Questions tagged [wireless]

Wireless security topics including 802.11, Bluetooth, and others.

46 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
9
votes
1answer
708 views

wireless security - Authentication and Association

I am trying to learn wireless security a bit more technically but resources out there on the net are so confusing. Here is my understanding. There are two types of Authentication: 1) Open System ...
6
votes
2answers
3k views

How to connect HackRF to Wireshark?

How to capture ZigBee waves using HackRF and how to analyze it through Wireshark?
4
votes
0answers
93 views

WiFi Fingerprinting RFC2617 Linux Device Cannot Unauthenticate Unless AP Password Changes

There is a Cisco WiFi Access Point in the office that is intended for guests. It is an open network in that you can associate without providing a password with the SSID. It supports RFC2617 and so the ...
2
votes
0answers
62 views

Is this the signature of a KRACK attack?

A router (or one spoofing as a router) unilaterally sent to a client an EAPOL packet 1 of 4, and then immediately sent 5 packets of EAPOL packet 3 of 4. Is this the signature of a KRACK attack? And ...
2
votes
0answers
67 views

How to identify the communication protocol used in a wireless device?

I really hope that this is the right place to ask. I need to analyze a baby monitor for any security or privacy weaknesses. The spec sheet of the baby monitor says, that it uses the ISM 2400~2483.5 ...
2
votes
0answers
89 views

Why do car key remotes not use E2EE?

Background I read an article about how car keys that remotely open one's car are not secure. This answer also talks about different encryption methods being insecure. The article mentions that ...
2
votes
0answers
157 views

Duplicate packets in packet injection

I've been trying to develop a few scripts that can forge custom 802.11 frames and inject them through a monitor mode interface. I have gone through the development documentation of radiotap headers ...
2
votes
0answers
391 views

Storing Wireless auth certs in a TPM

Within my organisation we're being asked to provide a secure but seamless wireless experience e.g. user logs on to Windows device and are connected automatically to corporate network via wireless. ...
2
votes
0answers
81 views

How feasible would forced unpairing of paired bluetooth devices be?

What are the possible ways an attacker could force two paired devices to unpair? What it be any different for classic bluetooth and bluetooth smart?
2
votes
0answers
137 views

Is this a correct DH key exchange over RSA wirelessly?

Note: I am a network researcher, but a security newbie. Hence, this post may contain wrong understanding of security including DH and RSA. If it does, please let me know it. I've designed a certain ...
2
votes
0answers
159 views

Was the OSX/iOS Airdrop flaw real?

One exploit has caught my eye, mainly due to the possibility of malware incorporating it infecting businesses and schools. This exploit is, as you may have guessed from the title, the OSX/iOS Airdrop ...
2
votes
0answers
739 views

ssh dns spoofing warning - possible investigation?

Recently the router my ISP provided started to work suspiciously. At times the wireless connection from my devices to the router breaks and the router stops responding while sometimes the connection ...
1
vote
1answer
47 views

Looking to take a hotspot that is shared and create my own hotspot that can be firewalled

What is the best way to take a wireless hotspot that is owned by someone else, create my own hotspot or VLAN to be able to Firewall / Not allow my devices to view the other individuals' devices? I ...
1
vote
2answers
101 views

How can wireless password cracking be detected?

Our team was hired for a red team engagement for a client. A part of the engagement is attempting to crack the WiFi passwords of their office APs. However, we obviously want to stay undetected. What ...
1
vote
0answers
82 views

Aireplay issues

I started using the aircrack-suite and to be more specific it is about aireplay-ng. The problem ist that... aireplay-ng -0 wlan0mon ...does work, but... aireplay-ng -9 wlan0mon ...doesn't In fact ...
1
vote
0answers
40 views

Video card - pci express security

I recently bought a second hand Nvidia video card which runs in SLI mode with my default video card. Can it be infected with a malicious program added by the previous owner, steal data from the ...
1
vote
0answers
71 views

Can a computer be vulnerable to BroadPwn?

