Questions tagged [wireless]
Wireless security topics including 802.11, Bluetooth, and others.
444
questions
-2
votes
1answer
82 views
how many network adapters does an evil twin attack require
what is the difference between performing an evil twin attack with 2 wireless adapters or with just on or is it even possible to perform this attack with just one adapter? i am using Kali Linux
4
votes
2answers
179 views
What does WPA2 traffic look like to a packet sniffer that is not connected to the network?
Imagine there is a wireless network using WPA2, and an attacker has come along with his wireless card in monitor mode. What will the packets from that network look like? Is any information disclosed i....
0
votes
0answers
40 views
Wireshark doesn't capture on interface wlan0mon [migrated]
I am using Wireshark to scan for unwanted traffic in my home network. I enabled monitor mode for wlan0 using:
airmon-ng check kill
airmon-ng start wlan0
When I check iwconfig I can see the wlan0mon ...
1
vote
1answer
85 views
802.11 data frames missing from Wireless frames capturing
By working on the Wireless QoS (WMM/802.11e), I captured with airmon-ng and airodump-ng on Kali Linux, the 802.11 raw wireless frames, on my BSSID and channel.
I generate some traffic from my ...
1
vote
1answer
67 views
Looking to take a hotspot that is shared and create my own hotspot that can be firewalled
What is the best way to take a wireless hotspot that is owned by someone else, create my own hotspot or VLAN to be able to Firewall / Not allow my devices to view the other individuals' devices?
I ...
1
vote
2answers
126 views
How can wireless password cracking be detected?
Our team was hired for a red team engagement for a client. A part of the engagement is attempting to crack the WiFi passwords of their office APs. However, we obviously want to stay undetected. What ...
1
vote
1answer
73 views
Scapy: Sending forged Probe Requests and capturing them in a different device
Objective:
Sending a forged Probe Request frame from one machine and capturing it on a second machine.
I have two codes running:
sender.py
interface = sys.argv[1]
dot11 = Dot11(addr1='ff:ff:ff:ff:...
0
votes
1answer
94 views
What is the significant difference between a Rogue Access Point & Client Mis-Association [closed]
As the title states, how can I differentiate both of them.
0
votes
0answers
75 views
How does an IMSI catcher “impersonate” a base station/cell tower?
On reading about IMSI catchers, I keep seeing that they "impersonate" a real cell tower or "base station" so that the phone drops its signal-carried data on that machine while on its way to the ...
1
vote
0answers
180 views
Display filter to see WPS attempts in WireShark [closed]
My neighbour is actively trying WPS pins on my router - I know because the "WiFi/WPS" LED on my router lit up when I have permanently turned it off! I double checked the setting using the router admin ...
2
votes
0answers
65 views
Is this the signature of a KRACK attack?
A router (or one spoofing as a router) unilaterally sent to a client an EAPOL packet 1 of 4, and then immediately sent 5 packets of EAPOL packet 3 of 4.
Is this the signature of a KRACK attack? And ...
1
vote
1answer
153 views
Capture WiFi AP authentication attempted password
Is it possible for someone who is doing air monitor mode (ex. using airmon-ng) or is using a rogue device to capture attempted authentication on a Wi-Fi AP ?
For example, I have a home router WPA2-...
1
vote
1answer
99 views
How does one steal files by connecting to a laptop's WIFI / Bluetooth? [closed]
I'm asking how does one steal files by connecting to a laptop's WIFI / Bluetooth and can it be done with the laptop powered off if there is a battery?
Could you please explain how you would connect ...
2
votes
0answers
96 views
RF signal Wi-Fi leak [closed]
How can one steal files off a laptop hard drive using RF / Wi-Fi signals? Can it be done with the laptop powered off if there is a battery?
1
vote
1answer
268 views
Network Adapter error on airgeddon
I keep getting an error on airgeddon while using my Alfa AWUS036ACH network adapter (RTL8812AU chipset).
I can launch airgeddon successfully with all requisite tools installed, select my wlan0 ...
0
votes
0answers
47 views
Aireplay-ng doesnt get ACKs
I use the panda pau09 wireless adapter with a kali vm. I am attempting to deaauth my laptop off my home wifi. My last theory was that for some reason i wasn't able to deauth on 5Ghz band but after ...
