0

we have several authorized users on our WiFi (school). it appears that one of them has a program to deny service to others. do you know any of these programs and what can be done to prevent this?

5
  • What kind of authentication do you have set up on the network? If it's WPA-PSK then just change the PSK (password), if it's WPA-Enterprise then revoke their access on your radius server. Aug 15, 2016 at 12:57
  • 1
    If you're in a school, you should have an IT team. Get them to check where most of the packets are being sent and received, from what computer and who is logged in.
    – Xanmashi
    Aug 15, 2016 at 13:04
  • This: youtu.be/N22YyheMW-c?t=13s
    – iAdjunct
    Aug 15, 2016 at 14:19
  • 1
    Who are you? student? teacher? IT guy? teacher who has to play IT guy because your school is too small to have a proper IT department? Aug 15, 2016 at 15:04
  • @Jedi - it is specifically phrased as asking what programs may be used, but more importantly how to stop it and secure against these kinds of attacks.
    – iAdjunct
    Aug 15, 2016 at 17:07

2 Answers 2

1

There are several ways an attacker can deny people's access to Internet.

For example SYN flood or MitM.

MitM is more probable and much more efficient though, popular app WifiKill uses this principle (it makes the device(s) think that it's the router and then it drops all their packets)

I suggest:

  • start intercepting traffic
  • once you're sure that an attack has happened already, stop intercepting
  • open the capture file in Wireshark

Analysis:

Write down your router's MAC address and local address.

Type "arp" into the Wireshark filter box to see the ARP packets

If you see something like 192.168.0.1 is 01:23:45:67:89:ab where 192.168.0.1 is your router's local address but 01:23:45:67:89:ab is not its MAC address, you are seeing an MitM attack based on ARP spoofing (which is what WifiKill uses)

You can use arp -a (on Linux) to see the local/MAC addresses. I think you will see one MAC address twice if an attack is running (and of course the router's MAC will not be the value that you have written down)

What's really nice is that ARP packets in Wireshark are very easy to understand even for not-very-technical person.

You will see conversation like:

Who has 10.0.0.6? Tell 10.0.0.138
10.0.0.6 is at 00:17:f2:20:e6:bf

And SYN flood is obviously enormous amount of SYN packets in extremely fast rate.


Defense:

You can block their MAC address at the router, but be aware that they can change it.

apparently one of them has hacked in and is denying service to others.

Be sure you're using WPA2 without WPS. You can add MAC filtering, but note that it's easy to bypass. However, if the attacker obtained the wifi password from a legitimate machine, they might not be able to avoid being MAC filtered. Always use multiple layers of security.


Summary

The attack is most likely based on ARP spoofing, which can be easily detected if you have a packet capture sample.

To make sure this does not happen again, secure your network as much as possible.

2
  • 1
    This + a baseball bat Aug 15, 2016 at 13:38
  • 2
    @CaffeineAddiction I guess the *cough* mastermind behind this attack is someone who rooted their phone and thinks that using WifiKill to deny people's access to Internet is l33t h4x0ring. They might change their mind once they get caught though :) Aug 15, 2016 at 13:44
0

bobhum, you state " we have several authorized users on our WiFi (school). it appears that one of them has a program to deny service to others. do you know any of these programs and what can be done to prevent this? "

As it's taking place in a school you should have an IT dept. that you can voice your concerns & issues to re. this matter. Don't start running wireshark or other similar programs without proper authorization or you may be just as liable as the suspected culprit.

Also since it only "appears that one of them has a program " but hasn't been caught in the act, there may not actually be anyone doing anything malicious at all. The person or persons having access issues could try another device to access the network but will be logged with the same credentials. If the disruption no longer occurs, I'd look at the device more closely for crapware/malware, outdated hardware, driver issues... even something like IP conflicts. Is this issue happening to everyone else at the same time ? Is there a microwave or cordless phone close to the router ?

If you're in a school that doesn't have an IT dept. which leads to many questions.... have your teacher go to the head of the school & explain what's going on.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .