Hot answers tagged wifi
52
Unprotected Wifi networks, particularly in public places, are most certainly a threat. This is because you are connecting to a network without knowing who else could be on the network.
'Free Wifi' provided by cafes, restaurants, etc serve as excellent places for harvesting passwords.
The attacker will perform a Man in the Middle attack, typically by ...
43
Something left unsaid, Why is the user wanting a WiFi? As long as the user feels they have a legitimate need they will continue to find workarounds to any of your attempts at blocking it.
Discuss with the users what they are trying to accomplish. Perhaps create an official wifi network ( use all the security methods you wish - it will be 'yours' ). Or, ...
28
The schemes you mention are protocols for securing 802.11x traffic over wireless networks. They don't mandate how the AP password is encrypted or hashed during storage. However, the security of the protocol does rely on making the key secure.
WEP relies on a broken RC4 implementation and has severe flaws in various aspects of its protocol which make ...
27
Most probably the blocker is designed to let images through, maybe because they are hotlinking some images on the page where they ask for you to login.
Appending ?.jpg to the URL makes the blocker think that the URL is an image. On the other hand, anything after the ? doesn't change the actual webpage requested, it only changes the GET headers. (so ...
14
Firewalls can't tell where your traffic is coming from in terms of the physical network - they only see the data that the protocol provides, such as MAC / IP, which aren't much use in this case.
I think you're falling into the trap of looking for a technical solution to a managerial problem. Remember Immutable Law of Security #10: Technology is not a ...
12
Yes and no. They may not have your password in plaintext, but they have enough to potentially guess it and verify that guess (i.e. offline brute forcing).
WPA2 authentication is performed through a four-way handshake. Instead of just sending your password in plaintext to any access point you connect to, this handshake ensures that unless both parties ...
12
There is no firewall rule which can help you there: by construction, the rogue AP provides a network path which bypasses your firewalls. As long as the users have physical access to the machines they use and their USB ports (that's hard to avoid, unless you pour glue in all the USB ports...) and that the installed operating systems allow it (then again, hard ...
12
Yes, a VPN connection encrypts the connection between your computer and the remote VPN host. The connection would just look like gibberish to anyone sniffing the traffic, either in the coffee shop or on the Internet. It is worth noting that the same applies to any content sent over HTTPS even if you aren't using a VPN.
It is also worth noting that if you ...
11
In addition to the answers around the policy side of things there's a couple of technical approaches that can help you here, depending on how tightly controlled your IT environment is.
USB port lockdown - in your particular case the user has made use of a USB Wi-Fi stick to create the AP. If you have software which can lock-down what classes of USB device ...
11
If your bank Web site uses HTTPS, and you dutifully check that the server name in the URL is indeed the expected name, and you don't disregard warnings about unverified or expired certificates, then yes, it is safe.
If these conditions are not met, then no, it is not safe -- but it would not be safe from anywhere else either. Public WiFi is not special in ...
11
The question (to most people) is an oxymoron. By definition, people will think that "open WiFi" means "un-encrypted WiFi. To me you seem to be asking "Why did the people that wrote the 802.11 standard way back in 1997 make the decisions that they did?"
The short answer - we can only find out by asking them (or seeing if there are any discussion documents ...
9
The initialization vector in WEP is a 24-bit random value that is used to seed the RC4 algorithm.
RC4 is a stream cipher. This means that for each bit of plaintext, it produces one bit of keystream and xors the two, to generate the ciphertext. The keystream is simply a stream of random numbers, generated from the RC4 algorithm.
In the most basic operation ...
9
You can try to build Faraday cages; this would require the WiFi access point and the authorized clients to be inside the cage, while the vindicative attacker would be on the outside. The Faraday cage should be a mesh with rings substantially smaller than the wavelength of the signal which is to block (radio-astronomers would recommend a factor of 10): 5 GHz ...
9
I'm actually quite shocked and somewhat appalled by the number of people dismissing this as a policy or managerial problem.
Yes, a policy needs to be created/enforced so that appropriate disciplinary action can be taken if or when a user is caught violating policy.
However, policy alone is not going to prevent your network/data from being compromised if a ...
9
Firesheep has nothing to do with the WiFi encryption. If you and I were both on an encrypted WiFi connection, I would still be able to Firesheep your data.
What Firesheep does happens at the router level. It does not intercept the waves on air (well, not exactly)
Basically, it runs an ARP spoofing attack. This sort of attack can be run on a LAN network as ...
8
Full disclosure I work for a large Cisco solution partner.
