Wireless security topics including 802.11, Bluetooth, and others.

learn more… | top users | synonyms

93
votes
8answers
19k views

What would one need to do in order to hijack a satellite?

I realise this borders on sci-fi, but there's been some interesting demonstrations regarding security of various satellites. What would be required to hack a satellite (in general terms, any hack ...
73
votes
16answers
16k views

Trying to keep high school students out of the Wi-Fi network

I'm a teacher and IT person at a small K-12 school. The students are not supposed to have phones, laptops or access to the network. However, students being students they will try to find a way around ...
73
votes
7answers
7k views

How to patch “keyless entry” car keys?

The German automobile club ADAC did a test with several cars which open doors and start the engine with a "keyless entry" system. You don't have to push a button on your car key. If you get near your ...
48
votes
6answers
11k views

Phones broadcast the SSIDs of all networks they have ever connected to. How can these be obtained by an attacker?

I just watched an interesting talk from Glen Glenn Wilkinson titled: The Machines that Betrayed their Masters. He said that your phone is constantly broadcasting all the SSIDs it has ever connected ...
38
votes
7answers
7k views

How would you detect an Evil Twin attack, especially in a new environment?

Let's say you are traveling, and you pause in the airport lounge, or your hotel lobby, or a nearby coffee shop. You haul out your laptop and scan the available wireless networks. You know the name of ...
36
votes
3answers
24k views

What is the best home wireless network encryption algorithm to use?

What is the best home wireless network encryption algorithm to use? I realize the best answer will probably change over time, and hopefully people can provide updated answers as new standards come ...
36
votes
6answers
174k views

If someone hacks my wi-fi password, what can they see and how?

If someone knows my wifi password (be it WEP or WPA) what can they see? Do they just see URLs I visit, or can they see everything in my browser, or even everything I do on my computer? Does using ...
31
votes
1answer
7k views

Vehicle remote key security

How secure are car remote keys? When you lock or unlock your car, can someone spoof or make another remote key? How do car remote keys work? Do they use some kind of private/public keys, encryption? ...
25
votes
2answers
14k views

What is the difference between Promiscuous and Monitor Mode in Wireless Networks?

In Wireless Networks, you can put your wireless card in Promiscuous or in Monitor Mode. What is the difference between these two modes ?
23
votes
2answers
10k views

How does WiFi password cracking work?

Let's say I have a wireless network that is password protected. What procedures can an intruder take to gain access to my wireless network, or at least be able to decipher the packets I am sending ...
22
votes
2answers
1k views

Aviation security - Lessons to learn from PlaneSploit

A somewhat related question has already been asked (What would one need to do in order to hijack a satellite?), only at a more abstract level. Now we have a presentation by Hugo Teso from n.runs AG ...
20
votes
2answers
5k views

Wireless keyboard sniffing risk

I've just acquired a wireless keyboard/mouse combo (Microsoft Wireless Desktop 3000). Only after having plugged it in did it get me thinking. How susceptible are those kind of setups to sniffing? Are ...
18
votes
2answers
1k views

Security threats of wireless charging?

It is well known that plugging your mobile device for charging in public/uncontrolled places through Micro-USB can be a security hazard. USB protocol supports much more than just transferring power, ...
17
votes
1answer
5k views

Is it even possible to hack a television channel?

In spite of all the hacking news in the recent few years I never heard of someone who managed to hack a TV channel. What makes them so secure?
15
votes
1answer
1k views

Wireless mouse security

How secure are wireless mice? Is it possible to control a wireless mouse from a different computer? Is it possible to know the mouse movements from a different computer?
13
votes
3answers
22k views

How is 4G LTE encrypted?

After a few quick searches for 3G security I was able to learn that this standard uses the KASUMI block cipher, of which several weaknesses have been identified (although apparently none of practical ...
12
votes
6answers
2k views

Why do coffee shops not use WPA/WPA2? Would it solve many problems if they did?

