Tag Info

Hot answers tagged

38

Fairly easy to be honest, all you need is to do is listen for Probe Requests. There is a nice blog explaining how to go about setting up a computer with BT5 to listen for them here. With a networking card that supports "Monitor mode", you are able to pick up so called "Probe requests". Once the networking card is set up to be in monitor mode you can use ...


27

From a security perspective, I think you are asking the wrong question. WPA2 is the basic answer. But it's entirely incomplete! A more complete answer will view WPA2 as one component of your wireless network defence. Of course there's strong encryption methods using certificates/vpn etc but these are too difficult for most people to set up and are usually ...


25

In a nutshell, WPA2 is currently the most secure wireless security scheme. Personal and Enterprise It supports two main modes of authentication, known as WPA2-Personal and WPA2-Enterprise. The former utilises a pre-shared key (PSK) and is generally considered to be most suitable for home networks, whereas the latter is 802.1x which requires an ...


11

Hacking a television station is hard. Most of the broadcast infrastructure isn't connected to the Internet, making outside intrusion difficult or impossible. Let's say you want to hack your local news station. Problem #1 is that their equipment isn't connected to the Internet -- it's quite possible that they're still using a bank of Betamax machines for ...


10

For example, using the great aircrack-ng, specifically the airodump-ng utility from it. The information you are looking for will show up under "Probes" in the lower section.


10

Short answer is: use WPA2. WPA would be somewhat tolerable, but WPA2 should really be preferred. Do not use WEP, which is not really better than nothing (arguably, WEP is worse than nothing, because it gives to users the impression that security is happening, whereas it is not). More importantly, be sure to use a strong password (meaning: very random) and ...


10

Instead of continuing in the comments, I think I will just answer your real question, which I understand to be - why is using WPA/WPA2 Personal with a public SSID and Passphrase not more secure than having an open network, and why doesn't WPA/WPA2 Enterprise work in the coffee shop scenario. If the passphrase was public (as it would be in this scenario) ...


8

From what I've read, using https:// is safe. Is this true for networks set up for malicious purposes? If done right https is still safe. But, if you (actively) accept any kind of untrusted certificate (self-signed or signed by unknown CA) an active man-in-the-middle attack is possible. If the attacker owns a public root-CA or some intermediate CA or ...


7

Though the OSI model is more often a source of confusion than enlightenment, it is here reasonably informative. The WiFi encryption occurs in layer 2 ("data link") because it strives to embody a security feature which is inherently related to the data link. Namely, WiFi was designed to be the over-the-air equivalent of wired Ethernet. In Ethernet networks, ...


6

This should work for most Linuxes: sudo apt-get install aircrack-ng sudo airmon-ng start <card> sudo airodump-ng mon0 This outputs a list of what all devices are trying to connect to. Some devices only probe networks that are available, however, as you suspected, smartphones probe all networks that they know about, no matter whether they are ...


6

There are two main ways in which SSL/TLS and EAP may mix: EAP-TLS and EAP-TTLS. Basically, EAP is a generic protocol for exchanging "messages", and the "authentication method" defines the message contents. In the case of the TLS-based EAP methods, the messages contain the various handshake messages from SSL/TLS. In EAP-TLS, the normal case is that the client ...


6

For NFC technology, the main solution that has been offered to date is distance bounding, in which a tightly timed exchange of challenges and responses persuades the verfier that the prover cannot be further away than a certain distance. This solution, however, has some drawbacks: It still won't say whether the specific endpoint the verifier is talking to ...


5

After putting your wireless network card in monitor mode as mentioned in the other answers, you can do something like the following to print out MAC addresses and ssid. This code is dependent on the scapy library/tool. #!/usr/bin/env python from scapy.all import * conf.iface = "mon0" def handle_pkt(pkt): if Dot11 in pkt and pkt[Dot11].type == 0 and ...


5

A wireless network that is unprotected means that anyone can simply connect to your wireless access point, and collect all of your traffic. If users of the network aren't using HTTPS (SSL/TLS enabled) webpages then their passwords, usernames, and any other sensitive information would be unprotected. Using WPA2-PSK, the wireless access point uses the ...


4

If you don't have permission, breaking into someone else's network is illegal regardless of why you're doing so. If you really want to learn about the security vulnerabilities of WPA-PSK and WEP, I recommend setting up your own AP and practice breaking into it.


