Tag Info

Hot answers tagged

38

Fairly easy to be honest, all you need is to do is listen for Probe Requests. There is a nice blog explaining how to go about setting up a computer with BT5 to listen for them here. With a networking card that supports "Monitor mode", you are able to pick up so called "Probe requests". Once the networking card is set up to be in monitor mode you can use ...


10

For example, using the great aircrack-ng, specifically the airodump-ng utility from it. The information you are looking for will show up under "Probes" in the lower section.


9

Hacking a television station is hard. Most of the broadcast infrastructure isn't connected to the Internet, making outside intrusion difficult or impossible. Let's say you want to hack your local news station. Problem #1 is that their equipment isn't connected to the Internet -- it's quite possible that they're still using a bank of Betamax machines for ...


7

Though the OSI model is more often a source of confusion than enlightenment, it is here reasonably informative. The WiFi encryption occurs in layer 2 ("data link") because it strives to embody a security feature which is inherently related to the data link. Namely, WiFi was designed to be the over-the-air equivalent of wired Ethernet. In Ethernet networks, ...


6

There are two main ways in which SSL/TLS and EAP may mix: EAP-TLS and EAP-TTLS. Basically, EAP is a generic protocol for exchanging "messages", and the "authentication method" defines the message contents. In the case of the TLS-based EAP methods, the messages contain the various handshake messages from SSL/TLS. In EAP-TLS, the normal case is that the client ...


6

The evil twin attack works because with most versions of WPA there is no validation of the AP. When connecting to an AP a system authenticates trusts that the AP is what it says it is. This isn't a good design frankly, however we are stuck with it. WPA enterprise allows the use of certificates for verification of both AP and connecting system, however it ...


6

This should work for most Linuxes: sudo apt-get install aircrack-ng sudo airmon-ng start <card> sudo airodump-ng mon0 This outputs a list of what all devices are trying to connect to. Some devices only probe networks that are available, however, as you suspected, smartphones probe all networks that they know about, no matter whether they are ...


6

For NFC technology, the main solution that has been offered to date is distance bounding, in which a tightly timed exchange of challenges and responses persuades the verfier that the prover cannot be further away than a certain distance. This solution, however, has some drawbacks: It still won't say whether the specific endpoint the verifier is talking to ...


5

Safe is a big word, and depending on how tempting of a target you are, achieving it in public might not be possible. XKCD #538 - Security that's rather popular here explains this pretty well:                             ...


5

After putting your wireless network card in monitor mode as mentioned in the other answers, you can do something like the following to print out MAC addresses and ssid. This code is dependent on the scapy library/tool. #!/usr/bin/env python from scapy.all import * conf.iface = "mon0" def handle_pkt(pkt): if Dot11 in pkt and pkt[Dot11].type == 0 and ...


5

A wireless network that is unprotected means that anyone can simply connect to your wireless access point, and collect all of your traffic. If users of the network aren't using HTTPS (SSL/TLS enabled) webpages then their passwords, usernames, and any other sensitive information would be unprotected. Using WPA2-PSK, the wireless access point uses the ...


4

Sure there is! In the absence of a "guest" SSID feature on your router, use one of the bands for guests/visitors, and the other band for private use. That way you can regularly change the password for the guest/visitor WiFi without disrupting connectivity on your own devices. Granted, this is more of a practical consideration (even though you do gain some ...


4

For WPA, The authentication process is known as a four-way handshake. It's a bit complex to describe but in short, the access point will know that there was an unsuccessful attempt to connect, but it will not know what key was actually supplied. Fortunately, this would mean that the bogus wifi ap will not be able to figure out the key to the "real" ap. ...


4

My understanding of NFC is that, as a standard, it doesn't offer any provision for encryption of data security. This means you'll have to implement security on top of it. So first: the important part: do not try to implement it yourself: You do not have the understanding necessary to design it properly (as demonstrated by your question) Even with proper ...


4

Your understanding is already pretty good. As you say, there are a variety of EAP protocols: LEAP, PEAP, EAP-FAST, EAP-TLS, etc. Each one works differently, but they all do the same thing: authenticate a user before allowing them access to a wireless network. You could call EAP a protocol, or you could call it a framework of protocols, where each variant ...


