29 ms·

Offtopic: You were faster than my comment! I understand the Yubikey is popular but I do not understand the why the Wi-Fi dongle is popular. Any ideas?

matchai 7y ago
That wifi dongle in particular supports packet injection, and supports aircrack-ng for penetration testing.
- thelittleone 7y ago
  Indeed and cheap enough to throw away after each project for improved opsec.
  - Godel_unicode 7y ago
    Given that you can change the MAC address, how does throwing it away improve opsec...?
    - diminoten 7y ago
      Makes you feel more like an operator, I guess?
    - jascii 7y ago
      It seems good practice not to assume there are no other ways to id/fingerprint a device then by mac address..
      - Godel_unicode 7y ago
        That's actually the opposite of good practice; good practice in security is to base your planning off of facts and research. Throwing away your whole setup after every gig works for Mission: Impossible, and I guess it makes people feel extra-super-ninja, in practice it just perpetuates the endless (and pointless) culture of I-know-something-you-don't. Opsec should be based on reality and threat modeling, not endless rounds of whatabout. Edit: if you (the rhetorical you, not parent specifically) actually know something here, chime in!
        jascii 7y ago
        That really is the difference between "proven secure" vs "not proven insecure", which would you consider best practice? As far as fingerprinting WiFi devices goes: It is an rf device and all rf devices vary in behaviour due to component tolerances. This shows in such things as spurious emissions, power variations across its transmission spectrum, oscillator drift, etc, etc. These are fairly easy to detect remotely. One example is shown in this paper: https://www.cs.ucr.edu/~zhiyunq/pub/infocom18_wireless_fingerprinting.pdf https://www.cs.ucr.edu/~zhiyunq/pub/infocom18_wireless_finge...
        Godel_unicode 7y ago
        That paper states that the accuracy could be as high as 95%. Apple has sold over a billion iOS devices with WiFi radios in them. I'll let you Google the base-rate fallacy for yourself, and decide if that risk is worth it. Edit: make that over 2 billion Edit: also, "proven secure" is impossible.
        jascii 7y ago
        The paper is only one such method, there are countless and these methods have been in documented use in signal intelligence since at least WW2, combined your accuracy increases. And this is on top of all the other known methods of fingerprinting network devices.. Besides, most of the time you only care whether the same device was used, 95% gives you a lot of certainty. Within propper constraints "proven secure" certainly is possible.
        scarejunba 7y ago
        I actually recycle my entire person after each pen test attempt to prevent people from cottoning on to each body’s unique tics.
        nickpsecurity 7y ago
        "That's actually the opposite of good practice" Good security practice is considering all devices as insecure until proven otherwise. Also, mitigating known unknowns where a general problem happens a lot. Devices snooping on you, misleading you, interdiction, hacks on firmwate, etc. Then, you mitigate it in situations where you're unsure of what's going on just in case. So, long as mitigation isn't too costly. I used to buy and get rid of WiFi devices and throwaway computers for that reason. Also, buy them in person at random places with cash. You can even turn it into charity by using FDE, wiping them afterwards, and reselling cheap or donating to others that cant afford full price. Put Ubuntu and Firefox on them to spread some other good things.
  - dTal 7y ago
    Why would you care about opsec for consensual "penetration testing"?
    - jascii 7y ago
      Your security profile needs to exceed that set for the highest level of clearance you could possibly gain. In practice that means exceeding the highest level of security used in an organisation. You wouldn't want to inadvertently exfiltrate a clients data would you? Aside from that, it is not uncommon for say a department to not be aware they are being pen-tested with consent of their management, and you don't want to trigger counter measures.
      - dTal 7y ago
        I upvoted you because your first sentence is a useful observation, but I'm having a hard time using any of that to justify throwing away a wifi adapter. Even if it were possible to fingerprint the adapter beyond its MAC address, there's no global database of whitehat pentester wifi adapter fingerprints, and such a thing would be worthless anyway. You're not going trigger countermeasures by reusing a wifi adapter. The only threat model that remotely makes sense for that kind of precaution is fear of nation-state level resources trying to identify and catch you. And that's well outside of the realm of "pentesting". (And the idea of accidentally exfiltrating data through a reused wifi adapter is ludicrous)
Sendotsh 7y ago
> Description The best wireless adapter for those who use the penetration platform Kali Linux & BackTrack. The wireless USB adapter has been tested to work with Aircrack-ng and supports packet injection along with monitor mode.
Saus 7y ago
I've bought an Alfa adapter 10+ years ago because you can use them in promiscuous mode. So you can snoop wifi traffic, listen for handshakes and doing so crack WEP/WPA (wifi) encryption. Things probably haven't changed..
- mises 7y ago
  They have a little. 5ghz is more common, so you won't get any thing there. WPA2 is significantly harder to crack, and I usually do it on GPU with pyrit or hashcat-ocl and a wordlist. WPA3 is out now, too, and I'm there aren't really any well-established procedures for it yet.
  - TrueDuality 7y ago
    Just FYI WPA2 is pretty solidly and quickly broken (lookup KRACK attacks). WPA3 is unfortunately already partially broken (though currently joining the network / password breaking aren't fully broken, see Dragonblood attacks).
    - dayofthedaleks 7y ago
      KRACK is patched on most platforms. What weaknesses in WPA2 remain?
    - mises 7y ago
      KRACK was a nonce re-use, not a core protocol flaw. WPA2's flaws are more around un-encrypted control packets; i.e. I can de-auth you without having to get session keys.
- jgrowl 7y ago
  This was a popular adapter more recently because of the WPS pin exploit using something like the reaver tool.
Noxmiles 7y ago
Someone know a good 2.4/5.0 GHz wifi adapter for these kind of things?
- zoobab 7y ago
  a good directional antenna makes THE difference.
  - arendtio 7y ago
    any recommendations?
- aphextim 7y ago
  Not sure if it is what you are looking for but this site has various products regarding tapping, sniffing and pen testing. https://www.wallofsheep.com/ https://www.wallofsheep.com/
- mises 7y ago
  The Alfa AWUS1900 is a nice model, but if you want something cheaper (and will put up with 2.4ghz-only), the TP-Link TL-WN722N is cheap, but get the v1 chipset! It's the best-supported with drivers on linux. Oh yeah, and you will probably need to do monitor mode on linux.

