Tag Info

Hot answers tagged

33

First of all that would entirely depend on the encryption used by the access point. There are several types of possible encryption. Mostly on consumer wireless access points these are: WEP WPA WPA2 WPS WEP Let's first dive into WEP. WEP was the first algorithm used to secure wireless access points. Unfortunately it was discovered that WEP had some ...


27

More details here. High-end manufacturers use expensive challenge-response schemes (the key sends a request, the car answers with a challenge, and the key sends a reply derived from the challenge with some algorithm). Even so, such algorithms are proprietary, usually not reviewed, and could well be an example of "rolling your own crypto". There are ...


23

Monitor mode: Sniffing the packets in the air without connecting (associating) with any access point. Think of it like listening to people's conversations while you walk down the street. Promiscuous mode: Sniffing the packets after connecting to an access point. This is possible because the wireless-enabled devices send the data in the air but only "mark" ...


12

Promiscuous Mode: Capture packets on a network that you have connected to. This is likely what you need to be in if you want to analyze packets (Wireshark, tcpdump, etc.) Monitor Mode: Capture packets regardless of connected network. No association to AP needed (and no authentication). Because it is not connected to a network, you can't process the ...


8

[ I'm first assuming you're isolating the guest network from your corporate network. Anything else would be irresponsible. ] I see three common options for guest access: no password, captive portal, or guest password. No password means no opportunity to give them chance to agree to your guest network policy. You risk legal trouble if a hidden neighbor ...


7

The second article (Safaka et al) describes a protocol which is based on a roughly similar to the Cachin-Maurer protocol that I describe at the end of this answer. The premise is that there is a broadcast unreliable communication channels between the involved parties, so that when one party emits a list of "packets", all others see only some of the packets, ...


7

Why are you using iptables rather than using good old Wireshark which is specifically made for this? Wireshark is a free and open-source packet analyzer and the ideal tool for performing these types of analysis. EDIT If you need to reinject the packets I would have a look at scapy in python.


7

[...] if I am authorized to use a wireless network, and after authenticating myself I use something like wireshark or airopeek to sniff packets, how is this any different than just wardriving open wireless networks w/o authentication? Wardriving generically refers to the activity of identifying accessible access points. The term 'wardriving' is a play on ...


7

WiMax is a radio communications standard, so locating the origin of a broadcast signal is of course possible whenever you're transmitting. As implemented in cellular networks, such as LTE, the coverage will overlap and the protocol will provide means of switching between masts as you move between cells. This means you will likely be within contact from two ...


7

Though the OSI model is more often a source of confusion than enlightenment, it is here reasonably informative. The WiFi encryption occurs in layer 2 ("data link") because it strives to embody a security feature which is inherently related to the data link. Namely, WiFi was designed to be the over-the-air equivalent of wired Ethernet. In Ethernet networks, ...


6

You can technically start sniffing away without "connecting" to the network. Terry is correct, if the network is open (no encryption, WEP/WPA/WPA2) then you can just "Join" the network and sniff the traffic. However, you do not need to join the network to sniff the traffic. WLANs use radio frequencies, all you have to do is match the freq (channel) and ...


6

It depends on what you put on that network. If you just want to provide a free Internet access then you can probably get away with it. Janitors, delivery people, and night vigils will benefit from the service. If the wireless network is for anything else related to work, then you have a big problem. Normal WiFi has a nominal range of about 100 meters ...


6

The evil twin attack works because with most versions of WPA there is no validation of the AP. When connecting to an AP a system authenticates trusts that the AP is what it says it is. This isn't a good design frankly, however we are stuck with it. WPA enterprise allows the use of certificates for verification of both AP and connecting system, however it ...


6

There are two main ways in which SSL/TLS and EAP may mix: EAP-TLS and EAP-TTLS. Basically, EAP is a generic protocol for exchanging "messages", and the "authentication method" defines the message contents. In the case of the TLS-based EAP methods, the messages contain the various handshake messages from SSL/TLS. In EAP-TLS, the normal case is that the client ...


5

WPA can be used with different protocols. Using WPA-TKIP, there are alternative attacks than the common handshake-bruteforce, but those will not grant you access to the AP. These attacks focus on RC4 weaknesses (similar to WEP, but far less effective due to successful countermeasures). I assume that you want to acces an AP. In this case, bruteforcing is the ...


