Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [wireless]

Wireless security topics including 802.11, Bluetooth, and others.

Filter by
Sorted by
Tagged with
0 votes
0 answers
28 views

Which signals (wifi, mobile phone, gps) can reliably be blocked by tin foil? [closed]

There seems to be conflicting information regarding which signals can be effectively blocked by wrapping the device in tin foil. Faraday bags exist but they have been shown to be rather expensive and ...
CuriousIndeed's user avatar
0 votes
0 answers
81 views

What is the best way to demonstrate spoofing?

I use this tutorial to spoof with Kali Linux on VirtualBox: https://www.geeksforgeeks.org/ssl-stripping-and-arp-spoofing-in-kali-linux/ However got some errors ip route: Route information 10.1.80.121 ...
Alex Anonym's user avatar
0 votes
0 answers
106 views

Wpa ptk and gtk in detail

I have been checking Pairwise and Group Transient keys in a network for security. I understand PTK is derived from = PMK, AP nonce (ANonce), STA nonce (SNonce), AP MAC address, and STA MAC address ...
C.Unbay's user avatar
  • 207
0 votes
1 answer
147 views

Suspected Audio/Wireless/Bluetooth Hijacking - Need Expert Insight [closed]

I have reason to believe that there may be ongoing audio/wireless/Bluetooth hijacking occurring in my network environment. The issue appears to involve unauthorized access to Bluetooth and wireless ...
Jimmy's user avatar
  • 3
1 vote
2 answers
4k views

Do car Bluetooth FM transmitters allow others to eavesdrop on the hands-free phone calls that I make?

My car's entertainment system is only able to play audio CDs and receive AM/FM radio. I am thinking of getting a Bluetooth FM transmitter so that I could use my car's speakers to play my smartphone's ...
Flux's user avatar
  • 913
0 votes
1 answer
1k views

Does WPA/WPA2 mixed mode have weak security even if I always connect using WPA2-AES?

My Wi-Fi access point is in "WPA/WPA2 mixed mode", which allows devices to connect to it using either WPA, WPA2-TKIP, or WPA2-AES. My Apple® smartphones and tablet computers are warning that ...
Flux's user avatar
  • 913
0 votes
0 answers
126 views

Technical details behind how a malware-infected device infects other devices on the same network?

I'm a security student and for one of my projects, I'm trying to learn the technical details behind a malware-infected device infecting other devices on the same network. I can see so much content ...
scottstots's user avatar
3 votes
1 answer
1k views

Do wireless (2.4 ghz) headphones use encryption?

I've noticed that there are two types of wireless headphones / headsets / earbuds on the market – bluetooth and 2.4 GHz wireless (via proprietary dongles). Good example of headset that has both – ...
Mike's user avatar
  • 141
2 votes
1 answer
1k views

How can I find out if a wireless keyboard is encrypted / secure?

I bought wireless keyboards from Ali Express (brand is Royal Kludge) that connect to the pc using either Bluetooth or a 2.4GHz USB dongle, and I want to make sure no one can read my keystrokes when I ...
W2a's user avatar
  • 673
1 vote
0 answers
204 views

Getting 'cannot verify server identity' only on wireless LAN. Is this a MITM attack?

I am getting the notification 'Cannot verify server identity' for every single website I try to open on an iPhone. This, however, only happens when connected to a certain WLAN. On mobile internet this ...
curious_weather's user avatar
0 votes
0 answers
113 views

Overlap between Wired vs WiFi vulnerabilities

This is a fundamental question, but, I'm interested in understanding the "venn diagram" of attack vectors between wired and Wi-Fi connections. What are the attacks that both wired and Wi-Fi ...
Steven Chris's user avatar
1 vote
0 answers
70 views

Force A Reply WPA/WPA2

I am working on an open source project, and am currently stumped. Let’s say I have a client connect to a wireless WPA network I am not authenticated to the wireless network I just have a wireless card ...
sonicCrypt0r's user avatar
30 votes
4 answers
8k views

How to reduce/mitigate the degree to which a Starlink terminal user in a war zone is giving their position in real time?

Space.com's SpaceX Starlink satellite internet terminals arrive in Ukraine, The Verge's Elon Musk’s promised Starlink terminals have reached Ukraine and Vice Prime Minister of Ukraine and Minister of ...
uhoh's user avatar
  • 1,409
0 votes
1 answer
642 views

Airodump-ng shows AP on negative channel

I am new to WiFi and was trying to learn pentesting with the aircrack-ng suite. In the following airodump-ng excerpt, any idea why airodump-ng is showing an access point with negative value -1 as the ...
pippo1980's user avatar
  • 101
4 votes
1 answer
1k views

How secure is the wireless Bluetooth data stream going from my computer to my headphones?

