Questions tagged [wireless]

Wireless security topics including 802.11, Bluetooth, and others.

Filter by
Sorted by
Tagged with
1 vote
1 answer
452 views

Airmon-ng/Airodump-ng - Low Beacon Count on certain networks

It's been a few years since I've played around with this so I'm not sure if times have changed. When using AR7921 chipset (Alfa AWUS036NHA) on Ubuntu 20.04 I can see many networks using the following ...
0 votes
0 answers
50 views

What is the best way to demonstrate spoofing?

I use this tutorial to spoof with Kali Linux on VirtualBox: https://www.geeksforgeeks.org/ssl-stripping-and-arp-spoofing-in-kali-linux/ However got some errors ip route: Route information 10.1.80.121 ...
2 votes
1 answer
892 views

How can I find out if a wireless keyboard is encrypted / secure?

I bought wireless keyboards from Ali Express (brand is Royal Kludge) that connect to the pc using either Bluetooth or a 2.4GHz USB dongle, and I want to make sure no one can read my keystrokes when I ...
0 votes
0 answers
65 views

Wpa ptk and gtk in detail

I have been checking Pairwise and Group Transient keys in a network for security. I understand PTK is derived from = PMK, AP nonce (ANonce), STA nonce (SNonce), AP MAC address, and STA MAC address ...
18 votes
1 answer
6k views

How do rolling code fobs and receivers synchronise?

This is a follow-up question to my earlier one: Does pressing a car remote many times offer denial of service attack for rolling codes? I want to emphasize that I am asking this question more to shore ...
2 votes
1 answer
676 views

Encrypting OTA software updates files for embedded devices

I need to encrypt and send update files of the order of 100K from a server, through a mobile app, to low power wireless embedded devices (32 bit). The file transfers will be infrequent. The mobile ...
1 vote
2 answers
180 views

Which EAP connection is strong? Certificate based EAP connection or credentials based EAP connection?

What difference we can observe when connecting using the certificate generated using the RADIUS and the credentials that we define in RADIUS like username & password.
1 vote
2 answers
3k views

Do car Bluetooth FM transmitters allow others to eavesdrop on the hands-free phone calls that I make?

My car's entertainment system is only able to play audio CDs and receive AM/FM radio. I am thinking of getting a Bluetooth FM transmitter so that I could use my car's speakers to play my smartphone's ...
6 votes
2 answers
4k views

Can a bluetooth speaker contain malware?

Can a bluetooth speaker contain malware? If someone were to find a random bluetooth speaker laying around and tries to connect with it, is there a possibility that the speaker has malware in it?
0 votes
1 answer
116 views

Suspected Audio/Wireless/Bluetooth Hijacking - Need Expert Insight [closed]

I have reason to believe that there may be ongoing audio/wireless/Bluetooth hijacking occurring in my network environment. The issue appears to involve unauthorized access to Bluetooth and wireless ...
3 votes
2 answers
546 views

Do VPNs even protect ftp and virtual machine connections?

I have to go out of town and stay in a hotel. During these days I will also have to work on some websites code and VMs that call external APIs. Not being a system administrator nor a security ...
6 votes
3 answers
6k views

Is it possible to hack a SSID without actually having to sniff or send deauth frames to a host?

I'd like to know if there exists at least the possibility of a known/theoretical attack on a wireless SSID that does not involve a host within the network, what I mean by this is that some of the ...
0 votes
1 answer
1k views

Does WPA/WPA2 mixed mode have weak security even if I always connect using WPA2-AES?

My Wi-Fi access point is in "WPA/WPA2 mixed mode", which allows devices to connect to it using either WPA, WPA2-TKIP, or WPA2-AES. My Apple® smartphones and tablet computers are warning that ...
0 votes
0 answers
97 views

Technical details behind how a malware-infected device infects other devices on the same network?

I'm a security student and for one of my projects, I'm trying to learn the technical details behind a malware-infected device infecting other devices on the same network. I can see so much content ...
3 votes
1 answer
809 views

Do wireless (2.4 ghz) headphones use encryption?

I've noticed that there are two types of wireless headphones / headsets / earbuds on the market – bluetooth and 2.4 GHz wireless (via proprietary dongles). Good example of headset that has both – ...
6 votes
3 answers
12k views

Can a wireless headphone (bluetooth) contain malware?

Can a wireless (bluetooth) headphone store data? Also, if it can, then can someone put malware in it? I assume that the device must necessarily be able to store some sort of data, since it has buttons ...
3 votes
2 answers
8k views

Security of Bluetooth tethering vs. Wi-Fi hotspot

I'm using my cellphone to connect my laptop to the web. I think connecting my cellphone to my laptop with a USB cable would be the safest connection but if I go wireless, is it safer to connect to my ...
4 votes
1 answer
1k views

How secure is the wireless Bluetooth data stream going from my computer to my headphones?

Let's say I have bought a USB-to-Bluetooth dongle and "paired" it with my wireless Bluetooth headphones which I purchased by accident, thinking that they were wired. One of the biggest ...
30 votes
4 answers
8k views

How to reduce/mitigate the degree to which a Starlink terminal user in a war zone is giving their position in real time?

Space.com's SpaceX Starlink satellite internet terminals arrive in Ukraine, The Verge's Elon Musk’s promised Starlink terminals have reached Ukraine and Vice Prime Minister of Ukraine and Minister of ...
5 votes
2 answers
4k views

How to Man-in-the-middle a whole network?

When performing a MiTM attack, you generally need to specify the router's IP address and the "victim" IP address. I'm trying to demonstrate to a business owner why he needs to secure his ...
3 votes
1 answer
1k views

'Removing' telecom provider from my phone

Baseband Processors have very weak overall security(closed-source firmware, no audits etc.) It also gives the telecom operator very high privileges on a mobile device. So, now I use 2 phones. First ...
1 vote
0 answers
177 views

Getting 'cannot verify server identity' only on wireless LAN. Is this a MITM attack?

I am getting the notification 'Cannot verify server identity' for every single website I try to open on an iPhone. This, however, only happens when connected to a certain WLAN. On mobile internet this ...
1 vote
0 answers
55 views

Force A Reply WPA/WPA2

I am working on an open source project, and am currently stumped. Let’s say I have a client connect to a wireless WPA network I am not authenticated to the wireless network I just have a wireless card ...
0 votes
0 answers
95 views

Overlap between Wired vs WiFi vulnerabilities

This is a fundamental question, but, I'm interested in understanding the "venn diagram" of attack vectors between wired and Wi-Fi connections. What are the attacks that both wired and Wi-Fi ...
1 vote
1 answer
910 views

Why does message 1 of the WPA2 4 way handshake begin with the access point sending a random number?

All the references I have found https://en.wikipedia.org/wiki/IEEE_802.11i-2004 https://www.wifi-professionals.com/2019/01/4-way-handshake https://www.hitchhikersguidetolearning.com/2017/09/17/eapol-4-...
4 votes
3 answers
33k views

How to stay anonymous in public wireless network?

If we are accessing a public wifi network, does changing mac address at certain intervals of time keep us anonymous forever? Is there anything other than mac address to identify a user in an AP?
0 votes
0 answers
495 views

Airodump-ng shows AP on negative channel

I am new to WiFi and was trying to learn pentesting with the aircrack-ng suite. In the following airodump-ng excerpt, any idea why airodump-ng is showing an access point with negative value -1 as the ...
0 votes
1 answer
223 views

How to secure this simple radio communication against replay attacks

In my current project i have few ESP32's connected to server over TCP. These ESP's are distributed across a range of 300 meters. Once per hour server requests (randomly) selected ESP's to beacon a ...
2 votes
1 answer
3k views

How vulnerable are rolling codes used in car keyfobs to simple replay attacks?

I've read this question - Vehicle remote key security, and I have a few simpler questions that are not addressed in that one. I just received a whatsapp viral forward raising a few claims regarding ...
0 votes
1 answer
260 views

How and what can attackers use Rogue AP attacks for? [closed]

I have some questions about rogue access points. How attackers can get victim's creds over secured HTTPS websites? Can attackers do this kind of attack only by using basic tools + sharing the AP ...
2 votes
1 answer
935 views

Why does WiFi deauthentication need multiple packets to work?

I am trying to understand a common "problem" when injection deauthentication frames in 802.11 networks. My goal is to cause a client to re-authenticate (like one would do, to capture a 4-way-...
12 votes
4 answers
5k views

Can someone use WiFi snooping to see data I send through Tor Browser when I'm not using SSL?

(NOTE: I've read other similar questions, but I'm not at all certain about this, therefore I'm asking.) I travel a lot, and I generally use public WiFi spots and hotels/hostels/boarding houses etc. ...
2 votes
1 answer
3k views

How to actually calculate Pairwise Transient Key?

