2

I understand that if you change your network card from managed mode to monitor mode you will be able to monitor and sniff the traffic of your local network plus all the access points around you. My question has two parts:

  1. If the hacker knows the SSID of my access point and the password (WPA2), could he sniff the traffic of my local network? Is it necessary to capture the authentication handshake between the device and the access point in order to decrypt the IEEE 802.11 traffic? If so, how this process could be done?

  2. If the hacker now the SSID of my access point but not the password, could he still be able to sniff the traffic of my local network?

  • A new attack was found recently that allows one to begin attacking the traffic without needing to first capture the 4-way handshake. – forest Nov 12 '18 at 2:13
  • could you tell me how? – user8125024 Nov 12 '18 at 8:28
  • 1
    hashcat.net/forum/thread-7717.html – forest Nov 12 '18 at 8:30
1

If the hacker knows the SSID of my access point and the password (WPA2), could he sniff the traffic of my local network?

If they have access to both your SSID and have your WPA2 password, then they will be able to monitor any traffic going between you and the router. This is of course limited to unencrypted connections. If you use websites that have HTTPS, then while the attacker will obtain the raw data you are transmitting, they will not be able to decrypt it. HTTPS adds another layer to the encryption.

Note that an active attacker could also tamper with traffic, for example by injecting malware into websites or redirecting logins to a phishing site. This is a reason why a secure password is important.

Is it necessary to capture the authentication handshake between the device and the access point in order to decrypt the IEEE 802.11 traffic? If so, how this process could be done?

It used to be, but a new method has been discovered which allows the attacker to bypass that stage. However, simply obtaining the handshake (or using the new technique) does not automatically give them access. They will still need to crack your password, and if your password is strong, you will be safe from that. Make sure your password is difficult to guess. Remember that computers can guess at hundreds of millions of times per second, so take that into account when creating a strong password.

If the hacker now the SSID of my access point but not the password, could he still be able to sniff the traffic of my local network?

Sort of. He would be able to monitor and record the traffic but not decrypt it. If he later obtained the password (e.g. by cracking it or by stealing it from you), he would be able to retroactively decrypt everything he has recorded so far. This means that you need to make sure your password is secure and stays secure to prevent retroactive decryption at any point in the future.

| improve this answer | |
  • If they have access to both your SSID and have your WPA2 password, then they will be able to monitor any traffic going between you and the router. Only the broadcast packets (encrypted with the GTK), the rest of the traffic you need either the PTK which is you can generate with the handshake or using the PMKID attack. – Azteca Nov 16 '18 at 3:18
  • 1
    @Azteca Sure, but you can get that information simply by sniffing the traffic. It's not a good idea to assume that the traffic will remain confidential after an attacker who is monitoring the wireless communications also has your PSK. – forest Nov 16 '18 at 3:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.