Tag Info

Hot answers tagged

7

[...] if I am authorized to use a wireless network, and after authenticating myself I use something like wireshark or airopeek to sniff packets, how is this any different than just wardriving open wireless networks w/o authentication? Wardriving generically refers to the activity of identifying accessible access points. The term 'wardriving' is a play on ...


6

I am not a lawyer, so the following is just from experience: We have found in most countries (exclude the really restrictive ones such as Germany) you should have no ethical or legal issues with wardriving and collecting info on where weak wireless networks are. The problem is more around what you want to do with it - if you haven't been specifically ...


5

Wardriving is now out of date, if you're a corporation that sells phones. Google used to perform wardriving with their Street View trucks, but they no longer do. You might describe the modern tactic as "distributed war-usering". A ZDNet article entitled "How Google--and everyone else--gets Wi-Fi location data" describes the process: How it works, ...


5

Usually within the U.S., special-ordered equipment is required to scan channels not permitted for operation by the FCC. This could be WiFi devices imported from overseas, or specially-licensed equipment manufactured specifically for spectrum analysis. Since consumer electronic devices (including Wi-Fi) sold within the U.S. must conform to FCC Part 15 ...


4

Using this as a source, it appears we can conclude that- (in relation to consumer devices)- Any device purchased in the USA cannot be configured (through normal means) to be operate on channels 12-14, even when changing the locale to EU or JP because it's illegal to provide a device that you can simply configure to break regulations. A device imported ...


3

I think the first confusion is that it is not your MAC address, as in the MAC address of your device, but it's actually the MAC address of the Access Point. The access point generally has a fixed location where a WiFi device, such as your phone or laptop, may not. Even so, moving on from that you can also still obtain the MAC address of all the WiFi ...


3

As far as I know the range doesnt depend on the device scanned, but on the device that is scanning. With an antenna it is possible to detect a class 2 device one mile away if you point your antenna in the right direction. Anyway the question is about wardriving for bluetooth devices. You can use Bluediving loop mode for that (see http://bluediving.sf.net) ...


3

Well bluetooth scanner apps do exist (e.g. like this one ), so if the lock is broadcasting it will likely be discoverable. As to range, as @adnan says in comments depends on the class, however there have been examples of specialist antennas picking up signals over a mile away.


3

Analysing kismet XML is the best way to go on this one. There's a script that I've knocked up which should do most of what you're looking for, but feel free to look through it and modify for your purposes. I'm planning to put it in a github repo at some point, but it needs cleaned up a bit before that. That said it should work ok for you at the moment, so ...


2

Many people will be suspicious of you even though your motives are noble. I usually wardriving with my android phone & the wardrive app ITS working fine. But as you say with a directional antenna will allow you to find out exactly where the hotspot is.


2

Be mindful of how people will interpret '[a] low-cost consultation visit, to help the owner secure their network appropriately.' I offer free pen testing work to open source projects and had one particularly unhinged developer claim (libelously) I was trying to blackmail them. I had even given them the patches and everything they needed to fix the issues, ...


2

When using open wifi there is no protection of the data at that layer, however if they are using encryption on a higher layer then it's still encrypted. So yes if you listen on open networks you can see any raw traffic over the network. Keep in mind that if the network has a generally known password then it provides no more protection then an open network.


2

FON routers are purchased world wide, and can be set to operate in pretty much any International wifi band. And if you've got a locked firmware on many "standard" devices, you need only load a firmware from a different region. (Especially for USB devices) the hardware is the same, but the firmware itself is soft loaded and can be manipulated with a little ...


1

If the device isn't normally discoverable, it won't necessarily transmit unless a paired device transmits to it first (depending on how it is implemented.) Range will depend on the devices involved and if you need one or two way communication. It's also worth noting that even if discovered, a bluetooth lock is unlikely to draw additional attention to you. ...


1

To answer Jeff's updated question. If your network is controlled enough where you are worried about rouge access points, then you would also be using wired security. (802.1x or otherwise.) Besides using a rogue wifi access point, you could be using an undetectable wireless connection on the 700mhz band. It's easier to make sure that everything connected ...


1

(Sorry for posting on this "more-than-a-year-old" question, came across the topic while searching for somethings similar, hopefully it can help someone) Giskimet stores the imported access points in a SQLite3 database, a suitable format for data mining. While Giskismet ouputs KML graphs, if you have access to the SQLite shell ...


1

In australia Google is looking like getting into trouble for a breach of privacy. This revolves around the fact that they collected user's wireless router MAC addresses, and stored that information alongside the users residential home address. Whilst this might sound fairly harmless, it appears to be an intrusion of privacy. i.e. the same way that it would ...



Only top voted, non community-wiki answers of a minimum length are eligible