I have following information: PTK-Pairwise Transient Key: A value derived from PMK, Authenicator nonce(Anonce), Supplicant nonce(Snonce), Authenticator Address, Supplicant Address. This is used to ...
3 votes
2 answers
18k views

Airodump-ng : why are BSSID not associated?

Using airodump-ng with my wireless adapter in monitor mode, I am able to get expected scan to run. I have a few questions : Why do BSSIDs show as "not associated" (note: not all of them show as ...
3 votes
0 answers
10k views

How to send deauth packets on Windows (manually or with software)?

first of all I know how deauth packets work basically. But since my wifi adapter refuses to work on my virtual Kali, I want to use my host machine (Windows 10). So I have NPcap and Wireshark and I can ...
1 vote
3 answers
5k views

Detecting access point model

Is there any way to detect the model (brand, reference, ...) of a reachable wireless access point without having to connect to it? Sniffing packets with Wireshark or others does not give any info, but ...
1 vote
1 answer
376 views

Can my ISP see documents I print trough my wireless network printer that is connected to ISP-provided router?

As stated in title - I am wondering if connecting my printer to ISP-provided router could expose all of my printed data to his eyes? Cheers!
3 votes
3 answers
447 views

Are there any known attacks for a laptop with the wifi connection turned off?

I recently got a new laptop. As I usually do, I removed the wifi module from it, since I intend to use it in public places such as my college and I don't need any sort of connectivity outside my home. ...
0 votes
0 answers
88 views

Different Intermediate Certificates on client/server question

Hope someone can explain the impact as I know a bit but not too much about using certificates. We use an external CA QV (I think now Digicert) to create certs and install into the web, vpn, wired/...
4 votes
2 answers
1k views

Data Security on a Malicious WiFi Network

Let's assume that I unwittingly connect to a malicious WiFi network and visit some websites. By malicious, I mean the network has been set up for the purpose of stealing data. From what I've read, ...
1 vote
3 answers
18k views

Do I need to have Airpcap?

I am learning system security in an online course. In a practical experiment I tried to monitor the traffic through my router using wireshark1.10.3. But I have a feeling that it only sensing traffic ...
0 votes
2 answers
5k views

Why do WEP, WPA, WPA2 need TKIP, AES, CCMP?

Okay so im looking into understanding more about Wireless security. One thing i have not be able to understand is what does WEP, WPA and WPA2 do without the help of TKIP, CCMP, and AES, and what do ...
51 votes
1 answer
16k views

Vehicle remote key security

How secure are car remote keys? When you lock or unlock your car, can someone spoof or make another remote key? How do car remote keys work? Do they use some kind of private/public keys, encryption? ...
42 votes
2 answers
52k views

What is the difference between Promiscuous and Monitor Mode in Wireless Networks?

In Wireless Networks, you can put your wireless card in Promiscuous or in Monitor Mode. What is the difference between these two modes ?
1 vote
3 answers
465 views

How can wireless password cracking be detected?

Our team was hired for a red team engagement for a client. A part of the engagement is attempting to crack the WiFi passwords of their office APs. However, we obviously want to stay undetected. What ...
0 votes
2 answers
10k views

Is it possible to detect when a device has been MAC filtered on a Wi-Fi network?

Is it possible to detect when a device has been MAC filtered on a Wi-Fi network? I don't know if it's in the 802.11 standard, or if it's just implemented by ignoring the client network packets.
0 votes
1 answer
376 views

What may a attacker do when they gain have password to my wifi router

So, suppose you gain access to my wifi router through some attacks (may be brute-force). After a days or two I changed my wifi password with more complexity. So what can you(a attacker) do to again to ...
0 votes
0 answers
1k views

Why my card changes from WPA Handshake to PMKID or vice versa just by airodump-ng

I am running Kali linux 2020.3 on VBox on Windows 10. I put my wireless card AWUS036ACH chipset Realtek RTL8812AU in monitor mode using airmon-ng start wlan0. Then i use airodump-ng wlan0 to capture ...
2 votes
0 answers
473 views

As of 2020, is there any fix for 802.11w deadlock?

This is an old 802.11w issue that has been documented and it's a very big issue as clients can be selectively attacked and enter a deadlock, where only disabling and re-enabling wifi solves the issue (...
51 votes
7 answers
20k views

How would you detect an Evil Twin attack, especially in a new environment?

Let's say you are traveling, and you pause in the airport lounge, or your hotel lobby, or a nearby coffee shop. You haul out your laptop and scan the available wireless networks. You know the name of ...

1
2 3 4 5
10