Questions tagged [wifi]

Security for 802.11 wireless networks.

118 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
291 views

Do modern operating systems still send targeted or directed Wi-Fi probe requests that contain SSIDs?

Do modern (versions of) operating systems, primarily Android and iOS on mobile, still send targeted or directed probe requests when searching for Wi-Fi networks to connect to? Such targeted or ...
4
votes
0answers
131 views

Broadcasting 10k SSIDs

How hard would it be, and or is it possible, to configure a router or PC to broadcast ten thousand SSIDs. If it is possible what repercussions would it have? Would this be a form of DOSing or is there ...
4
votes
0answers
93 views

WiFi Fingerprinting RFC2617 Linux Device Cannot Unauthenticate Unless AP Password Changes

There is a Cisco WiFi Access Point in the office that is intended for guests. It is an open network in that you can associate without providing a password with the SSID. It supports RFC2617 and so the ...
4
votes
2answers
1k views

How is TSC (TKIP sequence counter) calculated, in WPA?

I'm reading about 802.11, from IEEE's PDF, from page 1191, and in particularly I'm reading about TKIP. To decrypt and encrypt, you use a TSC (TKIP Sequence Counter) as you can see in these images: ...
3
votes
0answers
124 views

WPA2 MIC 128bits value VS HMAC SHA1 output 160bits

I understand that under WPA2, if the MIC value is equal to the HMAC SHA1 function, that means the password from dictionary attack works. However, after deriving the MIC value from Wireshark, which is ...
3
votes
1answer
375 views

Possible Phishing Attempt?

I use an iPhone. Today I got a text from an unknown number starting from +65. The message was "your one-time Wifi password is xxxx and it’s valid for only 10 minutes". Thought it was a scam and ...
3
votes
1answer
95 views

Least riskiest option when it comes to reinstalling the OS

I understand security is a continuum rather than a binary, which is why I'm asking this question. I need to reinstall the OS on my Macbook. However, after a security mishap, I’m far more alert about ...
3
votes
2answers
6k views

Security of bluetooth tethering vs. wifi hotspot

I'm using my cellphone to connect my laptop to the web. I think connecting my cellphone to my laptop with a USB cable would be the safest connection but if I go wireless, is it safer to connect to my ...
2
votes
0answers
736 views

How to send deauth packets on Windows (manually or with software)?

first of all I know how deauth packets work basically. But since my wifi adapter refuses to work on my virtual Kali, I want to use my host machine (Windows 10). So I have NPcap and Wireshark and I can ...
2
votes
0answers
46 views

802.11s with SAE vs WPA-RSN (802.11i) on a MESH network

I'm investigating a protection options for a mesh network (p2p). The amount of nodes is constantly changing and possibly owned by different entities. We are thinking between 802.11s with SAE (...
2
votes
1answer
2k views

PMKID found , but it should be WPA handshake

i was trying to get access in wifi network but i came to something that i need to ask afteraireplay-ng –0 20 –a [router bssid] –c [client bssid] wlan0mon i expect WPA handshake in right top ...
2
votes
0answers
115 views

How does WIFI password verification work in a WiFi evil twin?

Problem Statment I am trying to guard against the following scenario. I have a laptop and it connects over wifi, at home as well as at workplace. I am not familiar with the wifi protocol. I ...
2
votes
0answers
376 views

I'm not able to DeAuth a Client (Aireplay-ng)

I'm trying to perform a De-authentication attack on my own network and client. However, the client never disconnects and I cannot boot the client from the AP. I'm running: aireplay-ng -0 0 -a [BSSID]...
2
votes
1answer
201 views

Monitoring nearby WiFi clients

I know that a WiFi adapter can scan for active BSSIDs, and that in monitor mode it can scan all unencrypted traffic. What is the best way to list nearby WiFi clients from Python? I understand that ...
2
votes
0answers
111 views

A very curious wifi problem

I was having some trouble with my wifi reception on the 2.4g band so I started up airodump to look for any offending signals. I found a strong hidden essid on the same channel I was on, so I logged on ...
2
votes
0answers
414 views

How to prevent a DHCP Starvation attack in a wireless network

Is there any way to prevent a DHCP Starvation attack when using a wireless network with anonymous users? Port security cannot be used since maxing the number of clients that can connect on a port ...
2
votes
0answers
346 views

For cloud-based password managers, is it safe to login using public WiFi?

