11

I am wondering if this scenario may happen - described from the users point of view: Being connected to my home router, the connection suddenly breaks. So I go to the wireless network adapters drop down menu, select my well known device to connect. But instead of connecting silently as normal, it asks me for the PSK. After typing the PSK the connection is accomplished. I am wondering what may have happend, but as I am back again online, I am not concerned.

The same scenario from the attackers perspective: The attacker (may be sitting in his car in front of my house) has set up a fake AP with my home routers name. Then he disconnects my PC and brings my home router down. When reconnecting, I actually connect to the fake AP, which accepts any PSK, not to my own router.

Is that possible? In detail: - is it possible to disconnect me from my home router? - is it possible to bring my router down or make it invisible?

If this is possible, any of those WIFI attacks that are described for public (fake) hotspots would also work with private and secured WIFI routers, be it at home or in the office! How would I protect myself than?

Improve this question
2
  • How does an attacker take down your access point, unless they have physical access to the device itself, its still powered and running.
    – Ramhound
    Oct 30, 2012 at 12:24
  • 2
    Some routers can crash when you attempt to brute force then with things like reaver. However if you are using PSK en.wikipedia.org/wiki/Pre-shared_key you should be safe from a jasager "Pinapple" attack.
    – CaffeineAddiction
    Jun 23, 2016 at 14:38

8 Answers 8

Reset to default
7

No, if you are using WPA2, even though they may be able to deauth you from your router using one of the mentioned exploits, since your original question had to do with a PSK protected network, assuming you are using a WPA2 connection, the four way handshake will require that the AP prove itself to your system. A rogue AP would be unable to do this as it would be unaware of the pre-shared key and the connection would be aborted.

Improve this answer
1
  • 3
    +1 this is the only correct answer. The PSK authentication will fail if the router doesn't know the password.
    – rook
    Oct 31, 2012 at 20:15
2

The PSK is not only used for authentication, but also encryption. Without having the PSK on the attacker's side, they would only know that they were getting a gibberish response and to the client, the expected messages from the rogue AP would also be gibberish.

Assuming that there was some theoretical attack that could work via MITM (I'm not aware of any currently.) Without access to your network, they still would have no way to "bring down" your router. They could attempt to use an access point with a much stronger signal to get your connection to fail over to theirs, but your access point would still be transmitting and there is a decent chance that any discrepancy between the two could be detected as an error.

Now if the network was unprotected, it becomes a fairly trivial matter to broadcast a stronger signal on the same SSID and get a client to connect to a rogue AP, but one of the advantages of using protection on your network is that it mutually authenticates clients and the AP as belonging on the network.

Improve this answer
4
  • Browsing through airbase-ng man page: it looks like there is more possible. It talks about "ability to cause the WPA/WPA2 handshake to be captured" and "The main idea of the implementation is that it should encourage clients to associate with the fake AP, not prevent them from accessing the real AP." Or is the latter only ment for unprotected or WEP protected APs?
    – thomas
    Oct 29, 2012 at 23:42
  • Capturing the handshake is not capturing the PSK in plain text, you still need to crack the handshake using your favourite script... and brute forcing of course will take you a while :) Using airbase won't DoS the victim's router, but add another fake AP. as AJ Henderson wrote, you cannot completely drop an AP router.
    – Boaz Tirosh
    Oct 30, 2012 at 7:17
  • 2
    @Thomas - to expand on what Boaz was clarifying, the WPA2 handshake is designed to verify both client and access point with protection against replay. Both devices request that some new value be encrypted using the PSK on each connection. This is known as challenge-response. Since the value to be encoded changes every time, while it is possible to capture the handshake (the raw data on the line), it is not possible to rapidly break said handshake to authenticate a different challenge-response. You would also need the PSK to hijack the handshake in this case as well.
    – AJ Henderson
    Oct 31, 2012 at 4:31
  • Thanks Rook, yeah, I wasn't thinking about it in terms of explaining that the point was to encrypt the connection so that it couldn't simply be picked up by a sniffer. (My initial assumption was that the asker thought the entire point of the key was to validate itself, ie "What's your key to allow on the network?" "12345". But my initial failed to capture that authentication is also provided.
    – AJ Henderson
    Nov 1, 2012 at 15:45
2

This is totally possible to kick you and make your router invisible (using mdk3).

Now the attacker can start a router with same essid, luring you. Then many stuff can be done (MITM, phishing, for example).

Fluxion is a very good demo of this, you can take a look at it to understand the process. When you connect to its fake AP, a login page (like public network do) is shown asking you for your wifi password. Thanks to aircrack it get the handshake, and use it to verify the WPA of your real router (who is being hidden) then connect you to it if succeed.

To prevent this kind of attack, you can do the basics (password complexity, turn off wifi when not needed), check if your wifi suddenly appear without password and you need to re-connect at it.

Improve this answer
1

Yes, this can happen. I'm not sure if it's enabled by default, but one of the features of Windows 7 is roaming. Windows will automatically change to a WiFi AP with the same name if the signal of that AP is stronger.

If an attacker could deauth you from the AP or DoS the AP (recently discovered flaw in WPA-TKIP by Mathy Vanhoef), it could be that your Windows machine automatically switches to a rogue AP.

I don't know if this works on Linux and I don't know if it works from an AP that uses encryption to one that isn't.

