Questions tagged [wifi]

Security for 802.11 wireless networks.

94 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
0answers
202 views

How to send Wi-Fi management frames from macOS?

I realise that this question has been touched on before as linked here. However, none of the solutions suggested solved my question and it fails to answer the overarching question of how to send all ...
4
votes
0answers
121 views

How can I properly secure the WiFi setup process of an IoT device?

My company develops a WiFi-connected IoT product. I want to make sure that the process of getting the user's WiFi credentials into the device is as safe as possible. At the moment, the product is in a ...
4
votes
0answers
123 views

Broadcasting 10k SSIDs

How hard would it be, and or is it possible, to configure a router or PC to broadcast ten thousand SSIDs. If it is possible what repercussions would it have? Would this be a form of DOSing or is there ...
4
votes
0answers
93 views

WiFi Fingerprinting RFC2617 Linux Device Cannot Unauthenticate Unless AP Password Changes

There is a Cisco WiFi Access Point in the office that is intended for guests. It is an open network in that you can associate without providing a password with the SSID. It supports RFC2617 and so the ...
4
votes
1answer
1k views

How do TSC (TKIP sequence counter) calculate into WPA?

I'm reading about 802.11, from IEEE's PDF, from page 1191, and in particularly I'm reading about TKIP. To decrypt and encrypt, you use a TSC (TKIP Sequence Counter) as you can see in these images: ...
3
votes
0answers
120 views

Do modern operating systems still send targeted or directed Wi-Fi probe requests that contain SSIDs?

Do modern (versions of) operating systems, primarily Android and iOS on mobile, still send targeted or directed probe requests when searching for Wi-Fi networks to connect to? Such targeted or ...
3
votes
1answer
222 views

Possible Phishing Attempt?

I use an iPhone. Today I got a text from an unknown number starting from +65. The message was "your one-time Wifi password is xxxx and it’s valid for only 10 minutes". Thought it was a scam and ...
3
votes
1answer
81 views

Least riskiest option when it comes to reinstalling the OS

I understand security is a continuum rather than a binary, which is why I'm asking this question. I need to reinstall the OS on my Macbook. However, after a security mishap, I’m far more alert about ...
3
votes
1answer
4k views

Security of bluetooth tethering vs. wifi hotspot

I'm using my cellphone to connect my laptop to the web. I think connecting my cellphone to my laptop with a USB cable would be the safest connection but if I go wireless, is it safer to connect to my ...
2
votes
1answer
54 views

What identifiable variables can be collected via server/client connection logs( wireless AP's) to uniquely identify a device across networks?

For instance, the MAC address is one variable that stays the same across networks, along with Hostname, Operating System, and the combination of open ports/services. Ignoring browser specific ...
2
votes
1answer
94 views

Monitoring nearby WiFi clients

I know that a WiFi adapter can scan for active BSSIDs, and that in monitor mode it can scan all unencrypted traffic. What is the best way to list nearby WiFi clients from Python? I understand that ...
2
votes
0answers
106 views

A very curious wifi problem

I was having some trouble with my wifi reception on the 2.4g band so I started up airodump to look for any offending signals. I found a strong hidden essid on the same channel I was on, so I logged on ...
2
votes
0answers
204 views

How to prevent a DHCP Starvation attack in a wireless network

Is there any way to prevent a DHCP Starvation attack when using a wireless network with anonymous users? Port security cannot be used since maxing the number of clients that can connect on a port ...
2
votes
0answers
221 views

For cloud-based password managers, is it safe to login using public WiFi?

For cloud-based password managers, is it safe to login when using public WiFi? To help get good answers to this question, let's define 3 terms: Cloud-based password managers = Password managers such ...
2
votes
0answers
142 views

WiFi Channel 6 unusable, but no other AP on Channel 6

There is a single MAC address broadcasting a vast amount of QoS packets on channels between 3 and 9. Is this a DoS attack? The access point that MAC address is associated with says its on channel 1. ...
2
votes
1answer
80 views

Network with one possible unsecure device and one home assistant device

Background: I have a google home and I plan to buy 1 or 2 cheap cameras to monitor my home when I'm not in it. I plan to have the camera connected to a wifi plug, so I can switch it off via the app ...
2
votes
0answers
97 views

How can a 802.11 client verify the authenticity of an AP it is trying to connect to?

