18 ms·
WiFi deauthentication attacks and home security
- nullc 7y agoOwner of wired cameras that do not store data in the cloud unaffected.
- superkuh 7y agoYep. Wired is always best. You get (almost) the entire electromagnetic spectrum to yourself for each device. There's no reason to share a single spectrum if you don't have to.
- allset_ 7y agoDepending on where you live, your neighbors recording audio may be illegal and you should confront them about it https://www.southerncaliforniadefenseblog.com/2018/04/do-ring-doorbell-cameras-violate-wiretapping-laws-pc-632.html https://www.southerncaliforniadefenseblog.com/2018/04/do-rin...
- kelnos 7y agoThe article you link to suggests that people with these doorbells probably have nothing to worry about ("Unless you are deliberately using a recording for exploitive or commercial purposes, you face little risk of facing charges for violating wiretapping laws through your everyday use of a doorbell camera."); not sure why you're using it as evidence to the contrary.
- joecool1029 7y agoUnlikely. Devices installed for security purposes cannot trigger wiretapping charges since there's no reasonable expectation of privacy in a public place and no intent to record confidential conversations in the first place. Either way, it's not a well written post. I'd shred it here but the comments below it already cover what I would have said.
- mjg59 7y agoIt's not clear that a corridor inside an access controlled building is a public place.
- obituary_latte 7y agoEdit: it seems it is divided and cases have gone both ways in regards to expectation of privacy in apartment buildings: https://illinoislawreview.org/print/vol-2018-no-3/fourth-amendment-protections-in-common-areas-of-apartment-buildings/ https://illinoislawreview.org/print/vol-2018-no-3/fourth-ame...
- mjg59 7y agoDo you have case law citations for that?
- obituary_latte 7y agoIt looks like it is quite divided and could go either way at least wrt apartment buildings: https://illinoislawreview.org/print/vol-2018-no-3/fourth-amendment-protections-in-common-areas-of-apartment-buildings/ https://illinoislawreview.org/print/vol-2018-no-3/fourth-ame...
- mjg59 7y agoWhat experience? Edit: Parent comment edited such that this makes no sense now
- deleted 7y ago[deleted]
- mehhh 7y agoPrivate clubs include many authorized families and people, yet they are not public. Your definition of public space seems very off...
- deith 7y agoNot sure if DoSing a device that's not yours is much more legal.
- Maxious 7y agoMarriott Hotels fined $600,000 by FCC for jamming Wi-Fi hotspots [using deauth packets] https://news.ycombinator.com/item?id=8406022 https://news.ycombinator.com/item?id=8406022
- briandear 7y agoThat article is nonsense. “Wiretapping” is the interception of a signal, generally a telephone signal, to record or listen in on a conversation. A monitoring device, such as a Ring doorbell — those aren’t “wiretaps.” The linked article is nothing but SEO spam designed as lead gen for a law firm. A lawyer certainly didn’t write that.
- Reventlov 7y ago>Finally, none of this is even slightly new. A presentation from Def Con in 2016 covered this, demonstrating that Nest cameras could be blocked in the same way. The industry doesn't seem to have learned from this. Well that's a kind of fundamental flaw of Wifi networks, so you're kinda stuck with this if you use Wifi, nope ?
- Piskvorrr 7y agoSays in the article "unless you use 802.11w" So, fixable; just not supported by everything.
- londons_explore 7y agoEven 802.11w doesn't fix the fundamental problem... WiFi runs in an unlicensed band, and anything else in those bands might disrupt it. There is no service guarantee. You should never rely on it working, especially not for security or safety.
- mjg59 7y agoAnything running over rf is vulnerable to jamming. It's really just a matter of how much disruption an attacker is willing to cause.
- capableweb 7y ago> Anything running over rf is vulnerable to jamming Yeah, and the same sentence can be changed to "Anything running anywhere is vulnerable to something" and it's still true. I guess the valuable lessons are "There is never any service guarantee" and "something will always go wrong" when you want to built something reliable.
- aledalgrande 7y agoI think the title should be changed to something like "how to protect your privacy with Wifi deauthentication". Incidentally, I was considering one of these devices as an addition to my home automation setup, then I realized that it would not be cool to monitor every person getting out of the elevators on my floor.
- Jnr 7y agoI suppose the idea of the article is to resist your neighbours monitoring you as you come home? That is actually a pretty good idea. Also, deauth isn't anything new and you don't have to 'hack' anything in aircrack-ng since all of the tools for this are available out of the box, with nice configuration to select what has to be included and what excluded from deauth.
