Wireless security topics including 802.11, Bluetooth, and others.

learn more… | top users | synonyms

0
votes
1answer
18 views

What does it mean when airodump-ng shows 0 beacons?

I have one particular AP that shows 0 Beacons in airodump. I can see the beacons in all the other AP without a problem. So is it even possible for AP to not send beacon frames?
-1
votes
0answers
35 views

Not able to capture credentials when sniffing WiFi packets

I have an open access point nearby with a captive portal asking me to enter credentials which I don't have. I observed that the login page of captive portal doesn't use SSL protection and decided to ...
0
votes
0answers
26 views

Sniffing packet on wireless connection (airodump-ng)

Short Question: Is it important for a sniffing device to be in the broadcasting range of a client (NOT THE ROUTER) to sniff its packets? Complete Scenario: I assume that a wireless sniffing tool, ...
3
votes
4answers
308 views

Is a computer more vulnerable if wireless is left on when booting?

Normally I switch off wireless on my laptop before I shut it down but I forgot to do this last night. So this morning, after I booted up the laptop, I saw the wireless notification on the bottom right ...
0
votes
0answers
71 views

Security of an IoT network using AES (LoRaWAN)

I am studying the security of LoRaWAN. Here is a simplified architecture of the network: As you can see, there are two keys: one for the network security (no mitm, no modificatiof the messages). ...
-1
votes
3answers
141 views

Who can spy on my wifi usage and websites I visit?

I'm using a WPA/WPA2 encrypted WiFi. Who can view what I'm doing? Also how? Can the person that pays for the WiFi look up exactly what I am doing (e.g. look up exact messages I've sent on Facebook)?...
-1
votes
1answer
75 views

Deauthenticate ALL wlan networks/clients in range [closed]

I need to deauthenticate all clients in all networks within the range of my wlan-adapter. Aireplay-ng allows only to focus a single network. Are there any programs or scripts i can use for this ...
0
votes
1answer
40 views

What are attack vectors for attacking tethering smartphones?

Are there any attack vectors for attacking tethered wireless networks (mobile hotspot), other than for normal wireless networks? Assuming the tethered wirless network uses state-of-the-art encryption+...
4
votes
1answer
54 views

What's the difference between pixie attack and other attacks on WPS?

I have been studying about the brute-force attack on the WPS PIN, and I understand that because the last digit is the check digit, and that the PIN is divided into two halves in M4 and M6 messages, ...
2
votes
3answers
81 views

Wireless network risks? [closed]

What are the security risks associated with installing a Wi-Fi (802.11) network in-comparison to a wired network for internet connection?
1
vote
0answers
33 views

What information about a user can wireless carriers access?

What is the maximum amount of imformatiom about a user and the user's phone that can be obtained by a wireless carrier on a GSM network? Here is a list of the things I know, but are there more? IMEI,...
0
votes
0answers
36 views

Are there security concerns with Bluetooth low energy?

In the first versions of BLE specifications, there was a huge security flaw during the pairing allowing an attacker to perform a MITM attack. Since Bluetooth 4.2, the pairing use ECDH, so there isn't ...
3
votes
1answer
115 views

Is it possible to hack WPS PIN of routers that lockout exponentially after failed tries?

I have been interested in Wireless hacking lately, and I can do dictionary attacks, and some other type of attacks. Though, I wanted to hack my ASUS RT-N12D1 router's WPS PIN. ASUS doesn't alllow to ...
1
vote
1answer
49 views

What is the difference between capture traffic from inside and outside of my network?

I'm thinking to use Wireshark tool to packet capture in my Wireless network. I read something that tells I can capture from inside or outside of my network, just making my wifi board working in "...
6
votes
1answer
72 views

How safe is a standard wireless keyboard from a MITM attack?