Let's say I have bought a USB-to-Bluetooth dongle and "paired" it with my wireless Bluetooth headphones which I purchased by accident, thinking that they were wired. One of the biggest ...
Caseton Siebenhaar's user avatar
0 votes
1 answer
249 views

How to secure this simple radio communication against replay attacks

In my current project i have few ESP32's connected to server over TCP. These ESP's are distributed across a range of 300 meters. Once per hour server requests (randomly) selected ESP's to beacon a ...
PeeS's user avatar
  • 225
0 votes
1 answer
298 views

How and what can attackers use Rogue AP attacks for? [closed]

I have some questions about rogue access points. How attackers can get victim's creds over secured HTTPS websites? Can attackers do this kind of attack only by using basic tools + sharing the AP ...
9ys's user avatar
  • 36
1 vote
1 answer
1k views

Why does message 1 of the WPA2 4 way handshake begin with the access point sending a random number?

All the references I have found https://en.wikipedia.org/wiki/IEEE_802.11i-2004 https://www.wifi-professionals.com/2019/01/4-way-handshake https://www.hitchhikersguidetolearning.com/2017/09/17/eapol-4-...
aquagremlin's user avatar
3 votes
0 answers
11k views

How to send deauth packets on Windows (manually or with software)?

first of all I know how deauth packets work basically. But since my wifi adapter refuses to work on my virtual Kali, I want to use my host machine (Windows 10). So I have NPcap and Wireshark and I can ...
Cemeb's user avatar
  • 31
1 vote
1 answer
421 views

Can my ISP see documents I print trough my wireless network printer that is connected to ISP-provided router?

As stated in title - I am wondering if connecting my printer to ISP-provided router could expose all of my printed data to his eyes? Cheers!
Dominic's user avatar
  • 45
0 votes
0 answers
104 views

Different Intermediate Certificates on client/server question

Hope someone can explain the impact as I know a bit but not too much about using certificates. We use an external CA QV (I think now Digicert) to create certs and install into the web, vpn, wired/...
user4565's user avatar
  • 151
0 votes
2 answers
6k views

Why do WEP, WPA, WPA2 need TKIP, AES, CCMP?

Okay so im looking into understanding more about Wireless security. One thing i have not be able to understand is what does WEP, WPA and WPA2 do without the help of TKIP, CCMP, and AES, and what do ...
gene's user avatar
  • 43
3 votes
1 answer
2k views

'Removing' telecom provider from my phone

Baseband Processors have very weak overall security(closed-source firmware, no audits etc.) It also gives the telecom operator very high privileges on a mobile device. So, now I use 2 phones. First ...
user's user avatar
  • 275
1 vote
2 answers
196 views

Which EAP connection is strong? Certificate based EAP connection or credentials based EAP connection?

What difference we can observe when connecting using the certificate generated using the RADIUS and the credentials that we define in RADIUS like username & password.
ravi kumar's user avatar
0 votes
1 answer
422 views

What may a attacker do when they gain have password to my wifi router

So, suppose you gain access to my wifi router through some attacks (may be brute-force). After a days or two I changed my wifi password with more complexity. So what can you(a attacker) do to again to ...
Sudip Ghimire's user avatar
0 votes
0 answers
1k views

Why my card changes from WPA Handshake to PMKID or vice versa just by airodump-ng

I am running Kali linux 2020.3 on VBox on Windows 10. I put my wireless card AWUS036ACH chipset Realtek RTL8812AU in monitor mode using airmon-ng start wlan0. Then i use airodump-ng wlan0 to capture ...
Qasim's user avatar
  • 1
2 votes
0 answers
501 views

As of 2020, is there any fix for 802.11w deadlock?

This is an old 802.11w issue that has been documented and it's a very big issue as clients can be selectively attacked and enter a deadlock, where only disabling and re-enabling wifi solves the issue (...
Motheus's user avatar
  • 121
0 votes
1 answer
394 views

Could a Chromecast be compromised from its default open network?

I left my apartment for few days, so I disconnected my wireless router but I forgot to disconnect my Chromecast as well. I remember that when a Chromecast can't find the network it was connected to ...
pmbonneau's user avatar
  • 191
1 vote
1 answer
486 views

Airmon-ng/Airodump-ng - Low Beacon Count on certain networks

It's been a few years since I've played around with this so I'm not sure if times have changed. When using AR7921 chipset (Alfa AWUS036NHA) on Ubuntu 20.04 I can see many networks using the following ...
jblz's user avatar
  • 113
2 votes
1 answer
1k views

Why does WiFi deauthentication need multiple packets to work?

I am trying to understand a common "problem" when injection deauthentication frames in 802.11 networks. My goal is to cause a client to re-authenticate (like one would do, to capture a 4-way-...
NIoSaT's user avatar
  • 121
-2 votes
1 answer
3k views

how many network adapters does an evil twin attack require

what is the difference between performing an evil twin attack with 2 wireless adapters or with just on or is it even possible to perform this attack with just one adapter? i am using Kali Linux
nonope2454's user avatar
5 votes
2 answers
3k views

What does WPA2 traffic look like to a packet sniffer that is not connected to the network?