- mjg59 7y agoIf you want to do this against arbitrary endpoints without knowing the channel they're on you can't just parse airodump-ng output and pass that to aireplay-ng - it takes too long. The hack is just to automate this within the same process.
- javajosh 7y agoWhat if someone were to offer you, oh, $50/mo for that feed?
- zamadatix 7y agoDo you think $50 the going rate to convince the average person to record their neighbors?
- benenglish 7y agoRing just got rang
- FartyMcFarter 7y agoDid I read the article correctly in that it is possible to disrupt WiFi networks to make devices disconnect from it, without breaking its encryption? Wow.
- mjg59 7y agoUnless the devices and AP support 802.11w, yes.
- Maxious 7y agoSo easily that a tamagotchi style game has been made of it and other wifi attacks https://pwnagotchi.ai/ https://pwnagotchi.ai/
- dtornabene 7y agohadn't seen this one yet and just got a zero, thanks for posting this
- Piskvorrr 7y agoTemporarily. Most devices (rescan and) reassociate when this happens. Obviously this is enough to break devices that assume that the link is always up and never retry failed transmissions.
- mjg59 7y agoIf you keep sending disassociate frames, most devices will continue dropping off and spending time reassociating. If you don't have significant quantities of local storage then that's enough to break video streaming.
- walrus01 7y agoEnterprise wifi systems from Cisco, xirrus, ruckus and others implement this feature for rogue access point suppression.
- Jon_Lowtek 7y ago
- punnerud 7y agoIn Norway/Oslo there is a lot of people with equipment sending deauthentication packages, jamming neighboring equipment, and one of the main reason for slow Internet (lot of jitter). Did some research on this together with The Norwegian Communications Authority (NKOM) to isolate the problem. If you want to check for yourself if someone close by i sending deauthentication packages; fire up a Mac and: 1. Open Wi-Fi-diagnostics and change to 'Sniffer' from the Window-tab 2. Dump 30sec-1min of data. The dump is saved to /var/tmp ending with .pcap 3. Open the .pcap file in WireShark and search for wlan[0] == 0x0C For all the different WiFi packages to filter for: https://www.willhackforsushi.com/papers/80211_Pocket_Reference_Guide.pdf https://www.willhackforsushi.com/papers/80211_Pocket_Referen... The router Synology RT2600AC is the only one I have found that guard against deauthentication packages by supporting WPA3 and PMF (encrypt management frames). iOS 13, Mac OS Catalina and Windows 10 support WPA3 so it comes down to your router.
- threatofrain 7y agoWhy might this be a phenomena in Oslo?
- punnerud 7y agoProbably a problem elsewhere also, just not cooperated with someone to check
- joeraut 7y agoWhy are people actually doing this on a wide scale?
- zie1ony 7y agoDoes that mean you can monitor when someone is pushing your neighbors' ring bell?
- oefrha 7y ago> The most interesting one here is the deauthentication frame that access points can use to tell clients that they're no longer welcome. These can be sent for a variety of reasons, including resource exhaustion or authentication failure. And, by default, they're entirely unprotected. Anyone can inject such a frame into your network and cause clients to believe they're no longer authorised to use the network, at which point they'll have to go through a new authentication cycle - and while they're doing that, they're not able to send any other packets. Anyone has background info on why the hell WiFi spec is designed this way?
- nebulous1 7y agoThe wifi alliance has a long history of failing when it comes to security audits and not doing public RFCs
- McTossOut 7y agoNetwork consortium proceedings after the 2000s have become a vehicle for companies to sabotage one another, and practically nothing else. Wifi is being used outside the much narrower scope it was probably designed for initially. Installing a cloud-based security system as your primary source of security constitutes several engineering decisions that were out of scope and it only cost $50 so short-sighted porch thieves targeted would still be plenty deterred by it.
- cwingrav 7y agoA man-in-the-middle attack is what can happen here. Deauth and then the device tries to reauth. At that point, the attacker can pose as the router and collect the password hash. The WiFi spec has serious problems.
