Questions tagged [wifi]

Security for 802.11 wireless networks.

107 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
0answers
274 views

How to send Wi-Fi management frames from macOS?

I realise that this question has been touched on before as linked here. However, none of the solutions suggested solved my question and they all fail to answer the overarching question of how to send ...
4
votes
0answers
125 views

Broadcasting 10k SSIDs

How hard would it be, and or is it possible, to configure a router or PC to broadcast ten thousand SSIDs. If it is possible what repercussions would it have? Would this be a form of DOSing or is there ...
4
votes
0answers
93 views

WiFi Fingerprinting RFC2617 Linux Device Cannot Unauthenticate Unless AP Password Changes

There is a Cisco WiFi Access Point in the office that is intended for guests. It is an open network in that you can associate without providing a password with the SSID. It supports RFC2617 and so the ...
4
votes
2answers
1k views

How is TSC (TKIP sequence counter) calculated, in WPA?

I'm reading about 802.11, from IEEE's PDF, from page 1191, and in particularly I'm reading about TKIP. To decrypt and encrypt, you use a TSC (TKIP Sequence Counter) as you can see in these images: ...
3
votes
0answers
177 views

Do modern operating systems still send targeted or directed Wi-Fi probe requests that contain SSIDs?

Do modern (versions of) operating systems, primarily Android and iOS on mobile, still send targeted or directed probe requests when searching for Wi-Fi networks to connect to? Such targeted or ...
3
votes
0answers
117 views

WPA2 MIC 128bits value VS HMAC SHA1 output 160bits

I understand that under WPA2, if the MIC value is equal to the HMAC SHA1 function, that means the password from dictionary attack works. However, after deriving the MIC value from Wireshark, which is ...
3
votes
1answer
288 views

Possible Phishing Attempt?

I use an iPhone. Today I got a text from an unknown number starting from +65. The message was "your one-time Wifi password is xxxx and it’s valid for only 10 minutes". Thought it was a scam and ...
3
votes
1answer
83 views

Least riskiest option when it comes to reinstalling the OS

I understand security is a continuum rather than a binary, which is why I'm asking this question. I need to reinstall the OS on my Macbook. However, after a security mishap, I’m far more alert about ...
3
votes
2answers
5k views

Security of bluetooth tethering vs. wifi hotspot

I'm using my cellphone to connect my laptop to the web. I think connecting my cellphone to my laptop with a USB cable would be the safest connection but if I go wireless, is it safer to connect to my ...
2
votes
0answers
84 views

How does WIFI password verification work in a WiFi evil twin?

Problem Statment I am trying to guard against the following scenario. I have a laptop and it connects over wifi, at home as well as at workplace. I am not familiar with the wifi protocol. I ...
2
votes
0answers
85 views

I'm not able to DeAuth a Client (Aireplay-ng)

I'm trying to perform a De-authentication attack on my own network and client. However, the client never disconnects and I cannot boot the client from the AP. I'm running: aireplay-ng -0 0 -a [BSSID]...
2
votes
1answer
122 views

Monitoring nearby WiFi clients

I know that a WiFi adapter can scan for active BSSIDs, and that in monitor mode it can scan all unencrypted traffic. What is the best way to list nearby WiFi clients from Python? I understand that ...
2
votes
0answers
109 views

A very curious wifi problem

I was having some trouble with my wifi reception on the 2.4g band so I started up airodump to look for any offending signals. I found a strong hidden essid on the same channel I was on, so I logged on ...
2
votes
0answers
261 views

How to prevent a DHCP Starvation attack in a wireless network

Is there any way to prevent a DHCP Starvation attack when using a wireless network with anonymous users? Port security cannot be used since maxing the number of clients that can connect on a port ...
2
votes
0answers
273 views

For cloud-based password managers, is it safe to login using public WiFi?

For cloud-based password managers, is it safe to login when using public WiFi? To help get good answers to this question, let's define 3 terms: Cloud-based password managers = Password managers such ...
2
votes
0answers
154 views

WiFi Channel 6 unusable, but no other AP on Channel 6

There is a single MAC address broadcasting a vast amount of QoS packets on channels between 3 and 9. Is this a DoS attack? The access point that MAC address is associated with says its on channel 1. ...
2
votes
1answer
99 views

Network with one possible unsecure device and one home assistant device

Background: I have a google home and I plan to buy 1 or 2 cheap cameras to monitor my home when I'm not in it. I plan to have the camera connected to a wifi plug, so I can switch it off via the app ...
2
votes
0answers
103 views

How can a 802.11 client verify the authenticity of an AP it is trying to connect to?