Imagine there is a wireless network using WPA2, and an attacker has come along with his wireless card in monitor mode. What will the packets from that network look like? Is any information disclosed i....
RandyAnon's user avatar
1 vote
1 answer
1k views

802.11 data frames missing from Wireless frames capturing

By working on the Wireless QoS (WMM/802.11e), I captured with airmon-ng and airodump-ng on Kali Linux, the 802.11 raw wireless frames, on my BSSID and channel. I generate some traffic from my ...
bdes31's user avatar
  • 113
1 vote
1 answer
139 views

Looking to take a hotspot that is shared and create my own hotspot that can be firewalled

What is the best way to take a wireless hotspot that is owned by someone else, create my own hotspot or VLAN to be able to Firewall / Not allow my devices to view the other individuals' devices? I ...
Alehandro's user avatar
1 vote
3 answers
488 views

How can wireless password cracking be detected?

Our team was hired for a red team engagement for a client. A part of the engagement is attempting to crack the WiFi passwords of their office APs. However, we obviously want to stay undetected. What ...
trallgorm's user avatar
  • 885
1 vote
1 answer
1k views

Scapy: Sending forged Probe Requests and capturing them in a different device

Objective: Sending a forged Probe Request frame from one machine and capturing it on a second machine. I have two codes running: sender.py interface = sys.argv[1] dot11 = Dot11(addr1='ff:ff:ff:ff:...
Rafael's user avatar
  • 55
0 votes
1 answer
679 views

What is the significant difference between a Rogue Access Point & Client Mis-Association [closed]

As the title states, how can I differentiate both of them.
VisualKnw's user avatar
0 votes
0 answers
342 views

How does an IMSI catcher "impersonate" a base station/cell tower?

On reading about IMSI catchers, I keep seeing that they "impersonate" a real cell tower or "base station" so that the phone drops its signal-carried data on that machine while on its way to the ...
Long Way's user avatar
1 vote
0 answers
1k views

Display filter to see WPS attempts in WireShark [closed]

My neighbour is actively trying WPS pins on my router - I know because the "WiFi/WPS" LED on my router lit up when I have permanently turned it off! I double checked the setting using the router admin ...
Dev Kanchen's user avatar
1 vote
0 answers
137 views

Is this the signature of a KRACK attack?

A router (or one spoofing as a router) unilaterally sent to a client an EAPOL packet 1 of 4, and then immediately sent 5 packets of EAPOL packet 3 of 4. Is this the signature of a KRACK attack? And ...
Dev Kanchen's user avatar
2 votes
1 answer
1k views

Capture WiFi AP authentication attempted password

Is it possible for someone who is doing air monitor mode (ex. using airmon-ng) or is using a rogue device to capture attempted authentication on a Wi-Fi AP ? For example, I have a home router WPA2-...
pmbonneau's user avatar
  • 191
1 vote
1 answer
275 views

How does one steal files by connecting to a laptop's WIFI / Bluetooth? [closed]

I'm asking how does one steal files by connecting to a laptop's WIFI / Bluetooth and can it be done with the laptop powered off if there is a battery? Could you please explain how you would connect ...
user220481's user avatar
2 votes
0 answers
158 views

RF signal Wi-Fi leak [closed]

How can one steal files off a laptop hard drive using RF / Wi-Fi signals? Can it be done with the laptop powered off if there is a battery?
user220481's user avatar
1 vote
1 answer
3k views

Network Adapter error on airgeddon

I keep getting an error on airgeddon while using my Alfa AWUS036ACH network adapter (RTL8812AU chipset). I can launch airgeddon successfully with all requisite tools installed, select my wlan0 ...
jh4x's user avatar
  • 23
2 votes
0 answers
133 views

How SIGINT Researchers/Operators collect, decode and monitor a vast array of wireless data? [closed]

In wireless communication, data flows at various frequencies ranging from Radio to Satellite communication. These frequency carriers are allocated for different uses based on various requirement ...
0xSecNerd's user avatar
0 votes
0 answers
151 views

Can I use a public / private keypair to secure traffic on my wifi on OpenWRT?

Wifi passwords are a pretty weak way to secure a Wifi Access point; is it possible to use a public / private key to secure traffic on a wifi access point which runs OpenWRT. I know I can secure SSH ...
leeand00's user avatar
  • 1,441
1 vote
1 answer
3k views

How to speed up brute forcing of finding a WEP key from a captured file?

I have been working on decrypting a WEP .cap file using crunch. It has 1268 IVs. I am wondering: Can I get a clue from the captured file to speed the process of brute-forcing? If not, what other ways ...
pyDeb's user avatar
  • 45
0 votes
1 answer
226 views

Capturing multicast packets in WLAN

(I had to move this from Network Engineering stack exchange where I origianlly asked this question) If a device in monitoring mode snoops on the traffic in a WLAN, can it CAPTURE and READ multicast ...
Nht_e0's user avatar
  • 15
0 votes
0 answers
397 views

Why doesn't the fluxion attack steal credentials when authenticating to the network?

I ask this question because i am not happy with the answer here In a normal attack such as fluxion. You send DEAUTH packets to the victim wifi. Clone their access point and host an open wifi. Let the ...
yeah_well's user avatar
  • 3,794
1 vote
2 answers
2k views

Why do evil twin attacks against WiFi use a captive portal?

I was recently the victim of an evil twin attack on my WiFi network, probably by the new upstairs neighbors. It prompted me, with a captive portal, saying there had been an update and I needed to ...
Hugo's user avatar
  • 123

1
2 3 4 5
10