0

Let's say there is someone doing some malicious activity on your network and you want to track the packet's signal strength to catch the attacker.

Is this theory plausible?

5
  • 1
    how will you judge based on the signal strength?
    – Limit
    Nov 26 '16 at 19:56
  • 1
    MITM doesn't mean physically closer. The attacker can be anywhere in relation to you or the AP.
    – schroeder
    Nov 26 '16 at 20:57
  • @Limit As what I understand: The closer you get an AP, dBm increases. eg -80 dBm is bad, then -30 is physically right next to the AP. Is there then any way to instead of measuring the received signal strength of the packets to the AP, measure a packet sniffed/interfered from lets say 10.0.0.21 to the ap 10.0.0.1?
    – BlitZz
    Nov 26 '16 at 21:15
  • Umm can you explain what you mean by a man in the middle and what exact attack are you trying to detect? This will help people identify the problem.
    – Limit
    Nov 26 '16 at 21:30
  • So, let's say the attacker does a MITM (He tells my device he is the ap 10.0.0.1) Then my question is: Can you then check the signal strength of his packets in order to "guide" yourself closer to the attacker as a victim?
    – BlitZz
    Nov 26 '16 at 22:00
0

To find who is doing it, you can use a cantenna (more precise and mobile for this than a yagi - a cantenna does nothing except trap a bunch of waves in the can, which bounce around until they hit the feedpoint. It is directional only in the sense that the waves enter at the open end, and you point that at the waves you want to receive).

Use a program like kismet/airodump-ng/kismac which has RFMON mode, and can see rx/tx quality from network peers. Then scan in all directions.

Once you have a few ideas of the direction, move outside and confirm it. Wifi signals bounce a lot. Eventually you find the point where the signal is strongest. This doesn't prove anything to anyone - except you - however.

I expect you can do RFMON scanning with a rooted android phone, but haven't done it.

1

If the attacker and the valid AP are transmitting packets with significantly different RSSI (e.g., they are in different proximity from the client, or actually transmitting with different power levels, or there is an obstacle between one) then it is possible to fire-up t-shark or wireshark filter out the packets that come from APs with a given MAC address (both valid and malicious) and store the signal strength field. Then do conduct statistical analysis over time (e.g., median or better something more complex) and note whether the measure significantly deviates from normality. This MIGHT be an indication of something wrong e.g. presence of a fake AP, including MITM attack an Evil Twin etc.

With that being said if you try to replicate such an experiment you will immediately notice that the RSSI significantly fluctuates even if the experiment parameters relative location of the devices are unchanged. You will definitely need to apply all your statistical/ML knowledge to distinguish normal from abnormal traffic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.