With the onset of hardware like the WiFi pineapple, it has become somewhat harder to protect the privacy of your WiFi network. WPA2 Enterprise with Radius authentication could come to rescue here, but ...
2
votes
2answers
159 views

Wi-fi Certificate Permission and Access to phone/data

There are several questions addressing similar questions, but not quite the same (others ask about MITM Attacks). They also state conflicting and opposing answers/responses, so I ask here 3 specific ...
2
votes
0answers
103 views

WPA2 MIC 128bits value VS HMAC SHA1 output 160bits

I understand that under WPA2, if the MIC value is equal to the HMAC SHA1 function, that means the password from dictionary attack works. However, after deriving the MIC value from Wireshark, which is ...
2
votes
1answer
379 views

Can the client communicate with the AP after a KRACK attack?

When a client is forced to reinstall the key and to reset the nonce and the replay counter, what does it imply for the future communication between the client and the AP? There's a adversary in the ...
2
votes
0answers
415 views

Securing wifi hotspots across multiple devices with multiple users

I have a situation where multiple devices will be installed in public places and different maintenance engineers, from potentially different companies, will need to login via their wifi hotspot to set ...
2
votes
0answers
2k views

Can SSH tunneling over DNS tunnel work in China to use free WiFi at airport?

I have followed a tutorial here: http://ebnj.net/sshoverdns/ This tutorial tells us how to carry all internet traffic via DNS tunnel if your airport enables no-limit outgoing DNS. This guides us to ...
2
votes
0answers
788 views

Does EAP-TLS provide a two-factor authentication?

I am currently setting up FreeRADIUS on my pfSense firewall to authenticate WLAN clients (mainly iOS) via EAP-TLS. I have therefor created a user certificate and a user within the FreeRADIUS user ...
2
votes
0answers
199 views

WPA2-Enterprise - unable to find a way around Lanner Electronics

I have currently been working in an environment where I am connected to a WPA2-Enterprise network requiring me to enter my username and password for the network whenever I connect. I have been asked ...
2
votes
1answer
216 views

WPA PSK to WPA EAP PSK roaming

Would clients (iPhone, android, whatever) roam seamlessly from an AP using WPA-PSK to an AP using WPA-EAP-PSK (with PEAP passthrough setup) if the same PSK was used and valid on both APs (AP1 and AP2 ...
1
vote
0answers
66 views

Preventing DoS and flooding attacks on wireless MANET network

How can I prevent DoS/flooding attacks on a wireless MANET network?
1
vote
0answers
225 views

Bully and reaver not finding anything in any network

I have been trying out reaver and bully on my network and friends network, multiple different routers, but none of them finds anything. The command for reaver that I run is: reaver -i wlan0mon -c ...
1
vote
0answers
80 views

What information for identification does a WiFi router get from a connecting device (Android)? What information can be spoofed?

When I want my device to connect to a WiFi router and make the router not recognize the device I have to change the MAC and the hostname. Is this right? And what information will also be usually ...
1
vote
0answers
564 views

How secure is my apartment's building wide wifi network using Spectrum Community Solutions?

Recently my apartment moved from having individual modems (with our own router/wifi network) to this Spectrum Community Solutions building wide network. Everyone can connect to the network anywhere, ...
1
vote
0answers
459 views

aircrack-ng issue: No mon0 when run “airmon-ng start wlan0” and “No such BSSID available”

I have read many threads on StackExchange and some other blogs but none helped me. The issue is with aircrack-ng on Kali Linux. It gives me error No such BSSID available when I run aireply-ng. I think ...
1
vote
0answers
78 views

Are VLANs necessary to segment WiFi SSID to secure traffic?

WiFi routers offer the ability to configure multiple SSIDs. Equally some routers also enable the option to configure virtual networks (VLANs). If the requirement is to secure WiFi traffic such that ...
1
vote
1answer
123 views

Can my online activity be detected with this set up?

Here's my situation. In the past several months, I've had my credit card information stolen twice and Instagram account hacked into. I'm hoping this is just bad luck, but I'm a little paranoid now ...
1
vote
0answers
156 views

How to secure Wifi Direct p2p connection between android devices?

