4 ms·
It's not just denial of service. First step is to kick the client off. That's DoS. Next step is spoof the station so when it tries logging back in it grabs the
by temporarely 3y ago
It's not just denial of service. First step is to kick the client off. That's DoS. Next step is spoof the station so when it tries logging back in it grabs the password. I am asking how to mitigate against that, and don't see anything beyond disabling auto logging and password rotation.
- mvkg 3y ago802.1x allows for the client to validate the authentication server by way of X.509 certificates, although this normally does require manual configuration since there is no global namespace to tie an ESSID to like there is for domain names in normal TLS. Mutual asymmetric key auth is available through EAP-TLS as well, but I could see that being a rare feature on cameras.
- adql 3y agoActually, why there is not? Company should be able to just get cert for wifi.company.com and then be allowed to just call its network wifi.company.com...
- ceejayoz 3y agoI replaced my Orbi network with Eeros. Same SSID, same password, but almost nothing in my house (smart devices, phones, computers, Alexa) would use it until I logged in again on each device. I'm not sure how it's done, but something's in place.
- acuozzo 3y agoDid you configure the Eero to spoof the Orbi's BSSID? It's not really "secure" in the academic sense of the word, but many devices record the BSSID along with the SSID to be a little more safe from hijacking. It's trivial to spoof the BSSID if you're an attacker since it's something that's just advertised wirelessly.
- echoangle 3y agoThe access point doesn’t get sent the password, right? Just spoofing the access point does not allow you to get the password of the real network.