Hot answers tagged

13

When you use Tor, all data is encrypted between your computer and the exit node. As long as the exit node isn't on the same network that you are on (very, very unlikely to occur), the data will be protected from the local network. Note that meta data such as the fact that you're using Tor and rough estimates of how much data you are communicating may be ...


5

The focus of Tor is not privacy, but anonymity. When you use Tor, your traffic is protected under multiple layers of encryption as it bounces between relay nodes, before it finally reaches and is decrypted by the exit node. The exit node finally sends your traffic to the intended destination and the reply back to you through the Tor network. This setup has ...


4

Remember, SIM is "subscriber identity module." It identifies itself to the mobile carrier each time it talks to a cell site, and the carrier knows which cell site. The best you can hope for is that it will stop working when the original owner gets the next bill. At worst, you could be tracked down with a cell site simulator (aka "stingray") and charged ...


3

Here's a reasonable metaphor (I think). Imagine you're going to deliver a message to someone and you're gonna mail it on a postcard. That is, anyone who can get their hands on the postcard can read your message. Now, you pick 3 random citizens to help you—A, B, and C. You put C's address on an envelope and you put the postcard inside. Then you put B's ...


2

My guess is that your visitor is owning a Windows Phone. A windows phone does not announce what SSID networks it is looking for, but instead, it will wait for an access-point to announce its presence before connecting to it. This can be the reason why you never saw your visitors phone - it had no need to waste power or privacy on looking for a network it ...


2

As Julian said, the lack of HTTPS allows for man-in-the-middle attacks. He also mentioned access point spoofing, which are relatively common, especially in certain countries. What else should I be aware of? I'm of the opinion that authentication is the least of your worries. Without properly-implemented https, a man-in-the-middle attack - which can be ...


2

The act of setting up an evil twin is not sniffing, but the generally accepted definition (CISSP) is that the purpose of the evil twin attack is to harvest credentials, etc. It might also be argued that the evil twin attack is not strictly a sniffing attack if the attacker only uses it to DoS the people on the network.


2

Pentesters do not use any "common" routers. As a pentester you should be able to perform a penetration test on any device. If a device is too difficult, it means you need to try harder.


2

There are solutions already on the market provided by several vendors. These include client isolation (clients are not allowed to talk to eachother using the wireless access point as medium). Other mitigating techniques include wireless IPS which detect MAC spoofing. MAC spoofing is nescesary when the attacker wants to trick the client in thinking he/she is ...


2

This is half speculative but worth a consideration. While it is certainly possible to snoop on traffic the chances anyone will bother in general is very small. On the other hand if you specifically are a target then your laptop will be bugged and this is what I would be much more worried about. How's your personal opsec?



Only top voted, non community-wiki answers of a minimum length are eligible