Questions tagged [wireless]

Wireless security topics including 802.11, Bluetooth, and others.

53 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
151 views

WiFi Fingerprinting RFC2617 Linux Device Cannot Unauthenticate Unless AP Password Changes

There is a Cisco WiFi Access Point in the office that is intended for guests. It is an open network in that you can associate without providing a password with the SSID. It supports RFC2617 and so the ...
PhilBot's user avatar
  • 141
3 votes
0 answers
10k views

How to send deauth packets on Windows (manually or with software)?

first of all I know how deauth packets work basically. But since my wifi adapter refuses to work on my virtual Kali, I want to use my host machine (Windows 10). So I have NPcap and Wireshark and I can ...
Cemeb's user avatar
  • 31
2 votes
0 answers
474 views

As of 2020, is there any fix for 802.11w deadlock?

This is an old 802.11w issue that has been documented and it's a very big issue as clients can be selectively attacked and enter a deadlock, where only disabling and re-enabling wifi solves the issue (...
Motheus's user avatar
  • 121
2 votes
0 answers
308 views

How to identify the communication protocol used in a wireless device?

I really hope that this is the right place to ask. I need to analyze a baby monitor for any security or privacy weaknesses. The spec sheet of the baby monitor says, that it uses the ISM 2400~2483.5 ...
Tofulicious's user avatar
2 votes
0 answers
170 views

Why do car key remotes not use E2EE?

Background I read an article about how car keys that remotely open one's car are not secure. This answer also talks about different encryption methods being insecure. The article mentions that ...
creativecreatorormaybenot's user avatar
2 votes
0 answers
326 views

Duplicate packets in packet injection

I've been trying to develop a few scripts that can forge custom 802.11 frames and inject them through a monitor mode interface. I have gone through the development documentation of radiotap headers ...
user148898's user avatar
2 votes
0 answers
798 views

Storing Wireless auth certs in a TPM

Within my organisation we're being asked to provide a secure but seamless wireless experience e.g. user logs on to Windows device and are connected automatically to corporate network via wireless. ...
RichUK's user avatar
  • 41
2 votes
0 answers
141 views

How feasible would forced unpairing of paired bluetooth devices be?

What are the possible ways an attacker could force two paired devices to unpair? What it be any different for classic bluetooth and bluetooth smart?
Lew Wei Hao's user avatar
2 votes
0 answers
313 views

Is this a correct DH key exchange over RSA wirelessly?

Note: I am a network researcher, but a security newbie. Hence, this post may contain wrong understanding of security including DH and RSA. If it does, please let me know it. I've designed a certain ...
Jeon's user avatar
  • 141
2 votes
1 answer
677 views

Encrypting OTA software updates files for embedded devices

I need to encrypt and send update files of the order of 100K from a server, through a mobile app, to low power wireless embedded devices (32 bit). The file transfers will be infrequent. The mobile ...
nduru's user avatar
  • 21
2 votes
0 answers
229 views

Was the OSX/iOS Airdrop flaw real?

One exploit has caught my eye, mainly due to the possibility of malware incorporating it infecting businesses and schools. This exploit is, as you may have guessed from the title, the OSX/iOS Airdrop ...
Saunders Eberly's user avatar
2 votes
0 answers
897 views

ssh dns spoofing warning - possible investigation?

Recently the router my ISP provided started to work suspiciously. At times the wireless connection from my devices to the router breaks and the router stops responding while sometimes the connection ...
Jernej's user avatar
  • 61
1 vote
0 answers
178 views

Getting 'cannot verify server identity' only on wireless LAN. Is this a MITM attack?

I am getting the notification 'Cannot verify server identity' for every single website I try to open on an iPhone. This, however, only happens when connected to a certain WLAN. On mobile internet this ...
curious_weather's user avatar
1 vote
0 answers
56 views

Force A Reply WPA/WPA2

I am working on an open source project, and am currently stumped. Let’s say I have a client connect to a wireless WPA network I am not authenticated to the wireless network I just have a wireless card ...
sonicCrypt0r's user avatar
1 vote
2 answers
181 views

Which EAP connection is strong? Certificate based EAP connection or credentials based EAP connection?

What difference we can observe when connecting using the certificate generated using the RADIUS and the credentials that we define in RADIUS like username & password.
ravi kumar's user avatar
1 vote
1 answer
453 views

Airmon-ng/Airodump-ng - Low Beacon Count on certain networks

It's been a few years since I've played around with this so I'm not sure if times have changed. When using AR7921 chipset (Alfa AWUS036NHA) on Ubuntu 20.04 I can see many networks using the following ...
jblz's user avatar
  • 113
1 vote
0 answers
124 views

Is this the signature of a KRACK attack?

A router (or one spoofing as a router) unilaterally sent to a client an EAPOL packet 1 of 4, and then immediately sent 5 packets of EAPOL packet 3 of 4. Is this the signature of a KRACK attack? And ...
Dev Kanchen's user avatar
1 vote
0 answers
143 views

Aireplay issues

I started using the aircrack-suite and to be more specific it is about aireplay-ng. The problem ist that... aireplay-ng -0 wlan0mon ...does work, but... aireplay-ng -9 wlan0mon ...doesn't In fact ...
Ov3rfl0w's user avatar
1 vote
0 answers
98 views

Video card - pci express security

I recently bought a second hand Nvidia video card which runs in SLI mode with my default video card. Can it be infected with a malicious program added by the previous owner, steal data from the ...
fstfn's user avatar
  • 11
1 vote
0 answers
124 views

Can a computer be vulnerable to BroadPwn?

There is a lot of info and warnings about most phones using Broadcom BCM43xx WiFi chipset that are vulnerable to remote code execution and full takeover. What about computers? I saw that MacOS also ...
Mr. H's user avatar
  • 15
1 vote
0 answers
152 views

How should I manage wireless connections if using iptables?

I am implementing some modest iptables on xubuntu 17.04 and came across this blurb from IptablesHowTo Ubuntu WARNING: Iptables and NetworkManager can conflict. Also if you are concerned enough ...
flerb's user avatar
  • 460
1 vote
0 answers
166 views

How possible would it be for an attacker to sniff the pairing process in Classic Bluetooth?

Classic Bluetooth protects its connection by keeping the pairing process secret. How does Classic Bluetooth prevent the keys from being sniffed during the pairing process? On what channel does the ...
Lew Wei Hao's user avatar
1 vote
0 answers
90 views

Which attributes of a WPA AP certificate are used by a client device in deciding if the certificate has been trusted before?

When connecting to a new AP, the client device will pop a warning to ask if the certificate of the new AP should be trusted. If trusted, the warning doesn't show anymore if the certificate is known to ...
Lew Wei Hao's user avatar
1 vote
0 answers
444 views

How can I capture a chronological record of the clients connected to a specific standalone AP?

I want to have a chronological/historical graph showing what times each client was connected to an AP using either airodump-ng with a simple script or some other free and open tool.
JEF's user avatar
  • 11
1 vote
0 answers
204 views

Is the keystream recovered by tkiptun-ng the same key used to encrypt all data frames between the client and the AP?

Looking at the manual for tkiptun-ng,(http://www.aircrack-ng.org/doku.php?id=tkiptun-ng) The output saves the keystream in the example near the end of the program. Is this the same keystream used to ...
Lew Wei Hao's user avatar
1 vote
0 answers
107 views

What happens when an attacker sends fake nonce in TKIP handshake?

The TKIP handshake is halfway completed; the access point and station have exchanged the first two messages. Now, before the access point can send the third message to the station an attacker sends a ...
tpm900's user avatar
  • 171
1 vote
0 answers
286 views

mdk3 beacon pwning not detected by other devices

I'm new to wireless security. I'm trying to pwn beacon frames to announce a new access point using mdk3. However, when I run the command I get the following result where the MAC address is not ...
Peter Gerges's user avatar
1 vote
0 answers
65 views

Netgear Administratrive distance

Not sure if this is the right stackexchange forum though I am using Netgear WNR1000v2 running firmware version 1.1.2.58. Open authentication is enabled, so no password is required, and only used for ...
winsmak's user avatar
  • 59
1 vote
0 answers
174 views

How does deauth protection (IEEE_802.11w-2009) work?

I read a Wikipedia article on IEEE_802.11w-2009 and I wonder how does it work with WPA2. In other words, how do I turn it on in my Linux kernel? If I enable it both in it and in an OpenWRT router, am ...
d33tah's user avatar
  • 6,524
1 vote
0 answers
186 views

What information about a user can wireless carriers access?

What is the maximum amount of imformatiom about a user and the user's phone that can be obtained by a wireless carrier on a GSM network? Here is a list of the things I know, but are there more? IMEI, ...
user111915's user avatar
1 vote
0 answers
260 views

Are there security concerns with Bluetooth low energy?

In the first versions of BLE specifications, there was a huge security flaw during the pairing allowing an attacker to perform a MITM attack. Since Bluetooth 4.2, the pairing use ECDH, so there isn't ...
Shan-x's user avatar
  • 441
1 vote
0 answers
853 views

Difference between WPA, WPA2 and mixed mode on packets level

What is the difference between wpa, wpa2 and mixed mode, particulary how 4-way handshake packets look-like for every type? Is there any good lecture about it with packets examples? Above question ...
Tenso's user avatar
  • 11
1 vote
0 answers
131 views

fakeauthentication is working when my belkin belkin router f7d2301 mac-address filtering enabled

Actually i have enabled mac-filtering in my belkin router and the security policy is none and the authentication is open authentication. Iam(attacker) using kali linux. when i done a fakeauth attack ...
ashok's user avatar
  • 231
1 vote
0 answers
728 views

problem with mdk3

I have a problem in using mdk3 on kali. I want to DOS my AP with deauthenticate packets. I use the command: Mdk3 mon0 d <AP mac address> I am sure that the command is true. It is not working ...
m.khorram93's user avatar
1 vote
0 answers
232 views

Decrypting WLAN (WPA2) Traffic - What kind of Antenna to use?

