Tag Info

Hot answers tagged

58

Overview First, I learned a lot of my information from a combination of my amateur radio experience and an awesome talk I sat in at DEFCON 18. The majority of satellite systems are simple repeaters. The signal that comes in on a transponder is cleaned, amplified, and retransmitted. If you know the location and input frequency, and you pump more effective ...


33

First of all that would entirely depend on the encryption used by the access point. There are several types of possible encryption. Mostly on consumer wireless access points these are: WEP WPA WPA2 WPS WEP Let's first dive into WEP. WEP was the first algorithm used to secure wireless access points. Unfortunately it was discovered that WEP had some ...


27

More details here. High-end manufacturers use expensive challenge-response schemes (the key sends a request, the car answers with a challenge, and the key sends a reply derived from the challenge with some algorithm). Even so, such algorithms are proprietary, usually not reviewed, and could well be an example of "rolling your own crypto". There are ...


23

Monitor mode: Sniffing the packets in the air without connecting (associating) with any access point. Think of it like listening to people's conversations while you walk down the street. Promiscuous mode: Sniffing the packets after connecting to an access point. This is possible because the wireless-enabled devices send the data in the air but only "mark" ...


18

What would be required to hack a satellite (in general terms, any hack really)? When it comes to satellites, the word general does not apply. Almost every satellite, with very few exceptions is custom. Even the currently orbitng GPS satellites are not all the same: there are GPS IIA, GPS IIR, GPS IIR-M, and GPS IIF. I would venture that even satellites ...


13

From testing, I have demonstrated to clients that yes, both of these are possible. The machines are supposed to have a 1 to 1 relationship with the mouse, but for some types of mouse there aren't a lot of ID codes, so you can get overlap. The same is true for some wireless keyboards. Simplest solution: if you are worried at all, use wired devices


13

If someone knows my wifi password (be it WEP or WPA) what can they see on my screen? Do they just see URLs I visit, or can they see everything in my browser,....or can they see everything I do on my computer? Does using HTTPS make any difference? They can't see anything on your screen (unless you've enabled some sort of unencrypted remote desktop screen ...


12

In lieu of waxing elequent in a topic that I am only briefly versed, I will defer my response to a DEFCON talk I saw last year that will do at least three things: Blow your mind Expose vulnerabilities in Sats Enlighten your knowledge on the subject in painstaking detail (see item one) Here is the archived talk with video. This is a very nice guy (Matt ...


12

Older chargers used to just be a simple power supply - little more than a diode bridge, a capacitor and a voltage regulator IC. They supplied a steady voltage to the phone, often +5V. When USB connectivity arrived with modern phones, +5V became a standard and the supply pins on the USB header were used for charging just the same. The two data pins would be ...


12

Most WiFi routers have a browser-accessible admin interface (usually supplied with default passwords, that need changing...) showing connected clients. There is not, usually, a way to "kick them out", but there is a "MAC security" option. Not really so effective, since tools exist that allow modifying MACs of WiFis, but you can tell your router to only ...


12

Promiscuous Mode: Capture packets on a network that you have connected to. This is likely what you need to be in if you want to analyze packets (Wireshark, tcpdump, etc.) Monitor Mode: Capture packets regardless of connected network. No association to AP needed (and no authentication). Because it is not connected to a network, you can't process the ...


11

@ewanm89 is entirely correct. Securing the connection between ground control and a plane should be no different from securing any regular connection. The main issue is that the protocol designers are relying on security by obscurity. Obscurity through the relatively unknown protocol being used. Obscurity through what used to be relatively difficult to ...


10

The key here is what you define as "every day use" - if you work in an environment where the data is sensitive, your security policy should take into account the risk from wireless interception and if appropriate, the use of wireless devices should be forbidden. Faraday cage equivalents, such as shielded rooms/buildings may be appropriate but are obviously ...


9

One must also keep in mind that due to various considerations, primarily cost and regulations (depending on country), even your wired keyboard may be vulnerable to interception. A couple of researchers, Vuagnoux and Pasini, discovered that the EMI produced by the keyboard itself could be decoded into plain text. The paper they presented at USENIX Security ...


9

Not alone like a WPA/2 PSK attack, where you can simply capture the handshake and bruteforce. You'll need to capture the "Enterprise" authentication attempt. To do this, you can perform an "Evil Twin" attack that captures the authentication attempt, which can then be subsequently cracked. Here's an excellent presentation by Matt Neely of SecureState that ...


