0

I want to create a honeypot that will detect KRACK attacks. Is there any way to detect that kind of attack, are there any traces, any information that is stored in log files (syslog for example) that tells: "You are under KRACK attack"?

2

A WiFi card in monitor mode will (given the right circumstances, id est in range of the client, the AP and the attacker) pick up the repeated third step of the handshake.

A filter rule could find such packets and trigger an alert.

There’s nothing in (usually configured) logs or otherwise persistent to the attack itself.

  • APs should also be able to alert when frames with the zero-key encrypted are received. This would indicate vulnerable Android clients (but might happen without attack) – eckes Oct 26 '17 at 9:56
  • Yes, but that’d be a firmware feature that’s not going to be commonplace. And it would only detect parts of the attack. – Tobi Nary Oct 26 '17 at 9:57
  • Is there a smartphone app that i can install for iPhone (tm) that will monitor and alert me? – Andyz Smith Oct 26 '17 at 12:34
  • @AndyzSmith not as far as I know. And if there is, it’s only for jailbroken iPhones, which brings in a load of other problems. That’s because you do not have access to the hardware as directly as you need within the API. – Tobi Nary Oct 26 '17 at 12:47
  • Any smartphone? Code for Arduino with wifi shield? – Andyz Smith Oct 26 '17 at 13:02
-1

This is not a straight answer but can help a lot in your case, I believe. Here is a script that can detect if your WIFI AP is vulnerable to HRACK :

This script tests if APs are affected by CVE-2017-13082 (KRACK attack)

The script was made by one of the original authors of KRACK.

  • Thank You, I know that script and I have been using it, but it don't anwser my needs. – bartekch Oct 26 '17 at 10:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.