So I'm looking into public WiFi security in places such as hotels, coffee shops etc. It seems the current standard is just to use open wi fi connections in many of these locations. I would assume this ...
12
votes
2answers
14k views

Is it possible to use the aircrack-ng tool to crack a WPA2 Enterprise network?

is this tool (aircrack-ng) capable of cracking into a WPA/WPA2 Enterprise network? This tool has major success cracking the passwords of WEP/WPA networks. If it can, how, but if not, is there another ...
12
votes
3answers
3k views

Why does Evil twin works?

https://en.wikipedia.org/wiki/Evil_twin_%28wireless_networks%29 My question: it's OK that someone can make an AP with the same MAC and SSID as the original AP. And with stronger signal. But what I ...
12
votes
2answers
139 views

Is my Windows phone protected from attacks that reveal list of ssids it knows about?

My goal is to see the SSIDs requested by mobile devices in my home. For example, my Windows phone knows about SSIDs called "coffee_shop", "planet_fitness" and "library". I have my phone set to ...
11
votes
4answers
1k views

Can someone use WiFi snooping to see data I send through Tor Browser when I'm not using SSL?

(NOTE: I've read other similar questions, but I'm not at all certain about this, therefore I'm asking.) I travel a lot, and I generally use public WiFi spots and hotels/hostels/boarding houses etc. ...
9
votes
1answer
2k views

Are networks using EAP-TLS affected by Heartbleed?

Does the Heartbleed bug affect WiFi networks secured by WPA2-EAP in TLS mode? Since it's using TLS to secure connections between the server and clients, is it possible to attack the server using the ...
8
votes
4answers
536 views

Password-less network in skyscraper office

If a company has offices way up in a skyscraper, is it acceptable to have an open network without a password, as an easy-to-use courtesy to visiting guests? The only ones that possibly would be able ...
7
votes
1answer
2k views

In WPA2-Enterprise, where does AES come in?

WPA2-Enterprise uses 802.1X to facilitate authentication, but when and how is CCMP/AES used to encrypt the data after the authentication is completed? Let us say you want to use PEAP, and the TLS ...
7
votes
1answer
765 views

Is Bluetooth 4.0 traffic encrypted by default/design?

I wonder if the BLE (v4.0) traffic is encrypted by default or by design, or is it just optional? If the former, is the traffic encrypted using a key derived just from the pairing pin or is there some ...
6
votes
2answers
11k views

How to discover if there is someone else connected to my wireless router?

I have a wireless router (WPA/WPA2) that is connected to my modem, so I can use wi-fi internet on my laptop. So, I'd like to know if there is any tool that allows me to discover if there is someone ...
6
votes
3answers
207 views

What would be the application-level equivalent of dynamic communication secrets?

I'm probably just thick and sufficiently new to security related issues in software development, but since I can't find information and I've been stuck on Googling this for a while. Recently I came ...
6
votes
2answers
584 views

Remediation against relay attacks (ie. NFC)

Question first: Is there any remediation for passive MITM? I've come across examples of NFC relay attacks which use phones to get around the proximity requirement for NFC payments. It looks ...
6
votes
2answers
311 views

How does the predator network prevent outside control by an attacker?

I read several articles saying some of the command and control fleet for the US robotic attack planes may have been infected with a virus. Does this command and control system communicate with the ...
6
votes
2answers
609 views

How to Man-in-the-middle a whole network?

When performing a MiTM attack, you generally need to specify the router's IP address and the "victim" IP address. I'm trying to demonstrate to a business owner why he needs to secure his network, but ...
6
votes
1answer
4k views

What makes PINless Wi-Fi Direct using WPS on Android secure?

I've read from Wikipedia that Wi-Fi direct uses WPS (Wifi Protected Setup), and I know that in Android (at least what I have which is 4.0.1 on Galaxy S3) uses the WPS method of the "push button" to ...
6
votes
1answer
52 views

How safe is a standard wireless keyboard from a MITM attack?

And are there any mitigations except using a wired keyboard?
5
votes
6answers
2k views

Can one steal data using electric wire?

If I would like to keep my work secret in my computer and I don't use Internet, is it possible for a cracker to steal my data via electric wires or a wireless connection?
5
votes
3answers
1k views

Defending against rogue access points

Tools like Karma, and its offspring's, have the feature of becoming any AP that a client is probing for. Your client will naturally connect to this fake AP as it sees nothing wrong with it, thus ...
5
votes
4answers
304 views

How can I intercept video over a wireless network in real time?