There is a lot of info and warnings about most phones using Broadcom BCM43xx WiFi chipset that are vulnerable to remote code execution and full takeover. What about computers? I saw that MacOS also ...
1
vote
0answers
83 views

How should I manage wireless connections if using iptables?

I am implementing some modest iptables on xubuntu 17.04 and came across this blurb from IptablesHowTo Ubuntu WARNING: Iptables and NetworkManager can conflict. Also if you are concerned enough ...
1
vote
1answer
1k views

How to actually calculate Pairwise Transient Key?

I have following information: PTK-Pairwise Transient Key: A value derived from PMK, Authenicator nonce(Anonce), Supplicant nonce(Snonce), Authenticator Address, Supplicant Address. This is used to ...
1
vote
0answers
98 views

How possible would it be for an attacker to sniff the pairing process in Classic Bluetooth?

Classic Bluetooth protects its connection by keeping the pairing process secret. How does Classic Bluetooth prevent the keys from being sniffed during the pairing process? On what channel does the ...
1
vote
0answers
37 views

Which attributes of a WPA AP certificate are used by a client device in deciding if the certificate has been trusted before?

When connecting to a new AP, the client device will pop a warning to ask if the certificate of the new AP should be trusted. If trusted, the warning doesn't show anymore if the certificate is known to ...
1
vote
0answers
392 views

How can I capture a chronological record of the clients connected to a specific standalone AP?

I want to have a chronological/historical graph showing what times each client was connected to an AP using either airodump-ng with a simple script or some other free and open tool.
1
vote
0answers
138 views

Is the keystream recovered by tkiptun-ng the same key used to encrypt all data frames between the client and the AP?

Looking at the manual for tkiptun-ng,(http://www.aircrack-ng.org/doku.php?id=tkiptun-ng) The output saves the keystream in the example near the end of the program. Is this the same keystream used to ...
1
vote
0answers
45 views

What happens when an attacker sends fake nonce in TKIP handshake?

The TKIP handshake is halfway completed; the access point and station have exchanged the first two messages. Now, before the access point can send the third message to the station an attacker sends a ...
1
vote
0answers
102 views

mdk3 beacon pwning not detected by other devices

I'm new to wireless security. I'm trying to pwn beacon frames to announce a new access point using mdk3. However, when I run the command I get the following result where the MAC address is not ...
1
vote
0answers
465 views

Encrypting OTA software updates files for embedded devices

I need to encrypt and send update files of the order of 100K from a server, through a mobile app, to low power wireless embedded devices (32 bit). The file transfers will be infrequent. The mobile ...
1
vote
0answers
17 views

Netgear Administratrive distance

Not sure if this is the right stackexchange forum though I am using Netgear WNR1000v2 running firmware version 1.1.2.58. Open authentication is enabled, so no password is required, and only used for ...
1
vote
0answers
89 views

How does deauth protection (IEEE_802.11w-2009) work?

I read a Wikipedia article on IEEE_802.11w-2009 and I wonder how does it work with WPA2. In other words, how do I turn it on in my Linux kernel? If I enable it both in it and in an OpenWRT router, am ...
1
vote
0answers
109 views

What information about a user can wireless carriers access?

What is the maximum amount of imformatiom about a user and the user's phone that can be obtained by a wireless carrier on a GSM network? Here is a list of the things I know, but are there more? IMEI, ...
1
vote
0answers
156 views

Are there security concerns with Bluetooth low energy?