4

Your understanding is already pretty good. As you say, there are a variety of EAP protocols: LEAP, PEAP, EAP-FAST, EAP-TLS, etc. Each one works differently, but they all do the same thing: authenticate a user before allowing them access to a wireless network. You could call EAP a protocol, or you could call it a framework of protocols, where each variant ...


4

My understanding of NFC is that, as a standard, it doesn't offer any provision for encryption of data security. This means you'll have to implement security on top of it. So first: the important part: do not try to implement it yourself: You do not have the understanding necessary to design it properly (as demonstrated by your question) Even with proper ...


4

For WPA, The authentication process is known as a four-way handshake. It's a bit complex to describe but in short, the access point will know that there was an unsuccessful attempt to connect, but it will not know what key was actually supplied. Fortunately, this would mean that the bogus wifi ap will not be able to figure out the key to the "real" ap. ...


4

It does indeed slightly facilitate a remote attack on your machine, since an attacker would be able to send you packets from your local network, rather than having to rely on NAT traversal from the router you use to connect to the Internet. You would still need to have network-facing services running on your machine, such as SMB/CIFS, Telnet, other protocols ...


4

Use a faraday cage. I have tried it before and managed to completing shield it such that it is unable to get any GSM or wifi signal. http://en.wikipedia.org/wiki/Faraday_cage A link on building simple homemade faraday cages : http://www.thesurvivalistblog.net/build-your-own-faraday-cage-heres-how/


4

First of all, you need to disable SSLv3 on your browser, to prevent POODLE attack (SSL3 "POODLE" Vulnerability) Then, there's no issue using HTTPS even in "not safe" areas, because TLS protect you from Man In The Middle attack, with handshake, end-to-end encryption and Certificate Chain verfication. One common problem you could encounter, is SSL ...


3

My approach to this was to use an OpenWRT (could be done with DDwrt or other similar projects) device (a TPlink 3600) and to use only tcpdump and monitor mode (not airodump). Using TCPdump lets you see all traffic (to profile area activity as well as watching for beacons/probes) The advantage to using a dedicated device is they are inexpensive, use little ...


3

The part of WEP you describe isn't really a major weakness because most encryption algorithms in use today are immune to known-plaintext attacks. Basically, this means that having access to both the encrypted data and the decrypted plaintext will not help you figure out the key in any way - so "figuring out the password from here" would NOT be ...


3

Here's a whitepaper from logitech on the technology. They seem to believe it is secure, and apparently the two devices are paired at the factory. The actual key never gets broadcast. It has a short range of about 33 feet. It certainly isn't 100%, but if you're worried about the NSA... I doubt this is your biggest problem. A regular keyboard is most likely ...


3

In my context, the asia-pacific region, it's about 50-50 between secured WPA/WPA2 and unsecured. If you have a look at wigle.net you could find out exactly, however it's a lot of work, because you'll have to do quite a bit of filtering etc for actual coffee shops and not just commercial or personal networks, but you'll get a good broad picture anyway. For a ...


3

In "Promiscous mode", the driver still outputs standard ethernet frames belonging to the one wireless network you are currently associated to (identified by the BSSID). Possibly the device will only dump packets from the AP to wireless devices, but not packets from wireless clients to the AP, as receiving packets from non-AP devices is not used in AP client ...


3

For the first question, your MAC address is simply not generally considered sensitive information; protocols are not designed to protect it. MAC addresses are used to let multiple devices share a physical link; packets have a source MAC and destination MAC, so that everyone but the destination knows they can ignore the packet and the destination knows which ...


3

Can This be done? I would say yes, but with some caveats. Depending on the cable and the data, you would need some very expensive / sensitive equipment to pull this off. To me this is a similar issue to the old Van Eck Phreaking (http://en.wikipedia.org/wiki/Van_Eck_phreaking). Intel has some tech to circumvent this kind of attack: ...


2

Here's a relevant excerpt from a blogpost I did on here a few months ago: WPA generally uses Temporal Key Integrity Protocol (TKIP). TKIP was designed by the IEEE 802.11i task group and the Wi-Fi Alliance as a solution to replace WEP without requiring the replacement of legacy hardware. This was necessary because the breaking of WEP had left WiFi networks ...


2

In short, yes. I'm convinced the next wave of home PC compromises will stem from devices that we don't give a second thought about, such as TV's, BluRay players, Streaming Music Devices, etc that are connected to the internet through our home routers. But, before I get sidetracked..... The reasons it may be easier for your machine to be compromised by ...



Only top voted, non community-wiki answers of a minimum length are eligible