8

PEAP is an authentication protocol which reuses TLS to establish a secure sort-of tunnel between the client and the authentication server. Nominally, SSL/TLS uses a bidirectional full-duplex transport medium (such as a TCP connection) and provides a bidirectional full-duplex tunnel. However, the initial parts of SSL/TLS (the "handshake") can be expressed as ...


8

If your WiFi router is hijacked (which is a bit more thorough than simply obtaining your WiFi password), then the attackers will be able to see every byte which leaves your computer or enters it. Your computer, by itself, ought to be safe. Theoretically, safe Web browsing is still possible thanks to SSL. In practice, however, this means that the attackers ...


8

[ I'm first assuming you're isolating the guest network from your corporate network. Anything else would be irresponsible. ] I see three common options for guest access: no password, captive portal, or guest password. No password means no opportunity to give them chance to agree to your guest network policy. You risk legal trouble if a hidden neighbor ...


7

First, of all, I'm not expert on hacking satellites, I don't know how to turn GPS repeater into Death Star. What I find interesting is space exploration, travelling into space and so... Everything I'll write here is just something I read somewhere and it's all hypothetical. Satelitte hacking (yeah, I know it's not quite the same as hijacking it) is ...


7

I'm no pilot, or an aviation expert, but I'm going to stick my neck out on this one and call it a zero substance FUD and an attempt at using our general ignorance on avionic systems as a cheap way of advertising one's so called security expetise. I've read through the presentation (if reading is a proper term for browsing through a few only seemingly ...


7

[...] if I am authorized to use a wireless network, and after authenticating myself I use something like wireshark or airopeek to sniff packets, how is this any different than just wardriving open wireless networks w/o authentication? Wardriving generically refers to the activity of identifying accessible access points. The term 'wardriving' is a play on ...


7

Why are you using iptables rather than using good old Wireshark which is specifically made for this? Wireshark is a free and open-source packet analyzer and the ideal tool for performing these types of analysis. EDIT If you need to reinject the packets I would have a look at scapy in python.


7

The second article (Safaka et al) describes a protocol which is based on a roughly similar to the Cachin-Maurer protocol that I describe at the end of this answer. The premise is that there is a broadcast unreliable communication channels between the involved parties, so that when one party emits a list of "packets", all others see only some of the packets, ...


7

WiMax is a radio communications standard, so locating the origin of a broadcast signal is of course possible whenever you're transmitting. As implemented in cellular networks, such as LTE, the coverage will overlap and the protocol will provide means of switching between masts as you move between cells. This means you will likely be within contact from two ...


7

Though the OSI model is more often a source of confusion than enlightenment, it is here reasonably informative. The WiFi encryption occurs in layer 2 ("data link") because it strives to embody a security feature which is inherently related to the data link. Namely, WiFi was designed to be the over-the-air equivalent of wired Ethernet. In Ethernet networks, ...


6

WEP has a flaw that renders it essentially unsecure. If you look at How wep wireless security works? it explains in better detail. WPA(2) has fixed that vulnerability but they also suffer from their own problems. WPA significantly less secure than WPA2? Wifi WPA cracking with reaver How to get hold of and use WPA session keys?


6

On a virtual lab, assuming that you want to demo this with no physical hardware, I would recommend getting a .pcap of actual WEP traffic (wireshark or tcpdump will do for this) and rebroadcast it with a simple python script or a tool like tcprelay. Just setup two VMs on the same subnet and use one to broadcast and one to crack. One of the problems that ...


6

Let's not mix things. Modern cell phones can use at least three different "wireless" protocols: The main "phone" protocol, in all its incarnations (CDMA, GSM, GPRS, UMTS...), from which comes the expression "cell phone". The phone "number", SMS and voice channels use that. That's the protool for which you pay your provider. WiFi, aka "802.11". Shorter ...


6

You can technically start sniffing away without "connecting" to the network. Terry is correct, if the network is open (no encryption, WEP/WPA/WPA2) then you can just "Join" the network and sniff the traffic. However, you do not need to join the network to sniff the traffic. WLANs use radio frequencies, all you have to do is match the freq (channel) and ...



Only top voted, non community-wiki answers of a minimum length are eligible