Tag Info

New answers tagged


The good AP should have a trusted fingerprint of its self-signed* certificate. I think that's automated as "certificate pinning" - What is certificate pinning? *: Self-signed because not all CAs are trustworthy.


EAPOL used to create keying material instead of PSK for WEP. But after deriving key dynamically WEP password is still easyly crackable. I don't think that you can find a lot of articles about it cause it's very rare combination WEP+EAPOL I don't know any AP that supports this mode.


WPS does not seem to be a well implemented technology. If you reverse engineer the firmware, you may find that the algorithm is MAC based, etc (such as in the case of some D-Link Routers or Belkin). It also looks like in many cases that implementation weaknesses also permit brute forcing (also see CERT VU#723755) to be done easily. This is supposedly open ...


If I remember right, you are fairly limited in the choice of wireless NICs for a NUC to begin with. I have a NUC, but never installed a wireless NIC. I would go with the one Intel recommends (which is, not surprisingly, an Intel NIC). Of course, you can also always use a USB NIC.


I dont have a NUC but if you want to do wireless testing you'll want a card capable of packet injection and promiscuous mode. I use the Alfa AWUS036H card (you may want to get a newer model) with kali linux and have no problems. From there you'll want to use the aircrack-ng suite of tools at minimum.


One really simple way, if you're the network administrator, is to have a host that is attached to your physical network. So a quick ping to it, will reveal if you've been sidelined to another network. In the use case of you being in a public area, then using a vpn might be a good idea.


For detecting an Evil Twin attack with a standard setup, the only information you really have and the SSID, The MAC address of the wireless access point, and the DHCP IP address, gateway, and DNS server that it hands out. Apart from that, you might find the evil twin using a different frequency than the original, like the true AP being on 2.4GHz and the evil ...


Tell the barrista/clerk/etc the wifi has gone down, can they reboot the router. Most people will happily do so, bringing the AP down for a moment, and exposing the evil twin router in the process as any active network that survives a power cycle. If there is more than 1 evil twin router, this still works. If there are multiple good routers, this would ...


There is one thing an evil twin can't copy: location. Set up three computers, then triangulate it. Or have some sort of time detector. If one of them is responding fast enough that you know, according to the speed of light, they must be within the store, then you know that it will be in the store, which is helpful if delays make triangulation harder. Note: ...


Traditionally there hasnt been an easy user-oriented method to detect evil twin attacks. Most attempts to detect an evil twin attack (ETA) are geared towards the administrator of a network where they basically have the authorised network admins scanning and comparing wireless traffic. This isnt so much of what you are interested in. There is a paper here ...


They're both evil. You shouldn't be connecting to any "Free Public Wifi" without assuming that all your unencrypted traffic will be monitored and modified. The best solution is to not connect to public networks at all, but if that's not an option for you then you can protect yourself a little more by specifying your own DNS (rather than letting the router ...


WPA2 is just a commercial name for a complete implementation of the 802.11i specification (WPA implemented only a part of it as a temporary measure against WEP weakness). 802.11i is an amendment to the original 802.11 specification, which means that it replaced several part from it, the original content becoming deprecated and a new revision of the 802.11 ...


No, unlike HTTP Basic authentication, the password isn't sent in cleartext (or obfuscated) form across the air. The weakest form of WiFi security is WEP. Don't use it, it can be cracked, but not in the way you describe. The password is used to create an encrypted tunnel as described here http://en.wikipedia.org/wiki/Wired_Equivalent_Privacy


No, because each time you try to connect to your router it will require your computer to authenticate, not only that but the router's SSID is unique even if it's shared with another router in the same location. The reason lies not in the name but in the combination of the router's specific frequency, ip address, dns settings, ips predetermined proxy ...

Top 50 recent answers are included