Tag Info

Hot answers tagged

37

Fairly easy to be honest, all you need is to do is listen for Probe Requests. There is a nice blog explaining how to go about setting up a computer with BT5 to listen for them here. With a networking card that supports "Monitor mode", you are able to pick up so called "Probe requests". Once the networking card is set up to be in monitor mode you can use ...


29

More details here. High-end manufacturers use expensive challenge-response schemes (the key sends a request, the car answers with a challenge, and the key sends a reply derived from the challenge with some algorithm). Even so, such algorithms are proprietary, usually not reviewed, and could well be an example of "rolling your own crypto". There are ...


10

For example, using the great aircrack-ng, specifically the airodump-ng utility from it. The information you are looking for will show up under "Probes" in the lower section.


8

[ I'm first assuming you're isolating the guest network from your corporate network. Anything else would be irresponsible. ] I see three common options for guest access: no password, captive portal, or guest password. No password means no opportunity to give them chance to agree to your guest network policy. You risk legal trouble if a hidden neighbor ...


7

WiMax is a radio communications standard, so locating the origin of a broadcast signal is of course possible whenever you're transmitting. As implemented in cellular networks, such as LTE, the coverage will overlap and the protocol will provide means of switching between masts as you move between cells. This means you will likely be within contact from two ...


7

Though the OSI model is more often a source of confusion than enlightenment, it is here reasonably informative. The WiFi encryption occurs in layer 2 ("data link") because it strives to embody a security feature which is inherently related to the data link. Namely, WiFi was designed to be the over-the-air equivalent of wired Ethernet. In Ethernet networks, ...


6

What you are thinking of doing is incredible similar to an existing attack known as the karma attack, made popular by the super fun Wifi Pineapple. The basic principle behind the attack is for the attacker to setup an AP that responds to the wireless probe packets clients send out when attempting to connect to a previously trusted AP. By responding to each ...


6

It depends on what you put on that network. If you just want to provide a free Internet access then you can probably get away with it. Janitors, delivery people, and night vigils will benefit from the service. If the wireless network is for anything else related to work, then you have a big problem. Normal WiFi has a nominal range of about 100 meters ...


6

The evil twin attack works because with most versions of WPA there is no validation of the AP. When connecting to an AP a system authenticates trusts that the AP is what it says it is. This isn't a good design frankly, however we are stuck with it. WPA enterprise allows the use of certificates for verification of both AP and connecting system, however it ...


6

There are two main ways in which SSL/TLS and EAP may mix: EAP-TLS and EAP-TTLS. Basically, EAP is a generic protocol for exchanging "messages", and the "authentication method" defines the message contents. In the case of the TLS-based EAP methods, the messages contain the various handshake messages from SSL/TLS. In EAP-TLS, the normal case is that the client ...


6

This should work for most Linuxes: sudo apt-get install aircrack-ng sudo airmon-ng start <card> sudo airodump-ng mon0 This outputs a list of what all devices are trying to connect to. Some devices only probe networks that are available, however, as you suspected, smartphones probe all networks that they know about, no matter whether they are ...


5

Safe is a big word, and depending on how tempting of a target you are, achieving it in public might not be possible. XKCD #538 - Security that's rather popular here explains this pretty well:                             ...


5

After putting your wireless network card in monitor mode as mentioned in the other answers, you can do something like the following to print out MAC addresses and ssid. This code is dependent on the scapy library/tool. #!/usr/bin/env python from scapy.all import * conf.iface = "mon0" def handle_pkt(pkt): if Dot11 in pkt and pkt[Dot11].type == 0 and ...


4

Someone might be able to access your network from father away than you would expect using a cantenna of some sort. I doubt there are a huge number of people that would take advantage of this though, so it might not be a huge deal. An easy alternative is to have a secure network, but post a sign wherever people will be logging in that has the password on ...


4

Your phone or laptop will not necessarily automatically connect to that alternate AP, because even though it has a known SSID, it also has a MAC address which does not necessarily match the one at your home. Whether a given system will be ready to disregard the MAC address change depends on that system (from an explicit experiment at home, I can say that ...


