3 ms·

Here's an angle for HN to ponder: How could the navy have noticed this? Noticing an SSID is easy enough to work around. What's next? Can one easily scan for ju

Here's an angle for HN to ponder: How could the navy have noticed this? Noticing an SSID is easy enough to work around. What's next? Can one easily scan for just radio activity on wifi bands? What if it was all wired, could the navy notice the unplanned RF signature (note that it's quite directional)? Do military installations scan their RF environment regularly to notice such unwanted things? I'd assume CIA/NSA/embassies do make similar scans, to notice surveillance gadgets.

SV_BubbleTime 2y ago
I would think that there is some radio officer on a ship That would in their normal day-to-day business find errant radio signals.
vueko 2y ago
Yes, it's pretty trivially easy to detect, even without fancy EW equipment. At one point I admin'd a college dorm's network, wifi/wired, and we didn't allow personal APs for interference reasons (you could run your own switch or router as long as it wasn't a WAP). Our run-of-the-mill networking hardware could find signals and triangulate them down to a couple of feet. A couple residents were flummoxed to learn that the "hidden network" thing doesn't actually do anything, which was hopefully at least a useful educational moment. Any decent SDR can notice such things, presumably not to mention actual EW equipment. It's only really with sub-noise-floor gold code type stuff where a signal doesn't jump out on a waterfall spectrum chart, and even then it's generally fairly obvious at close range. I can only speculate as to why that didn't actually happen here.
- rendall 2y ago
  > we didn't allow personal APs for interference reasons For "interference reasons"? Would you mind expanding on that?
  - __d 2y ago
    I imagine the issue was that in earlier WiFi versions, there weren't a lot of channels available. You basically got 2 or 3 (depending on which country you were in) non-interfering channels. The protocols also dealt with congestion less well, I think. On a university campus, let's assume that at least one of those channels is taken by the campus WiFi, possibly more if they have separate networks for staff or whatever. At that point, you start getting a few dozen private networks running in the dorms, and the campus network(s) grind to a halt.
  - Anonbrit 2y ago
    https://wiki.emfcamp.org/2018/wiki/Network/Rogue_Access_Points https://wiki.emfcamp.org/2018/wiki/Network/Rogue_Access_Poin...
GauntletWizard 2y ago
Cisco Wifi Equipment has long had the ability to detect, and even "block", what they define as "Rogue" Wireless Networks. In fact, one of their clients landed in legal trouble for using such[1], and they have since dialed back said features to make it less misusable. I'm surprised that on Navy Ships, they're not using something of the sort, if only of the "Stalker Prevention" variety; Their EWAR systems should be scanning for APs that show up for more than a few consecutive days when not in port. [1] https://docs.fcc.gov/public/attachments/FCC-15-146A1_Rcd.pdf https://docs.fcc.gov/public/attachments/FCC-15-146A1_Rcd.pdf
- lxgr 2y ago
  Wow, every time I think it can't possibly get worse with hotel/conference Wi-Fi... Fortunately PMF, a mandatory part of WPA3 but also available on some WPA2 hardware, should make these types of attacks much harder.
samplatt 2y ago
Boats typically don't scan local RF unless they need to for the simple reason that boats - especially LARGE boats - are absolutely godawful environments for wifi. Metal panels between each deck and most of the walls, instruments and engines and microwave ovens running at all different times every shift generating RF noise... you almost need an extra repeater/access point for EVERY SINGLE ROOM and running on separate channels if you want it to be at all reliable.

SV_BubbleTime 2y ago

I would think that there is some radio officer on a ship That would in their normal day-to-day business find errant radio signals.

vueko 2y ago

Yes, it's pretty trivially easy to detect, even without fancy EW equipment. At one point I admin'd a college dorm's network, wifi/wired, and we didn't allow personal APs for interference reasons (you could run your own switch or router as long as it wasn't a WAP). Our run-of-the-mill networking hardware could find signals and triangulate them down to a couple of feet. A couple residents were flummoxed to learn that the "hidden network" thing doesn't actually do anything, which was hopefully at least a useful educational moment. Any decent SDR can notice such things, presumably not to mention actual EW equipment. It's only really with sub-noise-floor gold code type stuff where a signal doesn't jump out on a waterfall spectrum chart, and even then it's generally fairly obvious at close range. I can only speculate as to why that didn't actually happen here.

rendall 2y ago
> we didn't allow personal APs for interference reasons For "interference reasons"? Would you mind expanding on that?
- __d 2y ago
  I imagine the issue was that in earlier WiFi versions, there weren't a lot of channels available. You basically got 2 or 3 (depending on which country you were in) non-interfering channels. The protocols also dealt with congestion less well, I think. On a university campus, let's assume that at least one of those channels is taken by the campus WiFi, possibly more if they have separate networks for staff or whatever. At that point, you start getting a few dozen private networks running in the dorms, and the campus network(s) grind to a halt.
- Anonbrit 2y ago
  https://wiki.emfcamp.org/2018/wiki/Network/Rogue_Access_Points https://wiki.emfcamp.org/2018/wiki/Network/Rogue_Access_Poin...

GauntletWizard 2y ago

Cisco Wifi Equipment has long had the ability to detect, and even "block", what they define as "Rogue" Wireless Networks. In fact, one of their clients landed in legal trouble for using such[1], and they have since dialed back said features to make it less misusable. I'm surprised that on Navy Ships, they're not using something of the sort, if only of the "Stalker Prevention" variety; Their EWAR systems should be scanning for APs that show up for more than a few consecutive days when not in port. [1] https://docs.fcc.gov/public/attachments/FCC-15-146A1_Rcd.pdf https://docs.fcc.gov/public/attachments/FCC-15-146A1_Rcd.pdf

lxgr 2y ago
Wow, every time I think it can't possibly get worse with hotel/conference Wi-Fi... Fortunately PMF, a mandatory part of WPA3 but also available on some WPA2 hardware, should make these types of attacks much harder.

samplatt 2y ago

Boats typically don't scan local RF unless they need to for the simple reason that boats - especially LARGE boats - are absolutely godawful environments for wifi. Metal panels between each deck and most of the walls, instruments and engines and microwave ovens running at all different times every shift generating RF noise... you almost need an extra repeater/access point for EVERY SINGLE ROOM and running on separate channels if you want it to be at all reliable.