wireless or Bluetooth radio waves (or whatever)? ...
0
votes
1answer
49 views

Not receiving beacons for airodump-ng to work

I have an AP close enough to me with high signal strength but for some reason I'm not receiving beacons from it. Since I don't have beacons coming in, I cannot perform deauth as well. One thing I'm ...
5
votes
3answers
149 views

How will popular WiFi clients react to an evil twin

If I create an evil twin hotspot next to a legitimate AP and simply clone the SSID, I know that my WiFi client will see these as 2 different APs and both will show up in a list of available networks (...
1
vote
1answer
31 views

Analog CCTV over wireless [closed]

I work in a security company, and we have a client who would like CCTV put in around their premises. They have an existing analog system (over COAX) that we were going to replace, but he would also ...
2
votes
0answers
38 views

Was the OSX/iOS Airdrop flaw real?

One exploit has caught my eye, mainly due to the possibility of malware incorporating it infecting businesses and schools. This exploit is, as you may have guessed from the title, the OSX/iOS Airdrop ...
2
votes
0answers
106 views

Sniff wireless (Wi-Fi) trafic with Wireshark

I have a wireless card (AWUS036H) in monitor mode (with airmon-ng start wlan0) on my Debian machine. In Wireshark, in "capture options", all my interfaces are in promiscuous mode. The test network is ...
3
votes
1answer
267 views

Is UPnP still insecure?

Here's my question: In today's world, on equipment that is properly updated to the latest software/firmware, is UPnP still insecure, or have its vulnerabilities been fixed? This type of question ...
1
vote
1answer
480 views

Dumpper and Jumpstart for hacking WPS

As asked in this question, there is a program called Dumpper. it can find PIN of AP without brute forcing them. But with another tool called Jumpstart, together they can crack any AP that is running ...
42
votes
6answers
184k views

If someone hacks my wi-fi password, what can they see and how?

If someone knows my wifi password (be it WEP or WPA) what can they see? Do they just see URLs I visit, or can they see everything in my browser, or even everything I do on my computer? Does using ...
17
votes
1answer
5k views

Is it even possible to hack a television channel?

In spite of all the hacking news in the recent few years I never heard of someone who managed to hack a TV channel. What makes them so secure?
0
votes
0answers
56 views

Prevention of sinkhole attacks

I have read about many approaches to launch and detect sinkhole attacks in wireless (sensor) networks. Yet I couldn't find any (good) articles to read about the prevention/avoidance of sinkhole ...
-3
votes
2answers
70 views

NTAG216 lock bytes security [closed]

I want to ask about the "lock bytes" implemented on the NTAG216 by NXP. What exactly are these and how do they work? Are they a standard or is it some proprietary technology by NXP? Are there any ...
73
votes
7answers
7k views

How to patch “keyless entry” car keys?

The German automobile club ADAC did a test with several cars which open doors and start the engine with a "keyless entry" system. You don't have to push a button on your car key. If you get near your ...
3
votes
2answers
87 views

Can wireless (wifi, blutooth..) be attacked even when not connected?

For example, my computer displays a list of wifi network in range, even it doesn't connect to any of them. I don't know wifi protocol so I don't know whether my computer must actively send ...
1
vote
2answers
139 views

Sniff network packets that don't talk to my computer?

How would one sniff wireless network packets that do not pass directly through my computer- without access the the AP or router? I want to be able to sniff for network traffic (even while ...