Remote Auditing a Secure WiFi Network-Obtaining enough of the Secured-Network credentials to attack without being in range of WiFi

Question

I was wondering if there are any methods I'm unaware of that will allow an attacker to attempt to obtain WiFi access outside the physical range of the WiFi signal.

When using net-stumbler or any other signal detection suites, we all know it'll report the following:

BSSID/Mac,PWR,RXQ,Beacons,#data,#/s,CH,MB,ENC,Cipher,Auth, and ESSID.

I'm familiar with the common WiFi attacks that it requires the attacker to be in physical range of the WiFi.

My Question is: Are there any other methods of finding out network information enough to remotely attempt to audit the security parameters of their WiFi/network?

I hope I conveyed my thoughts enough... Please let me know if I can provide any further details to the scope of my question.

Answer 1

I believe the PTW attack on WEP only requires you to be within range of one of the clients of the AP, not the AP itself. Other than that, I'm not aware of any attacks that can be done without being within range of the AP. Some information-gathering can be done by listening for probes from former clients of the AP, but I don't know if you would call this an attack.

Note that this range can be a lot longer than you'd expect. Without using any special equipment, I've picked up APs from as much as 15 miles away. Quirks of radio propagation can change the coverage area as well: I've picked up APs that are out of line-of-sight by pointing an antenna at a tall building and catching the reflected signal.