17

I have watched a hak5 YouTube that they did make people connect to their wifipineapple (a WiFi Honey pot) , and they stored the Wi-Fi hotspots, those the phone used to connect to.

The historical hotspots are many. I am wondering how they made it. If they simulated the SSID, should they replace it with another one seconds later?

Here's the Youtube video

28

You can't simply Force a client, but to trick him!

As long as the device's WiFi is running, it keeps sending probe requests, searching for your previous connected networks. Using some software like airodump-ng, you can easily sniff out those probes.
Then the attacker may create a similar evil twin using the BSSID and ESSID gathered from the previous probes.

So, as the device sees the pre-saved network up again, it re-connects thinking it is the legit network.

However, there is something to be aware of:
Only works with public networks. This does not work with secured networks unless you already know the security phrase.

Important note:
This attack also can be done to pre-saved networks with passphrase, if the passphrase is weak enough to be cracked. steps are:

  1. Create the evil twin networks using the BSSID, ESSID AND the same auth type of the spoofed network "WPA, WPA2 or WEP"
  2. The client will try to connect to the network providing the passphrase challenge
  3. The authentication won't work obviously, but you can sniff the challenge
  4. Using some cracking tool, you can crack the phrase
  5. Re-create the network using the new passphrase

Now the client will connect to the spoofed network even if it has some security level, so it's always a good idea to use a strong phrases!

  • You are right. Do you mean that all the pre-saved SSID should not have password in this scenario? Coz we can't simply know other pre-saved hotspot passwords. All the public networks shouldn't have password, right? – dotslash Jul 4 '16 at 6:43
  • Yes. all the pre-saved public networks are presenting a way to preform this kind of attacks, but you must know that even the secured networks are maybe vulnerable, if the key is compromised. – Emadeddin Jul 4 '16 at 6:47
  • I see. So the wifipineapple may just scan all the probes in the air and create different no-password SSID, those clients used to connect to, periodically, say every 5 minutes? So in this way, all the phones in this area can connect to the cloned router in a while. What would you think? – dotslash Jul 4 '16 at 6:54
  • Of course, any device that's scanning for the same network will connect to your spoofed AP. – Emadeddin Jul 4 '16 at 6:57
  • Nice. It would be awesome, if there are some open source projects like that. Thank you – dotslash Jul 4 '16 at 7:01
8

There are a few methods that could have been used:

  1. Devices of all sorts that use WiFi connection usually have a setting that lets the device connect automatically when the same SSID is out there. This is usually set by default and users do not usually turn it off.
    Hak5 generated a list of many many public WiFi SSID's (Ex: "MacDonald's free wifi") that the devices probably connected to at some point in their life time.
    Then the devices connect to the AP since they recognize the SSID.
    Note:

    • This is a setting that can be turned off easily or even a simple "Forget this network" solves the issue.
    • Some devices also have a settings that tells the device to connect automatically to any open WiFi. You can imagine the issue here...
  2. Another method is to scan the local area for all WiFi connections and duplicate the exact ones using their SSID and MAC address and then create a stronger signal forcing the connected devices to move to your AP (They see it as the same one).

  3. Some devices also send out requests searching for specific WiFi connection that they have in their history in order to reconnect. These requests can be captured and used against the device by faking the AP the device is requesting.

Note: These methods will only work using a open WiFi network that does not require a passphrase. If you do wish to spoof an AP with a passphrase, it would have to be the same passphrase as the original AP.

  • Nice. So can I assume that if the no-paasword WiFi SSID is the same as the one used be connected, say, McDonald, the phone would re-connect to it no matter it's another router actually? Right? – dotslash Jul 4 '16 at 6:28
  • Mostly. Some devices also do MAC & SSID comparing. – Bubble Hacker Jul 4 '16 at 6:30
  • Thanks. I did a test minutes ago. It turned out phones nowadays re-connect to the WiFi with the same SSID, even they are different router. For the next consideration, should the SSID be changed every several seconds to let all phones connect to it? – dotslash Jul 4 '16 at 6:37
  • @dotslash I didn't understand your question... – Bubble Hacker Jul 4 '16 at 6:38
  • I read your method 2. If we don't have the cloned hotspot passphrase, will the phone connect to pentester's cloned router, which has no password this time? – dotslash Jul 4 '16 at 6:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.