With the onset of hardware like the WiFi pineapple, it has become somewhat harder to protect the privacy of your WiFi network. WPA2 Enterprise with Radius authentication could come to rescue here, but ...
2
votes
2answers
215 views

Wi-fi Certificate Permission and Access to phone/data

There are several questions addressing similar questions, but not quite the same (others ask about MITM Attacks). They also state conflicting and opposing answers/responses, so I ask here 3 specific ...
2
votes
0answers
416 views

Securing wifi hotspots across multiple devices with multiple users

I have a situation where multiple devices will be installed in public places and different maintenance engineers, from potentially different companies, will need to login via their wifi hotspot to set ...
2
votes
0answers
2k views

Can SSH tunneling over DNS tunnel work in China to use free WiFi at airport?

I have followed a tutorial here: http://ebnj.net/sshoverdns/ This tutorial tells us how to carry all internet traffic via DNS tunnel if your airport enables no-limit outgoing DNS. This guides us to ...
2
votes
0answers
832 views

Does EAP-TLS provide a two-factor authentication?

I am currently setting up FreeRADIUS on my pfSense firewall to authenticate WLAN clients (mainly iOS) via EAP-TLS. I have therefor created a user certificate and a user within the FreeRADIUS user ...
2
votes
0answers
203 views

WPA2-Enterprise - unable to find a way around Lanner Electronics

I have currently been working in an environment where I am connected to a WPA2-Enterprise network requiring me to enter my username and password for the network whenever I connect. I have been asked ...
2
votes
1answer
228 views

WPA PSK to WPA EAP PSK roaming

Would clients (iPhone, android, whatever) roam seamlessly from an AP using WPA-PSK to an AP using WPA-EAP-PSK (with PEAP passthrough setup) if the same PSK was used and valid on both APs (AP1 and AP2 ...
1
vote
0answers
50 views

WPA3-Enterprise Modes

Looking at the Wi-Fi alliance document we find basically three modes: WPA3-Enterprise only Mode WPA3-Enterprise transition Mode WPA3-Enterprise 192-bit Mode Inside another document provided by Aruba ...
1
vote
0answers
43 views

What should we do in practice to mitigate vulnerabilities in WPA3?

WPA3 for Wi-Fi systems is generally acknowledged to be more secure than WPA2. For example, it introduces SAE with the Dragonfly handshake, in an attempt to close the door on the kind of brute force ...
1
vote
0answers
37 views

Why did I get incorrect wifi password pop up for unknown network on iPhone?

A few months ago my iPhone had a pop up saying 'incorrect wifi password' and telling me to enter the correct password, however it was for a network that I had never connected to or seen before. It ...
1
vote
1answer
232 views

Success rate of pixie dust attack

Recently I read about the pixie dust attack in which a WPS PIN is decoded with time stamp and other resources within a fraction of a second. The only drawback is that it only works on WPS enabled ...
1
vote
0answers
496 views

Problem while using Reaver WPS

I was trying to crack my WiFi Router. I have two laptops an older one(Lenevo 3000 G430) and a newer one(HP Elitebook 840 G3) with their internal adapter. The old one has BCM4312 802.11b/g chipset and ...
1
vote
0answers
71 views

Preventing DoS and flooding attacks on wireless MANET network

How can I prevent DoS/flooding attacks on a wireless MANET network?
1
vote
0answers
767 views

Bully and reaver not finding anything in any network

I have been trying out reaver and bully on my network and friends network, multiple different routers, but none of them finds anything. The command for reaver that I run is: reaver -i wlan0mon -c ...
1
vote
0answers
83 views

What information for identification does a WiFi router get from a connecting device (Android)? What information can be spoofed?

When I want my device to connect to a WiFi router and make the router not recognize the device I have to change the MAC and the hostname. Is this right? And what information will also be usually ...
1
vote
0answers
927 views

How secure is my apartment's building wide wifi network using Spectrum Community Solutions?