I found this answer. However, I want to know how to use WPA2 and ssl to secure wifi - direct connection. Also is there a way to make wifiDevice visible only in the app that I want and not in other ...
1
vote
0answers
89 views

How does fake authentication work with no other clients connected to the AP? (aireplay-ng)

I was reading a tutorial about how to hack a WEP network that has no other clients connected to the AP. It says that fake authentication must be used and it appears to work, but I don't understand how ...
1
vote
0answers
153 views

Why WPA2 did not design a PTK based on asymmetric cryptography?

I was shocked to learn how the PTK is crafted from the PMK in WPA2 WiFi. PMK is made with crypt_hash(SSID + PSK). OK, seems good. Then, the client and the Access Point (AP) make the famous 4 way ...
1
vote
1answer
540 views

Passive WiFi sniffing without associating to the AP

Suppose that I have a WiFi adapter that is in range of several APs and clients, all sharing the same channel and all using WPA2 encryption. I know all their passwords. I'd like to sniff on all of them ...
1
vote
0answers
161 views

scapy Deauthentication address understanding

I have the problem to understand from_DS, to_DS with Deauthentication packet, deauthentication packets are type=Managment, FCfield managment and control frames always FROM_DS = 0 , TO_DS=0, ...
1
vote
0answers
489 views

Replay attack in Wi-Fi (802.11) network

I am trying to create a small smartphone activated lock for my house via Wi-Fi. The setup is like this: The solenoid of the lock is connected to an esp8266 that acts as an access point, and has an ...
1
vote
0answers
219 views

DoS attack to device not connected to WiFi

I would like to know if there is any attack to DoS a device (NOT AN AP) that is not connected to any WiFi network. Using Probe Request frames I can obtain the MAC address. I can't 802.11 deauth ...
1
vote
0answers
98 views

Forward packages to Access Point in KRACK attack

I am investigating the KRACK attack based on the published paper and their youtube video. I largely understand the attacks proposed in the paper as they are except for the completion of the ...
1
vote
0answers
142 views

how can i know if mdk3 deauthentication really disconnects clients without checking the devices?

How can I know if mdk3 deauthentication really worked just from my laptop using tools like wireshark?
1
vote
0answers
157 views

How effective is WiFi deauthentication attack performed using ESP8266?

There is this tiny ESP8266 WiFi module which can be bought for ~$2. There are projects on Github as well that can turn this cute little module into a big devil (example). I wonder what is the ...
1
vote
0answers
581 views

Different CRC32 implementations? different results?

So recently I managed to implement the Caffe-Latte attack in python. I got stuck for two weeks because the final ICV wouldn't match. After some digging around I found that airbase-ng (which already ...
1
vote
0answers
1k views

Unknown device in home network

I have a home network that is behind NAT. My router IP address is 192.168.0.1 and DHCP is configured to provide addresses from the 192.168.0.1/24 range. My desktop is connected trough the ethernet ...
1
vote
0answers
392 views

How can I capture a chronological record of the clients connected to a specific standalone AP?

I want to have a chronological/historical graph showing what times each client was connected to an AP using either airodump-ng with a simple script or some other free and open tool.
1
vote
0answers
61 views

Is this system of tracking users via Wi-Fi secure?

I am trying to make an app which will be used to track the presence of the users in a location, using the Wi-Fi hotspot of the location. The purpose is to know which user was at the location for how ...
1
vote
0answers
44 views

What happens when an attacker sends fake nonce in TKIP handshake?

The TKIP handshake is halfway completed; the access point and station have exchanged the first two messages. Now, before the access point can send the third message to the station an attacker sends a ...
1
vote
0answers
88 views

What will happen if WEP reuses a challenge?

What will happen if a WEP authentication challenge string is reused? If the access point ran out of unique random numbers and reused one then what would happen? I'd think that if challenges were ...
1
vote
0answers
99 views

mdk3 beacon pwning not detected by other devices

I'm new to wireless security. I'm trying to pwn beacon frames to announce a new access point using mdk3. However, when I run the command I get the following result where the MAC address is not ...
1
vote
0answers
146 views

Can MDM on iOS restrict which WiFi networks are accessible?

I'm evaluating MDM solutions for iOS devices that need to be restricted in what WiFi networks they can attach to. It would be great if I could only allow connections to Networks A and B and ban all ...