Wireless security topics including 802.11, Bluetooth, and others.

learn more… | top users | synonyms

75
votes
9answers
13k views

What would one need to do in order to hijack a satellite?

I realise this borders on sci-fi, but there's been some interesting demonstrations regarding security of various satellites. What would be required to hack a satellite (in general terms, any hack ...
42
votes
6answers
4k views

Phones broadcast the SSIDs of all networks they have ever connected to. How can these be obtained by an attacker?

I just watched an interesting talk from Glen Glenn Wilkinson titled: The Machines that Betrayed their Masters. He said that your phone is constantly broadcasting all the SSIDs it has ever connected ...
22
votes
6answers
74k views

If someone hacks my wi-fi connnection, what can they see and how?

I have two questions on wifi security: If someone knows my wifi password (be it WEP or WPA) what can they see on my screen? Do they just see URLs I visit, or can they see everything in my ...
21
votes
2answers
3k views

What is the difference between Promiscuous and Monitor Mode in Wireless Networks?

In Wireless Networks, you can put your wireless card in Promiscuous or in Monitor Mode. What is the difference between these two modes ?
21
votes
1answer
2k views

Vehicle remote key security

How secure are car remote keys? When you lock or unlock your car, can someone spoof or make another remote key? How do car remote keys work? Do they use some kind of private/public keys, encryption? ...
20
votes
2answers
6k views

How is wireless WiFi password cracked?

Let's say I have a wireless network that is password protected. What procedures can an intruder take in order to be able to gain access to my wireless network, or at least be able to decipher the ...
20
votes
2answers
660 views

Aviation security - Lessons to learn from PlaneSploit

A somewhat related question has already been asked (What would one need to do in order to hijack a satellite?), only at a more abstract level. Now we have a presentation by Hugo Teso from n.runs AG ...
18
votes
2answers
651 views

Security threats of wireless charging?

It is well known that plugging your mobile device for charging in public/uncontrolled places through Micro-USB can be a security hazard. USB protocol supports much more than just transferring power, ...
15
votes
2answers
4k views

Wireless keyboard sniffing risk

I've just acquired a wireless keyboard/mouse combo (Microsoft Wireless Desktop 3000). Only after having plugged it in did it get me thinking. How susceptible are those kind of setups to sniffing? Are ...
13
votes
1answer
948 views

Wireless mouse security

How secure are wireless mice? Is it possible to control a wireless mouse from a different computer? Is it possible to know the mouse movements from a different computer?
11
votes
2answers
2k views

Why does Evil twin works?

https://en.wikipedia.org/wiki/Evil_twin_%28wireless_networks%29 My question: it's OK that someone can make an AP with the same MAC and SSID as the original AP. And with stronger signal. But what I ...
9
votes
1answer
1k views

Are networks using EAP-TLS affected by Heartbleed?

Does the Heartbleed bug affect WiFi networks secured by WPA2-EAP in TLS mode? Since it's using TLS to secure connections between the server and clients, is it possible to attack the server using the ...
8
votes
2answers
9k views

How is 4G LTE encrypted?

After a few quick searches for 3G security I was able to learn that this standard uses the KASUMI block cipher, of which several weaknesses have been identified (although apparently none of practical ...
7
votes
4answers
505 views

Password-less network in skyscraper office

If a company has offices way up in a skyscraper, is it acceptable to have an open network without a password, as an easy-to-use courtesy to visiting guests? The only ones that possibly would be able ...
7
votes
2answers
7k views

Is it possible to use the aircrack-ng tool to crack a WPA2 Enterprise network?

is this tool (aircrack-ng) capable of cracking into a WPA/WPA2 Enterprise network? This tool has major success cracking the passwords of WEP/WPA networks. If it can, how, but if not, is there another ...
6
votes
2answers
7k views

How to discover if there is someone else connected to my wireless router?

I have a wireless router (WPA/WPA2) that is connected to my modem, so I can use wi-fi internet on my laptop. So, I'd like to know if there is any tool that allows me to discover if there is someone ...
6
votes
3answers
168 views

What would be the application-level equivalent of dynamic communication secrets?

