Questions tagged [wireless]

Wireless security topics including 802.11, Bluetooth, and others.

Filter by
Sorted by
Tagged with
3
votes
1answer
4k views

Enterprise Wireless 5Ghz deauth

I am running blackbox pentests on an enterprise wireless setup. My area of attack consists of multiple APs that have a 2.4 GHz interface and also a 5GHz one. I have successfully deauthenticated users ...
2
votes
1answer
2k views

WPS PBC Security

On my router I have a WPS button (PBC) that enables anyone to connect during a short time frame. There is no 4 numbers PIN anywhere on the router or on the instruction manual, and I can't find any ...
1
vote
0answers
45 views

What happens when an attacker sends fake nonce in TKIP handshake?

The TKIP handshake is halfway completed; the access point and station have exchanged the first two messages. Now, before the access point can send the third message to the station an attacker sends a ...
6
votes
4answers
943 views

Caught Deauth attempt on wireless network last night. Suggestions on what to do from this point?

Last night around 3-4 am I had noticed my network acting funky.. I flipped my wireless card into monitor mode and boom there was a rogue AP. I then acknowledged that I had seen them and mimic'd the ...
1
vote
0answers
102 views

mdk3 beacon pwning not detected by other devices

I'm new to wireless security. I'm trying to pwn beacon frames to announce a new access point using mdk3. However, when I run the command I get the following result where the MAC address is not ...
1
vote
0answers
464 views

Encrypting OTA software updates files for embedded devices

I need to encrypt and send update files of the order of 100K from a server, through a mobile app, to low power wireless embedded devices (32 bit). The file transfers will be infrequent. The mobile ...
1
vote
1answer
496 views

What information does a wireless access point have about connected devices?

Which information about a connected device leaks to the access point it is connected to? What's the minimum amount of information that must be supplied to successfully connect, apart from the password?...
5
votes
1answer
791 views

How Hole 196 actually works ? What WPA parameters does it exploit?

While dealing with wireless set I came across the term Hole 196. Got to know that preventions too. But can it still bypass Client isolation and standard preventive approach if packets are crafted at ...
0
votes
2answers
272 views

Wireless EAP-TLS implementing on Medical Wireless Device

I am new to PKI, digital certificates etc and will be the first time to connect a medical wireless device to a wireless network using EAP-TLS. I am connecting a medical wireless device to our customer'...
6
votes
2answers
839 views

What are weak IVs? Can we somehow stop or slow down WEP cracking by avoiding usage of them?

Most of us dealing with wireless security must have cracked a WEP key, and while doing that must have come across texts like this: weak IVs, reveal more information about the secret part of the WEP ...
0
votes
1answer
42 views

Wireless devices with default configurations

I have the idea of deploying a product using a Raspberry Pi alike (CHIP) however I am concerned of the security issues getting a wireless device into people's homes The device will be: Using all the ...
1
vote
2answers
749 views

scans for WIFI access points

PCI DSS requirement 11.1: "Implement processes to test for the presence of wireless access points (802.11), and detect and identify all authorized and unauthorized wireless access points on a ...
2
votes
2answers
1k views

Change device MAC address to router's MAC address

This is in respect to bypassing Captive Portals. I haven't tried it yet on a captive portal yet. But I was wondering, what will happen if : I connect to a wireless network Get the router's MAC ...
3
votes
1answer
166 views

Why are wireless adapters needed for wireless attacks?

I got into penetration testing a couple of weeks ago and just started learning more about wireless attacks and how they are done, and they mention a lot the need of wireless adapters. Would I still ...
4
votes
3answers
1k views

Are Apple Magic Keyboards Secure Against Man-in-the-Middle Attacks?

Is Apple magic keyboard secure against man-in-the-middle attacks when it pairs to mac automatically? Recently I heard lots of wireless keyboards are vulnerable to eavesdropping. I don’t want my key ...
1
vote
1answer
817 views

Capture Handshake with WPS disabled

I just got into exploring network cracking. Honestly, just to learn how the process works. I am not curious about cracking the handshake as much as capturing it. It seems when I set up a test ...
7
votes
1answer
2k views

List wireless stations around me

I'm looking to find a specific wireless user around me, I have his MAC address, I even have the channel he is on. I've tried iwlist peers, to no avail, as well as airodump. I have seen his mac pop up ...
3
votes
1answer
669 views

Arp replay for cracking WEP key IN Aircrack-ng

I'm pretty new to all of this so it might be a little stupid question... but why do we need to wait to capture an arp packet from a client to the AP? Can't we just send a 'fake' arp request to the AP ...
2
votes
1answer
576 views

Strange behavior when injection wifi packets with aireplay-ng [closed]

When I'm testing packet injection with aireplay-ng I can witness a strange behaviour on my Lenovo T510i. Several blogs report my wireless device to be capable of packet injection. But then look at ...
2
votes
1answer
638 views

Is WPS still insecure if the router requires a client pin?

Recently purchased an Asus AC88U and I noticed that you can require a client pin for a WPS connection to successfully happen. It seems that this would be a pretty secure implementation of WPS. Are ...
4
votes
1answer
2k views

Can my college Wi-Fi admin obtain the serial number/IMEI of my device?

I am using my own device on my college's Wi-Fi. I've heard that many pieces of information about my device such as my OS version is sent through a browser such as Google Chrome. But how can he obtain ...
2
votes
2answers
151 views

Does any Wifi technology permit safe & secure sharing of an Internet connection?

I have an internet circuit that I would like to protect from untrusted peers. BUT I don't want the peers in the same broadcast domain to be able to affect other peers. (e.g. Wifi user 1 shouldn't be ...
0
votes
1answer
824 views

2FA with Windows NPS

I would like to set up two-factor authentication for my Wireless users. I have an Windows NPS server that is currently authenticating my wireless users and I want to add certificates or any other ...
3
votes
1answer
315 views

How do I find a digital (non-WiFi) baby monitor with an encrypted signal?

What would I look for to see if a digital baby monitor (audio or video, but non-IP/WiFi) has an actual encrypted signal, or at least something to defend against the following threat model? As I'm not ...
3
votes
1answer
90 views

NFC Security for Payment

During an offline transaction, the Point-of-Sale has no internet connection, and so the payment terminal cannot verify if the client’s payment device has been revoked. A malicious person can use a ...
3
votes
2answers
111 views

Why do I need to unlock my phone to enable wifi

I have a mobile phone running Android 6.0.1, even when the phone is locked, I still can access various settings from the quick settings menu, one of those is the wifi setting. However, when I enable ...
7
votes
5answers
323 views

How might the BBC snoop on wi-fi usage?

It's just been reported that the BBC plan to deploy wi-fi detection vans to identify users who are streaming content from their internet service (BBC iPlayer) without a TV license. For example, see ...
0
votes
3answers
418 views

Weird problem on airbase-ng

The situation is pretty simple, I'm trying to create a rogue AP, am I missing something? No matter what I do I get the same error message: I tried using different bssid and essid's with the ...
1
vote
0answers
17 views

Netgear Administratrive distance

Not sure if this is the right stackexchange forum though I am using Netgear WNR1000v2 running firmware version 1.1.2.58. Open authentication is enabled, so no password is required, and only used for ...
0
votes
2answers
422 views

Does wireless card need to be on same channel as AP to sniff beacon frames?

OBJECTIVE Essentially, my goal is to emulate something like airodump-ng wlan0 Here is a link just in case ... airodump-ng Collects raw 802.11 frames Displays nearby access points and data GAMEPLAN ...
0
votes
1answer
233 views

Using old router as wi-fi extender/extra security on shared network?

I just moved into a building with three apartments, all of which split an internet subscription. There is only one router, however, in one of the other apartments. For security/privacy purposes, I'd ...
1
vote
2answers
352 views

Attacker knows what I do online and even has screenshots from my computer - how?

What can be achieved by hacking the Wi-Fi connection? Can you then use that to access somebody else's computer remotely, i.e., from their own house instead of across the street from me? I think ...
0
votes
2answers
104 views

How secure is LAN wireless 802.11 if password is used with access point?

I've read a book on computer networks, and among other subjects the author touched WiFi security. It was said that WiFi has some serious security flaws and that there is even free publicly available ...
1
vote
0answers
89 views

How does deauth protection (IEEE_802.11w-2009) work?

