4 ms·

"But the best way for hotels to deal with rogue networks is to inform law enforcement agencies and help them apprehend criminals who are trying to steal informa

by ryan-c 12y ago

"But the best way for hotels to deal with rogue networks is to inform law enforcement agencies and help them apprehend criminals who are trying to steal information." That's an absurd point to make. One does not even need to run a rouge access point - much traffic is in the clear, and many MitM attacks can be pulled off just using injection. Even if someone were running a rouge access point, it's pretty difficult to track down an exact location (not very hard to figure out what room it's in though) in a crowd without direction finding gear and special equipment. They would get much more sympathy as far as security goes if they were only asking for the right to block rouge access points that have the same ESSID as their official ones.

juliangregorian 12y ago
Okay, given that the security angle is a subterfuge, but let's say you run a hotel with a network named "RyansExorbitantWifi" and I set up a WAP named "RyanWifi-Free". I think we both know it's gonna generate some interest. Then I can serve them fake versions of Facebook, Google, and their bank's login pages, which is a lot wider of an attack vector than trying to sidejack via packet sniffing.
- ryan-c 12y ago
  Enumerating some possibilities, here are things the hotel can do: * Deauth jam nothing * Deauth jam "evil twin" access points only * Deauth jam above plus access points "similar" to the official wifi (have fun trying to prevent homoglyph attacks) * Deauth jam all unofficial unencrypted access points (preventing an attack from monitoring probe requests and spinning up matching fake APs on the fly) perhaps with a whitelist of "known" nearby wireless networks to leave alone * Deauth jam all unofficial WiFi (what they want to do) There's not really much difference from a security standpoint between those last two, though I suppose someone could set up an encrypted rouge network like "FreeWifi - password is swordfish" and/or make flyers for their evil network. Basically, I could empathize with them arguing to jam any open wireless networks, but jamming encrypted wireless networks in the name of security is a major stretch.

by ryan-c 12y ago

juliangregorian 12y ago

Okay, given that the security angle is a subterfuge, but let's say you run a hotel with a network named "RyansExorbitantWifi" and I set up a WAP named "RyanWifi-Free". I think we both know it's gonna generate some interest. Then I can serve them fake versions of Facebook, Google, and their bank's login pages, which is a lot wider of an attack vector than trying to sidejack via packet sniffing.

ryan-c 12y ago
Enumerating some possibilities, here are things the hotel can do: * Deauth jam nothing * Deauth jam "evil twin" access points only * Deauth jam above plus access points "similar" to the official wifi (have fun trying to prevent homoglyph attacks) * Deauth jam all unofficial unencrypted access points (preventing an attack from monitoring probe requests and spinning up matching fake APs on the fly) perhaps with a whitelist of "known" nearby wireless networks to leave alone * Deauth jam all unofficial WiFi (what they want to do) There's not really much difference from a security standpoint between those last two, though I suppose someone could set up an encrypted rouge network like "FreeWifi - password is swordfish" and/or make flyers for their evil network. Basically, I could empathize with them arguing to jam any open wireless networks, but jamming encrypted wireless networks in the name of security is a major stretch.