Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
How could someone go undetected on a WiFi? (No trace with NMap scan, not in network admin page) Is this even possible? If so, how can you prevent it?
If being undetected while on WiFi network isn’t possible, what are some key things to do to hide your devices identity while on a network? (MAC spoofing?)
One thing you can do is disguise yourself. Look at the devices on the network and pretend to be like them. Change your hostname to match their naming scheme, change your MAC address, and if you feel really cool, expose the same types of services on the same ports (granted there is a lot of ways to go wrong there...). If the devices don't have general access to the Internet (for example, if it's an IoT network where HTTP is blocked but NTP isn't), see what ports the other devices are using and try to use that to communicate with your external server (which can then translate the traffic into standard web traffic if necessary). Be warned there are ways to detect suspicious traffic that's using the wrong port.
However, that's all targeted at sophisticated networks. If you're dealing with a home network with a cheap WiFi router, you can sometimes evade detection by... using a static IP address. Some routers will only list DHCP clients in their web admin pages.
"Undetected" is in the eye of the beholder (or detector).
To participate in the network, you need to send traffic. You announce yourself when you do. There are ways to avoid or confuse detection if you need to be active on the network. And this assumes that the network is even set up to detect unauthorised devices. A lot of networks are not.
Just sending traffic sends a lot of detail about the device. If your device supports it, you can modify many of those details:
Those details are found in the logs of the devices that you interact with on the network, so it requires that the network and its processes are designed to detect unauthorised access.
One way to temporarily evade detection is to join the network passively, listen to traffic and choose another device to emulate. Then disconnect, boot off the other device, and take its place while spoofing its details. This might work, but only as long as the booted device isn't investigated as to why it is no longer on the network.
Active detection is when the device is scanned (like with nmap). There are ways to detect a scan and simply not respond (firewall rules can do this) or to provide fake details.
However, an experienced network admin will notice the discrepancy if your device is transmitting but not acting like a "normal" device.
WiFi can use certificate-based access so that only approved devices can participate in the network.
There is also a whole field called "network access control" (NAC). Some use agents on devices to send an authorized token to an access server that permits access to the network. Some use active and passive methods to characterise the device and its behavior. The concept of "zero trust" is the maturing of this process.
The sad fact is that while you can try all these fancy techniques to avoid detection, you can probably not use any of them and still not get detected on most home and SME networks. Monitoring networks for unauthorised access takes time, resources, and a business case.
If the network is not using certificate-based access or NAC, which are relatively cheap but very effective, then they are likely not going to be spending the time or money to monitor their network. There will be some that are, but not many.