And are there any mitigations except using a wired keyboard?
0
votes
0answers
10 views

aireplay-ng can't replay packets

I am using the command: aireplay-ng -3 -b 12:34:56:78:90:12 -h 34:56:78:90:12:34 wlan1mon but I can't replay any packets. I have set the correct channel for wlan1mon and I also have spoofed the ...
0
votes
0answers
58 views

Is it possible for an attacker to log keystrokes of a bluetooth or wireless keyboard [duplicate]

Bluetooth and wireless keyboards are sending keystrokes wirelessly. Could this mean that an attacker (or spy) can log the keystrokes by monitoring the wireless or Bluetooth radio waves (or whatever)? ...
0
votes
1answer
39 views

Not receiving beacons for airodump-ng to work

I have an AP close enough to me with high signal strength but for some reason I'm not receiving beacons from it. Since I don't have beacons coming in, I cannot perform deauth as well. One thing I'm ...
1
vote
1answer
28 views

Analog CCTV over wireless [closed]

I work in a security company, and we have a client who would like CCTV put in around their premises. They have an existing analog system (over COAX) that we were going to replace, but he would also ...
2
votes
0answers
35 views

Was the OSX/iOS Airdrop flaw real?

One exploit has caught my eye, mainly due to the possibility of malware incorporating it infecting businesses and schools. This exploit is, as you may have guessed from the title, the OSX/iOS Airdrop ...
2
votes
0answers
103 views

Sniff wireless (Wi-Fi) trafic with Wireshark

I have a wireless card (AWUS036H) in monitor mode (with airmon-ng start wlan0) on my Debian machine. In Wireshark, in "capture options", all my interfaces are in promiscuous mode. The test network is ...
3
votes
1answer
191 views

Is UPnP still insecure?

Here's my question: In today's world, on equipment that is properly updated to the latest software/firmware, is UPnP still insecure, or have its vulnerabilities been fixed? This type of question ...
1
vote
1answer
402 views

Dumpper and Jumpstart for hacking WPS

As asked in this question, there is a program called Dumpper. it can find PIN of AP without brute forcing them. But with another tool called Jumpstart, together they can crack any AP that is running ...
0
votes
0answers
56 views

Prevention of sinkhole attacks

I have read about many approaches to launch and detect sinkhole attacks in wireless (sensor) networks. Yet I couldn't find any (good) articles to read about the prevention/avoidance of sinkhole ...
-3
votes
2answers
65 views

NTAG216 lock bytes security [closed]

I want to ask about the "lock bytes" implemented on the NTAG216 by NXP. What exactly are these and how do they work? Are they a standard or is it some proprietary technology by NXP? Are there any ...
3
votes
2answers
82 views

Can wireless (wifi, blutooth..) be attacked even when not connected?

For example, my computer displays a list of wifi network in range, even it doesn't connect to any of them. I don't know wifi protocol so I don't know whether my computer must actively send ...
73
votes
7answers
7k views

How to patch “keyless entry” car keys?

The German automobile club ADAC did a test with several cars which open doors and start the engine with a "keyless entry" system. You don't have to push a button on your car key. If you get near your ...
1
vote
2answers
129 views

Sniff network packets that don't talk to my computer?

How would one sniff wireless network packets that do not pass directly through my computer- without access the the AP or router? I want to be able to sniff for network traffic (even while ...
2
votes
0answers
32 views

PMK/s and Keys/s: Which is faster?

I'm practicing on Kali Linux and was struck with the fact that almost all tutorials on the internet specified speed of aircrack-ng in Keys per second and the speed of pyrite as PMKs per second. So, ...
4
votes
3answers
109 views

Risks of giving a hacker my WPA key for my router?

What are the risks when someone (maybe a hacker), that through Social Engineering gets the WPA or WEP key of my router and (obviously) can navigate through internet. At this point, what can this ...
1
vote
2answers
92 views

How to evaluate a wireless network risk level?

When travelling everyone has to use structural wireless networks (managed by airports, hotels, museums, restaurants…). Some of these only open (80|443)/tcp/ip once you have provided an E-mail or ...
0
votes
2answers
133 views

What is really wireless sniffing, and how can this attack damage someone

I guess that this is a dumb question, but i really thought for a longtime that the wireless sniffing attack consists of listening to all the packets that get over the air, but apparently it isn't that,...
5
votes
3answers
125 views

How will popular WiFi clients react to an evil twin

If I create an evil twin hotspot next to a legitimate AP and simply clone the SSID, I know that my WiFi client will see these as 2 different APs and both will show up in a list of available networks (...
2
votes
1answer
50 views

Is a “standalone WPS server” possible?