For cloud-based password managers, is it safe to login when using public WiFi? To help get good answers to this question, let's define 3 terms: Cloud-based password managers = Password managers such ...
2
votes
0answers
166 views

WiFi Channel 6 unusable, but no other AP on Channel 6

There is a single MAC address broadcasting a vast amount of QoS packets on channels between 3 and 9. Is this a DoS attack? The access point that MAC address is associated with says its on channel 1. ...
2
votes
1answer
124 views

Network with one possible unsecure device and one home assistant device

Background: I have a google home and I plan to buy 1 or 2 cheap cameras to monitor my home when I'm not in it. I plan to have the camera connected to a wifi plug, so I can switch it off via the app ...
2
votes
0answers
117 views

How can a 802.11 client verify the authenticity of an AP it is trying to connect to?

With the onset of hardware like the WiFi pineapple, it has become somewhat harder to protect the privacy of your WiFi network. WPA2 Enterprise with Radius authentication could come to rescue here, but ...
2
votes
2answers
330 views

Wi-fi Certificate Permission and Access to phone/data

There are several questions addressing similar questions, but not quite the same (others ask about MITM Attacks). They also state conflicting and opposing answers/responses, so I ask here 3 specific ...
2
votes
0answers
232 views

Why WPA2 did not design a PTK based on asymmetric cryptography?

I was shocked to learn how the PTK is crafted from the PMK in WPA2 WiFi. PMK is made with crypt_hash(SSID + PSK). OK, seems good. Then, the client and the Access Point (AP) make the famous 4 way ...
2
votes
0answers
417 views

Securing wifi hotspots across multiple devices with multiple users

I have a situation where multiple devices will be installed in public places and different maintenance engineers, from potentially different companies, will need to login via their wifi hotspot to set ...
2
votes
0answers
2k views

Can SSH tunneling over DNS tunnel work in China to use free WiFi at airport?

I have followed a tutorial here: http://ebnj.net/sshoverdns/ This tutorial tells us how to carry all internet traffic via DNS tunnel if your airport enables no-limit outgoing DNS. This guides us to ...
2
votes
0answers
901 views

Does EAP-TLS provide a two-factor authentication?

I am currently setting up FreeRADIUS on my pfSense firewall to authenticate WLAN clients (mainly iOS) via EAP-TLS. I have therefor created a user certificate and a user within the FreeRADIUS user ...
2
votes
0answers
203 views

WPA2-Enterprise - unable to find a way around Lanner Electronics

I have currently been working in an environment where I am connected to a WPA2-Enterprise network requiring me to enter my username and password for the network whenever I connect. I have been asked ...
2
votes
1answer
275 views

WPA PSK to WPA EAP PSK roaming

Would clients (iPhone, android, whatever) roam seamlessly from an AP using WPA-PSK to an AP using WPA-EAP-PSK (with PEAP passthrough setup) if the same PSK was used and valid on both APs (AP1 and AP2 ...
1
vote
0answers
54 views

WEP fake authentication purpose

I am studying WEP protocol and more specifically fake authentication attack. Man page says This is only useful when you need an associated MAC address in various aireplay-ng attacks and there is ...
1
vote
0answers
44 views

What is Received Sequence Counter(RSC) in WPA authentication

In WPA 4-way handshake and in Message 3 (while GTK transfer), A RSC (Received sequence Number ) sent by the Authenticator (AP) to the supplicant. The only information I found about RSC is that it's ...
1
vote
1answer
45 views

How to prevent the device from connecting to the original AP?

I'm running an Evil Twin attack with airgeddon. Point is that after deauth the account is going, automatically, to get reconnected to the orginal AP and not the fake one. The aireplay is likes so: ...
1
vote
1answer
128 views

WPS PIN and key

I was testing how WPS works on my home router and tried to gain access with a tool I found on github called airgeddon. Problem is, I got the PIN down (the PIN I wrote down below is made up, it's ...
1
vote
0answers
60 views

How cameras receive Wi-Fi credentials from App?

I bought a wifi camera and performed the simple startup process: Powered on Discovered the camera through the dedicated App Set the WiFi credentials on the App to pass to the camera After that, the ...
1
vote
0answers
54 views

Problems in stopping/restoring Aircrack session

I'm running aircrack-ng version 1.6 on Live Kali. I noticed that "recently" a -N option has been added for saving a session, which can be later resumed with the option -R. However this seems ...
1
vote
0answers
36 views

How to start Hotspot 2.0 registration and provision?

