7

At 5:50 the video I Gave a Hacker 28 Days To Ruin My Life by Zac Alsop briefly describes a "pineapple" as a router masquerading as an AP of the office network. Once the victim devices are connected, they are serviced by a malicious DNS cache, leading them to fake websites of their Banks, social media sites, etc., where their login credentials are collected.

This oversimplified description leaves two questions in my head:

  1. WPA2/3 makes both clients and APs prove that they know the password during session key negotiation. Even if the legit APs are DoS'd and the clients have no other choice but to connect to the "pineapple", why would they do so if it can't authenticate itself? WPA2 being deactivated isn't really an option since they mention finding a WiFi password later at 14:06 when they break into the office. Does the attack hinge on finding the password in the break-in? Because they explicitly state that the attack can be deployed "from afar".

  2. Even if the victim's DNS queries lead them to the wrong web server, the server still has to present a valid TLS certificate that mentions the domain name for the browser to display the site without manual intervention from the user (which they presumably wouldn't do, since they knew they were being attacked). Does this attack also hinge on the break-in for manually planting untrustworthy CA public keys? Is there a trick that lets a malicious DNS cache forward the victim to a slightly misspelled domain, for which the attacker could then present a valid certificate? (Do browsers not demand the cert include the originally requested domain?)

Improve this question
1

1 Answer 1

Reset to default
9

As to 1):

WPA2-Personal with a preshared key (PSK) and WPA2-Enterprise with authentication methods like MSCHAPv2 are vulnerable to dictionary attacks. Since this attack is implemented by the WiFi Pineapple, it's presumably what the video is supposed to show.

As to 2):

It's correct that when HTTPS is used, it's not enough for an attacker to point the victim to the wrong IP address. An attack would only work under specific conditions, e.g., if the victim initially uses HTTP, and if there is no Strict Transport Security in effect for the target website. Planting a malicious CA through social engineering might also an option.

In any case, since the video is clearly made for the shock effect rather than a realistic assessment of security risks, I would take it with a grain of salt. Yes, the demonstrated attacks exist and can work, but a lot of details are never mentioned.

Improve this answer
3
  • 8
    This answer is too conservative. The Pineapple is snake oil and videos like that are utterly BS. Performing a dictionary attack on any WPA2+ network that's not a coffee shop is hopeless. All home devices come with a preconfigured random strong password that users don't bother to change. Performing an MITM through DNS spoofing is also mostly hopeless. Browser defaults to HTTPS, HSTS is ubiquitous where it matters, and phishing and break-in work at scale, not so much for targeted attacks. On top of that, you can easily do anything the Pineapple does with any distro (but Kali, that's for kids).
    – Margaret Bloom
    Commented Aug 17 at 11:09
  • 1
    @MargaretBloom company wifi passwords (non wpa-enterprise) can be more predictable ime, but it won't be caught by dictionaries still. You'd want to come up with patterns that include variations of the company name, some common words, common digits (recent years (2/4 digits), telephone, license plate, etc number associated with city, state etc), and then still not expect a good success rate.
    – ave
    Commented Aug 17 at 20:18
  • @MargaretBloom my home router password was den@1234. Devices with default credentials can be vulnerable in many cases.
    – eternalodballl
    Commented Aug 18 at 22:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .