5

Tools like Karma, and its offspring's, have the feature of becoming any AP that a client is probing for. Your client will naturally connect to this fake AP as it sees nothing wrong with it, thus potentially making your client try to authenticate to mailservers and so on, revealing your username and password.

Does anyone know of a good way of protecting one self against attacks where the attacker listens to SSID beacon requests, responds to all of these and claims to be one of them?

I have some ideas on how to potentially protect against this, but I wonder if there is anything out there already that will sufficiently protect against attacks like this.

Improve this question

3 Answers 3

Reset to default
4

One interesting mitigation against karma attacks.

Set a unused network with a unique enough SSID as your most preferred network. Anytime your computer connects to that particular network, you will know that you have fallen prey to a karma attack.

Improve this answer
3
  • This was my original idea, and I thought of creating an application for handling this. Thanks for giving me faith in it!
    – Chris Dale
    Commented Oct 8, 2012 at 12:27
  • @Karrax I picked it up from a blog post - I can't remember where. An application for it does sound interesting! I could give a hand in testing it if you ever get it done as i have a wifi pineapple handy!
    – user10211
    Commented Oct 8, 2012 at 12:51
  • 1
    Yes but then any automatic services will start sending data over that connection. You would need to add a script which prevents the connection actually being used otherwise you'll start pulling data before you know of the rogue AP or are able to disconnect.
    – Inverted Llama
    Commented Oct 8, 2012 at 14:59
5

This depends slightly on what type of wireless networks you're authenticating too. If it's practicable to have the client only authenticate to the Corporate wireless network then you could use 802.1x and server certificate validation to ensure that the client is connecting to an authentic AP.

For home Access Points, the best bet would be to set-up WPA2-PSK authentication and then only connect to the encrypted network. Attacks like Karma are primarily targeted at open networks (e.g. coffee shop wi-fi)

Without that for unencrypted networks there's nothing that I'm aware of at the wireless layer that would guarantee that the AP you're connecting to is authentic (the only identifiers (SSID and BSSID) are spoofable).

So really at that point you need to head higher up the stack for an answer. What I'd say for situations where you're connecting to hotspot networks or other general wireless networks is that the answer is to establish a VPN connection with validation of the servers authenticity (e.g. SSL certificate validation) as soon as the connection is established (and ideally with a security suite which prevents all outbound connections apart from over the VPN tunnel)

Improve this answer
2
  • How this this relate to ordinary humans setting up their wifi access points? I'd guess the integrity check of the server certificate is not a trivial task for a home user to set up, or am I wrong? This type of protection is setup on the AP side of things right? I should've specified in my question that I was looking for client side things to do to mitigate. Please correct me if I am wrong. Thank you! :)
    – Chris Dale
    Commented Oct 8, 2012 at 8:15
  • well if you're looking at home AP use, AFAIK you'd just set-up WPA2-PSK and use that. By definition it's a pre-shared key, so both parties need to know it, so something like Karma won't work :) Then the security very much depends on your user base. If it's knowledgable people the key is only to connect to the encrypted network and not any fake version (which won't be encrypted)
    – Rory McCune
    Commented Oct 8, 2012 at 9:15
3

Three methods work: 1. VPN - Though note this just moves the exit point so you need to be able to make sure that this point is secure 2. WPA - Such methods only spoof, they can't deal with encryption 3. Turn off 'remember network' - The spoofing only works because the client asks for a specific network, if it doesn't send out a request then the AP won't have anything to spoof.

Take a look at Hak5's episodes on the Wifi Pineapple

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .