Questions tagged [wpa2]
Security protocol (IEEE 802.11i) developed by the Wi-Fi Alliance to protect wireless networks.
327
questions
2
votes
1
answer
210
views
Should I wait for Apple to fix the recent WPA2 KRACK exploit before downloading new apps over Wi-Fi?
Monday of this week: researchers announced the WPA2 KRACK exploit that effectively voids the protection of WPA2. Supposedly Microsoft already fixed it, Apple's working on patching it for Mac OS and ...
- 420
1
vote
2
answers
410
views
Can a KRACK attack force a reauthentication handshake?
Is there any way an attack AP can break into an existing connection where handshake has already completed? Can the AP somehow force reauth?
- 173
2
votes
1
answer
158
views
Krack prevention by channel lock?
Is there a way for most of the field clients to lock their channel to the one they know their secured AP is handling?
If I look at my channel can I tell immediately if there is an attack AP on me?
- 173
3
votes
1
answer
265
views
Why is KRACK a protocol error and not implementation error?
I don't quite understand how KRACK is considered a protocol weakness rather than an implementation error.
From reading about KRACK, I found following facts:
There are more vulnerable implementation ...
- 33
0
votes
1
answer
1k
views
How vulnerable is ADB (Android Debugging Bridge) over wifi now that WPA2 is cracked?
How vulnerable is ADB over wifi now that WPA2 is cracked? Could hackers MITM/inject commands I am sending from my pc to my phone? My Windows PC is patched but no official fix is available for Android ...
4
votes
1
answer
580
views
KRACK: will there be an exploit soon?
Given that the probability is high that there are unpatched devices left even years from now (android devices, IoT-Things, etc.):
Is it likely that there will be an exploit available soon? I think of ...
- 14.4k
5
votes
1
answer
176
views
Why is Android/Linux able to communicate with the wireless access point after the encryption key is set to zero?
As I understand it, when exploited against Linux and Android the KRACK attack results in the encryption key for the session being zeroed out on the device, so an eavesdropper can easily decrypt the ...
- 713
2
votes
1
answer
244
views
Does only having one end of a wifi connection patched reduce the risks from KRACK?
From the official FAQ on the vulnerability (emphasis mine):
So again, update all your devices once security updates are available. Finally, although an unpatched client can still connect to a ...
3
votes
1
answer
2k
views
Does EAP-(T)TLS mitigate against KRACK?
It is my understanding that EAP-TLS and EAP-TTLS do not trust in WPA2 4-Way handshake, essentially establishing an authenticated tunnel between client and server independant on the WPA2 protocol.
In ...
- 209
1
vote
0
answers
224
views
Why didn't anyone think "use zero nonce and continue handshake" was a problem or at least strange in wpa-supplicant before now? [duplicate]
If someone is coding a secure connection library, I'd have expected this to stick out like a red flag to them.
Why on earth would someone code logic like this (anyone working on it must have ...
- 1,684
9
votes
1
answer
659
views
Consequences of the WPA2 KRACK attack on older Windows and iOS clients
What are the real-world consequences of the WPA2 KRACK attacks on older Windows systems (XP/Vista) and iOS devices (10 and older) that will not be patched?
I am aware of another question on this site ...
- 252
3
votes
1
answer
460
views
Can the client communicate with the AP after a KRACK attack?
When a client is forced to reinstall the key and to reset the nonce and the replay counter, what does it imply for the future communication between the client and the AP? There's an adversary in the ...
5
votes
1
answer
1k
views
Would MAC filtering protect against KRACK?
Thinking of interim solutions to lower the chance of attack while waiting for patches for routers. Would setting a MAC filter, i.e. limiting WIFI access to only known devices, reduce or protect ...
- 153
17
votes
3
answers
10k
views
Is WPA2-Enterprise affected by the KRACK attack?
From my reading of the whitepaper it is the 4-way handshake that is vulnerable, but WPA2-Enterprise uses a RADIUS server for authentication, so is it also exploitable? And if so, how?
- 173
119
votes
3
answers
19k
views
Why wasn't the KRACK exploit discovered sooner? [closed]
From what I've read, the issue is as simple as performing step 3 of a 4-step handshake and the consequences of performing that step more than once. Considering the complexity of these kinds of ...
- 890
142
votes
9
answers
19k
views
To sufficiently protect against KRACK is patching the client, the AP, or both, required?
Following on from this question, I am unclear on which of the following steps are sufficient to protect a WPA2-based wifi connection from the KRACK flaw:
Patching the AP (e.g. router)
Patching the ...
- 2,001
35
votes
1
answer
4k
views
How does a nonce reset allow for decryption?
I'm sure that by now most InfoSec-lovers have heard about KRACK.
If you haven't, check out this great explaination by a fellow StackExchanger.
It's a new attack on WPA2 which allows for decryption ...
- 472
4
votes
0
answers
1k
views
Are there any detection scripts available for WPA2 Key Reinstallation Attacks (KRACKs)? [duplicate]
I have just read about a new weaknesses in the WPA2 protocol called KRACKs. The authors of the paper says that they will release scripts that can be used to test if a network is exploitable when they ...
- 767
256
votes
5
answers
30k
views
Consequences of the WPA2 KRACK attack
Today new research was published on vulnerabilities in wireless network security called Krack.
What are the real-world consequences of these attacks for users and owners of wireless networks, what ...
- 62.1k
3
votes
2
answers
855
views
I connected to an apparently password protected WiFi without giving a password
My partner and I have just moved house and we're waiting for our internet to be connected. We're living in a group of units and as you'd expect there are numerous WiFi networks, all secured... or so I ...
- 195
0
votes
1
answer
357
views
AWS Elastic GPU Compute vs WPA2 [closed]
Looking at cracking a WPA/WPA2 handshake predetermined at 8 Characters long only. This means that there are: 208,827,064,576 possible combinations.
Looking at toms hardware page and Rockfish Sec ...
- 151
1
vote
1
answer
2k
views
wpa2-psk aes hacking with android
I have a digisol HR3400 router, I want to prevent it from being hacked.
Can I use wpa2-psk aes to prevent hacking by Android apps like andro dumper or wpa tester?
- 13
1
vote
2
answers
488
views
Online banking on wpa & wpa2 enterprise
I could use two wifi connections, both with WPA & WPA2 Enterprise security, automatic PEAP and MSCHAPv2, one of them with certificate, the other without; both require user/pwd and are on a ...
- 359
2
votes
1
answer
6k
views
How to continue where I left off on reaver?
I was attempting to brute-force the WPS PIN on my home router to check the security of my network. Strangely, after three days it still had not finished, I believe this is because my computer was far ...
- 715
7
votes
3
answers
15k
views
Can someone explain in simple steps how WPA2-Enterprise authentication and encryption happens?
When I try asking this question on other websites I get massive downvotes and am told "We're not doing your homework. Use google." Also I sometimes get banned.
Anyways, I've searched tens of pages of ...
- 145
1
vote
1
answer
2k
views
What does it mean when Reaver returns a PIN but no passphrase?
Usually when it's done, the WPA passphrase/password is listed immediately below the WPS PIN.
Any idea what it means when it's absent from the results?
I also tried entering the PIN directly, using ...
- 1,769
1
vote
1
answer
620
views
Accessing WPA/WPA2 password from native auth form on a rogue router
I'm trying to wrap my head around the WPA/WPA2 4-way handshake in an attempt to determine if it is possible for a rogue wireless access point to retrieve a plaintext (or hashed) version of a router's ...
- 135
5
votes
1
answer
2k
views
WPA2 and ChopChop attack
I know that WEP is vulnerable to the ChopChop attack. Could the ChopChop attack be carried against WPA2-PSK as well? Some Internet articles suggest this possibility, I want to be sure though.
- 381
1
vote
3
answers
925
views
Why can't Wifi be secured assymetrically? [closed]
Why couldn't we switch from AES to something asymmetric? Then a private key doesn't need to be shared with the client; rather just share a public key with them.
- 121
-1
votes
2
answers
1k
views
How do I use driftnet without hacking?
I want to see which images are being sent through the air using my wifi and foreign wifi. How do I do that without cracking WPA(2) but just filtering out the unencrypted packages using windows or kali ...
- 171
3
votes
2
answers
8k
views
Cafe's wifi disconnects me whenever I connect my VPN. How?
I'm at a cafe where all but a couple of websites like Youtube are blocked. I'm typing this from my hotspot.
Whenever I connect my VPN (PIA), it automatically disconnects me from the wifi. After I ...
- 135
5
votes
3
answers
9k
views
WiFi Hacking - Certificate based authentication instead of password
I would like to know if using a certificate based authentication instead of a WPA2 password in a WiFi network would be secure or insecure in terms of is it breakable or not?
Since WPA2 can be ...
- 51
1
vote
1
answer
711
views
Utilizing OCLHashcat to crack WPA/WPA2 passwords obtained via airodump-ng
Wondering if its possible (edit - Found ways to do so, the question now is does it make more sense) to do so? Did a little bit of searching but it would seem that most people utilize Aircrack-NG. ...