4

If you don't have permission, breaking into someone else's network is illegal regardless of why you're doing so. If you really want to learn about the security vulnerabilities of WPA-PSK and WEP, I recommend setting up your own AP and practice breaking into it.


4

Use a faraday cage. I have tried it before and managed to completing shield it such that it is unable to get any GSM or wifi signal. http://en.wikipedia.org/wiki/Faraday_cage A link on building simple homemade faraday cages : http://www.thesurvivalistblog.net/build-your-own-faraday-cage-heres-how/


3

Yes as there has been no exchange of password between client and AP. So it is pretty much impossible.


3

Sure this is possible. There's a couple of ways to approach it. The easiest way is to run kismet then as you're running it look for your Rogue access point appearing on the list of access points seen. When it does, lock the channel that kismet is looking on to the channel being used by your rogue access point (this gives a clearer signal than if kismet is ...


3

So several companies have a database of Wireless Access Points (Google, Apple, Skyhook). In terms of how the data is collected, I don't believe that any of the companies have made official statements on the matter, but there's a couple of likely avenues. First one point is that your wireless Access Point broadcasts it's BSSID address into, likely public, ...


3

As VMWare workstation provides USB Passthrough, it should be fine using USB wireless cards and doing testing from a kali/linux Virtual Machine. I say should as there's always a risk of bugs in how VMWare passes the data through to the guest VM, so it could have an impact in some circumstances. That said, my experience of VMWare Workstation and using USB ...


3

Some of the options, such as Reaver's "ignore frame checksum errors" or Bully's "don't require ACKs" are technically violations of the WiFi spec, and can't be done by a device that's in managed mode. Additionally, I suspect that being in monitor mode is required to see the beacon packets that 1) tell if the AP supports WPS, and 2) tell if the AP has ...


3

Short answer: Yes, change it. As long as you can ensure that the attacker is not able to break into your WiFi (using WPA2 is good beginning) and is also not able to get access by other ways (e.g. over VPN, weak WPA2 password, plugging a cable into your switch, malware on your devices, ...), theoretically there is no need to change the password. However, ...


3

My approach to this was to use an OpenWRT (could be done with DDwrt or other similar projects) device (a TPlink 3600) and to use only tcpdump and monitor mode (not airodump). Using TCPdump lets you see all traffic (to profile area activity as well as watching for beacons/probes) The advantage to using a dedicated device is they are inexpensive, use little ...


3

It does indeed slightly facilitate a remote attack on your machine, since an attacker would be able to send you packets from your local network, rather than having to rely on NAT traversal from the router you use to connect to the Internet. You would still need to have network-facing services running on your machine, such as SMB/CIFS, Telnet, other protocols ...


3

The part of WEP you describe isn't really a major weakness because most encryption algorithms in use today are immune to known-plaintext attacks. Basically, this means that having access to both the encrypted data and the decrypted plaintext will not help you figure out the key in any way - so "figuring out the password from here" would NOT be ...


2

No, it's not safe. Any time you're connecting to public wifi you're joining a network of potential attackers. It's possible you have other ports open which the attackers could exploit and gain system access. Unlikely, but possible.


2

Partly, yes...but mostly no - there are many other things that can identify you. The Media Access Control address is used on the local network segment only. Yes, it is (supposed) to be unique to each network interface device, and sometimes can be changed/spoofed. So to a slight extent, regularly changing your MAC address will provide you with some degree ...


2

You might be interested in this talk that was given at DEFCON a few years back. Summary: if you are using WPA2, a separate key is used to encrypt broadcast traffic vs. unicast traffic. So in that sense, connections are isolated from each other. HOWEVER, you're still vulnerable to an insider attack; a malicious client could spoof ARP and intercept traffic ...


2

Are you looking to monitor packets between your computer as a client on the network and the router and other wireless clients and the router? If you're using windows, it looks like the answer is yes: you'll need to purchase Airpcap. http://ask.wireshark.org/questions/8504/supported-adapters-for-wireless-packet-capturing If you're attempting to monitor at ...



Only top voted, non community-wiki answers of a minimum length are eligible