Improve this answer
6
  • Add this to the recent Broadcom flaw (CVE / Research) and it's pretty trivial to deauth you from your AP.
    – Polynomial
    Oct 30, 2012 at 7:01
  • 1
    The question asks if this would work on a protected network. It would not work as the rogue AP would be unable to respond to the client in a manner that authenticates the AP based on the PSK that the user enters.
    – AJ Henderson
    Oct 31, 2012 at 18:46
  • The original question did not mention a psk
    – Lucas Kauffman
    Nov 1, 2012 at 7:41
  • "would also work with private and SECURED WIFI routers". It didn't mention a PSK specifically, but I'm not sure how you would secure a wifi router without one. The question was if a known attack against unprotected routers could also be used on protected routers by tricking someone in to connecting to an unprotected network. But since the client's saved configuration is for a protected network, it isn't going to automatically connect to an open one. The saved configuration would fail.
    – AJ Henderson
    Nov 1, 2012 at 15:50
  • That said, I suppose that you could still try to DOS the router and hope the user would manually connect to the unsecure one without noticing and tell windows it is a private network again and just write it off as Windows being weird, but then the only thing to protect yourself is to be cautious when reconnecting, because it would be obvious to the informed user, and since the user asking the question seems to be knowledgeable enough to recognize this, I didn't think it was applicable to the question.
    – AJ Henderson
    Nov 1, 2012 at 15:52
0

It's possible. If you are doing an "evil twin" attack against a known target, you send deuathentication frames to your router and then I advertise my evil twin using the same SSID. If I was doing this attack I probably wouldn't bother then asking for a password, but if the attacker thought you might find that suspicious they could likely modify the code to accept any PSK [instead of if(PSK == $realkey) just do if(true) logically in the code]. They could then hopefully get your read PSK or just be happy that your now on their network, unless you then deauth the evil AP, its unlikely Windows would disconnect. I have done Evil AP in the lab and Windows will just switch over if it see an SSID it knows. I have never tried to modify the aircrack-ng suite to accept a random PSK in the attack.

Some points:

  • SSIDS are not globally unique, you can have two completely different networks advertising the same SSID but be different networks
  • MAC addresses can be spoofed

So how do we protect ourselves from this?

  • You could use more advanced wireless security authentication 802.1x/PEAP/LEAP etc (set up a Radius server)
  • Encrypt at Layer 3 or above (e.g., connect over a VPN to the rest of the network)
  • Implement some type of WIPS (I am not aware of any cheap home WIPS)
Improve this answer
3
  • Note that using Radius Server is relevant only if you are verifying its signature every time you connect to the server: It is fairly easy to set up a radius server to return true for each username and password as you suggested for the PSK (Actually I think there is already a FreeRadius server version that does this). In such case, an attacker that will spoof both AP and RADIUS server will gain your entire credentials in plain text, making it much more dangerous than the original attack described in the question.
    – Boaz Tirosh
    Oct 30, 2012 at 7:24
  • 1
    Except that the PSK is part of the AP that the computer has been authorized to connect to. I'm not aware of any client that will connect to an AP that does not have a PSK if it was connecting on that SSID with a PSK and since the rogue AP will not know the PSK, how could it properly respond in a way which the client would accept?
    – AJ Henderson
    Oct 31, 2012 at 4:19
  • To clarify, the example I gave for using RADIUS server was for enterprise WPA and not PSK WPA. When using PSK version you are of course right.
    – Boaz Tirosh
    Oct 31, 2012 at 20:25
0

Yes, they don't even need to advertise your SSID as in the case of remembered netowkrs it is the PC which asks the router for the network not the other way round. Take a look at the wifi pineapple from hak5 if you want to see more on this.

Improve this answer
1
  • 1
    No, the question asked specifically if it would still work with a protected network. The rogue AP may be able to force a reauth, but it would be unable to complete a handshake for the unknown PSK value that the user enters. It is not possible for an AP to simply ignore the PSK since it must also authenticate itself to the client.
    – AJ Henderson
    Oct 31, 2012 at 18:48
0

Yes they can, they copy your ap and mac addresses and send a stronger signal thatis coming from your own ap. Then they deauth you from your ap and you automatically join the fake ap. (without your PSK), any password you enter will connect to the fake ap. This is used to annoy and not to gain access to your network but they can get your password if you manually enter it again and they save it as plain text and then spoof your mac addresses and use your PSK to access your network. My neighbour has all this automated and constantly deauth me from my ap and I can no longer use wifi because of this. Doesnt matter what ap name I use or if I change my mac addresses he does all this in 5 seconds. The only way to stop it is to stop a deauth attack and this can only be done if you dont associate with your ap, which means you cant connect to your ap or it will associate and they will use the associated mac addresses. If there is a way to not broadcast the association between your ap and device then you are fine but I think that is impossible.The above post points to a pineapple router and can also be done on DD-wrt type custom routers.

Improve this answer
0

It's possible for someone to disconnect you from your router and set up a rogue access point to try and get you to connect (not likely in most situations but definitely possible), but that wouldn't give them your password that easily. WPA2 uses a one-way hash on the password, so you would send them a hashed version of the password.

It is possible to crack a hashed password, especially if it's the default word5464anotherword1234 style, but it takes a lot of processor time. Unless you're James Bond, it's probably not going to happen.

Who knows, though, you might be James Bond, so if you ever get disconnected from a WPA2 router and it asks you to re-enter your password, go check the router because something is wrong.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .