Questions tagged [wireless]
Wireless security topics including 802.11, Bluetooth, and others.
469
questions
2
votes
0
answers
824
views
Storing Wireless auth certs in a TPM
Within my organisation we're being asked to provide a secure but seamless wireless experience e.g. user logs on to Windows device and are connected automatically to corporate network via wireless. ...
-1
votes
1
answer
556
views
Handshake not capturing on wpa-psk/wpa 2 psk
I'm struggling to get a handshake from my router when using airodump.
airmon-ng
airmon-ng check kill
airodump-ng wlan0mon
airodump-ng -c (channel)--bssid(adress)-w (.cap file locand name) wlan0mon
...
0
votes
2
answers
234
views
Is it impossible to know if the de-authentication packet has been sent to the victim using Wireshark and mdk3? [duplicate]
I want to know if the clients get disconnected or not without checking there devices while I am outside the network. Is it impossible with WireShark?
1
vote
3
answers
2k
views
Restrict mobile phones to specific Access Point (WIFI Router)
Is it possible to restrict the access of android phones, iphone, and MS phones and tablets to a specific AP?
I want the corporate mobile device to only be able connect to one specific AP (the ...
50
votes
6
answers
11k
views
How safe are wifi enabled talking toys?
There have been ads on the radio recently for a wifi enabled toy called Talkies, which are advertised as being able to communicate with app enabled phones, with a "trusted circle" that other phones ...
0
votes
1
answer
165
views
Modifying the Ethernet/Wifi driver to get faster Network access? [closed]
I've already asked this question on networkengineering.stackexchange.com, but unfortunately it was marked as Offtopic there.
As far as im concerned the CSMA/CD and the CSMA/CA standard rely on the ...
4
votes
2
answers
3k
views
Difference between alfa card and my laptop network card?
I'm following a CEH formation in which we have to buy an alfa card.
What's the difference between an alfa card and my laptop's network card?
I thought it was that alfa card can be set in monitor mode ...
0
votes
1
answer
367
views
Is TP-LINK TD-W8151N vulnerable to KRACK?
I have a TP-LINK TD-W8151N 150Mbps Wireless N ADSL2+ Modem Router.
Is this model vulnerable to KRACK?
It is not specified in the WPA2 Security (KRACKs) Vulnerability Statement. Will TP-Link publish ...
4
votes
1
answer
674
views
Will wireless isolation/AP isolation protect from KRACK?
Will using AP isolation on an Access Point protect connected clients from the KRACK vulnerability on that network?
17
votes
3
answers
10k
views
Is WPA2-Enterprise affected by the KRACK attack?
From my reading of the whitepaper it is the 4-way handshake that is vulnerable, but WPA2-Enterprise uses a RADIUS server for authentication, so is it also exploitable? And if so, how?
119
votes
3
answers
19k
views
Why wasn't the KRACK exploit discovered sooner? [closed]
From what I've read, the issue is as simple as performing step 3 of a 4-step handshake and the consequences of performing that step more than once. Considering the complexity of these kinds of ...
256
votes
5
answers
30k
views
Consequences of the WPA2 KRACK attack
Today new research was published on vulnerabilities in wireless network security called Krack.
What are the real-world consequences of these attacks for users and owners of wireless networks, what ...
0
votes
1
answer
2k
views
Zenmap: Can't get hostnames for clients just IP addresses
I have run both a quick and intense scan on my network with Zenmap and I can't get the hostnames of the clients. If I do an ARP scan I get some hostnames and if I use Fing app on my iPhone, I can see ...
5
votes
1
answer
3k
views
Where would I place a sniffer to capture data in a home network with the following topology?
I am aware of the various techniques that there are to sniff around a network that has Hubs or Switches (port mirroring, hubbing out, use of taps), but I am not sure which method would be more ...
0
votes
1
answer
3k
views
Mouse receiver shows up as keyboard too - is this an issue?
I have recently seen some wireless mice that when the receiver is plugged in to a USB port, Windows device manager shows a new "HID-compliant mouse" (as expected) and also an "HID-compliant keyboard." ...
3
votes
1
answer
266
views
How to secure Nikon Cameras open WIFI?
In Nikon digital cameras which support WiFi like D5300 you can browse and transfer the photos by enabling the WiFi and connecting to the camera SSID which is open and do and there is no option to ...
0
votes
1
answer
306
views
Captive Portal Security Measures
I am currently working on a Captive Portal solution, which can be distributed in an device that has an ethernet and wlan port. In short, I use iptables to restrict access to all devices unless they ...
6
votes
2
answers
2k
views
Just how much of a risk am I putting on my network by allowing UPnP
I am facing a serious conundrum (to me at least). Whether or not to disable UPnP on my network. I understand the risk, an infected computer could punch a hole in my firewall, and more infections can ...
1
vote
0
answers
130
views
Can a computer be vulnerable to BroadPwn?
There is a lot of info and warnings about most phones using Broadcom BCM43xx WiFi chipset that are vulnerable to remote code execution and full takeover.
What about computers? I saw that MacOS also ...
1
vote
1
answer
161
views
Limitations of electromagnetic emanations techniques (such as TEMPEST)
Target isolation
Attacks like TEMPEST seems to work well but what happen if you are one meter away with two or more computers on, let's say the same table ?
I suppose that the recording device will ...
1
vote
2
answers
4k
views
Airodump-ng doesn't capture handshake or sees any devices connected on Kali, but captures everything on Backtrack. How to fix it? [closed]
I ran into a problem in using kali linux system.
Kali doesn't allow me to see any devices connected to certain spot or capture any handshakes, I know that it can capture them(and see connected ...
3
votes
2
answers
410
views
Guest wireless network is directly connected to internal LAN. How bad is this?
At my work, there is a wireless network that is on the same subnet as the servers, printers and user machines. This wireless network allows users to have access to shared network drives as if the ...
5
votes
1
answer
2k
views
WPA2 and ChopChop attack
I know that WEP is vulnerable to the ChopChop attack. Could the ChopChop attack be carried against WPA2-PSK as well? Some Internet articles suggest this possibility, I want to be sure though.
1
vote
1
answer
4k
views
Can you use an android device as a wireless adapter for kali linux? [closed]
I am experimenting with Kali Linux. I set up Kali in Virtual Box on a mac. I realized that to do WPA/WPA2 cracking I would need a wireless adapter. Before running out to buy one I thought that I might ...
1
vote
0
answers
158
views
How should I manage wireless connections if using iptables?
I am implementing some modest iptables on xubuntu 17.04 and came across this blurb from IptablesHowTo Ubuntu
WARNING: Iptables and NetworkManager can conflict. Also if you are
concerned enough ...
3
votes
2
answers
580
views
Do VPNs even protect ftp and virtual machine connections?
I have to go out of town and stay in a hotel.
During these days I will also have to work on some websites code and VMs that call external APIs.
Not being a system administrator nor a security ...
-2
votes
1
answer
417
views
How can attacker know the router vendor without physical/visual access to it?
How can attacker know the (victim's) router vendor, for testing default passwords, without physical/visual access to it?
2
votes
1
answer
3k
views
How to actually calculate Pairwise Transient Key?
I have following information:
PTK-Pairwise Transient Key: A value derived from PMK, Authenicator nonce(Anonce), Supplicant nonce(Snonce), Authenticator Address, Supplicant Address. This is used to ...
2
votes
1
answer
255
views
Find rogue access point if area is saturated with networks
What do you do if you scan for rogue Access Points and find that the area is saturated by surrounding businesses with their own wifi?
I recently scanned for wifi networks and found 60+ networks just ...
1
vote
1
answer
233
views
Sharing wifi ,browsing
My neighbor gave me his WiFi password to use. He doesn't know much about computers, but he knows 'the basics'. Can he see in his browser history what sites I'm browsing, or my passwords?
2
votes
4
answers
2k
views
Is there a way to verify the identity of a router over WiFi?
I to find out a way to “verify a router's identity” for security purposes.
I was thinking in some process that involves hiding the router's SSID plus verifying the router's MAC address when ...
6
votes
3
answers
6k
views
Is it possible to hack a SSID without actually having to sniff or send deauth frames to a host?
I'd like to know if there exists at least the possibility of a known/theoretical attack on a wireless SSID that does not involve a host within the network, what I mean by this is that some of the ...
2
votes
1
answer
7k
views
How does Replay attack works on SSL/TLS authentication?
In security+ 401 cert guide there is a line about replay attack as follows,
In a replay attack
a hacker might use a packet sniffer to intercept data and retransmit it later. In this way the ...
2
votes
0
answers
149
views
How feasible would forced unpairing of paired bluetooth devices be?
What are the possible ways an attacker could force two paired devices to unpair? What it be any different for classic bluetooth and bluetooth smart?
2
votes
0
answers
321
views
Is this a correct DH key exchange over RSA wirelessly?
Note: I am a network researcher, but a security newbie. Hence, this post may contain wrong understanding of security including DH and RSA. If it does, please let me know it.
I've designed a certain ...
1
vote
0
answers
174
views
How possible would it be for an attacker to sniff the pairing process in Classic Bluetooth?
Classic Bluetooth protects its connection by keeping the pairing process secret. How does Classic Bluetooth prevent the keys from being sniffed during the pairing process? On what channel does the ...
1
vote
1
answer
172
views
What can an attacker know with knowledge of a device's BD_ADDR?
Lots of articles mention the importance of keeping the BD_ADDR secret as knowing it can allow an attacker to do stuff. What can an attacker really do?(Assuming that he has knowledge of the UAP + LAP ...
1
vote
0
answers
95
views
Which attributes of a WPA AP certificate are used by a client device in deciding if the certificate has been trusted before?
When connecting to a new AP, the client device will pop a warning to ask if the certificate of the new AP should be trusted. If trusted, the warning doesn't show anymore if the certificate is known to ...
1
vote
0
answers
449
views
How can I capture a chronological record of the clients connected to a specific standalone AP?
I want to have a chronological/historical graph showing what times each client was connected to an AP using either airodump-ng with a simple script or some other free and open tool.
3
votes
2
answers
3k
views
Is the Karma attack still relevant today?
I tried replicating the Karma attack and it does not work on my iphone5s and galaxy s6. Even when the phones send out directed probe requests and the Rouge AP responds with the appropriate probe ...
3
votes
1
answer
2k
views
Is a Captive Portal Wifi AP as insecure as an open unencrypted Wifi?
As far as I understand, the captive portal is implemented by some sort of iptable firewall rules. Since there is no handshake established during the initial association with the AP(As no passphrase is ...
0
votes
0
answers
414
views
How feasible would it be to sniff traffic between an Authentication Server and a RADIUS server in a corporate setting?
For WPA enterprise in the corporate world, is the RADIUS server connected to the Authenticator/Access Point wirelessly or 'wiredly' for most situations? If they are connected wirelessly, does this ...
1
vote
0
answers
209
views
Is the keystream recovered by tkiptun-ng the same key used to encrypt all data frames between the client and the AP?
Looking at the manual for tkiptun-ng,(http://www.aircrack-ng.org/doku.php?id=tkiptun-ng) The output saves the keystream in the example near the end of the program. Is this the same keystream used to ...
0
votes
1
answer
596
views
Which key is actually used for encrypting data traffic in WPA after the 4WHS?
Some sites say that the PTK is used for encrypting the data between the client and the WAP while others say that the PMK is used instead. Which one is true?
From what I understand, this can have very ...
0
votes
1
answer
2k
views
What are the roles of PSK and GTK in a WPA setting?
I understand that PTK is ultimately the key that is used to encrypt traffic between a device and the WAP after the 4WHS and that the PMK is directly related to the 'passphrase' of the wireless network....
9
votes
2
answers
938
views
wireless security - Authentication and Association
I am trying to learn wireless security a bit more technically but resources out there on the net are so confusing. Here is my understanding.
There are two types of Authentication:
1) Open System ...
2
votes
3
answers
1k
views
Handshake not recording
I am trying to crack wireless WEP password of my wireless AP.
When I enable monitor mode and issue this command:
root#airodump-ng -w TESTFILE1 -c 1 --bssid 68:72:51:58:A3:14 wlan0mon
No handshake ...
4
votes
1
answer
768
views
What additional steps can be taken on a wireless network penetration test after acquiring WPS pin?
I've been conducting some simple penetration tests on a few older wireless routers that I have lying around, focusing mainly on WPS vulnerabilities. I've been having some trouble with an old Belkin ...
0
votes
1
answer
2k
views
Fear of mac Spoofing. Two Mac addresses appearing on Router page with only 1 digit variation
I have tried looking into Info Sec's posts for a related issue but couldn't find a solution as my problem is a bit specific.
I have been having connectivity issues, and as paranoid as I can get, i ...
1
vote
2
answers
2k
views
Is there any way to send malicious keystrokes to wireless keyboard USB dongle?
I have read many blogs on how to intercept wireless keyboard keystrokes. Similarly is there any way where we can send keystrokes to any keyboards USB receiver module? can we kick out the existing ...