1

How could someone go undetected on a WiFi? (No trace with NMap scan, not in network admin page) Is this even possible? If so, how can you prevent it?

If being undetected while on WiFi network isn’t possible, what are some key things to do to hide your devices identity while on a network? (MAC spoofing?)

  • 2
    WiFi requires a broadcasting radio. You can't hide that ... Or are you asking about being undetected at the network level? For that, you can configure some wifi devices not to transmit at all but only to listen, but if you want to interact with the network, you need to transmit. So, what are you looking for? – schroeder Apr 29 at 20:45
  • I would also add whether you are interested in knowing if you can "hide" from public wifi AP's in order to prevent them from acquiring information about you (without turning off WiFi). – newyork10023 Apr 29 at 21:02
2

One thing you can do is disguise yourself. Look at the devices on the network and pretend to be like them. Change your hostname to match their naming scheme, change your MAC address, and if you feel really cool, expose the same types of services on the same ports (granted there is a lot of ways to go wrong there...). If the devices don't have general access to the Internet (for example, if it's an IoT network where HTTP is blocked but NTP isn't), see what ports the other devices are using and try to use that to communicate with your external server (which can then translate the traffic into standard web traffic if necessary). Be warned there are ways to detect suspicious traffic that's using the wrong port.

However, that's all targeted at sophisticated networks. If you're dealing with a home network with a cheap WiFi router, you can sometimes evade detection by... using a static IP address. Some routers will only list DHCP clients in their web admin pages.

| improve this answer | |
1

"Undetected" is in the eye of the beholder (or detector).

To participate in the network, you need to send traffic. You announce yourself when you do. There are ways to avoid or confuse detection if you need to be active on the network. And this assumes that the network is even set up to detect unauthorised devices. A lot of networks are not.

Evading Passive Detection

Just sending traffic sends a lot of detail about the device. If your device supports it, you can modify many of those details:

  • hostname
  • MAC address
  • User agent (on browsers)

Those details are found in the logs of the devices that you interact with on the network, so it requires that the network and its processes are designed to detect unauthorised access.

One way to temporarily evade detection is to join the network passively, listen to traffic and choose another device to emulate. Then disconnect, boot off the other device, and take its place while spoofing its details. This might work, but only as long as the booted device isn't investigated as to why it is no longer on the network.

Evading Active Detection

Active detection is when the device is scanned (like with nmap). There are ways to detect a scan and simply not respond (firewall rules can do this) or to provide fake details.

However, an experienced network admin will notice the discrepancy if your device is transmitting but not acting like a "normal" device.

Protection Against Evasion

WiFi can use certificate-based access so that only approved devices can participate in the network.

There is also a whole field called "network access control" (NAC). Some use agents on devices to send an authorized token to an access server that permits access to the network. Some use active and passive methods to characterise the device and its behavior. The concept of "zero trust" is the maturing of this process.

Real-World Application

The sad fact is that while you can try all these fancy techniques to avoid detection, you can probably not use any of them and still not get detected on most home and SME networks. Monitoring networks for unauthorised access takes time, resources, and a business case.

If the network is not using certificate-based access or NAC, which are relatively cheap but very effective, then they are likely not going to be spending the time or money to monitor their network. There will be some that are, but not many.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.