4 ms·

I'm sure that more creative versions exist, but a very common way is the WiFi deauth attack. The advantage is that it works on the protocol level, so you don't

by ArnoVW 3y ago

I'm sure that more creative versions exist, but a very common way is the WiFi deauth attack. The advantage is that it works on the protocol level, so you don't have to nuke the entire spectrum for the entire neighbourhood (which would attract attention) https://en.wikipedia.org/wiki/Wi-Fi_deauthentication_attack https://en.wikipedia.org/wiki/Wi-Fi_deauthentication_attack

temporarely 3y ago
wtf. Were these protocols designed to be insecure? Reading that page, how can you mitigate against it?
- dvdkon 3y ago
  It's hard and generally unnecessary to protect wireless protocols against DoS, since jamming almost always works. Military transceivers do try, but as I understand it it's well beyond just designing the protocol carefully.
  - temporarely 3y ago
    It's not just denial of service. First step is to kick the client off. That's DoS. Next step is spoof the station so when it tries logging back in it grabs the password. I am asking how to mitigate against that, and don't see anything beyond disabling auto logging and password rotation.
    - mvkg 3y ago
      802.1x allows for the client to validate the authentication server by way of X.509 certificates, although this normally does require manual configuration since there is no global namespace to tie an ESSID to like there is for domain names in normal TLS. Mutual asymmetric key auth is available through EAP-TLS as well, but I could see that being a rare feature on cameras.
      - adql 3y ago
        Actually, why there is not? Company should be able to just get cert for wifi.company.com and then be allowed to just call its network wifi.company.com...
    - ceejayoz 3y ago
      I replaced my Orbi network with Eeros. Same SSID, same password, but almost nothing in my house (smart devices, phones, computers, Alexa) would use it until I logged in again on each device. I'm not sure how it's done, but something's in place.
      - acuozzo 3y ago
        Did you configure the Eero to spoof the Orbi's BSSID? It's not really "secure" in the academic sense of the word, but many devices record the BSSID along with the SSID to be a little more safe from hijacking. It's trivial to spoof the BSSID if you're an attacker since it's something that's just advertised wirelessly.
    - echoangle 3y ago
      The access point doesn’t get sent the password, right? Just spoofing the access point does not allow you to get the password of the real network.
- walterbell 3y ago
  > Were these protocols designed to be insecure? Why do phones/laptops continually broadcast a list of all SSIDs they have ever connected?
  - temporarely 3y ago
    Fears of peasant uprisings is the only that comes to mind ..
  - ChainOfFools 3y ago
    How would this work for scenarios where people take advantage of the free network hotspot connectivity provided by some Wi-Fi and cellular providers? anyone who travels throughout even a moderately dense coverage area would swiftly accumulate a history of hundreds if not thousands of briefly-connected ssids? It seems like constantly broadcasting this data would result in fairly noticeable performance degradation.
    - walterbell 3y ago
      What's an example of such a provider? Shouldn't the provider use a stable SSID?
      - ChainOfFools 3y ago
        AT&T smart wifi is a recent example, it manages discovery of different system partner ssids through an app. But even if the SSID was exactly the same, the bssid would be different in every case, and that's the unique (mod spoofing) station identifier.
  - jazzyjackson 3y ago
    in case this is surprising to anyone: https://blog.spacehuhn.com/probe-request https://blog.spacehuhn.com/probe-request https://www.theatlantic.com/technology/archive/2016/08/wi-fi-surveillance/497132/ https://www.theatlantic.com/technology/archive/2016/08/wi-fi... I'll see your conspiratorial bent and raise you: why is iPXE enabled by default?
- mvkg 3y ago
  802.11w
  - temporarely 3y ago
    Thanks. Did see that on the wiki page. I'm shocked it is not the baseline spec!
- jazzyjackson 3y ago
  lol for real maybe a form of planned obsolescence to sell routers with WPA3 support intelligence agencies plugging agents into standards bodies is also not unheard of

by ArnoVW 3y ago

temporarely 3y ago

wtf. Were these protocols designed to be insecure? Reading that page, how can you mitigate against it?

dvdkon 3y ago
It's hard and generally unnecessary to protect wireless protocols against DoS, since jamming almost always works. Military transceivers do try, but as I understand it it's well beyond just designing the protocol carefully.
- temporarely 3y ago
  It's not just denial of service. First step is to kick the client off. That's DoS. Next step is spoof the station so when it tries logging back in it grabs the password. I am asking how to mitigate against that, and don't see anything beyond disabling auto logging and password rotation.
  - mvkg 3y ago
    802.1x allows for the client to validate the authentication server by way of X.509 certificates, although this normally does require manual configuration since there is no global namespace to tie an ESSID to like there is for domain names in normal TLS. Mutual asymmetric key auth is available through EAP-TLS as well, but I could see that being a rare feature on cameras.
    - adql 3y ago
      Actually, why there is not? Company should be able to just get cert for wifi.company.com and then be allowed to just call its network wifi.company.com...
  - ceejayoz 3y ago
    I replaced my Orbi network with Eeros. Same SSID, same password, but almost nothing in my house (smart devices, phones, computers, Alexa) would use it until I logged in again on each device. I'm not sure how it's done, but something's in place.
    - acuozzo 3y ago
      Did you configure the Eero to spoof the Orbi's BSSID? It's not really "secure" in the academic sense of the word, but many devices record the BSSID along with the SSID to be a little more safe from hijacking. It's trivial to spoof the BSSID if you're an attacker since it's something that's just advertised wirelessly.
  - echoangle 3y ago
    The access point doesn’t get sent the password, right? Just spoofing the access point does not allow you to get the password of the real network.
walterbell 3y ago
> Were these protocols designed to be insecure? Why do phones/laptops continually broadcast a list of all SSIDs they have ever connected?
- temporarely 3y ago
  Fears of peasant uprisings is the only that comes to mind ..
- ChainOfFools 3y ago
  How would this work for scenarios where people take advantage of the free network hotspot connectivity provided by some Wi-Fi and cellular providers? anyone who travels throughout even a moderately dense coverage area would swiftly accumulate a history of hundreds if not thousands of briefly-connected ssids? It seems like constantly broadcasting this data would result in fairly noticeable performance degradation.
  - walterbell 3y ago
    What's an example of such a provider? Shouldn't the provider use a stable SSID?
    - ChainOfFools 3y ago
      AT&T smart wifi is a recent example, it manages discovery of different system partner ssids through an app. But even if the SSID was exactly the same, the bssid would be different in every case, and that's the unique (mod spoofing) station identifier.
- jazzyjackson 3y ago
  in case this is surprising to anyone: https://blog.spacehuhn.com/probe-request https://blog.spacehuhn.com/probe-request https://www.theatlantic.com/technology/archive/2016/08/wi-fi-surveillance/497132/ https://www.theatlantic.com/technology/archive/2016/08/wi-fi... I'll see your conspiratorial bent and raise you: why is iPXE enabled by default?
mvkg 3y ago
802.11w
- temporarely 3y ago
  Thanks. Did see that on the wiki page. I'm shocked it is not the baseline spec!
jazzyjackson 3y ago
lol for real maybe a form of planned obsolescence to sell routers with WPA3 support intelligence agencies plugging agents into standards bodies is also not unheard of