7

So I just learned about the jasager attack, via the wifi pineapple and it struck me immediately that it wouldn't work at all if network managers (privately) associated MAC addresses with hotspots and asked for explicit permission if you were going to connect to a new physical device.

Obviously this would be mildly irritating in public hotspots where devices change and hundreds of diverse locations share network names, but it would make home and work networks much harder to penetrate.

I haven't found any wifi managers that do this, or at least I haven't found information that any do.

My question:

  • Am I missing something obvious? Would remembering MACs not actually increase security?
  • If it would, are there any network managers that do this? (I'm on Linux, but if there are tools for other OS's I think it's worth having them in the answers)
|improve this question
  • 5
    The thing you're probably missing is that MACs are sent over the air. For open networks or once the attacker has found the PSK, these can be sniffed without even connecting to the network and then spoofed for the evil access point. – Ladadadada May 11 '12 at 5:56
  • 1
    As for your second question: NetworkManager (at least here on my Kubuntu 12.04, network-manager version 0.9.4.0) has an option to specify the AP's BSSID. (BSSIDs can be spoofed, but that requires knowledge of the original one, IIRC) – Piskvor left the building May 11 '12 at 8:55
  • wicd also has the options, some network managers on windows also do, but in a large multi access point network with roaming there a lot of BSSIDs to specify so it is usually disabled by default. – ewanm89 May 11 '12 at 9:42
  • +1 to the question. Is there a way to connect to an AP with given SSID and MAC? E.g. if you have 2 APs with same SSID and want to be connected to one of them regardless to signal strength. – Smit Johnth Mar 28 '13 at 12:53
5

You didn't provide a good description of the attack you are concerned, but I believe you're referring to the following attack: a malicious "evil twin" access point can pretend to be a legitimate access point and fool your device into connecting to it; then it can play man-in-the-middle.

If this is what you had in mind, then remembering MAC addresses would not prevent this attack. Spoofing the MAC address is trivial because they must be transmitted over-the-air: on an unencrypted system everyone nearby can see it.

If a system is WPA-secured MAC filtering doesn't add to the security.

|improve this answer
  • 2
    The client do not announce the MAC address, just the essid, thus the jasager would not know what MAC address it should take. – Dog eat cat world May 11 '12 at 7:02
  • @Dogeatcatworld - The MAC address has to be announced.... – Ramhound May 17 '12 at 12:17
  • @Ramhound, have you looked at i.e. kismet or airodump for probes? They do not contain BSSID, only ESSID. – Dog eat cat world May 29 '12 at 9:35
4

MAC address spoofing is trivial for an attacker to carry out, any form of mac address filtering will not help secure any network. However, MAC address filtering can cause real problems for legitimate users. What if you buy a new router and give it the same SSID?

The best defense against this sort of attack is WPA. It isn't prefect, WPA-PSK is pretty easy to break, but its better than anything else consumers have.

|improve this answer
  • WPA isn't feasible for Wifi hotspots like BTOpenzone or "The Cloud". Even if it was, everyone would have to know the key anyway. MAC address association as described in the question isn't any better because you would receive a warning for every different access point of the hotspot network you connected to making the warning about the evil one with the same SSID useless. – Ladadadada May 11 '12 at 5:46
  • WPA is a partial solution for a single hotspot like a cafe where the PSK changes daily and is written on your receipt. The attacker can still have it for the price of a cup of coffee. – Ladadadada May 11 '12 at 5:52
  • Depends on the auth mode, if one isn't using preshared key it would be possible to get hotspots like bt-openzone to talk to a central RADIUS server. – ewanm89 May 11 '12 at 9:43
  • 1
    "WPA-PSK is pretty easy to break, but its better than anything else consumers have." - This is false. The only attack against WPA and WPA2 is brute force. I would not exactly say this is "pretty easy". – Ramhound May 17 '12 at 12:18
  • @Ramhound You probably have never cracked a WPA network before. Its scary how easy it is. When I am on a pen test I use a 80gb rainbow table that rips up most networks in less than a minute. – rook May 17 '12 at 13:06
2

Convenience, mostly:

  • I'm now historically using my third AP device - each one has been completely different make and vendor, but as long as the configuration stayed the same (SSID, encryption mode, passphrase), there was no need to re-enter the AP data on any of the client devices. This may not be enough of an issue in a home setting; if you have hundreds of devices which can connect to the network, reconfiguring them when an AP dies would be a royal pain.

  • Likewise, having multiple identically-configured APs (and thus a larger signal-covered area), the client devices will switch to the AP with the strongest signal without trouble. A few frames may be lost before the new MAC address location propagates through the local network, but overall the roaming is close to seamless.

As for the "only connect to this AP if it has a specific MAC address" - this is already possible with NetworkManager on Linux: there is an option to specify the AP's BSSID, which should be the AP's MAC address (of course, the BSSID can be spoofed - hence "should").

|improve this answer
  • No wai under Windows? – Smit Johnth Mar 28 '13 at 12:54
  • @Smit Johnth: To be honest, I don't know; it's been a while since I've used a Windows computer of my own; from the cursory use I've had, I haven't seen this option with the default wifi manager in Windows 7. In other words, I can't rule out existence of such option on Windows, but I can't confirm it, either. – Piskvor left the building Mar 29 '13 at 14:09
  • How about other managers? – Smit Johnth May 24 '13 at 3:25
0

Some do.

The Intel PROSet/Wireless connection manager adds another option onto Windows wireless networking options where you can specify the MAC address (BSSID) to prevent Pineapple Karma style attacks:

Intel Connection Manager

Of course, if the attacker follows you home or knows where you live they can also make a note of the BSSID to spoof. Enabling wireless encryption (WPA-2 with AES recommended) will prevent the Karma attack as the client will not connect with an AP with different security settings.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.