9

I read that Wifi network cards when disconnected are constantly sending probes to check if any known AP is around.

This means that a hacker could capture those probes and simulate one of the requested networks and finally establish a connection.

Is there a way to disable this? Wouldn't it be wise for the network card to ask which networks are up instead of calling them by the SSID?

  • 3
    That's not done by the network card but by the operating system using the card. And you can avoid it for example by switching WiFi off when you don' need it. – Steffen Ullrich Feb 12 '17 at 18:15
3

Yes, this kind of attack has different names: Mana wireless attack, Yes Man attack, Probe Rogue AP, etc...

Your O.S. is sending constantly probe requests asking for one of your known networks. The attacker get this info and create a Fake AP with that info. Bear in mind is going to work only with Open wifis. Because obviously, the attacker is not going to be able to create one of your known wireless networks with the right WPA2 key.

So you can do different things:

  1. Disable wifi if you are not using it.
  2. Disable radio instead of disabling the card.
  3. After finish using a public open network, delete the network profile in order to have only in memory secured networks that are not going to be cloned exactly.

The first two depends of your O.S. the third one is a good practice always.

  • Why it can't create a network? "not even with the right WPA2 key" What's wrong with an evil twin? – Azteca Feb 15 '17 at 19:50
  • If you have the right wpa2 key you can set up the network, of course. but the scenario is sniffing the probe packets... so on probe packets there is no key... you can read bssid, channel and essid. you can create a network with that data... so only is going to work (the auto association for the client) on open networks. – OscarAkaElvis Feb 15 '17 at 20:18
  • Well if you just said you actually CAN WITH the right key.... edit your answer? Or I am not getting something? In the probe requests also doesn't show anything about encryption, so at that point it's the same. – Azteca Feb 16 '17 at 3:42
  • I removed the "even" word from my answer, now is more accurate. Thanks. – OscarAkaElvis Feb 16 '17 at 8:01
2

Well, there's some subtlety here.

EDIT: And the subtlety was apparently a little lost in my effort to recommend some sound practices.

Bottom line; if you "hide" your AP at home or at the office, you have to configure your client device(s) to broadcast that SSID. That's because the AP's aren't broadcasting it. Somebody has to broadcast it. If you hide your AP, that somebody becomes your client device. Which means that everywhere you go, if you have your phone or laptop or other wireless device turned on, it is broadcasting your SSID on every WiFi channel, waiting for an AP to say "Here I am."

Here is an example of a normal WiFi client probe request. Note that the SSID field is empty (Length=0):

enter image description here

Image source: https://mrncciew.com/2014/10/27/cwap-802-11-probe-requestresponse/

Here is an example of a normal WiFi access point probe response. Note that it contains an SSID (called "MRN-EAP"). If this SSID is one the client wants to connect to, it can connect:

enter image description here

So, if you want to broadcast your home or office SSID everywhere you go, and give WiFi pineapple-equipped attackers far and wide an additional opportunity to get your wireless device to connect to their rogue access point, hiding your home/office SSID is an effective way to accomplish that.

Otherwise, just give your home/office SSID a sensible name, perhaps one that is meaningful to you without divulging more than you want. Maybe call it "GANDALF" instead of "TheRobertsonsHouse," make sure you're using WPA-2 with a good, long complex key, and rest assured you have done it the right way. ;-)

Back to the original post:

If you have masked your WiFi SSID so that your AP does not broadcast it, then your client device has to broadcast the SSID, like a baby sheep constantly calling for it's mother. It'll do this at your house, at the office, at the coffee shop, at the airport, wherever. In that case, yes, an attacker can absolutely answer that call. Of course, to actually get you connected they would need to know the key (password) for your WiFi network, or if you have your WiFi network unsecured, your device will hook right up to the attacker's rogue access point.

So people will sometimes think that hiding their WiFi SSID is a good security practice, but it is actually just the opposite. It is an anti-practice, a bad idea for security.

What can really get you is somebody using a WiFi pineapple and advertising itself as a common commercial WiFi network, such as AT&T or other systems commonly used in hotels, restaurants, bus terminals, airports, and other locations. The WiFi connection is intentionally unsecured, so that you can connect easily then be redirected to a guest portal where you have to log in. That guest portal is easy to fake. It's just a web page. So you hook right up, "authenticate" to the attacker's fake guest portal with a username and password (which the attacker now has), and then the attacker captures and analyzes all of your network traffic from that point forward, possibly even doing things like automatically redirecting HTTPS connections to the HTTP protocol, and so on.

