Hot answers tagged wireless
44
Overview
First, I learned a lot of my information from a combination of my amateur radio experience and an awesome talk I sat in at DEFCON 18. The majority of satellite systems are simple repeaters. The signal that comes in on a transponder is cleaned, amplified, and retransmitted. If you know the location and input frequency, and you pump more effective ...
13
From testing, I have demonstrated to clients that yes, both of these are possible. The machines are supposed to have a 1 to 1 relationship with the mouse, but for some types of mouse there aren't a lot of ID codes, so you can get overlap.
The same is true for some wireless keyboards.
Simplest solution: if you are worried at all, use wired devices
13
What would be required to hack a satellite (in general terms, any hack really)?
When it comes to satellites, the word general does not apply. Almost every satellite, with very few exceptions is custom. Even the currently orbitng GPS satellites are not all the same: there are GPS IIA, GPS IIR, GPS IIR-M, and GPS IIF. I would venture that even satellites ...
12
Older chargers used to just be a simple power supply - little more than a diode bridge, a capacitor and a voltage regulator IC. They supplied a steady voltage to the phone, often +5V. When USB connectivity arrived with modern phones, +5V became a standard and the supply pins on the USB header were used for charging just the same. The two data pins would be ...
12
Most WiFi routers have a browser-accessible admin interface (usually supplied with default passwords, that need changing...) showing connected clients. There is not, usually, a way to "kick them out", but there is a "MAC security" option. Not really so effective, since tools exist that allow modifying MACs of WiFis, but you can tell your router to only ...
10
In lieu of waxing elequent in a topic that I am only briefly versed, I will defer my response to a DEFCON talk I saw last year that will do at least three things:
Blow your mind
Expose vulnerabilities in Sats
Enlighten your knowledge on the subject in painstaking detail (see item one)
Here is the archived talk with video. This is a very nice guy (Matt ...
10
@ewanm89 is entirely correct. Securing the connection between ground control and a plane should be no different from securing any regular connection.
The main issue is that the protocol designers are relying on security by obscurity. Obscurity through the relatively unknown protocol being used. Obscurity through what used to be relatively difficult to ...
8
In addition to the low-cost solutions presented in other answers, which rely on beaming signals at the satellites, there's the (significantly, like many orders of magnitude) more expensive technique borrowed from Ian Fleming's Moonraker of going up there and stealing the thing. You don't even really need to get it back, just pointing it in the wrong ...
8
The key here is what you define as "every day use" - if you work in an environment where the data is sensitive, your security policy should take into account the risk from wireless interception and if appropriate, the use of wireless devices should be forbidden.
Faraday cage equivalents, such as shielded rooms/buildings may be appropriate but are obviously ...
8
Not alone like a WPA/2 PSK attack, where you can simply capture the handshake and bruteforce.
You'll need to capture the "Enterprise" authentication attempt. To do this, you can perform an "Evil Twin" attack that captures the authentication attempt, which can then be subsequently cracked.
Here's an excellent presentation by Matt Neely of SecureState that ...
7
One must also keep in mind that due to various considerations, primarily cost and regulations (depending on country), even your wired keyboard may be vulnerable to interception. A couple of researchers, Vuagnoux and Pasini, discovered that the EMI produced by the keyboard itself could be decoded into plain text. The paper they presented at USENIX Security ...
7
PEAP is an authentication protocol which reuses TLS to establish a secure sort-of tunnel between the client and the authentication server. Nominally, SSL/TLS uses a bidirectional full-duplex transport medium (such as a TCP connection) and provides a bidirectional full-duplex tunnel. However, the initial parts of SSL/TLS (the "handshake") can be expressed as ...
7
If your WiFi router is hijacked (which is a bit more thorough than simply obtaining your WiFi password), then the attackers will be able to see every byte which leaves your computer or enters it. Your computer, by itself, ought to be safe. Theoretically, safe Web browsing is still possible thanks to SSL.
In practice, however, this means that the attackers ...
7
[...] if I am authorized to use a wireless network, and after authenticating myself I use something like wireshark or airopeek to sniff packets, how is this any different than just wardriving open wireless networks w/o authentication?
Wardriving generically refers to the activity of identifying accessible access points. The term 'wardriving' is a play on ...
6
WEP has a flaw that renders it essentially unsecure. If you look at How wep wireless security works? it explains in better detail.
WPA(2) has fixed that vulnerability but they also suffer from their own problems.
WPA significantly less secure than WPA2?
