3

I'm looking for a captive portal solution that prevents other users from stealing the session key from other active users. (or prevents the cloning the authenticated user's MAC)

Is there a reliable way to prevent this kind of local service theft? The easiest solution I could imagine is a https session that sends a heartbeat from the MAC at a regular interval.

A step up would be a Zero Knowledge Proof VPN, though I'm not sure if such a thing exists.

  • 2
    "prevents the cloning the authenticated user's MAC" That's not possible. You can always copy the MAC address. – Gerifield Sep 16 '14 at 22:39
  • What would be a "Zero Knowledge Proof VPN"? A VPN where its not known who sent the request? – user10008 Sep 17 '14 at 0:45
  • @user10008 perhaps a ssl vpn would do the trick. I just want to authenticate users after they get a secure session – technology_is_overrated Sep 17 '14 at 1:42
  • Do you perhaps search for WPA2-enterprise? You can have a captive portal telling login data over HTTPS on one SSID, and WPA2-enterprise on the other. – user10008 Sep 17 '14 at 1:59
  • 1
    @makerofthings7 with WPA2-enterprise, you can give every user individual credentials, with are then used to make an unique key for every encrypted connection. WPA2-PSK also has unique keys, but it is derived from the PSK, and attackers getting the initial login can then do what you described. With WPA2-enterprise, this isn't as easy. And whether the clients can see the traffic of each other depends on the behaviour of the AP and the network it is connected to. – user10008 Sep 17 '14 at 19:08
1

Relevant answer to an existing question here: Can a captive portal be secured

You can generate a session key and store it in a cookie client side which contains a session token to authenticate the client to the Proxy (yes proxy!). (do make sure it's sent over HTTPS as otherwise it's completely useless)

The proxy does bring a limitation when it comes to other types of traffic such as SSH (taking out of scope that your users know how to tunnel traffic over HTTP). To solve this problem you can step away from the whole 'captive portal' story and try another authentication method like PEAP.

Note that setting up a good way of authentication is not easy as there are many ways of bypassing captive portals, for instance: DNS Tunneling, ICMP Tunneling, HTTP Tunneling

Apparently some routers have a 'Client Isolation' or 'Wireless Isolation' setting which may prevent devices on a network communicating with each other (mitigating any ARP poisoning attack). Source: http://www.howtogeek.com/179089/lock-down-your-wi-fi-network-with-your-routers-wireless-isolation-option/

WPA2 Enterprise could also be implemented which encrypts traffic at a user level, using each member of the networks unique credentials (username and password).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.