Questions tagged [wireless]
Wireless security topics including 802.11, Bluetooth, and others.
458
questions
0
votes
1answer
34 views
How to secure this simple radio communication against replay attacks
In my current project i have few ESP32's connected to server over TCP.
These ESP's are distributed across a range of 300 meters.
Once per hour server requests (randomly) selected ESP's to beacon a ...
0
votes
0answers
15 views
How can WIPS block unauthorized AP with PMF enabled?
To my knowledge, WIPS(wireless intrusion prevention system) prevents wireless devices connecting to unauthorized AP by sending de-authentication frames.
If 802.11w Protected Management Frame(PMF) is ...
0
votes
1answer
74 views
How and what can attackers use Rogue AP attacks for? [closed]
I have some questions about rogue access points.
How attackers can get victim's creds over secured HTTPS websites?
Can attackers do this kind of attack only by using basic tools + sharing the AP ...
0
votes
0answers
37 views
cannot connect to wifi in the captive portal stage in fluxion?
so while using fluxion, something strange (maybe not) happened,i've captured the handshake and try to penetrate the same wifi with a captive portal attack, fluxion created a duplicate wifi ,that's ...
4
votes
1answer
187 views
Does creating an Evil Twin require the network password in order to work?
I am currently trying to better understand this attack.
If the network is open ie, not password, I would assume that it would be super easy for the evil twin to work. If I understand correctly, ...
0
votes
1answer
102 views
Why does message 1 of the WPA2 4 way handshake begin with the access point sending a random number?
All the references I have found
https://en.wikipedia.org/wiki/IEEE_802.11i-2004
https://www.wifi-professionals.com/2019/01/4-way-handshake
https://www.hitchhikersguidetolearning.com/2017/09/17/eapol-4-...
2
votes
0answers
2k views
How to send deauth packets on Windows (manually or with software)?
first of all I know how deauth packets work basically. But since my wifi adapter refuses to work on my virtual Kali, I want to use my host machine (Windows 10). So I have NPcap and Wireshark and I can ...
1
vote
1answer
117 views
Can my ISP see documents I print trough my wireless network printer that is connected to ISP-provided router?
As stated in title - I am wondering if connecting my printer to ISP-provided router could expose all of my printed data to his eyes?
Cheers!
0
votes
0answers
37 views
Different Intermediate Certificates on client/server question
Hope someone can explain the impact as I know a bit but not too much about using certificates.
We use an external CA QV (I think now Digicert) to create certs and install into the web, vpn, wired/...
-1
votes
2answers
777 views
Why do WEP, WPA, WPA2 need TKIP, AES, CCMP?
Okay so im looking into understanding more about Wireless security. One thing i have not be able to understand is what does WEP, WPA and WPA2 do without the help of TKIP, CCMP, and AES, and what do ...
0
votes
0answers
63 views
How to simulate wireless sensor network attacks in packet tracer
I need to simulate Wireless Sensor Network attacks in packet tracer, to check the effectiveness of security protocols.
Can anyone tell me how can I simulate this attack in Packet Tracer?
2
votes
1answer
266 views
'Removing' telecom provider from my phone
Baseband Processors have very weak overall security(closed-source firmware, no audits etc.)
It also gives the telecom operator very high privileges on a mobile device.
So, now I use 2 phones. First ...
0
votes
2answers
89 views
Which EAP connection is strong? Certificate based EAP connection or credentials based EAP connection?
What difference we can observe when connecting using the certificate generated using the RADIUS and the credentials that we define in RADIUS like username & password.
0
votes
1answer
141 views
What may a attacker do when they gain have password to my wifi router
So, suppose you gain access to my wifi router through some attacks (may be brute-force). After a days or two I changed my wifi password with more complexity. So what can you(a attacker) do to again to ...
0
votes
0answers
415 views
Why my card changes from WPA Handshake to PMKID or vice versa just by airodump-ng
I am running Kali linux 2020.3 on VBox on Windows 10. I put my wireless card AWUS036ACH chipset Realtek RTL8812AU in monitor mode using airmon-ng start wlan0.
Then i use airodump-ng wlan0 to capture ...
2
votes
0answers
191 views
As of 2020, is there any fix for 802.11w deadlock?
This is an old 802.11w issue that has been documented and it's a very big issue as clients can be selectively attacked and enter a deadlock, where only disabling and re-enabling wifi solves the issue (...