2
votes
0answers
57 views
How SIGINT Researchers/Operators collect, decode and monitor a vast array of wireless data? [closed]
In wireless communication, data flows at various frequencies ranging from Radio to Satellite communication. These frequency carriers are allocated for different uses based on various requirement ...
0
votes
0answers
58 views
Can I use a public / private keypair to secure traffic on my wifi on OpenWRT?
Wifi passwords are a pretty weak way to secure a Wifi Access point; is it possible to use a public / private key to secure traffic on a wifi access point which runs OpenWRT.
I know I can secure SSH ...
1
vote
1answer
733 views
How to speed up brute forcing of finding a WEP key from a captured file?
I have been working on decrypting a WEP .cap file using crunch. It has 1268 IVs. I am wondering:
Can I get a clue from the captured file to speed the process of brute-forcing?
If not, what other ways ...
0
votes
1answer
55 views
Capturing multicast packets in WLAN
(I had to move this from Network Engineering stack exchange where I origianlly asked this question)
If a device in monitoring mode snoops on the traffic in a WLAN, can it CAPTURE and READ multicast ...
0
votes
0answers
197 views
Why doesn't the fluxion attack steal credentials when authenticating to the network?
I ask this question because i am not happy with the answer here
In a normal attack such as fluxion.
You send DEAUTH packets to the victim wifi.
Clone their access point and host an open wifi.
Let ...
1
vote
2answers
575 views
Why do evil twin attacks against WiFi use a captive portal?
I was recently the victim of an evil twin attack on my WiFi network, probably by the new upstairs neighbors. It prompted me, with a captive portal, saying there had been an update and I needed to ...
1
vote
1answer
110 views
MAC/IP address hiding
I am doing some experiments with wireless protocols on ns-3. What I want to ask is how can I hide MAC address/IP address, because I need it for my experiments? Is it possible to use encryption on ...
0
votes
1answer
136 views
Router administration page is served over HTTP
My wireless router admin page does not include https option.
It is always served over http. This is obviously a concern in case someone is sniffing the network and can read my password in plain text.
...
0
votes
2answers
131 views
unauthorized devices appear in windows 10 network drive SMB [closed]
Few days ago I was trying to access a shared folder via SMB on Windows File Explorer and noticed 3 strange mobile phone devices appear listed in the network drive. I never owned any of the mobile ...
4
votes
1answer
781 views
How do you prevent/guard against a wireless disassociation attack [duplicate]
Going over the security+ lectures by professor Messer here, he explains and demonstrates a wireless disassociation attack very well. But no where in the video does he explain how this type of attack ...
1
vote
1answer
461 views
Capturing traffic on WiFi Network using Wireshark [duplicate]
Is it possible to capture, using Wireshark, regular data sent by another machine inside my Wireless LAN?
0
votes
1answer
3k views
Detect / Prove and Prevent Wifi Deauth attack
I'm suspecting that my neighbor is running multiple Wifi deauth flood attacks against my Wifi. I'm using WPA2 and I don't think he can really crack my password, but my devices keep having wifi ...
1
vote
2answers
608 views
How to get result from airdump-ng on Ubuntu 18.04 LTS?
Issue: when I run airodump-ng wlp3s0mon, no results appear.
I recently installed all kali linux tools on Ubuntu 18.04 LTS from this git repo https://github.com/LionSec/katoolin
My chipset is the ...
1
vote
1answer
105 views
Where does last 4 bytes of hmac go in wpa2 mic?
The wpa2 mic is a 16 bytes array which is built by Hmac(sha1)
,But the Hmac(sha1) returns 20 bytes array.
So where does that 4 bytes go?
2
votes
1answer
162 views
Are there any known exploits against bluetooth mice or keyboards?
Most wireless mice are not bluetooth. There are known exploits that take over wireless mice and use them as a keyboard.
Are there known exploits that can remotely inject malware directly over ...
3
votes
1answer
198 views
What are the countermeasures against key cloning?
I’ve looked into the techniques of cloning the 315Mhz and 433Mhz remote car keys and I’m wondering what’s the countermeasure one can provide against wireless radio key lock? Since the radio signals do ...
8
votes
1answer
822 views
How do rolling code fobs and receivers synchronise?
This is a follow-up question to my earlier one: Does pressing a car remote many times offer denial of service attack for rolling codes?
I want to emphasize that I am asking this question more to ...
