3 ms·

> wireless proximity of the Google Home (but does NOT have the victim’s Wi-Fi password) Given this, I don’t fully understand the below: > listening for MAC ad

by yunohn 4y ago

> wireless proximity of the Google Home (but does NOT have the victim’s Wi-Fi password) Given this, I don’t fully understand the below: > listening for MAC addresses with prefixes associated with Google How do you scan MACs without being on the network? Is it like Bluetooth, where everything is constantly broadcasting? > Attacker sends deauth packets to disconnect the device from its network How does one send packets to 192.168.X.Y without being on that network already?

farnulfo 4y ago
« WPA2 provides strong encryption for data frames (as long as you choose a good password). However, “management” frames, like deauthentication frames (which tell clients to disconnect) are not encrypted. 802.11w and WPA3 support encrypted management frames, but the Google Home Mini doesn’t support either of these. »
lights0123 4y ago
> How do you scan MACs without being on the network? Is it like Bluetooth, where everything is constantly broadcasting? It's actually the opposite—WiFi broadcasts MAC addresses in the clear (although likely a random one per-network on modern devices) even with WPA, while BLE can use an Identity Resolving Key when it's not in active discovery mode. This way, a Random Resolvable Private Address can be created that only the paired device can decrypt and find the actual MAC address.
philsnow 4y ago
> How does one send packets to 192.168.X.Y without being on that network already? It's not sending IP packets; the attacker figures out the wi-fi MAC of the client they want to deauth, then spoofs that MAC in 802.11 "deauth" frames sent to the access point. The access point then complies by cleaning up whatever data structures it's using to keep track of the client, and when it receives the next packets from the client, it doesn't know who it's talking to anymore. The attacker doesn't need to authenticate to the wifi network to send these frames. At the most they might need root/admin on their machine because you have to send custom packets and that's generally restricted, but as the original article said, there are custom boards that are designed just for deauthing attacks.

by yunohn 4y ago

farnulfo 4y ago

« WPA2 provides strong encryption for data frames (as long as you choose a good password). However, “management” frames, like deauthentication frames (which tell clients to disconnect) are not encrypted. 802.11w and WPA3 support encrypted management frames, but the Google Home Mini doesn’t support either of these. »

lights0123 4y ago

> How do you scan MACs without being on the network? Is it like Bluetooth, where everything is constantly broadcasting? It's actually the opposite—WiFi broadcasts MAC addresses in the clear (although likely a random one per-network on modern devices) even with WPA, while BLE can use an Identity Resolving Key when it's not in active discovery mode. This way, a Random Resolvable Private Address can be created that only the paired device can decrypt and find the actual MAC address.

philsnow 4y ago

> How does one send packets to 192.168.X.Y without being on that network already? It's not sending IP packets; the attacker figures out the wi-fi MAC of the client they want to deauth, then spoofs that MAC in 802.11 "deauth" frames sent to the access point. The access point then complies by cleaning up whatever data structures it's using to keep track of the client, and when it receives the next packets from the client, it doesn't know who it's talking to anymore. The attacker doesn't need to authenticate to the wifi network to send these frames. At the most they might need root/admin on their machine because you have to send custom packets and that's generally restricted, but as the original article said, there are custom boards that are designed just for deauthing attacks.