Recently my apartment moved from having individual modems (with our own router/wifi network) to this Spectrum Community Solutions building wide network. Everyone can connect to the network anywhere, ...
1
vote
0answers
677 views

aircrack-ng issue: No mon0 when run “airmon-ng start wlan0” and “No such BSSID available”

I have read many threads on StackExchange and some other blogs but none helped me. The issue is with aircrack-ng on Kali Linux. It gives me error No such BSSID available when I run aireply-ng. I think ...
1
vote
0answers
101 views

Are VLANs necessary to segment WiFi SSID to secure traffic?

WiFi routers offer the ability to configure multiple SSIDs. Equally some routers also enable the option to configure virtual networks (VLANs). If the requirement is to secure WiFi traffic such that ...
1
vote
1answer
182 views

Can my online activity be detected with this set up?

Here's my situation. In the past several months, I've had my credit card information stolen twice and Instagram account hacked into. I'm hoping this is just bad luck, but I'm a little paranoid now ...
1
vote
0answers
192 views

How to secure Wifi Direct p2p connection between android devices?

I found this answer. However, I want to know how to use WPA2 and ssl to secure wifi - direct connection. Also is there a way to make wifiDevice visible only in the app that I want and not in other ...
1
vote
0answers
110 views

How does fake authentication work with no other clients connected to the AP? (aireplay-ng)

I was reading a tutorial about how to hack a WEP network that has no other clients connected to the AP. It says that fake authentication must be used and it appears to work, but I don't understand how ...
1
vote
0answers
187 views

Why WPA2 did not design a PTK based on asymmetric cryptography?

I was shocked to learn how the PTK is crafted from the PMK in WPA2 WiFi. PMK is made with crypt_hash(SSID + PSK). OK, seems good. Then, the client and the Access Point (AP) make the famous 4 way ...
1
vote
1answer
617 views

Passive WiFi sniffing without associating to the AP

Suppose that I have a WiFi adapter that is in range of several APs and clients, all sharing the same channel and all using WPA2 encryption. I know all their passwords. I'd like to sniff on all of them ...
1
vote
0answers
179 views

scapy Deauthentication address understanding

I have the problem to understand from_DS, to_DS with Deauthentication packet, deauthentication packets are type=Managment, FCfield managment and control frames always FROM_DS = 0 , TO_DS=0, ...
1
vote
0answers
584 views

Replay attack in Wi-Fi (802.11) network

I am trying to create a small smartphone activated lock for my house via Wi-Fi. The setup is like this: The solenoid of the lock is connected to an esp8266 that acts as an access point, and has an ...
1
vote
0answers
241 views

DoS attack to device not connected to WiFi

I would like to know if there is any attack to DoS a device (NOT AN AP) that is not connected to any WiFi network. Using Probe Request frames I can obtain the MAC address. I can't 802.11 deauth ...
1
vote
0answers
98 views

Forward packages to Access Point in KRACK attack

I am investigating the KRACK attack based on the published paper and their youtube video. I largely understand the attacks proposed in the paper as they are except for the completion of the ...
1
vote
0answers
148 views

how can i know if mdk3 deauthentication really disconnects clients without checking the devices?

How can I know if mdk3 deauthentication really worked just from my laptop using tools like wireshark?
1
vote
0answers
160 views

How effective is WiFi deauthentication attack performed using ESP8266?

There is this tiny ESP8266 WiFi module which can be bought for ~$2. There are projects on Github as well that can turn this cute little module into a big devil (example). I wonder what is the ...
1
vote
0answers
710 views

Different CRC32 implementations? different results?

So recently I managed to implement the Caffe-Latte attack in python. I got stuck for two weeks because the final ICV wouldn't match. After some digging around I found that airbase-ng (which already ...
1
vote
0answers
2k views

Unknown device in home network

I have a home network that is behind NAT. My router IP address is 192.168.0.1 and DHCP is configured to provide addresses from the 192.168.0.1/24 range. My desktop is connected trough the ethernet ...
1
vote
0answers
392 views

How can I capture a chronological record of the clients connected to a specific standalone AP?

I want to have a chronological/historical graph showing what times each client was connected to an AP using either airodump-ng with a simple script or some other free and open tool.
1
vote
0answers
61 views

Is this system of tracking users via Wi-Fi secure?

I am trying to make an app which will be used to track the presence of the users in a location, using the Wi-Fi hotspot of the location. The purpose is to know which user was at the location for how ...