0

I can confirm an intrusion from an unknown MAC address (identified as a Realtek device), getting a new, valid IP from the DHCP pool, and using the network for roughly 1 hour.

The network is WPA2 - 1 each for 2.4Ghz and 5Ghz both with the same password. The 2.4Ghz network also includes a TP-Link extender, which creates its own SSID, but again with the same password. So a total of 3 networks with the same password.

WPS is disabled on all 3 networks.

This 40+ random password was set less than 10 days ago. It is certainly random, with the recommended mix of cases, numbers and symbols, generated by a reputed password manager. There are no proximal patterns I can find or think of, and no characters have been repeated - I made sure of that.

How is it possible for this network to have been compromised so quickly?

  1. Is it even theoretically possible for a 40-character random password to be cracked IN 10 DAYS with anything less than a few hundred multi-GPU setups? I don’t think anyone wants to “get” me that badly.

  2. Is it possible for a network to be intruded/joined without knowing the password at all? A version of the KRACK attack or something similar, targeted at the router or perhaps at the repeater.

  3. Is it possible to perform a LOCAL attack similar to KRACK or BlueBorne on one of the 10-ish client devices, that would have allowed the intruder to read the WiFi password off one of these clients, thus compromising the network?

  4. The extended network shows a security setting of [WPA-PSK-CCMP]-TKIP, in addition to [WPA2-PSK-CCMP]-TKIP. Whereas the original networks only have [WPA2-PSK-CCMP]-TKIP. Is this a possible vulnerability?

I do know this question is broad - but I am dealing with a very real intrusion here. I would gladly narrow down the possibilities and subsequently the question based on guidance from the community


Minor addendum: The clients are a typical mix of Android, iOS, streaming sticks, Windows, Mac, Printer. No other IoT or Linux however. There are some Bluetooth accessories strewn about.

Improve this question
7
  • What is exactly your wireless router brand, model, software version? Maybe you could check any CVEs related to this very router and the software installed on your wireless router?
    – LLub
    Commented Nov 11, 2019 at 6:13
  • Tenda AC10 and TP-Link WA850RE are the router and extender respectively. Both are patched to the manufacturer recommended latest updates, but have a laundry list of ever-growing CVEs - always had. But is an attack on the routers LOCALLY possible without already knowing the WiFi password?
    – Dev Kanchen
    Commented Nov 11, 2019 at 6:25
  • 2
    Are you able to say with certainty that the unknown device is not authorized? Is it possible that the unknown MAC is a result of MAC address randomization turned on in one of the clients?
    – tlng05
    Commented Nov 11, 2019 at 6:54
  • Yes I’m positive. All other devices were connected and online (with caveat to follow). MAC Address Randomization is not turned on any device. I’m aware iOS/Android do this in beacon frames (i might be wrong about exact terminology), but while associating, they stick to the hard-coded MAC Address. One device had just been shut down, the Windows PC, say with the name “Desktop-1234”. 5 minutes later an unknown device with a “Realtek” OUI came online, claiming to the router it’s “name” was “Desktop-1234”. I’m not sure what the terminology for “human-readable device name” is, nor the implications.
    – Dev Kanchen
    Commented Nov 11, 2019 at 7:19
  • Maybe he already has access to one computer, like an APT, and exfiltrate the password? Typing netsh wlan show profile <ssid> key=clear ain't that hard if he's already inside. As you seaid, cracking a 40-character password ain't ez task... unless... he already precomputed eveything for that SSID... I answered something like that in here
    – Azteca
    Commented Nov 11, 2019 at 17:02

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .