4

For example, my computer displays a list of wifi network in range, even it doesn't connect to any of them.

I don't know wifi protocol so I don't know whether my computer must actively send information out, e.g. handshake, ack..., in order to get the information of the networks, or it only listens passively?

If it sends information out, can others know about my computer and attack it even if I don't connect to any of those networks?

The question is not only applied to wifi but any other type of wireless connection.

Improve this question
3

Most modern OSes have services that are responsible for parsing data received by the wireless interfaces, and if the code responsible for that is vulnerable your machine could be compromised.

The only way to be safe is to tell the OS to completely disable the interfaces or at the very least ignore data received by them (on Linux for example you could kill the wpa_supplicant process). This is made more complicated by some OSes as for example Google, in an attempt to violate everyone's privacy even more, has added this "always-on Wi-Fi feature" to Android where the device will scan for networks (and be vulnerable as a result) even when the Wi-Fi is turned off, in an attempt to improve location services.

A fail-safe way to protect your machine no matter what the OS has to say is to disable the wireless interfaces using the hardware switches - that would prevent the radio hardware from working unless it was specifically designed to ignore the hardware switch but we're not there just yet.

Improve this answer
5
  • take an experiemnt: Windows 10 laptop, cable and wifi, connect to the same router. then disable the wifi - everything OK, unplug the cable - and OPS.... you can try it. Windows 10 Home is behaving such a weird way, Pro edition too – Alexey Vesnin Mar 18 '16 at 19:43
  • @AlexeyVesnin I don't actually have a way to try it, but I guess the Wi-Fi magically enables itself? It wouldn't surprise me as Microsoft is becoming even more evil than Google lately. – André Borie Mar 18 '16 at 19:44
  • yes, you're correct. And - a KILLER! Even disabling by notebook hotkey on some models is bypassed by Win10 – Alexey Vesnin Mar 18 '16 at 20:01
  • @AlexeyVesnin the hotkeys are exactly the same as disabling the Wi-Fi using the software switch (on Win8 an above), it's the software rfkill. The almost bulletproof one is the hardware rfkill which is enforced by the network interface card itself - you'll need to replace its firmware to override it - still not completely bulletproof but extremely challenging to bypass. – André Borie Mar 18 '16 at 20:21
  • somewhere - yes, but in some models they are stated to be "motherboard self-management". For example - installing FreeBSD on such a laptop won't have a driver for some SMB things(checked it myself), and in Win7 it can not be enabled unless hotkey "reattached it". In FreeBSD syslog you'll see "device detached" and "attached" as a hardware hotswap ones, seems to be OK. BUT IN Win10 I suppose some undocumented BIOS functions are used - and it pop's UP! – Alexey Vesnin Mar 18 '16 at 20:25
2

Your wireless ifaces can be a source of your location leak : by listing "nearby's" and parsing the info about them. Either you're using wireless iface, or you physically disconnect/poweroff it and detaching an antenna afterwards.

Improve this answer
10
  • 2
    This is not entirely correct. Wi-Fi passive scanning has no leakage as nothing is transmitted; only active scanning actually leaks information about the machine's location, MAC address and its known networks. – André Borie Mar 18 '16 at 19:35
  • 1
    yes, but in a scale of Google or like that if some MAC's are leaking their GPS/location data somehow, and you can list them in a neighborhood and see a signal strength - it's not so difficult to pinpoint your location even if you don't have a GPS and GSM/cellular units at all For example : here – Alexey Vesnin Mar 18 '16 at 19:37
  • 1
    Your link describes locating an access point, which transmits by design. Clients, on the other hand, do not need to transmit and can be configured (well, at least on Linux) to be entirely passive until they actually connect to an AP and start transmitting data. – André Borie Mar 18 '16 at 19:39
  • @AndréBorie The similar mechanism is used to locate a client too. I pointed you to the well-known implementation, but it's not the only one. I used to be related with such a tracking system, and I can say - it's possible – Alexey Vesnin Mar 18 '16 at 19:41
  • 2
    It is only possible if the client is actually transmitting though, which means it is either associated with an AP or at the very least doing active scans. Purely passive scanning is possible and will go undetected by such techniques. – André Borie Mar 18 '16 at 19:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.