1

I have multiple devices connected to a router, including my phone. The router has no internet; therefore, the network only works locally. All nodes can talk with each other thanks to the router. I use my phone to send messages to the nodes.

If no one has access to the WiFi password will it be possible for someone to sniff the udp messages that I send over the network? If I host a small website in that enclosed network will HTTP traffic be secure? Will you guys recommend using HTTPS even though I am the only one that will use the network?

Pretend that if instead of using wifi, the network is wired. If I were to read the 0s and 1s from a cable, will the messages be encrypted even though they are simple HTTP requests?

3

Unless you are not using any security at all on your Wifi, no. Nobody but those connected can read anything. Please don't tell me your network is unprotected.

If you have your network "protected" by WEP, someone can crack the password in minutes, and begin decrypting the traffic. But if you use WPA2, it's very difficult. No matter what protection you have, unless the attacker gets your network password, they cannot read anything but encrypted blobs of data. No matter if UDP or TCP, they cannot.

On a cable things are different. If they tap into the wires, they can read all unencrypted traffic. All HTTP traffic is plaintext, and all non-encrypted protocol as well (FTP, SMTP, DNS, telnet).

  • It may be worth mentioning, that all WiFi traffic an be intercepted (whether encrypted or not). Thus an adversary may create an activity profile from the target network, even if the can not read the actual messages. – Marcel Aug 28 '20 at 8:10
  • but it's mentioned: "unless the attacker gets your network password, they cannot read anything but encrypted blobs of data." – ThoriumBR Aug 28 '20 at 13:30
1

Yes, your wireless traffic can be captured without connecting to your network. If it is unencrypted, an attacker may read it. HTTPS traffic is always encrypted. Whether HTTP traffic is encrypted depends on the configuration of your wireless access point, which in your case seems to be integrated into the SOHO router.

The same goes for intercepted wireless communications. If they are securely encrypted, they will not be readable. If they are unencrypted, they will be readable. It is a bit more effort /more intrusive to tap into the wire than to sniff wireless traffic though.

In any medium, encryption may be configured. WPA2 for your wireless is available on most SOHO routers from the last decade.

  • Unless the network has no protection at all, even HTTP traffic cannot be read. The attacker cannot even know it's HTTP at all. – ThoriumBR Aug 28 '20 at 13:33
  • "No protection at all" is not an accurate description of a network with unencrypted traffic. – Adrian Self Aug 28 '20 at 13:56
  • and what protection does an unencrypted network have? Anyone can read and alter traffic at will. – ThoriumBR Aug 28 '20 at 13:57
  • No, a lack of confidentiality does not imply a lack of integrity. You cannot assume that traffic can be altered just because it may be read, even though it is sometimes the case that traffic can be both read and altered. – Adrian Self Aug 28 '20 at 14:00
  • Ever heard of ARP spoofing? – ThoriumBR Aug 28 '20 at 14:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.