7 ms·
In Norway/Oslo there is a lot of people with equipment sending deauthentication packages, jamming neighboring equipment, and one of the main reason for slow Int
by punnerud 7y ago
In Norway/Oslo there is a lot of people with equipment sending deauthentication packages, jamming neighboring equipment, and one of the main reason for slow Internet (lot of jitter). Did some research on this together with The Norwegian Communications Authority (NKOM) to isolate the problem.
If you want to check for yourself if someone close by i sending deauthentication packages; fire up a Mac and:
1. Open Wi-Fi-diagnostics and change to 'Sniffer' from the Window-tab
2. Dump 30sec-1min of data. The dump is saved to /var/tmp ending with .pcap
3. Open the .pcap file in WireShark and search for wlan[0] == 0x0C
For all the different WiFi packages to filter for:
https://www.willhackforsushi.com/papers/80211_Pocket_Reference_Guide.pdf https://www.willhackforsushi.com/papers/80211_Pocket_Referen...
The router Synology RT2600AC is the only one I have found that guard against deauthentication packages by supporting WPA3 and PMF (encrypt management frames).
iOS 13, Mac OS Catalina and Windows 10 support WPA3 so it comes down to your router.
- threatofrain 7y agoWhy might this be a phenomena in Oslo?
- punnerud 7y agoProbably a problem elsewhere also, just not cooperated with someone to check
- joeraut 7y agoWhy are people actually doing this on a wide scale?
- Ziomislaw 7y agothey want privacy?
- Nextgrid 7y agoI can't see how screwing up the internet for everyone else improves your own privacy.
- the8472 7y ago> screwing up the internet for everyone else Unless you're on ethernet, then you suffer none of wifi's many downsides.
- Nextgrid 7y agoI don't get the point of this post - are you saying deauth attacks are fine and everyone should just abandon Wi-Fi?
- the8472 7y agoI am saying not everyone is affected, only those who solely rely on wifi. Others have realized that a shared medium with questionable security is inherently unreliable and have other options at their disposal.
- deith 7y agoLet me guess, you can also build a better dropbox with curlftpfs
- blackflame 7y agoEthernet is a shared medium as well if you want to talk to other devices on your network. So instead of deauth they do ARP poisoning.
- the8472 7y agoNot in the same way that wifi is, where anyone outside the building can attack it. And even if your ethernet is under attack you have the advantage of being able to physically locate ports.
- punnerud 7y agoI think most people don’t know that their equipment is doing this. A lot of WiFi Routers set to auto channel will select some other channel than the one with a lot of deauthentication packages, because the traffic is not stabil on this channel. In this way you get a better Internet connection if your equipment is sending these packages out. As a manufacture you know that you only need a couple of these “bad” devices before you damage the traffic for everyone, forcing everyone to upgrade all their equipment. It also benefit the Internet providers, because faster network will camouflage the problem a bit.
- tripzilch 7y agoCan you name any routers (brands) that do this?
- joeraut 7y agoThis is fascinating that some manufacturers may have gone down this Darwinian path in "improving" their products. Is there any such law against this or any efforts in introducing such laws, either in Norway or elsewhere?
- gumby 7y agoThe WiFi frequencies are unlicensed in afaik every jurisdiction (note that the precise frequencies aren’t de jure the same in every country) so it’s legal to send whatever packets you like within certain power constraints.
- gumby 7y agoI just want to comment that this is who HN is great. I posted what turned out to be a misunderstanding (or incomplete if you are more generous) understanding of spectrum rules. My comment was correctly downvoted to 0, but more importantly I got a response that simply explained where I was (utterly) wrong. No flames, no further conjecture, just references. There's a little bit of following discussion. This is the way it's supposed to work!!
- AngryData 7y agoI can think of 2 potential reasons but neither seems satisfying. The first would be state agencies testing attack vectors in real life. Would suck to send out an agent who commits their crime 100% flawlessly only for them to get caught by some unsecured doorbell or other random internet device. The second would be attempts to force increases in security through intentional hacks and sabotage. Although if someone can think of better reasons I would love to hear it.