I'm probably just thick and sufficiently new to security related issues in software development, but since I can't find information and I've been stuck on Googling this for a while. Recently I came ...
6
votes
1answer
982 views

In WPA2-Enterprise, where does AES come in?

WPA2-Enterprise uses 802.1X to facilitate authentication, but when and how is CCMP/AES used to encrypt the data after the authentication is completed? Let us say you want to use PEAP, and the TLS ...
6
votes
2answers
244 views

How does the predator network prevent outside control by an attacker?

I read several articles saying some of the command and control fleet for the US robotic attack planes may have been infected with a virus. Does this command and control system communicate with the ...
5
votes
3answers
844 views

Defending against rogue access points

Tools like Karma, and its offspring's, have the feature of becoming any AP that a client is probing for. Your client will naturally connect to this fake AP as it sees nothing wrong with it, thus ...
5
votes
3answers
257 views

Security difference in wardriving open network versus monitoring traffic on a network to which I am authenticated

I have been listening to the CBT nuggets on comptia security+ and there were a few sections on wireless security. A question that occurred to me was: if I am authorized to use a wireless network, and ...
5
votes
1answer
2k views

What makes PINless Wi-Fi Direct using WPS on Android secure?

I've read from Wikipedia that Wi-Fi direct uses WPS (Wifi Protected Setup), and I know that in Android (at least what I have which is 4.0.1 on Galaxy S3) uses the WPS method of the "push button" to ...
4
votes
2answers
319 views

Is a wireless receiver a security weak point?

I have bought the Logitech Wireless Presenter R400, and it includes a Wireless receiver that it should be plugged in to the computer in order for the remote send signals to the computer. I would like ...
4
votes
1answer
569 views

How to simulate a WEP cracking scenario for faster cracking in local lab?

I need to illustrate WEP cracking methods, I'll be using aircrack suit for that. There is a little problem that I want to speed up the method for very fast packet capturing, since this is just an ...
4
votes
1answer
5k views

Is brute-forcing the only way to crack WPA?

I don't know much about how WPA algorithms work internally. Is brute-forcing an AP the only way to crack WPA? (or to get associated with AP) Another question is about Reaver-WPS, what if an access ...
4
votes
2answers
194 views

Secure Wireless Implementations

For quite a while now, I have grown to treat wireless networks as inherently insecure. As part of this, I put them on the public Internet and require VPN connections to access company resources. My ...
4
votes
2answers
112 views

Should I set different passwords for different Wi-Fi bands?

My new router supports both the 2.4 and the 5 Ghz bands, and it obviously allows me to set a different password for each of them. Now, since cracking just one of the two means that the attacker would ...
4
votes
1answer
929 views

Hotspot with same SSID, how does authorization work?

My university has a wireless network I log into with my username and password. It's using PEAP. My phone and laptop automatically connect to this SSID when they detect the network. If someone sets up ...
4
votes
1answer
115 views

Tracing Wireless Card

Let's say that hypothetically someone had broken into a WiFi connection. We can't find any evidence of whom it is via sniffing the traffic or anything of the sort. Is there any way to triangulate ...
4
votes
1answer
433 views

Measuring SNR to detect jammers in Wi-Fi networks

I'm trying to figure out a way to detect a Wi-Fi 2.4 GHz signal Jammer. I am not looking into locating the location of the jammer but rather detect the jamming signal. How do i do so using only ...
4
votes
2answers
154 views

If two endpoints establish a mutual authenticated connection (TLSv1.0) is the medium between the endpoints a concern?

What are the vulnerable areas when two endpoint connect via TLS? Does the physical layer or data link layer a factor of security concern between the two endpoints? Does it matter in terms of security, ...
3
votes
2answers
2k views

how to monitor a Wifi (802.11) network?

How to capture a sequential stream of data between two machines, making no assumptions about network layer protocols? On wired network, one can do it by ARP spoofing and then sniff the network. One ...
3
votes
5answers
5k views

How to Investigate Wi-Fi Intrusion and where to look for evidence?

