4 ms·

I do agree with you that 802.11 security is lacking, but it's not always as straight forward as you make it out to be. It's early and I may be forgetting somet

by vlan0 12y ago

I do agree with you that 802.11 security is lacking, but it's not always as straight forward as you make it out to be. It's early and I may be forgetting something....but assuming their home network isn't an open network, how would you get a client to authenticate to your rogue network? Even though the client would think it was the same network, authentication should fail because the client would attempt to use the stored credentials, and you almost certainly wouldn't know their passkey. Thus, causing the client to receive a message indicating an issue with authentication. Are you inferring that you would brutal force the WPA2 passkey for their network with something like cowpatty? Are dictionary attacks really that easy to pull off these day? Mind you, it's been almost ten years since I've played around with WiFi cracking.

post_break 12y ago
It's so much easier than you think. Your laptop sends out a probe asking if "home" ssid is there. My laptop says "yep, I'm home!" and it connects. As easy as that. It doesn't matter if your home network was WPA2 or PEAP, it connects you and you're good to go. Usually in a place like starbucks the open wifi is open so I can just pretend to be that network and force everyone to connect to me instead.
- vlan0 12y ago
  Are you sure about that? I just checked my wireless controller to verify my thought process, and each time I switched wireless profiles (all of which are saved on my device) the 802.1x auth(EAPOL) process is used. I'm a little rusty on my wireless security, but wouldn't this same process occur for the rogue network? Like you said though, if you sit in an area with existing open wireless, none of that will come into play.
  - post_break 12y ago
    Almost positive, I tested it on my machines and my friends laptops while in college. I remember it working because I could see the SSID that their machine connected to, which at the time was LEAP or PEAP authentication and they were able to browse the web without fail. Their machines were macs if that makes any difference.
- dfinninger 12y ago
  So... my home network's SSID needs to be set to "home" for that to work? You are just spoofing an SSID? That's not so bad. Usually when TWC, ATT, etc, give you a router/modem it is set to some random string. A lot of people don't change that (lived in 7 apartments in 5 years), so you'd only grab the people that literally set their SSID to "home" then. Or am I missing something here?
  - davmre 12y ago
    If your laptop is used to connecting to "home01284", it will send out a probe "hey home01284, are you out there?". Anyone nearby who gets this packet can respond, "yes, I'm home01284, connect to me!" They don't have to know a priori what SSID you were looking for, because your machine specifically advertises it.
    - d23 12y ago
      And then if the user had any password on their router at all, it would fail.

by vlan0 12y ago

post_break 12y ago

It's so much easier than you think. Your laptop sends out a probe asking if "home" ssid is there. My laptop says "yep, I'm home!" and it connects. As easy as that. It doesn't matter if your home network was WPA2 or PEAP, it connects you and you're good to go. Usually in a place like starbucks the open wifi is open so I can just pretend to be that network and force everyone to connect to me instead.

vlan0 12y ago
Are you sure about that? I just checked my wireless controller to verify my thought process, and each time I switched wireless profiles (all of which are saved on my device) the 802.1x auth(EAPOL) process is used. I'm a little rusty on my wireless security, but wouldn't this same process occur for the rogue network? Like you said though, if you sit in an area with existing open wireless, none of that will come into play.
- post_break 12y ago
  Almost positive, I tested it on my machines and my friends laptops while in college. I remember it working because I could see the SSID that their machine connected to, which at the time was LEAP or PEAP authentication and they were able to browse the web without fail. Their machines were macs if that makes any difference.
dfinninger 12y ago
So... my home network's SSID needs to be set to "home" for that to work? You are just spoofing an SSID? That's not so bad. Usually when TWC, ATT, etc, give you a router/modem it is set to some random string. A lot of people don't change that (lived in 7 apartments in 5 years), so you'd only grab the people that literally set their SSID to "home" then. Or am I missing something here?
- davmre 12y ago
  If your laptop is used to connecting to "home01284", it will send out a probe "hey home01284, are you out there?". Anyone nearby who gets this packet can respond, "yes, I'm home01284, connect to me!" They don't have to know a priori what SSID you were looking for, because your machine specifically advertises it.
  - d23 12y ago
    And then if the user had any password on their router at all, it would fail.