Tag Info

Hot answers tagged

61

Overview First, I learned a lot of my information from a combination of my amateur radio experience and an awesome talk I sat in at DEFCON 18. The majority of satellite systems are simple repeaters. The signal that comes in on a transponder is cleaned, amplified, and retransmitted. If you know the location and input frequency, and you pump more effective ...


38

Fairly easy to be honest, all you need is to do is listen for Probe Requests. There is a nice blog explaining how to go about setting up a computer with BT5 to listen for them here. With a networking card that supports "Monitor mode", you are able to pick up so called "Probe requests". Once the networking card is set up to be in monitor mode you can use ...


36

First of all that would entirely depend on the encryption used by the access point. There are several types of possible encryption. Mostly on consumer wireless access points these are: WEP WPA WPA2 WPS WEP Let's first dive into WEP. WEP was the first algorithm used to secure wireless access points. Unfortunately it was discovered that WEP had some ...


29

More details here. High-end manufacturers use expensive challenge-response schemes (the key sends a request, the car answers with a challenge, and the key sends a reply derived from the challenge with some algorithm). Even so, such algorithms are proprietary, usually not reviewed, and could well be an example of "rolling your own crypto". There are ...


24

Monitor mode: Sniffing the packets in the air without connecting (associating) with any access point. Think of it like listening to people's conversations while you walk down the street. Promiscuous mode: Sniffing the packets after connecting to an access point. This is possible because the wireless-enabled devices send the data in the air but only "mark" ...


19

What would be required to hack a satellite (in general terms, any hack really)? When it comes to satellites, the word general does not apply. Almost every satellite, with very few exceptions is custom. Even the currently orbiting GPS satellites are not all the same: there are GPS IIA, GPS IIR, GPS IIR-M, and GPS IIF. I would venture that even satellites ...


18

If someone knows my wifi password (be it WEP or WPA) what can they see on my screen? Do they just see URLs I visit, or can they see everything in my browser,....or can they see everything I do on my computer? Does using HTTPS make any difference? They can't see anything on your screen (unless you've enabled some sort of unencrypted remote desktop screen ...


13

From testing, I have demonstrated to clients that yes, both of these are possible. The machines are supposed to have a 1 to 1 relationship with the mouse, but for some types of mouse there aren't a lot of ID codes, so you can get overlap. The same is true for some wireless keyboards. Simplest solution: if you are worried at all, use wired devices


12

Older chargers used to just be a simple power supply - little more than a diode bridge, a capacitor and a voltage regulator IC. They supplied a steady voltage to the phone, often +5V. When USB connectivity arrived with modern phones, +5V became a standard and the supply pins on the USB header were used for charging just the same. The two data pins would be ...


12

In lieu of waxing elequent in a topic that I am only briefly versed, I will defer my response to a DEFCON talk I saw last year that will do at least three things: Blow your mind Expose vulnerabilities in Sats Enlighten your knowledge on the subject in painstaking detail (see item one) Here is the archived talk with video. This is a very nice guy (Matt ...


12

Most WiFi routers have a browser-accessible admin interface (usually supplied with default passwords, that need changing...) showing connected clients. There is not, usually, a way to "kick them out", but there is a "MAC security" option. Not really so effective, since tools exist that allow modifying MACs of WiFis, but you can tell your router to only ...


12

Promiscuous Mode: Capture packets on a network that you have connected to. This is likely what you need to be in if you want to analyze packets (Wireshark, tcpdump, etc.) Monitor Mode: Capture packets regardless of connected network. No association to AP needed (and no authentication). Because it is not connected to a network, you can't process the ...


11

The key here is what you define as "every day use" - if you work in an environment where the data is sensitive, your security policy should take into account the risk from wireless interception and if appropriate, the use of wireless devices should be forbidden. Faraday cage equivalents, such as shielded rooms/buildings may be appropriate but are obviously ...


11

@ewanm89 is entirely correct. Securing the connection between ground control and a plane should be no different from securing any regular connection. The main issue is that the protocol designers are relying on security by obscurity. Obscurity through the relatively unknown protocol being used. Obscurity through what used to be relatively difficult to ...


10

For example, using the great aircrack-ng, specifically the airodump-ng utility from it. The information you are looking for will show up under "Probes" in the lower section.