- Someone1234 7y agoWiFi doesn't work the way you're claiming. You can use Deauth to be obnoxious/DoS but MITM could be accomplished without Deauth (via higher signal strength + cloned SSID) and WiFi Auth doesn't involve sending a "password hash" over the air that can be "collected." WiFi is protected via PSK (pre-shared [encryption] key), public cryptography (via CA generated key-pairs), or RADIUS. With RADIUS auth you may be able to harvest the username but the password is used as a PSK which is a shared secret between the client and RADIUS server. This is a two way check (i.e. the client confirms the RADIUS backed WiFi AP has the password too). After they both confirm each other has the password, a different encryption key is used. There's no WiFi Auth protocol that I know of that involves sending a password over the air (hashed or otherwise).
- aritmo 7y agoPeople send deauth packets just for fun, as part of social networking. While it is fun for the sender, the those that are affected, are probably very annoyed. https://pwnagotchi.ai/ https://pwnagotchi.ai/
- kozak 7y agoJust beware that in many jurisdictions using that thing on other people's devices is punishable by serious jail terms. Sometimes even possession of such a device.
- l33tman 7y agoSeems widespread; sad state of affairs... wonder how many locations suffer from (mis)configured APs battling each other.. https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-wireless-54/suppress-rogue-ap.htm https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortig... "In addition to monitoring rogue APs, you can actively prevent your users from connecting to them. When suppression is activated against an AP, the FortiGate WiFi controller sends deauthentication messages to the rogue AP’s clients, posing as the rogue AP, and also sends deauthentication messages to the rogue AP, posing as its clients."
- mattkirman 7y agoRogue APs are generally defined as APs that you don't manage but have been connected to your wired network. Obviously this could be a significant security risk. I don't think they're sending deauth messages to every client/AP they see. https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-wireless-54/monitor-rogue-ap.htm https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortig...
- thw0rted 7y agoI would define "rogue" as any AP intentionally using the SSID of my network to trick users into connecting to it instead of my own infrastructure.
- shawnz 7y agoIt looks like it allows you to mark any AP as "rogue" even if they're not detected as "on-wire" despite that not being the purpose of the feature.
- cwingrav 7y agoI need help with something much more nefarious. I know of a location in a downtown area where someone has set up a malicious wifi "thing". I'm guessing the PWNAGOTCHI since the device changes patterns and comes and goes? It has learned how to use deauth to do man-in-the-middle attacks and absolutely closed down wifi in a half block radius by sending RTC packets of 12 second wait times and also waiting for others to send RTC packets and transmitting over them. Businesses close to it have no wifi. As you move away, wifi starts to improve. And no, it's not flooded as there is plenty of open air time not being used by the many devices there. Steps taken: - Have talked to multiple business owners nearby and they can't figure out why their wifi won't work. - Comcast Business is worthless and weeks of calls by business owners and multiple tickets have led to nothing. - Have talked to the mayor of the town and their tech guy agrees something is wrong. - A "smart guy" that works for the government doing security did a quick scan and said it was because one wifi was on a channel between 1 and 6 so the overlap was causing the problem... that wasn't it. - Have approached university researchers to see if their students would be interested in looking at/for it. No response. - Have walked with laptop watching signal strength and know roughly which building it is coming from. From what I understand, there is NOTHING one can do to attack it, other than sending massive RF interference, which would be a crime in itself. How the heck does one get rid of this thing? Any suggestions?
- crazysim 7y agoDid you talk to the FCC? Eg. https://www.fastcompany.com/3050060/company-that-blocked-wi-fi-hotspots-at-conventions-must-pay-750000-fine-to-fcc https://www.fastcompany.com/3050060/company-that-blocked-wi-...
- imglorp 7y agoMy thought also. It might be a hotel or conference or somewhere the host can charge for wifi. That should narrow down the culprits.
- cwingrav 7y agoYes, I told the people about this precedent. And the FCC. Not really my place to get them to call. I think people don't believe a technical glitch is a real world problem. I've tried to tell them that it is definitely impacting their business (restaurants and cafes) and so there is in addition, a monetary impact, just as if someone was causing damage to their business that drove away customers.
- dom96 7y agoIt's surprising how easy it is to perform a deauth attack, you can also gain some information just by scanning the airwaves about the devices connected to a particular router. I created a little tool as a test of this a while back: https://github.com/dom96/deauther https://github.com/dom96/deauther
- stevekemp 7y agoIf you go to /r/esp8266 there are far too many posts from kiddies asking for help with their deauther projects.
