4 ms·
Does this kind of wi-fi sniffing work with WEP or WPA encrypted networks? What about 802.1x?
by thought_alarm 16y ago
Does this kind of wi-fi sniffing work with WEP or WPA encrypted networks? What about 802.1x?
- pmorici 16y agoYes, assuming you know the password to connect to the network. Otherwise no.
- thought_alarm 16y agoAre you sure? It's not working on my WPA2 network.
- pmorici 16y agono, I'm not familiar with WPA2.
- InclinedPlane 16y agoThis is incorrect. Traffic on an access point using WPA2 + AES is not sniffable without significant cryptanalysis or use of exploits.
- oasisbob 16y agoMind providing more information on this? eg, what about WPA2+TKIP? I'm trying to wrap my head around how WPA2 could still provide protection with a shared key... I'm sure I'm not the only geek who feels like their knowledge of WiFi protocols goes stale every six months or so.
- InclinedPlane 16y agoTKIP is much more vulnerable. In theory it requires "work" to crack WPA2+TKIP but it's comparatively trivial with modern hardware. With WPA2+AES you basically open a public/private key encrypted connection to the router (similar to SSL) and exchange the PSK in order to authorize the client. This traffic isn't any more sniffable, in principle, than https traffic. However, depending on configuration it can be vulnerable to man in the middle attacks and such-like.
- yuhong 16y agoActually this is false. I have actually read the 802.11i spec and I think the way the key exchange is done is same regardless of whether TKIP or CCMP is used.
- pieter 16y agoIt's fairly easy to do if you are logged in on the network already. For example, for the iPhone you can use something like pirni to spoof the mac address of the router. That way you'll receive all data on the network, and can send it on the router yourself. In the meantime, you can dump all cookies that are passed on. I think the tool even allows you to list all twitter and google cookies, and set them in Safari.
- deleted 16y ago[deleted]
- InclinedPlane 16y agoPirni uses a vulnerability of a common WPA2 configuration to execute a MITM attack using ARP spoofing. There are ways to prevent this exploit as well.
- yuhong 16y agoYep, if you are wondering what Hole196 was about, it was about this kind of attack.
- azim 16y agoThis specific attack should work just fine with WEP but will not work against WPA2 (Disclaimer: I haven't tried the combinations personally). With WEP every single client uses the same encryption key, so all the packets are visible to everyone. With WPA2-PSK, each client has it's own key which is derived from the pre-shared key. Because of this, your adapter won't decode someone else's packets, but it's technically feasible to do so with other types of attacks outside of the scope of this firefox plugin. I'm not that familiar with the encryption within WPA-Enterprise, but I don't believe you can derive other people's keys and sniff their data when using it.