Can you sniff the packets or use a network analyzer or MITM or ARP spoofing to somehow be able to see the videos that someone else is watching on a network in real time? Also: Can you somehow see ...
5
votes
3answers
392 views

Security difference in wardriving open network versus monitoring traffic on a network to which I am authenticated

I have been listening to the CBT nuggets on comptia security+ and there were a few sections on wireless security. A question that occurred to me was: if I am authorized to use a wireless network, and ...
5
votes
2answers
531 views

Is a wireless receiver a security weak point?

I have bought the Logitech Wireless Presenter R400, and it includes a Wireless receiver that it should be plugged in to the computer in order for the remote send signals to the computer. I would like ...
5
votes
1answer
9k views

Is brute-forcing the only way to crack WPA?

I don't know much about how WPA algorithms work internally. Is brute-forcing an AP the only way to crack WPA? (or to get associated with AP) Another question is about Reaver-WPS, what if an access ...
5
votes
3answers
766 views

How does EAP/PEAP integrate with modern security protocols?

How exactly does Extensible Authentication Protocol (EAP)/Protected EAP integrate into modern security protocols? What I know (or not know) so far... It's used by wireless networks utilizing ...
5
votes
1answer
2k views

Hotspot with same SSID, how does authorization work?

My university has a wireless network I log into with my username and password. It's using PEAP. My phone and laptop automatically connect to this SSID when they detect the network. If someone sets up ...
5
votes
1answer
80 views

32-bit Radio Voice Encryption, is it really that secure? If so, how?

I'm a student studying Electrical and Computer Engineering and a ham radio operator (i.e. my knowledge of encryption is basic). More and more, police and local government radio has become encrypted, ...
5
votes
1answer
326 views

Is it possible to steal WPA2 key using a rogue AP?

Without using a 'fishing' homepage explicitly asking for the user to retype the WPA key. Is it possible to catch the WPA key wich is sent to a rogue AP in the initial connection phase ?
5
votes
1answer
9k views

How does Dumper program get default WPS without bruteforcing them?

Today I tried a program called Dumper and the program showed me default WPS of all of my neighbor access points without bruteforcing them, see screenshot below: I had to cover BSSID and ESSID of the ...
5
votes
2answers
226 views

If two endpoints establish a mutual authenticated connection (TLSv1.0) is the medium between the endpoints a concern?

What are the vulnerable areas when two endpoint connect via TLS? Does the physical layer or data link layer a factor of security concern between the two endpoints? Does it matter in terms of security, ...
5
votes
1answer
616 views

Keyboards using 2.4GHz with AES

I got a Microsoft Sculpt keyboard, as it seems to be a small improvement over the much loved Ergo 4000. (What I'd give to have an Ergo 4000 with CheryMX Blues...) On various sites, they have this one ...
5
votes
1answer
764 views

Measuring SNR to detect jammers in Wi-Fi networks

I'm trying to figure out a way to detect a Wi-Fi 2.4 GHz signal Jammer. I am not looking into locating the location of the jammer but rather detect the jamming signal. How do i do so using only ...
5
votes
3answers
118 views

How will popular WiFi clients react to an evil twin

If I create an evil twin hotspot next to a legitimate AP and simply clone the SSID, I know that my WiFi client will see these as 2 different APs and both will show up in a list of available networks ...
4
votes
2answers
1k views

Data on Malicious WiFi Network

Let's assume that I unwittingly connect to a malicious WiFi network and visit websites. By malicious, I mean the network has been set up for the purpose of stealing data. From what I've read, using ...
4
votes
3answers
108 views

Risks of giving a hacker my WPA key for my router?

What are the risks when someone (maybe a hacker), that through Social Engineering gets the WPA or WEP key of my router and (obviously) can navigate through internet. At this point, what can this ...
4
votes
3answers
360 views

How do open (no password) wireless networks deal with abuse?

Many places today such as restaurants, malls, and other public places have free and open WiFi that does not need a password or login information to access. That means that anyone, even people outside ...