Does setting a WiFi AP to channel 14 avoid the most common detection methods used in Europe or the Americas?

Question

The legally allowable band for WiFI in the US covers channels 1-11. Europe goes to 13, Japan to 14. I suspect that most tools use the WiFi driver of the machine and only scan for the channels it is limited to. Do you know of any tools that scan higher channels by default? With configuration?

For some examples of things that will detect these:

• A modified firmware Linksys with extra channels opened up and run in analyzer mode.
• A radio spectrum analyzer.
• A USRP (kind of like above, but we can decode and talk back).

EDIT AND REDIRECT: I know how to perform this attack and detect a rogue access point that is out-of-band, whether it be WiFi or any other continuously operating transmission device. The point of this question is to discern whether most organizations would pick this attack up or are even aware of it in cases where somebody has placed an access point without company knowledge. I am aware of FCC communication rules and how they prohibit this. That said, it is the detection of such a device that is of concern, and that does not rely on illegal transmission.

Many security reviews include scanning for unauthorized WiFi devices, including the PCI DSS standards (11.1). What I seek are answers related to whether this attack vector is commonly accounted for.

Answer 1

FON routers are purchased world wide, and can be set to operate in pretty much any International wifi band. And if you've got a locked firmware on many "standard" devices, you need only load a firmware from a different region. (Especially for USB devices) the hardware is the same, but the firmware itself is soft loaded and can be manipulated with a little effort.

I can say with certainty that this equipment I have purchased in the US and can definitely passively monitor traffic on the 802.11 12-14 channels. This is not even a question. You can definitely test this yourself with a WRT54Gv2/v3 running kismet. And if it becomes something we want to prove out I have pcaps to show incidents where these systems are most certainly in service in the US.

If you are using a home brewed WIDS (using kismet sensors in distribution on waps) you would pick it up. On a Cisco WIDS, you would not pick this up. Which makes it a little difficult to pick up if used as an exfiltration connection.

Answer 2

Usually within the U.S., special-ordered equipment is required to scan channels not permitted for operation by the FCC. This could be WiFi devices imported from overseas, or specially-licensed equipment manufactured specifically for spectrum analysis.

Since consumer electronic devices (including Wi-Fi) sold within the U.S. must conform to FCC Part 15 regulations, which do not permit operation in certain channels, I'm fairly confident hardware manufacturers have taken every measure to ensure that their devices are literally incapable of operating (transmitting or receiving) on those frequencies. At the very least, I expect specialized firmware hacks would be required to work around those measures. On the higher end, it's entirely conceivable that the device has been physically engineered so that it cannot work on those frequencies regardless of what it's told to do.

It should be noted however that:

1. As already stated, unlicensed operation in channels 12-14 on the 2.4 GHz band (as well as a number of channels in 5 GHz) is illegal in the U.S.. One may be subject to fine by the FCC if caught in violation.
2. Operating in such frequencies where not allowed by law is not a real security measure. It is simply another form of "security by obscurity". If an attacker has knowledge that a network is using illegal frequencies, or has equipment that can detect and connect to networks operating in those frequencies, that network is as vulnerable to the attacker as any network that is operating legally.

Answer 3

Using this as a source, it appears we can conclude that-

(in relation to consumer devices)-

1. Any device purchased in the USA cannot be configured (through normal means) to be operate on channels 12-14, even when changing the locale to EU or JP because it's illegal to provide a device that you can simply configure to break regulations.
2. A device imported from outside the USA may be able to operate outside these frequencies if configured for a location where this is allowed. [2]
3. Many devices may not be physically limited to operate in a certain regulation, and modified open source drivers will allow operation outside this frequency. This appears to be the case with many atheros chips.
4. Many devices purchased outside the USA may also not be configured to operate in these frequencies because of a manufacture's laziness / relative importance of compliance in USA.

Also see- http://smorgasbord.gavagai.nl/2010/09/wifi-regulatory-compliance-and-how-to-fix-it/

Answer 4

To answer Jeff's updated question.

If your network is controlled enough where you are worried about rouge access points, then you would also be using wired security. (802.1x or otherwise.)

Besides using a rogue wifi access point, you could be using an undetectable wireless connection on the 700mhz band.

It's easier to make sure that everything connected to the authenticated rather than look for signal on random wireless bands.