I read a Wikipedia article on IEEE_802.11w-2009 and I wonder how does it work with WPA2. In other words, how do I turn it on in my Linux kernel? If I enable it both in it and in an OpenWRT router, am ...
1
vote
1answer
761 views

What does it mean when airodump-ng shows 0 beacons?

I have one particular AP that shows 0 Beacons in airodump. I can see the beacons in all the other AP without a problem. So is it even possible for AP to not send beacon frames?
2
votes
2answers
611 views

Sniffing packet on wireless connection (airodump-ng)

Short Question: Is it important for a sniffing device to be in the broadcasting range of a client (NOT THE ROUTER) to sniff its packets? Complete Scenario: I assume that a wireless sniffing tool, ...
2
votes
4answers
383 views

Is a computer more vulnerable if wireless is left on when booting?

Normally I switch off wireless on my laptop before I shut it down but I forgot to do this last night. So this morning, after I booted up the laptop, I saw the wireless notification on the bottom right ...
2
votes
1answer
5k views

Security of an IoT network using AES (LoRaWAN)

I am studying the security of LoRaWAN. Here is a simplified architecture of the network: As you can see, there are two keys: one for the network security (no mitm, no modificatiof the messages). It ...
0
votes
3answers
269k views

Who can spy on my wifi usage and websites I visit?

I'm using a WPA/WPA2 encrypted WiFi. Who can view what I'm doing? Also how? Can the person that pays for the WiFi look up exactly what I am doing (e.g. look up exact messages I've sent on Facebook)?...
-1
votes
1answer
393 views

Deauthenticate ALL wlan networks/clients in range [closed]

I need to deauthenticate all clients in all networks within the range of my wlan-adapter. Aireplay-ng allows only to focus a single network. Are there any programs or scripts i can use for this ...
1
vote
1answer
259 views

What are attack vectors for attacking tethering smartphones?

Are there any attack vectors for attacking tethered wireless networks (mobile hotspot), other than for normal wireless networks? Assuming the tethered wirless network uses state-of-the-art encryption+...
5
votes
1answer
11k views

What's the difference between pixie attack and other attacks on WPS?

I have been studying about the brute-force attack on the WPS PIN, and I understand that because the last digit is the check digit, and that the PIN is divided into two halves in M4 and M6 messages, ...
2
votes
3answers
414 views

Wireless network risks? [closed]

What are the security risks associated with installing a Wi-Fi (802.11) network in-comparison to a wired network for internet connection?
1
vote
0answers
109 views

What information about a user can wireless carriers access?

What is the maximum amount of imformatiom about a user and the user's phone that can be obtained by a wireless carrier on a GSM network? Here is a list of the things I know, but are there more? IMEI, ...
1
vote
0answers
156 views

Are there security concerns with Bluetooth low energy?

In the first versions of BLE specifications, there was a huge security flaw during the pairing allowing an attacker to perform a MITM attack. Since Bluetooth 4.2, the pairing use ECDH, so there isn't ...
4
votes
1answer
4k views

Is it possible to hack WPS PIN of routers that lockout exponentially after failed tries?

I have been interested in Wireless hacking lately, and I can do dictionary attacks, and some other type of attacks. Though, I wanted to hack my ASUS RT-N12D1 router's WPS PIN. ASUS doesn't alllow to ...
1
vote
1answer
878 views

What is the difference between capture traffic from inside and outside of my network?

I'm thinking to use Wireshark tool to packet capture in my Wireless network. I read something that tells I can capture from inside or outside of my network, just making my wifi board working in "...
8
votes
3answers
3k views

How safe is a standard wireless keyboard from a MITM attack?

And are there any mitigations except using a wired keyboard?
0
votes
0answers
103 views

Is it possible for an attacker to log keystrokes of a bluetooth or wireless keyboard [duplicate]

Bluetooth and wireless keyboards are sending keystrokes wirelessly. Could this mean that an attacker (or spy) can log the keystrokes by monitoring the wireless or Bluetooth radio waves (or whatever)? ...
0
votes
1answer
2k views

Not receiving beacons for airodump-ng to work

I have an AP close enough to me with high signal strength but for some reason I'm not receiving beacons from it. Since I don't have beacons coming in, I cannot perform deauth as well. One thing I'm ...

1 2 3 4 5 9