0
votes
1answer
179 views
Could a Chromecast be compromised from its default open network?
I left my apartment for few days, so I disconnected my wireless router but I forgot to disconnect my Chromecast as well. I remember that when a Chromecast can't find the network it was connected to ...
0
votes
1answer
157 views
Airmon-ng/Airodump-ng - Low Beacon Count on certain networks
It's been a few years since I've played around with this so I'm not sure if times have changed.
When using AR7921 chipset (Alfa AWUS036NHA) on Ubuntu 20.04 I can see many networks using the following ...
2
votes
1answer
333 views
Why does WiFi deauthentication need multiple packets to work?
I am trying to understand a common "problem" when injection deauthentication frames in 802.11 networks.
My goal is to cause a client to re-authenticate (like one would do, to capture a 4-way-...
-2
votes
1answer
721 views
how many network adapters does an evil twin attack require
what is the difference between performing an evil twin attack with 2 wireless adapters or with just on or is it even possible to perform this attack with just one adapter? i am using Kali Linux
4
votes
2answers
1k views
What does WPA2 traffic look like to a packet sniffer that is not connected to the network?
Imagine there is a wireless network using WPA2, and an attacker has come along with his wireless card in monitor mode. What will the packets from that network look like? Is any information disclosed i....
1
vote
1answer
357 views
802.11 data frames missing from Wireless frames capturing
By working on the Wireless QoS (WMM/802.11e), I captured with airmon-ng and airodump-ng on Kali Linux, the 802.11 raw wireless frames, on my BSSID and channel.
I generate some traffic from my ...
1
vote
1answer
82 views
Looking to take a hotspot that is shared and create my own hotspot that can be firewalled
What is the best way to take a wireless hotspot that is owned by someone else, create my own hotspot or VLAN to be able to Firewall / Not allow my devices to view the other individuals' devices?
I ...
1
vote
3answers
250 views
How can wireless password cracking be detected?
Our team was hired for a red team engagement for a client. A part of the engagement is attempting to crack the WiFi passwords of their office APs. However, we obviously want to stay undetected. What ...
1
vote
1answer
247 views
Scapy: Sending forged Probe Requests and capturing them in a different device
Objective:
Sending a forged Probe Request frame from one machine and capturing it on a second machine.
I have two codes running:
sender.py
interface = sys.argv[1]
dot11 = Dot11(addr1='ff:ff:ff:ff:...
0
votes
1answer
262 views
What is the significant difference between a Rogue Access Point & Client Mis-Association [closed]
As the title states, how can I differentiate both of them.
0
votes
0answers
133 views
How does an IMSI catcher "impersonate" a base station/cell tower?
On reading about IMSI catchers, I keep seeing that they "impersonate" a real cell tower or "base station" so that the phone drops its signal-carried data on that machine while on its way to the ...
1
vote
0answers
554 views
Display filter to see WPS attempts in WireShark [closed]
My neighbour is actively trying WPS pins on my router - I know because the "WiFi/WPS" LED on my router lit up when I have permanently turned it off! I double checked the setting using the router admin ...
2
votes
0answers
81 views
Is this the signature of a KRACK attack?
A router (or one spoofing as a router) unilaterally sent to a client an EAPOL packet 1 of 4, and then immediately sent 5 packets of EAPOL packet 3 of 4.
Is this the signature of a KRACK attack? And ...
2
votes
1answer
388 views
Capture WiFi AP authentication attempted password
Is it possible for someone who is doing air monitor mode (ex. using airmon-ng) or is using a rogue device to capture attempted authentication on a Wi-Fi AP ?
For example, I have a home router WPA2-...
1
vote
1answer
132 views
How does one steal files by connecting to a laptop's WIFI / Bluetooth? [closed]
I'm asking how does one steal files by connecting to a laptop's WIFI / Bluetooth and can it be done with the laptop powered off if there is a battery?
Could you please explain how you would connect ...
2
votes
0answers
105 views
RF signal Wi-Fi leak [closed]
How can one steal files off a laptop hard drive using RF / Wi-Fi signals? Can it be done with the laptop powered off if there is a battery?
1
vote
1answer
1k views
Network Adapter error on airgeddon
I keep getting an error on airgeddon while using my Alfa AWUS036ACH network adapter (RTL8812AU chipset).
I can launch airgeddon successfully with all requisite tools installed, select my wlan0 ...