matchai 7y ago

That wifi dongle in particular supports packet injection, and supports aircrack-ng for penetration testing.

thelittleone 7y ago
Indeed and cheap enough to throw away after each project for improved opsec.
- Godel_unicode 7y ago
  Given that you can change the MAC address, how does throwing it away improve opsec...?
  - diminoten 7y ago
    Makes you feel more like an operator, I guess?
  - jascii 7y ago
    It seems good practice not to assume there are no other ways to id/fingerprint a device then by mac address..
    - Godel_unicode 7y ago
      That's actually the opposite of good practice; good practice in security is to base your planning off of facts and research. Throwing away your whole setup after every gig works for Mission: Impossible, and I guess it makes people feel extra-super-ninja, in practice it just perpetuates the endless (and pointless) culture of I-know-something-you-don't. Opsec should be based on reality and threat modeling, not endless rounds of whatabout. Edit: if you (the rhetorical you, not parent specifically) actually know something here, chime in!
      - jascii 7y ago
        That really is the difference between "proven secure" vs "not proven insecure", which would you consider best practice? As far as fingerprinting WiFi devices goes: It is an rf device and all rf devices vary in behaviour due to component tolerances. This shows in such things as spurious emissions, power variations across its transmission spectrum, oscillator drift, etc, etc. These are fairly easy to detect remotely. One example is shown in this paper: https://www.cs.ucr.edu/~zhiyunq/pub/infocom18_wireless_fingerprinting.pdf https://www.cs.ucr.edu/~zhiyunq/pub/infocom18_wireless_finge...
        Godel_unicode 7y ago
        That paper states that the accuracy could be as high as 95%. Apple has sold over a billion iOS devices with WiFi radios in them. I'll let you Google the base-rate fallacy for yourself, and decide if that risk is worth it. Edit: make that over 2 billion Edit: also, "proven secure" is impossible.
        jascii 7y ago
        The paper is only one such method, there are countless and these methods have been in documented use in signal intelligence since at least WW2, combined your accuracy increases. And this is on top of all the other known methods of fingerprinting network devices.. Besides, most of the time you only care whether the same device was used, 95% gives you a lot of certainty. Within propper constraints "proven secure" certainly is possible.
      - scarejunba 7y ago
        I actually recycle my entire person after each pen test attempt to prevent people from cottoning on to each body’s unique tics.
      - nickpsecurity 7y ago
        "That's actually the opposite of good practice" Good security practice is considering all devices as insecure until proven otherwise. Also, mitigating known unknowns where a general problem happens a lot. Devices snooping on you, misleading you, interdiction, hacks on firmwate, etc. Then, you mitigate it in situations where you're unsure of what's going on just in case. So, long as mitigation isn't too costly. I used to buy and get rid of WiFi devices and throwaway computers for that reason. Also, buy them in person at random places with cash. You can even turn it into charity by using FDE, wiping them afterwards, and reselling cheap or donating to others that cant afford full price. Put Ubuntu and Firefox on them to spread some other good things.
- dTal 7y ago
  Why would you care about opsec for consensual "penetration testing"?
  - jascii 7y ago
    Your security profile needs to exceed that set for the highest level of clearance you could possibly gain. In practice that means exceeding the highest level of security used in an organisation. You wouldn't want to inadvertently exfiltrate a clients data would you? Aside from that, it is not uncommon for say a department to not be aware they are being pen-tested with consent of their management, and you don't want to trigger counter measures.
    - dTal 7y ago
      I upvoted you because your first sentence is a useful observation, but I'm having a hard time using any of that to justify throwing away a wifi adapter. Even if it were possible to fingerprint the adapter beyond its MAC address, there's no global database of whitehat pentester wifi adapter fingerprints, and such a thing would be worthless anyway. You're not going trigger countermeasures by reusing a wifi adapter. The only threat model that remotely makes sense for that kind of precaution is fear of nation-state level resources trying to identify and catch you. And that's well outside of the realm of "pentesting". (And the idea of accidentally exfiltrating data through a reused wifi adapter is ludicrous)

Sendotsh 7y ago

> Description The best wireless adapter for those who use the penetration platform Kali Linux & BackTrack. The wireless USB adapter has been tested to work with Aircrack-ng and supports packet injection along with monitor mode.

Saus 7y ago

I've bought an Alfa adapter 10+ years ago because you can use them in promiscuous mode. So you can snoop wifi traffic, listen for handshakes and doing so crack WEP/WPA (wifi) encryption. Things probably haven't changed..

mises 7y ago
They have a little. 5ghz is more common, so you won't get any thing there. WPA2 is significantly harder to crack, and I usually do it on GPU with pyrit or hashcat-ocl and a wordlist. WPA3 is out now, too, and I'm there aren't really any well-established procedures for it yet.
- TrueDuality 7y ago
  Just FYI WPA2 is pretty solidly and quickly broken (lookup KRACK attacks). WPA3 is unfortunately already partially broken (though currently joining the network / password breaking aren't fully broken, see Dragonblood attacks).
  - dayofthedaleks 7y ago
    KRACK is patched on most platforms. What weaknesses in WPA2 remain?
  - mises 7y ago
    KRACK was a nonce re-use, not a core protocol flaw. WPA2's flaws are more around un-encrypted control packets; i.e. I can de-auth you without having to get session keys.
jgrowl 7y ago
This was a popular adapter more recently because of the WPS pin exploit using something like the reaver tool.

Noxmiles 7y ago

Someone know a good 2.4/5.0 GHz wifi adapter for these kind of things?

zoobab 7y ago
a good directional antenna makes THE difference.
- arendtio 7y ago
  any recommendations?
aphextim 7y ago
Not sure if it is what you are looking for but this site has various products regarding tapping, sniffing and pen testing. https://www.wallofsheep.com/ https://www.wallofsheep.com/
mises 7y ago
The Alfa AWUS1900 is a nice model, but if you want something cheaper (and will put up with 2.4ghz-only), the TP-Link TL-WN722N is cheap, but get the v1 chipset! It's the best-supported with drivers on linux. Oh yeah, and you will probably need to do monitor mode on linux.