147
votes
3answers
18k views
Does pressing a car remote many times offer denial of service attack for rolling codes?
My understanding of remote car key fobs, and similar security devices with rolling codes, is that the key device is a transmitter that, each time the button is pressed, sends the next secret in a ...
2
votes
1answer
129 views
How does wireless keyboards' encryption prevent frequency analysis?
I've found very little information on this topic after much googling. The only partial answer I found was by Microsoft: Microsoft_AES_Technical_Factsheet
By adding random data to each message, each ...
1
vote
2answers
222 views
Is there any methodology to detect smart deauthentication attack?
I'm a project student in IIT-Hyderabad. I have been working in Wifi security domain for my M.Tech. In particular, I chose de-authentication attack.
Whenever I sent De-Auth frames continuously to APs ...
0
votes
4answers
217 views
Does improving password complexity improve the security of wireless networks?
Does having a complex preshared key improve the security of WPA2-PSK, or is having even a simple PSK enough to secure the wireless network?
2
votes
0answers
70 views
How to identify the communication protocol used in a wireless device?
I really hope that this is the right place to ask.
I need to analyze a baby monitor for any security or privacy weaknesses.
The spec sheet of the baby monitor says, that it uses the ISM 2400~2483.5 ...
1
vote
1answer
91 views
Is it possible to eavesdrop the wireless data transmission without being authorized to a router?
I read in computer security book that there are three places in wireless networking where you can be attacked: wireless transmission, access points and wireless network itself. The book illustrates ...
-1
votes
1answer
95 views
What hardware components in a laptop should be removed in order to prevent it from wirelessly communicating with other devices?
If you have a laptop, what hardware components should be removed in order to prevent it from wirelessly communicating with other devices? In other words, how can I prevent a laptop from getting ...
2
votes
2answers
5k views
Airodump-ng : why are BSSID not associated?
Using airodump-ng with my wireless adapter in monitor mode, I am able to get expected scan to run.
I have a few questions :
Why do BSSIDs show as "not associated" (note: not all of them show as ...
1
vote
2answers
1k views
Prevent Text Spoofing - Best methods
In an enterprise environment we have been inundated with spoof texts appearing to be from the corporate office.
After much research it appears Verizon isn't able to assist. Just wondering if anyone ...
2
votes
0answers
91 views
Why do car key remotes not use E2EE?
Background
I read an article about how car keys that remotely open one's car are not secure. This answer also talks about different encryption methods being insecure.
The article mentions that ...
0
votes
1answer
778 views
4G Pocket WiFi - IMSI Catcher?
Nearly all mobile phones are vulnerable to IMSI catcher attack's fake mobile networks. They can access storage, inject rootkits/backdoors, turn the microphone on view internet traffic even with a VPN ...
-2
votes
1answer
62 views
Which brand of USB key storage and external USB storage can prevent wave or wireless read? [closed]
Which brand of USB key storage and external USB storage can prevent wave or wireless read?
I find some has military encryption USB key storage
, but do I need to encrypt files before saved in these?
...
2
votes
2answers
87 views
My AP is probing other device?
I just installed kismet 2018 Beta update on my kali and test run it on my host but i came across something that i dont understand and i would appreciate if someone would explain to me.
When i check ...
1
vote
1answer
850 views
ARP request replay attack - why do APs work the way they do?
ARP request replay attacks are based on the practice that wireless access points repeat ARP packets injected into the network, and since these ARP packets are encrypted, they also carry the IV with it....
1
vote
1answer
103 views
Is it possible to push a device from a private WiFi in order to decoy it to a public WiFi?
Regarding How to force clients to connect to WiFi automatically? and this situation:
my neighbour is connected to his private Wi-Fi
I have a Pineapple Nano broadcasting public SSID's (McDonald, ...
5
votes
1answer
328 views
How do TV satellites authenticate the receiving signal to make sure its from the TV station that its claiming to be and is not spoofing? [duplicate]
What stops criminals from jamming a channel by sending spoofed signals to its satellite in space, acting like they are from the TV station and therefore hijack or jam the channel?
How can the ...
0
votes
1answer
126 views
wireless point-to-point security
I have a remote site where I need to bridge approx 700m distance either with fibre or wireless for a backbone internet connection.
The digging would cost a bit more and many suppliers are offering ...