- gmueckl 7y agoI am NOT a laywer, but I checked how much of what the article describes is illegal in Germany. The answer is just about everything. Installing a doorbell with a camera that looks into the hallway is illegal. You may not record what happens in public spaces on security cameras. And even inside your home, you still have to ask for consent to make an audio recording. Otherwise, this constitutes a crime. Also, sniffing Wifi for data not aimed at you is illegal. The law is quite broad and covers unencrypted data. Sniffing MACs of devices that don't communicate with your own network falls under that. Sending deauthenticarion packages using those MACs proves the intent to deliberately obtain that data. Thus might even result in a prison sentence. Deliberately interfering with the operation of a Wifi network may also constitute computer sabotage, but the bar for that is higher. EDIT: I also forgot: creating the program that is intended to specifically interfere with the doorbell is also punishable. This is one of the rare cases where the preparation of a crime constitutes a separate crime in itself. The same goes for the distribution of such tools.
- jedimastert 7y ago> You may not record what happens in public spaces on security cameras In America this could be up for debate. Much of this kind of law depends on a "reasonable expectation of privacy", meaning that if anyone could see you there, it's not an issue to record or take pictures. An apartment hallway actually may or may not count as a public space, depending on whether or not the building is access controlled.
- istjohn 7y agoIn America, as a rule, anything in public can be filmed.
- iso947 7y agoDefine public
- vorticalbox 7y ago
- oops 7y agoDoes deauthing it actually stop it from recording and later uploading? Wouldn’t the Ring just buffer and send once it rejoined the network?
- pak9rabid 7y agoI doubt Ring devices have the local storage to do this.
- jacquesm 7y agoThe proper thing to do here would be to call a HOA meeting to decide whether or not devices like these should be allowed in the common spaces. Typically a HOA will have pretty strict rules in the articles and household rules about what you can and can not do in common areas. Another angle is that you may live in a place where two party consent is required for recording, this is not a public space ('the street') nor is it a private area (the dwelling of the owner of the device). Running this software is likely illegal depending on the jurisdiction might be anything from a misdemeanor to a crime.
- bscphil 7y agoI'm not familiar with these devices. Are they not capable of caching a little (15 seconds or so) of recorded video (or much more audio) for sending later when it re-auths with the access point?
- rbritton 7y agoProbably, but it would block the alerting feature they highlight in their ads. That said, I find motion detection alerting to be useless on outdoor-facing cameras due to vegetation, weather, and wildlife. The false positive rate makes it annoying.
- rsync 7y agoI've said it before and I'll say it again: 20+ years ago when I was a Windows sysadmin, you could immediately discern the technological savviness and technological maturity of an individual by looking at their system tray: The number of little icons in their system tray was inversely proportional to their level of this kind of technological maturity. The system tray of 2019 is connected/smart/cloud devices in ones home.
- mikorym 7y ago> The industry doesn't seem to have learned from this. I think industries follow the money. If the end user doesn't absolutely demand security features, then there won't be such features. Typically people who obsess about security build a product that provides security as a product (vs. a camera as a product). The guy who wrote Minix makes this argument (and no, he doesn't dislike Linux Torvalds): There are solutions to security problems, but you need to be interested in them in the first place. The military for example is interested in microkernels because in their case security is critical. Minix I believe is written more for reliability (e.g.: uptime) and (better) security comes as a added benefit.
- 0x0aff374668 7y agoHe doesn't describe an attack, he describe literally what 802.11 was designed to do. An attack is forcing a deauth and then stealing the 4-way handshake data and, say, cracking WEP. Which is why WEP was decommissioned ... checks notes ... 15 years ago. No need to edit aircrack-ng, WireShark does what he did natively (filter out and set channels), and a good realtek chipset allows you to set the scan interval so you can cover more channels (which is why the new ALFAs suck). Also the DTIM and keepalive can be set such that the MCU can sleep while the phy link maintains a connection without a costly handshake, esp. if using TLS <1.3 to talk to the cloud. Reconnecting costs a shit ton of energy so they usually don't disconnect. Hacking Wi-Fi has become exceptionally more difficult, as noted by the slow dating of materials at DefCon's WiFi Village over the past 8 years: cracking WPA2 is basically so hard no one bothers, even in CtF games.
- thw0rted 7y agoDenial of service is also a type of attack.
- instaheat 7y agoDoes anyone here believe there is now a market for securing the masses against the obvious gaping security issues associated with these devices? "Smarter Home Networks" and creating a business around bolstering security on the slew of IoT devices available today.