- swinglock 7y agoMaybe an unethical Wi-Fi manufacturer thought they were clever to deauth clients of APs with MACs not in their own range, to clear other traffic off the band they use and have their products perform better than others by means of sabotage.
- blackflame 7y agoThat surely would be noticed in any sort of rigorous certification program.
- dylan604 7y agoWhat 'rigorous certification program'? Aren't the only regulations that they comply with FCC rules about creating/accepting interference, frequency ranges, and transmission power? These regulations do not have any say on what is actually transmitted on those frequencies.
- blackflame 7y agoThe IEEE 802.11 certification https://www.wi-fi.org/discover-wi-fi/wi-fi-certified-6 https://www.wi-fi.org/discover-wi-fi/wi-fi-certified-6
- _jal 7y agoYou mean the kind not used by any vendor on Alibaba?
- 7y ago
- cpach 7y agoThat’s really interesting. Did you ever publish a report on this? If you feel like it, please post a link. (Norwegian is fine.)
- punnerud 7y agoNo report, been thinking about it. Would then drive around with 4 devices collecting data on different channels simultaneously. With GPS and signal-strength you can calculate how often this is. Been walking around in my neighborhood with a GPS-logger and a simpler setup (WiFi hopping to gather data). Found 4 houses where these signals come from in a 300m radius.
- mehrdadn 7y agoWould you have any recommendation for those of us without a Mac?
- punnerud 7y agoBoot Kali Linux with USB/CB or use VM (that support mapping USB): https://www.kali.org https://www.kali.org Use a WiFi Dongle that support Monitor mode, as described here: https://www.aircrack-ng.org/doku.php?id=faq#what_is_the_best_wireless_card_to_buy https://www.aircrack-ng.org/doku.php?id=faq#what_is_the_best...
- mehrdadn 7y agoAh shoot, I was hoping to not have to buy something. But okay thanks! Edit: Seems my card might actually support monitor mode, I'll probably give it a shot.
- JensRex 7y agohttps://www.kismetwireless.net/ https://www.kismetwireless.net/
- big_chungus 7y agoI'd suggest blackarch and archstrike. Archstrike is sometimes a little more up-to-date, but blackarch has more packages; you can use both if you want to, but be warned you may hit dependency version conflicts. You can run aircrack-ng suite (specifically aireplay-ng tool) to deauth after that. Linux is a better choice anyway because many monitor mode drivers work only on linux.
- the8472 7y ago> by supporting WPA3 and PMF (encrypt management frames). OpenWRT 19.07 adds wpa3 support and the linux kernel supports 802.11w so probably many more APs could be secured.
- punnerud 7y agoSupported by almost all Raspberry Pi. Thank you for the comment! Now I have a good and cheap solution to get it solved for friends/family.
- Avamander 7y agoYou don't have to have WPA3 to have PMF though. You just have to search more which APs support 802.11w.
- thw0rted 7y agoJust to clarify: the attack depends on reading (unencrypted) management packets going from the AP to the device, and if PMF is enabled on the AP, it will only send encrypted management packets so the attack is not possible. Is that it?
- kevinoid 7y ago> OpenWRT 19.07 adds wpa3 support Neat! Note that it is not enabled by default and requires installing the -openssl or -wolfssl variant of the hostapd, wpa_supplicant, or wpad package[1] and may require recreating the wireless config file.[2] 1. https://openwrt.org/releases/19.07/notes-19.07.0-rc2#wpa3_support https://openwrt.org/releases/19.07/notes-19.07.0-rc2#wpa3_su... 2. https://forum.openwrt.org/t/wpa3-support-in-openwrt/10554/68 https://forum.openwrt.org/t/wpa3-support-in-openwrt/10554/68
- Thriptic 7y agoAsus Merlin also supports PMF
- mikorym 7y ago> a lot of people with equipment sending deauthentication packages Why do they do that?