I'm trying to figure out how to configure a network so that I can tell what an intruder did (in the past) while on the network after they are detected. eg. If someone with a wi-fi enabled laptop ...
3
votes
2answers
363 views

Wi-fi security using WPA or WEP

In current years we have used WPA and WPA 2 for the encryption of data sent over an 802.11 network. But in the past WEP is used . From time to time, many people say that WEP (Wired Equivalent Privacy) ...
3
votes
1answer
145 views

What are the requirements to sniff UDP packets in a Wireless Ad-Hoc network?

In a wireless Ad-Hoc network, I have two computers which communicates in UDP together from 192.168.1.3 to 192.168.1.5 I have a third computer (192.168.1.6) which wants to listen to the packets which ...
3
votes
3answers
2k views

How to capture wireless data from an intruder using a home router

After my house mate experienced consistent ping spikes whilst gaming, he asked me to check/set the wireless router password. I did and I found two intruders from obviously nearby. How can the data ...
3
votes
2answers
175 views

Are there any extra security risks with leaving wireless enabled while ethernet is connected?

Mainly I'm wondering if operating systems will always use ethernet for internet connections if it is available, falling back to wireless when it is not. My thinking is based around the security ...
3
votes
3answers
236 views

How do open (no password) wireless networks deal with abuse?

Many places today such as restaurants, malls, and other public places have free and open WiFi that does not need a password or login information to access. That means that anyone, even people outside ...
3
votes
2answers
451 views

Why does layer 2 IDS seem underdeveloped compared to layer 3 IDS, for wireless network?

I understand that there are many applications such as Snort that do the job for network layer 3 IDS. From what I have researched, layer 2 wireless IDS seems like a field that is very slow in ...
3
votes
2answers
74 views

Does an insecure computer on my home wireless network threaten other machines?

I have a DD-WRT based wireless network with strong password security. However, other machines on the network may not be as protected as mine. If these machines are compromised, need I fear the ...
3
votes
2answers
193 views

Wireless Security: PEAP

I was wondering if there are any known attacks against PEAP used in wireless authentication/authorization? I'm specifically looking for attacks that would allow: bypassing the authentication ...
3
votes
4answers
2k views

How to stay anonymous in public wireless network?

If we are accessing a public wifi network, does changing mac address at certain intervals of time keep us anonymous forever? Is there anything other than mac address to identify a user in an AP?
3
votes
1answer
3k views

what is the role of RADiUS server and Active Directory to increase the security in wireless networks?

In the CBT Nuggets Video Training, one slide about Wireless networks : i want to know about the role of Radius to increase the security and how? in this project: Deploy Active Directory and ...
3
votes
1answer
1k views

Are Kismet (on OpenWRT) and Snort IDS (on a linux server) compatitble?

I'm trying to develop an IDS/IPS system project to include these elements: A router running OpenWRT running Kismet drone (Attitude Adjustment 12.09rc1) A Linux server (Running Kismet server + client) ...
3
votes
2answers
1k views

How do I securely separate a wireless subnet from the wired network?

My setup looks like this: In the interest of security, I'd like to separate the wired network (where the Workstation is plugged in) from the wireless subnet. I don't trust some of the devices in ...
3
votes
1answer
275 views

Strange packets coming over wireless, looking for clues

While running airodump-ng in town, I have noticed an unusual type of AP or pseudo-AP. There is a steady stream of wireless beacon frames coming in on channel 6. The frames are valid, but have several ...
3
votes
1answer
481 views

Metasploit Wifi Modules Asking for lorcon2

I'm using Metasploit Framework for Wifi Exploiation, on Backtrack R2, but I'm getting this error: The Lorcon2 module is not available: no such file to load -- Lorcon2 But actually, I have installed ...
3
votes
1answer
61 views

What is a secure mechanism for wireless communication between Android and Ubuntu?

I have come across a few Android apps that provide various features for communicating with a desktop machine (sending text or typing in one direction or another, controlling the desktop pointer with ...
2
votes
2answers
213 views

Can WiMAX track its users' geo position?

We all know that if you carry a GSM terminal with you, its location is being tracked and stored in operators' databases without any need of cooperation from the terminal itself. Is tracking user's ...
2
votes
3answers
145 views

Protecting wireless network

My wireless network protected under WPA-PSK/WPA2-PSK protocol. Is there a good reason to change the default user/password for the router management interface? What would it take for an hacker to ...