6 ms·

Are my devices really broadcasting the SSIDs they have been connecting to?

zobzu 12y ago
unless you got an iphone/ipad ;)
tcdent 12y ago
You could brute force it by using common network names and seeing which ones get bites. Take it a step further and generate expected patterns ie. "2WIRE123". I'd expect "linksys" alone would grab a surprising amount to start, though.
- lucb1e 12y ago
  > using common network names Exactly, even if it's not broadcasting network names, almost every student in the Netherlands will have the train's WiFi hotspot in their list of networks. One thing I still want to check out is whether the laptop will connect to an open network with the same name as a known network that was password protected.
  - bluerobotcat 12y ago
    On OS X it will not. OS X will also alert you when you try to connect manually.
gamed 12y ago
Yes. They are called probe requests, and can be easily intercepted and viewed. Multiple programs exist to grab these requests off the air and stand up wireless networks with that SSID.[1] [1]http://digi.ninja/jasager/ http://digi.ninja/jasager/
victorvation 12y ago
Yep. Whenever wifi is enabled, your device is sending out probe request frames, which includes your list of preferred networks/networks you've connected to before.
- bdg 12y ago
  Wow... And I was thinking that using my phone to hotspot in cafes was mitigating things like that. Thanks for sharing!
  - A1kmm 12y ago
    To an extent it is; if your phone never connects to any WiFi device (and instead uses GPRS / EDGE / LTE etc... to a mobile carrier), and your laptop only ever connects to your phone, then the probes the attacker will see are for your laptop probing for the SSID of your phone. Given an appropriately vague SSID, this doesn't give the attacker much information (c.f. connecting to access points everywhere and giving away that list of SSIDs). If you use WPA2 PSK and choose a long, random password (you want enough entropy that brute forcing it is impossible - for example, 20 completely random and independent characters taken from a dictionary of 62 characters gives you ~105 bits of entropy, which should be enough, while 8 characters or a few dictionary words might not cut it) impersonating your phone is not feasible if your laptop is configured to only ever connect using the saved pre-shared key.
- RexRollman 12y ago
  What's the point of that? To speed up reconnection?
  - victorvation 12y ago
    Yes, and also so that you can go between two access points for the same network without having to reconnect.
  - keeperofdakeys 12y ago
    It also allows APs to be "hidden", by not broadcasting its own SSID, but relying on devices to send out a probe to ask if it's there. Of course, it's not hidden from packet sniffers if it's talking to someone.
    - xorcist 12y ago
cbsmith 12y ago
Yes, but that shouldn't be of much of a privacy concern. Keep in mind that your devices are also broadcasting a variety of globally unique identifiers everywhere you go.

zobzu 12y ago

unless you got an iphone/ipad ;)

You could brute force it by using common network names and seeing which ones get bites. Take it a step further and generate expected patterns ie. "2WIRE123". I'd expect "linksys" alone would grab a surprising amount to start, though.

lucb1e 12y ago
> using common network names Exactly, even if it's not broadcasting network names, almost every student in the Netherlands will have the train's WiFi hotspot in their list of networks. One thing I still want to check out is whether the laptop will connect to an open network with the same name as a known network that was password protected.
- bluerobotcat 12y ago
  On OS X it will not. OS X will also alert you when you try to connect manually.

gamed 12y ago

Yes. They are called probe requests, and can be easily intercepted and viewed. Multiple programs exist to grab these requests off the air and stand up wireless networks with that SSID.[1] [1]http://digi.ninja/jasager/ http://digi.ninja/jasager/

victorvation 12y ago

Yep. Whenever wifi is enabled, your device is sending out probe request frames, which includes your list of preferred networks/networks you've connected to before.

bdg 12y ago
Wow... And I was thinking that using my phone to hotspot in cafes was mitigating things like that. Thanks for sharing!
- A1kmm 12y ago
  To an extent it is; if your phone never connects to any WiFi device (and instead uses GPRS / EDGE / LTE etc... to a mobile carrier), and your laptop only ever connects to your phone, then the probes the attacker will see are for your laptop probing for the SSID of your phone. Given an appropriately vague SSID, this doesn't give the attacker much information (c.f. connecting to access points everywhere and giving away that list of SSIDs). If you use WPA2 PSK and choose a long, random password (you want enough entropy that brute forcing it is impossible - for example, 20 completely random and independent characters taken from a dictionary of 62 characters gives you ~105 bits of entropy, which should be enough, while 8 characters or a few dictionary words might not cut it) impersonating your phone is not feasible if your laptop is configured to only ever connect using the saved pre-shared key.
RexRollman 12y ago
What's the point of that? To speed up reconnection?
- victorvation 12y ago
  Yes, and also so that you can go between two access points for the same network without having to reconnect.
- keeperofdakeys 12y ago
  It also allows APs to be "hidden", by not broadcasting its own SSID, but relying on devices to send out a probe to ask if it's there. Of course, it's not hidden from packet sniffers if it's talking to someone.
  - xorcist 12y ago

cbsmith 12y ago

Yes, but that shouldn't be of much of a privacy concern. Keep in mind that your devices are also broadcasting a variety of globally unique identifiers everywhere you go.