One of the best defenses against this type of attack is to use a VPN, particularly if you connect from public locations a lot, and never, ever ignore any certificate validation error messages, which could indicate that a man in the middle attacker has intercepted your communication and is substituting a fake server certificate for the real one so that they can decrypt your communication on the fly.

  • 1
    Does not answer the question – schroeder Feb 13 '17 at 7:54
  • I think it does. These sorts of probes are sent by the client when an SSID is hidden, not so much when the SSID is broadcast, because the client can just listen for the broadcast in that case. So my point that there is some subtlety in the situation is accurate. – Craig Feb 13 '17 at 8:23
  • 1
    So, if my SSID is broadcast at home, and I go to the coffee shop, my laptop doesn't send beacons for my home SSID? The way to disable client-side beacons is to not hide my SSID at home? If that is the point you are making, it is lost. My point is that you address things around the question, but not the question itself. – schroeder Feb 13 '17 at 9:27
  • Hiding the SSID it's not a bad practice nor anti-practice, it's called security trough obscurity and it's the most basic and first line of defense, yeah if you're a target this is absolutely useless but it's basic SOHO security. And even if you hide your home AP SSID the STA will still send probe requests on airports, coffee shops, etc. That has nothing to do with it. – Azteca Feb 15 '17 at 19:58
  • 1
    So, if you hide your SSID at home, you are literally causing all of your wireless devices to broadcast your home SSID everywhere you go. – Craig Feb 15 '17 at 20:07
-1

Going straight to the main question: YES

Windows and other OS, have a PNL (Preferred network list) which are the networks you have connected AND checked the "Connect automatically" option. Which makes your computer to add it to the PNL and look for it when there is no wi-fi connection (send probe requests). You can also add them manually just by clicking "Manually Add Wireless Network"

The other obvious way and already answered everywhere is hard or soft disabling the network adapter (WiFi card)

(To see which profiles you have added you can go to Settings > Network & Internet > WiFi > Manage known networks on Win10 OR Network and Sharing Center > Manage Wireless network on Win7)

Also if you prefer the CMD or PS (Windows PowerShell) you can type netsh wlan show profiles

And with your second question it's also possible to wait for a beacon frame, but remember some networks are "hidden" by not sending the SSID. Just a note on what you said:

Wouldn't it be wise for the network card to ask which networks are up...

That's exactly what a probe request does... it probes if X is out there hearing...

And also by removing this functionality you also reduce usability. This is where the triangle of Security, Usability and Functionality makes it's appearance. [Security, functionality and usability triangle[1]

*Taken from Google Images > LinkedIn

PS: Here you can read the basics on WiFi Probe request and Beacon frame.

  • 2
    The specification does NOT require the probe request to contain the SSID. Note the empty SSID in this request. The request is generic unless the client is accessing a "hidden" AP, in which case the client MUST send the SSID in the clear. This is easy to intercept and observe, wherever the client is. The probe response contains the SSID. If the SSID matches what the client wants to attach to, the client attaches, without ever needing to broadcast the SSID itself. – Craig Feb 15 '17 at 20:17
  • Yes, some probe requests don't contain the SSID but some does, it's common to sniff the air and find which STA own which AP, not necessarily having this AP in non-broadcast mode. And what's with the down vote? What's wrong in it? Even in the page you shared, it says STA sending Probe Request may specify the SSID they looking (called directed probe request) these are from the PNL when the SSID is known, null probe requests are to find out which networks are available to populate the list when you want to connect to a wireless network. – Azteca Feb 16 '17 at 4:56
  • The only reason to send a directed probe request (a probe request containing an SSID) is if you don't already know the address of the AP that is using that SSID. That's because there is no other way to get the address of the AP. The client has to constantly ask "Are you there, Bob?" until an AP answers and says "Yes, this is Bob." If the wireless client has already obtained the address of the AP via active scanning--sending a null probe request on each channel asking AP's to respond with their SSID's and addresses--then there is no reason to send another probe request containing the SSID. – Craig Feb 16 '17 at 5:23
  • No, double check your sources, this is really basic, it's called "WiFi roaming" and it's basic functionality in simple words is when you ask for "Bob", you almost always use the broadcast address, because there are multiple "Bob"s, you then pick the "BOB" with the strongest signal strength. Here you can read some more about the differences of BSS, ESS, SSID and BSSID, and 67K probes requests With SSID included. – Azteca Feb 16 '17 at 19:23
  • Yep, that's pretty much what I'm saying. I appreciate you helping me make my point. ;-) – Craig Feb 16 '17 at 22:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.