4

Sure there is! In the absence of a "guest" SSID feature on your router, use one of the bands for guests/visitors, and the other band for private use. That way you can regularly change the password for the guest/visitor WiFi without disrupting connectivity on your own devices. Granted, this is more of a practical consideration (even though you do gain some ...


4

For WPA, The authentication process is known as a four-way handshake. It's a bit complex to describe but in short, the access point will know that there was an unsuccessful attempt to connect, but it will not know what key was actually supplied. Fortunately, this would mean that the bogus wifi ap will not be able to figure out the key to the "real" ap. ...


3

Short answer: Yes, change it. As long as you can ensure that the attacker is not able to break into your WiFi (using WPA2 is good beginning) and is also not able to get access by other ways (e.g. over VPN, weak WPA2 password, plugging a cable into your switch, malware on your devices, ...), theoretically there is no need to change the password. However, ...


3

Yes, “airplane mode” disables all methods through which the device voluntarily transmits information over wireless networks. That's the point. The device is still emitting, of course. For example it emits visible light: all information that is displayed on the screen can be snooped by shoulder surfing or hidden cameras. Even information that is not ...


3

MAC filtering is implemented by, indeed, ignoring packets whose source MAC address is deemed "inappropriate" by the access point. You won't get a response packet informing you that the access point does not wish to talk to you. You can test for a blacklist filter by temporarily changing the MAC address of your device: if the device can connect with another ...


3

As VMWare workstation provides USB Passthrough, it should be fine using USB wireless cards and doing testing from a kali/linux Virtual Machine. I say should as there's always a risk of bugs in how VMWare passes the data through to the guest VM, so it could have an impact in some circumstances. That said, my experience of VMWare Workstation and using USB ...


3

So several companies have a database of Wireless Access Points (Google, Apple, Skyhook). In terms of how the data is collected, I don't believe that any of the companies have made official statements on the matter, but there's a couple of likely avenues. First one point is that your wireless Access Point broadcasts it's BSSID address into, likely public, ...


3

Sure this is possible. There's a couple of ways to approach it. The easiest way is to run kismet then as you're running it look for your Rogue access point appearing on the list of access points seen. When it does, lock the channel that kismet is looking on to the channel being used by your rogue access point (this gives a clearer signal than if kismet is ...


3

Some of the options, such as Reaver's "ignore frame checksum errors" or Bully's "don't require ACKs" are technically violations of the WiFi spec, and can't be done by a device that's in managed mode. Additionally, I suspect that being in monitor mode is required to see the beacon packets that 1) tell if the AP supports WPS, and 2) tell if the AP has ...


3

Yes as there has been no exchange of password between client and AP. So it is pretty much impossible.


3

My approach to this was to use an OpenWRT (could be done with DDwrt or other similar projects) device (a TPlink 3600) and to use only tcpdump and monitor mode (not airodump). Using TCPdump lets you see all traffic (to profile area activity as well as watching for beacons/probes) The advantage to using a dedicated device is they are inexpensive, use little ...


3

It does indeed slightly facilitate a remote attack on your machine, since an attacker would be able to send you packets from your local network, rather than having to rely on NAT traversal from the router you use to connect to the Internet. You would still need to have network-facing services running on your machine, such as SMB/CIFS, Telnet, other protocols ...


2

This behavior is very similar to WIPSs (Wireless intrusion prevention system). A wireless intrusion prevention system (WIPS) is a network device that monitors the radio spectrum for the presence of unauthorized access points (intrusion detection), and can automatically take countermeasures (intrusion prevention).


2

WEP uses RC-4 for encryption, so by saying their encryption is AES means it has to be WPA2, not WEP or WPA. Almost all vendors offer WEP as an option in order to support legacy devices though, so that's not really an indicator. The fact that SSIDer showed it as WEP windows asked for a WEP key indicates it is simply a WEP-enabled access point.


2

Partly, yes...but mostly no - there are many other things that can identify you. The Media Access Control address is used on the local network segment only. Yes, it is (supposed) to be unique to each network interface device, and sometimes can be changed/spoofed. So to a slight extent, regularly changing your MAC address will provide you with some degree ...



Only top voted, non community-wiki answers of a minimum length are eligible