As others have mentioned, a firewall will not help much.
There is a whole class of products called wireless intrusion detection / prevention system (WIDS / WIPS). Cisco, Aruba, Motorola Air Defense, and Airtight Networks Spectraguard are some vendors/products in this category. Not an exhaustive ...
8
If the rogue access point is operating in bridged mode (which most will be) you'll see the mac addresses of the wireless client(s) on the switch port of the desktop.
You can block these unknown mac addresses on most switches by setting the switches port address filtering to "learn then block" mode - it will learn the 1st mac address seen and then block any ...
8
WPA2 is the only secure method. WEP and WPA are "broken". Also, WEP is easier to crack than WPA. However, any security, even WEP, is better than no security as it will effectively prevent opportunistic connections to your network.
I just checked and indeed the new Mac Books Pro don't have an Ethernet port. All I can say is WTF?!?
8
The PSK variants of WPA and WPA2 uses a 256-bit key derived from a password for authentication.
The Enterprise variants of WPA and WPA2, also known as 802.1x uses a RADIUS server for authentication purposes. Authentication is achieved using variants of the EAP protocol. This is a more complex but more secure setup.
The key difference between WPA and WPA2 ...
7
The general ways that a rogue access points are found:
An enterprise wi-fi access point spends some of its time not just serving clients, but listening on various channels for other wi-fi traffic. (This works best for the 2.4Ghz band where there are fewer channels. Fortunately this is also where most run-of-the-mill, non-targeted attacks are going to be. ...
7
According to Wikipedia's page on WEP:
A 64-bit WEP key is usually entered as a string of 10 hexadecimal (base 16) characters (0-9 and A-F). Each character represents four bits, 10 digits of four bits each gives 40 bits; adding the 24-bit IV produces the complete 64-bit WEP key. Most devices also allow the user to enter the key as five ASCII characters, ...
7
One of the two technologies used in the early 802.11 days was Direct Sequence Spread Spectrum - it had interest in military circles because it spread the signal across a wide range of frequencies with three key benefits:
very low signal base, making it very difficult to identify the signal in amongst RF noise
Resistance to intended or unintended jamming, ...
6
I suspect channel contention. It could be that a neighboring AP on the same frequency is transmitting or receiving large chunks of data on the same channel or channel group as the one your hotel AP is using. All I can suggest is using a different channel, which, as far as I know, is not an option if you don't control the AP. The AP you're using is probably ...
6
The implementation that I've seen of this is done by fiddling with the MAC forwarding table on the access point. Since the access point simply acts as a network bridge, it is fairly well suited to this kind of task. At the switching layer it is already collecting all of the heard (sometimes called learned) MACs and which interface it can be found on.
The ...
6
The vulnerability is not in allowing plaintext authentication, but in using plaintext authentication. For instance, an open telnet service on a Unix system does not make the Unix system weak -- the people who actually use that service do make it weak.
Human nature being what it is, when a service it available, people will use it, so this is a good reason to ...
6
WEP has a flaw that renders it essentially unsecure. If you look at How wep wireless security works? it explains in better detail.
WPA(2) has fixed that vulnerability but they also suffer from their own problems.
WPA significantly less secure than WPA2?
Wifi WPA cracking with reaver
How to get hold of and use WPA session keys?
6
WPA isn't that secure, but then again WPA2 is no great shakes either. The main risk is that WPA's encryption is easier to break, and implementing WPA versus WPA2 would make it easier for an attacker to discover your key, which is the same for all devices presuming you are running personal mode, even if you can run mixed WPA/WPA2. WPA and WPA2 share some of ...
6
While Android is the "official" OS on the device, the underlying OS on all Android phones is Linux. It's also the most popular Linux OS currently in use on smartphones. So if you see a phone that gets identified as running Linux, then it's probably Android.
The catch is that Android phones typically have NO network listening ports open at all, unless ...
6
If your WiFi router is hijacked (which is a bit more thorough than simply obtaining your WiFi password), then the attackers will be able to see every byte which leaves your computer or enters it. Your computer, by itself, ought to be safe. Theoretically, safe Web browsing is still possible thanks to SSL.
In practice, however, this means that the attackers ...
6
No, the spectrum that is used is well-known and not concealed. You can't conceal that activity is occurring, you can only prevent the SSID from being directly broadcast and encrypt the traffic such that the network can not be spied on without breaking the encryption. The fact that there is radio activity in the spectrum will be apparent to anyone listening ...
Only top voted, non community-wiki answers of a minimum length are eligible