In the first versions of BLE specifications, there was a huge security flaw during the pairing allowing an attacker to perform a MITM attack. Since Bluetooth 4.2, the pairing use ECDH, so there isn't ...
1
vote
0answers
558 views

Difference between WPA, WPA2 and mixed mode on packets level

What is the difference between wpa, wpa2 and mixed mode, particulary how 4-way handshake packets look-like for every type? Is there any good lecture about it with packets examples? Above question ...
1
vote
0answers
78 views

fakeauthentication is working when my belkin belkin router f7d2301 mac-address filtering enabled

Actually i have enabled mac-filtering in my belkin router and the security policy is none and the authentication is open authentication. Iam(attacker) using kali linux. when i done a fakeauth attack ...
1
vote
0answers
560 views

problem with mdk3

I have a problem in using mdk3 on kali. I want to DOS my AP with deauthenticate packets. I use the command: Mdk3 mon0 d <AP mac address> I am sure that the command is true. It is not working ...
1
vote
0answers
162 views

Decrypting WLAN (WPA2) Traffic - What kind of Antenna to use?

In a Penetration test after receiving the PSK of a WPA2 WLAN it's possible to decrypt the wireless traffic using airdecap-ng for example. This works well as long as one recorded the associated four-...
1
vote
0answers
4k views

How Modification attacks works?

Theoretically... In Active attacks we have "modification attack"...ie "In a message modification attack, an intruder alters packet header addresses to direct a message to a different destination or ...
1
vote
0answers
4k views

Whole system ACK flood attack making internet slow

Over the past few days, I'm noticing that the log of my wireless router is showing an ACK flood attack from various IP addresses. I use a D-Link DIR-600L. I've searched through the internet, also ...
0
votes
0answers
64 views

How does an IMSI catcher “impersonate” a base station/cell tower?

On reading about IMSI catchers, I keep seeing that they "impersonate" a real cell tower or "base station" so that the phone drops its signal-carried data on that machine while on its way to the ...
0
votes
0answers
34 views

Aireplay-ng doesnt get ACKs

I use the panda pau09 wireless adapter with a kali vm. I am attempting to deaauth my laptop off my home wifi. My last theory was that for some reason i wasn't able to deauth on 5Ghz band but after ...
0
votes
0answers
55 views

Can I use a public / private keypair to secure traffic on my wifi on OpenWRT?

Wifi passwords are a pretty weak way to secure a Wifi Access point; is it possible to use a public / private key to secure traffic on a wifi access point which runs OpenWRT. I know I can secure SSH ...
0
votes
0answers
160 views

Why doesn't the fluxion attack steal credentials when authenticating to the network?

I ask this question because i am not happy with the answer here In a normal attack such as fluxion. You send DEAUTH packets to the victim wifi. Clone their access point and host an open wifi. Let ...
0
votes
0answers
94 views

Capturing Dot11 (802.11) headers on Mac OSX

I'm trying to obtain remote signal strength indication (RSSI) from received packets by sniffing the ones having Dot11 headers. But I've heard somewhere that WLAN interface of Mac OSX (en1 interface as ...
0
votes
0answers
90 views

Wireshark showing all ports being probed from my tablet

The first two pictures: Wireshark shows a tablet device as the source and my computer as the destination and vice versa. This tablet has never been connected via USB, FTP, BT, nothing to the computer. ...
0
votes
0answers
200 views

How feasible would it be to sniff traffic between an Authentication Server and a RADIUS server in a corporate setting?

For WPA enterprise in the corporate world, is the RADIUS server connected to the Authenticator/Access Point wirelessly or 'wiredly' for most situations? If they are connected wirelessly, does this ...
0
votes
0answers
53 views

GPS security standards

Are there any GPS (global position) security standards to secure any kind of GPS implementation? For e.g GPS software coding standards, GPS traffic encryption standards? I asked because nowadays there ...
0
votes
1answer
652 views

Zenmap: Can't get hostnames for clients just IP addresses

I have run both a quick and intense scan on my network with Zenmap and I can't get the hostnames of the clients. If I do an ARP scan I get some hostnames and if I use Fing app on my iPhone, I can see ...
-1
votes
1answer
1k views

How can I trace MAC address of not asosciated devices in my WiFi network?

I'm looking for hints to solve my problem. I would like to trace all devices that are in my surroundings. I know how do it when someone already access to my WiFi network, but I'm also interested to ...