2
votes
0answers
75 views
How SIGINT Researchers/Operators collect, decode and monitor a vast array of wireless data? [closed]
In wireless communication, data flows at various frequencies ranging from Radio to Satellite communication. These frequency carriers are allocated for different uses based on various requirement ...
0
votes
0answers
91 views
Can I use a public / private keypair to secure traffic on my wifi on OpenWRT?
Wifi passwords are a pretty weak way to secure a Wifi Access point; is it possible to use a public / private key to secure traffic on a wifi access point which runs OpenWRT.
I know I can secure SSH ...
1
vote
1answer
2k views
How to speed up brute forcing of finding a WEP key from a captured file?
I have been working on decrypting a WEP .cap file using crunch. It has 1268 IVs. I am wondering:
Can I get a clue from the captured file to speed the process of brute-forcing?
If not, what other ways ...
0
votes
1answer
92 views
Capturing multicast packets in WLAN
(I had to move this from Network Engineering stack exchange where I origianlly asked this question)
If a device in monitoring mode snoops on the traffic in a WLAN, can it CAPTURE and READ multicast ...
0
votes
0answers
252 views
Why doesn't the fluxion attack steal credentials when authenticating to the network?
I ask this question because i am not happy with the answer here
In a normal attack such as fluxion.
You send DEAUTH packets to the victim wifi.
Clone their access point and host an open wifi.
Let the ...
1
vote
2answers
1k views
Why do evil twin attacks against WiFi use a captive portal?
I was recently the victim of an evil twin attack on my WiFi network, probably by the new upstairs neighbors. It prompted me, with a captive portal, saying there had been an update and I needed to ...
1
vote
1answer
141 views
MAC/IP address hiding
I am doing some experiments with wireless protocols on ns-3. What I want to ask is how can I hide MAC address/IP address, because I need it for my experiments? Is it possible to use encryption on ...
0
votes
1answer
416 views
Router administration page is served over HTTP
My wireless router admin page does not include https option.
It is always served over http. This is obviously a concern in case someone is sniffing the network and can read my password in plain text.
...
0
votes
2answers
191 views
unauthorized devices appear in windows 10 network drive SMB [closed]
Few days ago I was trying to access a shared folder via SMB on Windows File Explorer and noticed 3 strange mobile phone devices appear listed in the network drive. I never owned any of the mobile ...
4
votes
1answer
2k views
How do you prevent/guard against a wireless disassociation attack [duplicate]
Going over the security+ lectures by professor Messer here, he explains and demonstrates a wireless disassociation attack very well. But no where in the video does he explain how this type of attack ...
1
vote
1answer
550 views
Capturing traffic on WiFi Network using Wireshark [duplicate]
Is it possible to capture, using Wireshark, regular data sent by another machine inside my Wireless LAN?
1
vote
1answer
802 views
How to get result from airdump-ng on Ubuntu 18.04 LTS?
Issue: when I run airodump-ng wlp3s0mon, no results appear.
I recently installed all kali linux tools on Ubuntu 18.04 LTS from this git repo https://github.com/LionSec/katoolin
My chipset is the ...
1
vote
1answer
208 views
Where does last 4 bytes of hmac go in wpa2 mic?
The wpa2 mic is a 16 bytes array which is built by Hmac(sha1)
,But the Hmac(sha1) returns 20 bytes array.
So where does that 4 bytes go?
2
votes
1answer
411 views
Are there any known exploits against bluetooth mice or keyboards?
Most wireless mice are not bluetooth. There are known exploits that take over wireless mice and use them as a keyboard.
Are there known exploits that can remotely inject malware directly over ...
3
votes
1answer
579 views
What are the countermeasures against key cloning?
I’ve looked into the techniques of cloning the 315Mhz and 433Mhz remote car keys and I’m wondering what’s the countermeasure one can provide against wireless radio key lock? Since the radio signals do ...
10
votes
1answer
2k views
How do rolling code fobs and receivers synchronise?
This is a follow-up question to my earlier one: Does pressing a car remote many times offer denial of service attack for rolling codes?
I want to emphasize that I am asking this question more to ...
151
votes
3answers
20k views
Does pressing a car remote many times offer denial of service attack for rolling codes?
My understanding of remote car key fobs, and similar security devices with rolling codes, is that the key device is a transmitter that, each time the button is pressed, sends the next secret in a ...