In a Penetration test after receiving the PSK of a WPA2 WLAN it's possible to decrypt the wireless traffic using airdecap-ng for example. This works well as long as one recorded the associated four-...
davidb's user avatar
  • 4,313
1 vote
0 answers
5k views

How Modification attacks works?

Theoretically... In Active attacks we have "modification attack"...ie "In a message modification attack, an intruder alters packet header addresses to direct a message to a different destination or ...
Curi0usM3's user avatar
1 vote
0 answers
4k views

Whole system ACK flood attack making internet slow

Over the past few days, I'm noticing that the log of my wireless router is showing an ACK flood attack from various IP addresses. I use a D-Link DIR-600L. I've searched through the internet, also ...
Ayush Khemka's user avatar
0 votes
0 answers
52 views

What is the best way to demonstrate spoofing?

I use this tutorial to spoof with Kali Linux on VirtualBox: https://www.geeksforgeeks.org/ssl-stripping-and-arp-spoofing-in-kali-linux/ However got some errors ip route: Route information 10.1.80.121 ...
Alex Anonym's user avatar
0 votes
0 answers
66 views

Wpa ptk and gtk in detail

I have been checking Pairwise and Group Transient keys in a network for security. I understand PTK is derived from = PMK, AP nonce (ANonce), STA nonce (SNonce), AP MAC address, and STA MAC address ...
C.Unbay's user avatar
  • 207
0 votes
0 answers
98 views

Technical details behind how a malware-infected device infects other devices on the same network?

I'm a security student and for one of my projects, I'm trying to learn the technical details behind a malware-infected device infecting other devices on the same network. I can see so much content ...
scottstots's user avatar
0 votes
0 answers
97 views

Overlap between Wired vs WiFi vulnerabilities

This is a fundamental question, but, I'm interested in understanding the "venn diagram" of attack vectors between wired and Wi-Fi connections. What are the attacks that both wired and Wi-Fi ...
Steven Chris's user avatar
0 votes
0 answers
499 views

Airodump-ng shows AP on negative channel

I am new to WiFi and was trying to learn pentesting with the aircrack-ng suite. In the following airodump-ng excerpt, any idea why airodump-ng is showing an access point with negative value -1 as the ...
pippo1980's user avatar
  • 101
0 votes
0 answers
89 views

Different Intermediate Certificates on client/server question

Hope someone can explain the impact as I know a bit but not too much about using certificates. We use an external CA QV (I think now Digicert) to create certs and install into the web, vpn, wired/...
user4565's user avatar
  • 151
0 votes
0 answers
1k views

Why my card changes from WPA Handshake to PMKID or vice versa just by airodump-ng

I am running Kali linux 2020.3 on VBox on Windows 10. I put my wireless card AWUS036ACH chipset Realtek RTL8812AU in monitor mode using airmon-ng start wlan0. Then i use airodump-ng wlan0 to capture ...
Qasim's user avatar
  • 1
0 votes
0 answers
308 views

How does an IMSI catcher "impersonate" a base station/cell tower?

On reading about IMSI catchers, I keep seeing that they "impersonate" a real cell tower or "base station" so that the phone drops its signal-carried data on that machine while on its way to the ...
Long Way's user avatar
0 votes
0 answers
140 views

Can I use a public / private keypair to secure traffic on my wifi on OpenWRT?

Wifi passwords are a pretty weak way to secure a Wifi Access point; is it possible to use a public / private key to secure traffic on a wifi access point which runs OpenWRT. I know I can secure SSH ...
leeand00's user avatar
  • 1,431
0 votes
0 answers
376 views

Why doesn't the fluxion attack steal credentials when authenticating to the network?

I ask this question because i am not happy with the answer here In a normal attack such as fluxion. You send DEAUTH packets to the victim wifi. Clone their access point and host an open wifi. Let the ...
yeah_well's user avatar
  • 3,794
0 votes
0 answers
278 views

Capturing Dot11 (802.11) headers on Mac OSX

I'm trying to obtain remote signal strength indication (RSSI) from received packets by sniffing the ones having Dot11 headers. But I've heard somewhere that WLAN interface of Mac OSX (en1 interface as ...
ShellRox's user avatar
  • 161
0 votes
0 answers
402 views

How feasible would it be to sniff traffic between an Authentication Server and a RADIUS server in a corporate setting?

For WPA enterprise in the corporate world, is the RADIUS server connected to the Authenticator/Access Point wirelessly or 'wiredly' for most situations? If they are connected wirelessly, does this ...
Lew Wei Hao's user avatar
0 votes
0 answers
109 views

GPS security standards

Are there any GPS (global position) security standards to secure any kind of GPS implementation? For e.g GPS software coding standards, GPS traffic encryption standards? I asked because nowadays there ...
JinPangPang's user avatar
  • 1,951