On many materials of Passpoint and Hotspot 2.0 there is Register and Provision steps. For example https://youtu.be/p4gDW6SJ150?t=845 But I cant find RFC or technical materials how it must be ...
1
vote
0answers
133 views

What should we do in practice to mitigate vulnerabilities in WPA3?

WPA3 for Wi-Fi systems is generally acknowledged to be more secure than WPA2. For example, it introduces SAE with the Dragonfly handshake, in an attempt to close the door on the kind of brute force ...
1
vote
0answers
86 views

Why did I get incorrect wifi password pop up for unknown network on iPhone?

A few months ago my iPhone had a pop up saying 'incorrect wifi password' and telling me to enter the correct password, however it was for a network that I had never connected to or seen before. It ...
1
vote
1answer
1k views

Success rate of pixie dust attack

Recently I read about the pixie dust attack in which a WPS PIN is decoded with time stamp and other resources within a fraction of a second. The only drawback is that it only works on WPS enabled ...
1
vote
0answers
2k views

Problem while using Reaver WPS

I was trying to crack my WiFi Router. I have two laptops an older one(Lenevo 3000 G430) and a newer one(HP Elitebook 840 G3) with their internal adapter. The old one has BCM4312 802.11b/g chipset and ...
1
vote
0answers
76 views

Preventing DoS and flooding attacks on wireless MANET network

How can I prevent DoS/flooding attacks on a wireless MANET network?
1
vote
0answers
1k views

Bully and reaver not finding anything in any network

I have been trying out reaver and bully on my network and friends network, multiple different routers, but none of them finds anything. The command for reaver that I run is: reaver -i wlan0mon -c ...
1
vote
0answers
88 views

What information for identification does a WiFi router get from a connecting device (Android)? What information can be spoofed?

When I want my device to connect to a WiFi router and make the router not recognize the device I have to change the MAC and the hostname. Is this right? And what information will also be usually ...
1
vote
0answers
2k views

How secure is my apartment's building wide wifi network using Spectrum Community Solutions?

Recently my apartment moved from having individual modems (with our own router/wifi network) to this Spectrum Community Solutions building wide network. Everyone can connect to the network anywhere, ...
1
vote
2answers
1k views

aircrack-ng issue: No mon0 when run “airmon-ng start wlan0” and “No such BSSID available”

I have read many threads on StackExchange and some other blogs but none helped me. The issue is with aircrack-ng on Kali Linux. It gives me error No such BSSID available when I run aireply-ng. I think ...
1
vote
0answers
135 views

Are VLANs necessary to segment WiFi SSID to secure traffic?

WiFi routers offer the ability to configure multiple SSIDs. Equally some routers also enable the option to configure virtual networks (VLANs). If the requirement is to secure WiFi traffic such that ...
1
vote
1answer
268 views

Can my online activity be detected with this set up?

Here's my situation. In the past several months, I've had my credit card information stolen twice and Instagram account hacked into. I'm hoping this is just bad luck, but I'm a little paranoid now ...
1
vote
0answers
223 views

How to secure Wifi Direct p2p connection between android devices?

I found this answer. However, I want to know how to use WPA2 and ssl to secure wifi - direct connection. Also is there a way to make wifiDevice visible only in the app that I want and not in other ...
1
vote
0answers
126 views

How does fake authentication work with no other clients connected to the AP? (aireplay-ng)

I was reading a tutorial about how to hack a WEP network that has no other clients connected to the AP. It says that fake authentication must be used and it appears to work, but I don't understand how ...
1
vote
1answer
711 views

Passive WiFi sniffing without associating to the AP

Suppose that I have a WiFi adapter that is in range of several APs and clients, all sharing the same channel and all using WPA2 encryption. I know all their passwords. I'd like to sniff on all of them ...
1
vote
0answers
189 views

scapy Deauthentication address understanding

I have the problem to understand from_DS, to_DS with Deauthentication packet, deauthentication packets are type=Managment, FCfield managment and control frames always FROM_DS = 0 , TO_DS=0, ...
1
vote
0answers
697 views

Replay attack in Wi-Fi (802.11) network

I am trying to create a small smartphone activated lock for my house via Wi-Fi. The setup is like this: The solenoid of the lock is connected to an esp8266 that acts as an access point, and has an ...