Wi-Fi Protected Setup (WPS) is a network security standard to create a secure wireless home network. It aims at simplifying the enrollment of WiFi devices in a WiFi network (via a PIN, a button,...
3
votes
2answers
242 views

What is airodump-ng able to detect?

Recently I bought a raspberry pi and some wifi adapters with monitoring mode. I installed airodump-ng to detect wifi devices in the vicinity and this seemed to be working well. Over the course of a ...
0
votes
0answers
51 views

Difference between WPA, WPA2 and mixed mode on packets level

What is the difference between wpa, wpa2 and mixed mode, particulary how 4-way handshake packets look-like for every type? Is there any good lecture about it with packets examples? Above question ...
1
vote
1answer
74 views

Bought used computer with working GSM card [closed]

I recently bought a used computer from a company. They are buying lots of computers from big companies and they refurbish them for resale. Today I discovered that my computer has an installed SIM card....
0
votes
1answer
33 views

Are there any feasible solutions/workarounds for WPA2 hole196 vulnerability as of today?

I just read about a post linked to from archived Michał Zalewski's archived post on wireless security and heard of an insider-only WPA2 flaw that lets anyone who knows the wireless password snoop on ...
11
votes
4answers
1k views

Can someone use WiFi snooping to see data I send through Tor Browser when I'm not using SSL?

(NOTE: I've read other similar questions, but I'm not at all certain about this, therefore I'm asking.) I travel a lot, and I generally use public WiFi spots and hotels/hostels/boarding houses etc. ...
0
votes
2answers
147 views

Is the typical hotel wifi authentication insecure? [duplicate]

I saw many hotels use unencrypted wifi and then expect you to type in a wifi password over HTTPS. All HTTPS website requests are captured, and you get an "untrusted certificate" warning and HTTP ...
1
vote
2answers
96 views

is the evil twin attack considered sniffing?

Is the evil twin attack included in the sniffing category ? I am really confused and i can't tell if it is.
0
votes
0answers
31 views

GPS security standards

Are there any GPS (global position) security standards to secure any kind of GPS implementation? For e.g GPS software coding standards, GPS traffic encryption standards? I asked because nowadays there ...
-1
votes
1answer
58 views

what are some of the common routers people use for penetration testing? [closed]

So, I was looking for a router to penetration test on because the one I have is very difficult. What are some of the well-known routers that are supposed to work for beginners to penetration test on?
0
votes
3answers
129 views

Is it possible to obtain the WPA key of a wireless network while connected to it with an Ethernet cable?

I know that there are ways to view saved WPA keys, but I am trying to figure out how to get the WPA key of an access point while connected to the same domain over Ethernet. Also, what if the router ...
3
votes
1answer
33 views

Airodump-ng -1 DB networks

I'm using airodump-ng to test my network's integrity and when I put Airodump-ng into monitoring mode, I see some networks with no ESSID and the PWR is -1. What are these networks? Are these hidden ...
3
votes
2answers
129 views

Wireless card simultaneously in monitor mode and managed mode

I am looking to create a small first project to further my self education into infosec. I will be putting this on my Github. My idea is to create a script that automates the process of deauthing all ...
4
votes
1answer
95 views

Intercepting video in real time with arp spoofing

Is it possible to intercept video for example a netflix stream in real time if you are connected to the same LAN? Is it possible to know when the target computer pauses and plays the video so you know ...
1
vote
2answers
64 views

Resetting a hijacked router

If you reset a router that's been hijacked to factory defaults with the inbuilt reset button, will that take care of the problem?
5
votes
4answers
323 views

How can I intercept video over a wireless network in real time?

Can you sniff the packets or use a network analyzer or MITM or ARP spoofing to somehow be able to see the videos that someone else is watching on a network in real time? Also: Can you somehow see ...
1
vote
1answer
93 views

does the --nack command do what I think it does in reaver and why won't it work?

I have a problem with reaver. I try the --nack command reaver -i mon0 -b 00:01:02:03:04:05 -vv --nack --mac=00:BA:AD:BE:EF:6 for example. And I assume it will try a different PIN, even if it doesn'...