5

What you are thinking of doing is incredible similar to an existing attack known as the karma attack, made popular by the super fun Wifi Pineapple. The basic principle behind the attack is for the attacker to setup an AP that responds to the wireless probe packets clients send out when attempting to connect to a previously trusted AP. By responding to each ...


5

Safe is a big word, and depending on how tempting of a target you are, achieving it in public might not be possible. XKCD #538 - Security that's rather popular here explains this pretty well:                             ...


4

The first step in any sort of MITM attack on a network is connecting to the network. With a wired network, that involves somehow connecting your machine to the network through the use of an Ethernet cable. With a wireless network, you just need to connect to the network.. well, wirelessly. Without a requiring a password to connect to a wireless network, ...


4

If it is truly unsecured wireless, then a simple packet sniffer should pick information on the wireless network out of the air though you may have to use special drivers if your wireless card normally only presents information that is being sent to your MAC address. Most passwords would still be secure though as they should be getting exchanged using secure ...


4

Your phone or laptop will not necessarily automatically connect to that alternate AP, because even though it has a known SSID, it also has a MAC address which does not necessarily match the one at your home. Whether a given system will be ready to disregard the MAC address change depends on that system (from an explicit experiment at home, I can say that ...


4

Someone might be able to access your network from father away than you would expect using a cantenna of some sort. I doubt there are a huge number of people that would take advantage of this though, so it might not be a huge deal. An easy alternative is to have a secure network, but post a sign wherever people will be logging in that has the password on ...


4

Sure there is! In the absence of a "guest" SSID feature on your router, use one of the bands for guests/visitors, and the other band for private use. That way you can regularly change the password for the guest/visitor WiFi without disrupting connectivity on your own devices. Granted, this is more of a practical consideration (even though you do gain some ...


3

You can't detect if it's a wireless access point or not, what you can do is detect that a device was plugged in. With port security you can only allow your corporate devices to be plugged into the network whereas other detected apparatus will immediately cause the port to be shut down (white listing based on MAC address). Note that MAC spoofing is ...


3

From your description, I suppose that your router was configured such that: Using the WiFi entailed knowing the WiFi password, set to the password "blahblahblahblahblah". When contacting the router over IP (whether from the WiFi, or from the outside -- a router, by definition, routes data, so it is connected to at least two networks), it is possible to ...


3

If you're on a Linux machine, install ettercap and wireshark. First, find out your netmask (should be 255.255.255.0 for a normal home network). You can do this with ifconfig wlan0|grep Mask|sed s/^.*Mask://) Then, run: sudo ettercap -T -M -i wlan0 ARP // // -n 255.255.255.0 If you know the IP of the intruders, you can put it between the first slashes: ...


3

Tom's made some good points. This scheme is for a lossy network. Application level can use something like UDP, a ridiculous amount of packets and stats on sent vs received vs timing. It's not as good as the intended domain: lossy networks like wireless. So, it starts to sound hard to do and that's what I specialize in so why not take a stab anyway. ;) ...


3

Most sites with open wireless systems deal with abuse by not caring. And that's it. When police forces need to identify some villain and know that he connected to some wireless hotspot, e.g. in a bar, they resort to what police forces have always done since police exists: witnesses. Just ask everybody if they saw someone shifty or hacker-looking. In recent ...


3

Yes, “airplane mode” disables all methods through which the device voluntarily transmits information over wireless networks. That's the point. The device is still emitting, of course. For example it emits visible light: all information that is displayed on the screen can be snooped by shoulder surfing or hidden cameras. Even information that is not ...


3

As VMWare workstation provides USB Passthrough, it should be fine using USB wireless cards and doing testing from a kali/linux Virtual Machine. I say should as there's always a risk of bugs in how VMWare passes the data through to the guest VM, so it could have an impact in some circumstances. That said, my experience of VMWare Workstation and using USB ...


3

So several companies have a database of Wireless Access Points (Google, Apple, Skyhook). In terms of how the data is collected, I don't believe that any of the companies have made official statements on the matter, but there's a couple of likely avenues. First one point is that your wireless Access Point broadcasts it's BSSID address into, likely public, ...



Only top voted, non community-wiki answers of a minimum length are eligible