1
vote
1
answer
2k
views
I am unable to secure a WPA handshake (4 way handshake)
I am training to be a pen tester and am having some issues obtaining a 4 way handshake. I use airodump-ng -c -w file --bssid wlo1 followed by Aireplay-ng -0 0 -a (Mac) wlo1
Here's all the steps I ...
3
votes
0
answers
591
views
Raspberry Pi (Raspbian) not capturing WPA2 handshake with Aircrack-ng [closed]
I've been using Aircrack for a short time now with my Alfa wfif adapter on my laptop and it's been working perfectly. However when I try and do the same thing on my Raspberry Pi it's having issues ...
- 31
2
votes
2
answers
441
views
I am having difficulty maintaining a wpa handshake (4 way handshake) airodump-ng
Ifconfig wlo1
ifconfig wlo1 down
iwconfig wlo1 mode monitor
ifconfig wlo1 up
airmon-ng check wlo1
kill processes
Airodump-ng wlo1
airodump-ng -c (channel) -w (file) --bssid wlo1
aireplay-ng -0 0 -a ...
10
votes
1
answer
6k
views
Wifi encryption vs SSL encryption
I am a bit confused about two types of data encryption when I am connected to a wifi.
The first encryption is used as a part of the wifi connection. The technologies used are wep, wpa, wpa2.
The ...
- 205
0
votes
1
answer
538
views
Which key is actually used for encrypting data traffic in WPA after the 4WHS?
Some sites say that the PTK is used for encrypting the data between the client and the WAP while others say that the PMK is used instead. Which one is true?
From what I understand, this can have very ...
- 439
0
votes
1
answer
2k
views
What are the roles of PSK and GTK in a WPA setting?
I understand that PTK is ultimately the key that is used to encrypt traffic between a device and the WAP after the 4WHS and that the PMK is directly related to the 'passphrase' of the wireless network....
- 439
-1
votes
2
answers
853
views
Get PMK from Handshake
Is there a way to get the PMK from a .cap file containing the 4-way-handshake of a wifi network.
I want to get it to compare it with a long list containing pre-compiled PMKs
- 101
9
votes
2
answers
905
views
wireless security - Authentication and Association
I am trying to learn wireless security a bit more technically but resources out there on the net are so confusing. Here is my understanding.
There are two types of Authentication:
1) Open System ...
- 213
1
vote
1
answer
6k
views
How does the Michael shutdown exploitation (TKIP) work?
How exactly does the Michael shutdown exploitation (TKIP) work?
I know that cancels all traffic continuously, but how?
- 177
2
votes
0
answers
466
views
Securing wifi hotspots across multiple devices with multiple users
I have a situation where multiple devices will be installed in public places and different maintenance engineers, from potentially different companies, will need to login via their wifi hotspot to set ...
- 21
8
votes
1
answer
13k
views
Wireshark can't decrypt WPA2 LAN traffic
I want to decrypt my own network traffic.
I have Linux Mint on Samsung Laptop with a AR542x Wireless Network Adapter.
Open Wireshark, start capture in promiscuous mode & monitor mode and I ...
user135023
3
votes
2
answers
6k
views
WPA2 with 802.1x - how is the server certificate validated?
I want to replace my current WPA2/PSK Setup with WPA2+802.1x with RADIUS authentication. There are various algorithms which can be used for that, roughly divided in two groups:
The user uses a ...
- 133
0
votes
1
answer
585
views
Why is WPA/WPA2-personal Entropy different?
Why is WPA/WPA2-personal passphrase entropy different than other entropy measurements? Is this because of the way WPA/WPA2 is implemented? For example:
A passphrase of 15 lowercase letters has an ...
- 11
5
votes
2
answers
1k
views
Evil Twin Access Point Secured-Unsecured
A very similar question was asked here but it didn't get any reply, so I'm going to ask a new question with some more insights.
The problem of the most common Evil Twin Attack is that the fake AP is ...
- 177
3
votes
2
answers
1k
views
ARP Poisoning: exactly how it works
Can anyone tell me how ARP Poisoning exactly works?
Because I was sure that worked as I stated here.
But I've been told that is not how ARP poisoning works. That the path I've mentioned in the link ...
- 177
5
votes
2
answers
1k
views
ARP Poisoning: WPA Personal and Enterprise
As mentioned in the title, I've questions regarding an ARP Poisoning on a WPA Personal and WPA Enterprise.
I'm gonna do an example (please let me know if I'm wrong):
I need to send the ARP reply to ...
- 177
0
votes
1
answer
3k
views
WPS Why Can't Pin be Bruteforced Offline
I don't totally understand how the WPS protocol works but why cannot a user get the hash of the WPS pin from the router and crack it in the same way a WPA2 handshake is cracked? (Not pixiewps but ...
- 513