Wifi WPA cracking with reaver
How to get hold of and use WPA session keys?
6
On a virtual lab, assuming that you want to demo this with no physical hardware, I would recommend getting a .pcap of actual WEP traffic (wireshark or tcpdump will do for this) and rebroadcast it with a simple python script or a tool like tcprelay.
Just setup two VMs on the same subnet and use one to broadcast and one to crack. One of the problems that ...
6
Let's not mix things. Modern cell phones can use at least three different "wireless" protocols:
The main "phone" protocol, in all its incarnations (CDMA, GSM, GPRS, UMTS...), from which comes the expression "cell phone". The phone "number", SMS and voice channels use that. That's the protool for which you pay your provider.
WiFi, aka "802.11". Shorter ...
6
I'm no pilot, or an aviation expert, but I'm going to stick my neck out on this one and call it a zero substance FUD and an attempt at using our general ignorance on avionic systems as a cheap way of advertising one's so called security expetise.
I've read through the presentation (if reading is a proper term for browsing through a few only seemingly ...
6
You can technically start sniffing away without "connecting" to the network. Terry is correct, if the network is open (no encryption, WEP/WPA/WPA2) then you can just "Join" the network and sniff the traffic. However, you do not need to join the network to sniff the traffic. WLANs use radio frequencies, all you have to do is match the freq (channel) and ...
5
First, of all, I'm not expert on hacking satellites, I don't know how to turn GPS repeater into Death Star.
What I find interesting is space exploration, travelling into space and so... Everything I'll write here is just something I read somewhere and it's all hypothetical.
Satelitte hacking (yeah, I know it's not quite the same as hijacking it) is ...
5
If someone knows my wifi password (be it WEP or WPA) what can they see on my screen? Do they just see URLs I visit, or can they see everything in my browser,....or can they see everything I do on my computer? Does using HTTPS make any difference?
They can't see anything on your screen (unless you've enabled some sort of unencrypted remote desktop screen ...
4
Information regarding the current implementation of "4G" LTE, as well as the soon to be deployed true 4G LTE-A, can be found at the European Telecommunications Standards Institute (ETSI) website and portal.
3G networks use the KASUMI block cipher with the UEA1 confidentiality and UIA1 integrity algorithms. As you said, there have been several demonstrated ...
4
See: wiki on SIPRNet and NIPRNet.
Essentially the two are airgapped, and should not be interconnected at any point. In fact, measures are taken to prevent that very thing. Nevertheless humans are on both networks, which means the results are mixed.
4
Most routers (even retail wifi units) have an admin screen that lists all the active clients that have been allocated an IP address by DHCP. This usually lists the MAC address of the client too.
usually they look like this:
CLIENT NAME IP ADDRESS MAC ADDRESS
android_blah 192.168.1.10 AA-BB-CC-00-00-00
my_pc 192.168.1.11 ...
4
It is theoretically feasible, although normally used in the other direction by portable devices like the iPad: the device works out its own position with regards to WiFi access points which are in range. In your case, you would have to triangulate for the signals of all systems which emit packets on your WiFi, since you do not know which one is the culprit.
...
4
I'll answer this as best I can, since some of it is subjective or subject to change.
As I mentioned in a comment, the barrier to entry in terms of development is higher for layer 2 than it is layer 3, and cables are easier to interface with than radio waves. Most wireless technology involves firmware on a hardware device in order to translate the RF signals ...
4
The first step in any sort of MITM attack on a network is connecting to the network. With a wired network, that involves somehow connecting your machine to the network through the use of an Ethernet cable. With a wireless network, you just need to connect to the network.. well, wirelessly. Without a requiring a password to connect to a wireless network, ...
4
If it is truly unsecured wireless, then a simple packet sniffer should pick information on the wireless network out of the air though you may have to use special drivers if your wireless card normally only presents information that is being sent to your MAC address. Most passwords would still be secure though as they should be getting exchanged using secure ...
3
To quickly answer these:
Mostly no limits, assuming we're talking about WPA2. The password goes through a key-derivation algorithm, so the key is a fixed size regardless of password lengths. Some device vendors may put soft limits on their control panels, but these are usually pretty lax. I'd avoid unicode characters though, since they're not always ...
3
The actual physical layer or data link layer do not present a security concern as long as you force mutual authentication and use a properly secure ciphersuite.
There is no direct risk with physical layer access. There is a future risk with it.
As somebody with access to the physical layer or data link layer has the possibility to store all traffic ...
Only top voted, non community-wiki answers of a minimum length are eligible