9

One must also keep in mind that due to various considerations, primarily cost and regulations (depending on country), even your wired keyboard may be vulnerable to interception. A couple of researchers, Vuagnoux and Pasini, discovered that the EMI produced by the keyboard itself could be decoded into plain text. The paper they presented at USENIX Security ...


9

Not alone like a WPA/2 PSK attack, where you can simply capture the handshake and bruteforce. You'll need to capture the "Enterprise" authentication attempt. To do this, you can perform an "Evil Twin" attack that captures the authentication attempt, which can then be subsequently cracked. Here's an excellent presentation by Matt Neely of SecureState that ...


9

If your WiFi router is hijacked (which is a bit more thorough than simply obtaining your WiFi password), then the attackers will be able to see every byte which leaves your computer or enters it. Your computer, by itself, ought to be safe. Theoretically, safe Web browsing is still possible thanks to SSL. In practice, however, this means that the attackers ...


9

Hacking a television station is hard. Most of the broadcast infrastructure isn't connected to the Internet, making outside intrusion difficult or impossible. Let's say you want to hack your local news station. Problem #1 is that their equipment isn't connected to the Internet -- it's quite possible that they're still using a bank of Betamax machines for ...


8

PEAP is an authentication protocol which reuses TLS to establish a secure sort-of tunnel between the client and the authentication server. Nominally, SSL/TLS uses a bidirectional full-duplex transport medium (such as a TCP connection) and provides a bidirectional full-duplex tunnel. However, the initial parts of SSL/TLS (the "handshake") can be expressed as ...


8

[ I'm first assuming you're isolating the guest network from your corporate network. Anything else would be irresponsible. ] I see three common options for guest access: no password, captive portal, or guest password. No password means no opportunity to give them chance to agree to your guest network policy. You risk legal trouble if a hidden neighbor ...


7

The second article (Safaka et al) describes a protocol which is based on a roughly similar to the Cachin-Maurer protocol that I describe at the end of this answer. The premise is that there is a broadcast unreliable communication channels between the involved parties, so that when one party emits a list of "packets", all others see only some of the packets, ...


7

First, of all, I'm not expert on hacking satellites, I don't know how to turn GPS repeater into Death Star. What I find interesting is space exploration, travelling into space and so... Everything I'll write here is just something I read somewhere and it's all hypothetical. Satelitte hacking (yeah, I know it's not quite the same as hijacking it) is ...


7

I'm no pilot, or an aviation expert, but I'm going to stick my neck out on this one and call it a zero substance FUD and an attempt at using our general ignorance on avionic systems as a cheap way of advertising one's so called security expetise. I've read through the presentation (if reading is a proper term for browsing through a few only seemingly ...


7

[...] if I am authorized to use a wireless network, and after authenticating myself I use something like wireshark or airopeek to sniff packets, how is this any different than just wardriving open wireless networks w/o authentication? Wardriving generically refers to the activity of identifying accessible access points. The term 'wardriving' is a play on ...


7

Why are you using iptables rather than using good old Wireshark which is specifically made for this? Wireshark is a free and open-source packet analyzer and the ideal tool for performing these types of analysis. EDIT If you need to reinject the packets I would have a look at scapy in python.


7

WiMax is a radio communications standard, so locating the origin of a broadcast signal is of course possible whenever you're transmitting. As implemented in cellular networks, such as LTE, the coverage will overlap and the protocol will provide means of switching between masts as you move between cells. This means you will likely be within contact from two ...


7

Though the OSI model is more often a source of confusion than enlightenment, it is here reasonably informative. The WiFi encryption occurs in layer 2 ("data link") because it strives to embody a security feature which is inherently related to the data link. Namely, WiFi was designed to be the over-the-air equivalent of wired Ethernet. In Ethernet networks, ...


6

On a virtual lab, assuming that you want to demo this with no physical hardware, I would recommend getting a .pcap of actual WEP traffic (wireshark or tcpdump will do for this) and rebroadcast it with a simple python script or a tool like tcprelay. Just setup two VMs on the same subnet and use one to broadcast and one to crack. One of the problems that ...



Only top voted, non community-wiki answers of a minimum length are eligible