14

I read quite a bit from Troy Hunt about spoofing WiFi SSIDs and luring devices to connect to them.

When the Pineapple device sees a probe request it will create a WiFi with the probed SSID. The naive device will connect to the network and succeed if it is an open network.

What happens if the network is secured. Say my home network has the SSID “X” and is secured with WPA2-PSK. If such a spoofing device creates an SSID “X”, will my computer just send its password to that SSID? Do I have to worry about my WiFi password sniffed in this manner?

Improve this question

2 Answers 2

Reset to default
10

The answer to your question is, no. with a WPA-PSK authenticated network, the PSK is never actually sent over the wire, the protocol is designed to prove that both the client machine (a.k.a station) and Access point have the same key before commencing communication.

If an attacker can sniff the traffic sent between the station and the access point during the handshake process, it can attack it by trying to brute force the key value (which is why you should never use a weak key value).

There's some additional information here

Improve this answer
1
  • That sounds like my WPA-PSK are no worries. I even found an Android app in F-Droid which lets you forget all unsecured networks. Seems like that mitigates this attack vector completely, then.
    – Martin Ueding
    Apr 2, 2014 at 18:33
1

Yes, this is true. However, the attacker will have to respond with a beacon which correspond with your client configuration. It has to have the same encryption methods set.

There is a tool to automate this process of creating fake AP's which tries the various encryption option. Its named Wifi Honeypot, and can be found here

Your password will not be sent in clear text, but someone will be able to catch the handshake which can be bruteforced, thus revealing your password.

If your SSID is common, the effort of bruteforcing your password can be greatly reduced with a rainbow table. If your SSID is unique enough, it is also possible to determine its location by querying Wigle.

Funny thing, is that if you try to create a common SSID to hide from Wigle, you increase the odds that someone has created a rainbow table for it.

Game over man

Improve this answer
4
  • Faking SSIDs seems easy with the Pineapple device Troy Hunt uses. How can this handshake be compromised? Both router and client have the pre shared key. How do they make sure that the other side is the real one?
    – Martin Ueding
    Mar 26, 2014 at 23:35
  • Pineapple MK IV's karma module did not have the possibility to fake SSID with encryption options (afaik). This might have changed with the newly released MK V. If you look at en.wikipedia.org/wiki/IEEE_802.11i-2004#The_Four-Way_Handshake - you will see that the client will send the MIC after it received the nounce from AP. According to the answer in security.stackexchange.com/questions/17767/… - the MIC is based on the password, and can be cracked even if you have not the full handshake. Please correct me if I am wrong here.
    – Dog eat cat world
    Mar 26, 2014 at 23:55
  • I won't downvote but I think you should tone down the FUD of your answer a bit. Cracking WPA keys is not trivial as long as your password is not qwerty123 it is not a viable threat. "If your SSID is unique enough, it is also possible to determine its location by querying Wigle." How does someone determine your network's SSID without already knowing where you live?
    – user2675345
    Mar 27, 2014 at 9:33
  • You might not know where someone live, as you are attacking the client, and not the AP - you are the AP. The SSID can be used to find out where the client belongs.
    – Dog eat cat world
    Mar 27, 2014 at 9:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .