WiFi deauthentication attacks and home security • Hacker News Board

Re: WiFi deauthentication attacks and home security

#81

Post by imglorp » Fri, Dec 27, 2019, 12:13 PM UTC

crazysim wrote: post #75

cwingrav wrote: post #72

I need help with something much more nefarious. I know of a location in a downtown area where someone has set up a malicious wifi "thing". I'm guessing the PWNAGOTCHI since the device changes patterns and comes and goes? It has learned how to use deauth to do man-in-the-middle attacks and absolutely closed down wifi in a half block radius by sending RTC packets of 12 second wait times and also waiting for others to s…

Did you talk to the FCC? Eg. https://www.fastcompany.com/3050060/company-that-blocked-wi-...

My thought also. It might be a hotel or conference or somewhere the host can charge for wifi. That should narrow down the culprits.

Re: WiFi deauthentication attacks and home security

#82

Post by [deleted] » Fri, Dec 27, 2019, 12:16 PM UTC

mehrdadn wrote: post #78

cwingrav wrote: post #72

I need help with something much more nefarious. I know of a location in a downtown area where someone has set up a malicious wifi "thing". I'm guessing the PWNAGOTCHI since the device changes patterns and comes and goes? It has learned how to use deauth to do man-in-the-middle attacks and absolutely closed down wifi in a half block radius by sending RTC packets of 12 second wait times and also waiting for others to s…

Confused, it seems you realize this might be a crime, but you've talked to everyone except the most obvious point of contact—law enforcement. Is there a reason that's not an option?

[deleted]

Re: WiFi deauthentication attacks and home security

#83

Post by punnerud » Fri, Dec 27, 2019, 12:16 PM UTC

mehrdadn wrote: post #78

cwingrav wrote: post #72

I need help with something much more nefarious. I know of a location in a downtown area where someone has set up a malicious wifi "thing". I'm guessing the PWNAGOTCHI since the device changes patterns and comes and goes? It has learned how to use deauth to do man-in-the-middle attacks and absolutely closed down wifi in a half block radius by sending RTC packets of 12 second wait times and also waiting for others to s…

Confused, it seems you realize this might be a crime, but you've talked to everyone except the most obvious point of contact—law enforcement. Is there a reason that's not an option?

In Norway I did that but the similarity to FCC could only look at signal strengths and radio spectrum (not data), it was the equivalent to NSA that had the power to look into network traffic.

Re: WiFi deauthentication attacks and home security

#84

Post by dom96 » Fri, Dec 27, 2019, 12:23 PM UTC

It's surprising how easy it is to perform a deauth attack, you can also gain some information just by scanning the airwaves about the devices connected to a particular router.

I created a little tool as a test of this a while back: https://github.com/dom96/deauther

Re: WiFi deauthentication attacks and home security

#85

Post by stevekemp » Fri, Dec 27, 2019, 12:27 PM UTC

If you go to /r/esp8266 there are far too many posts from kiddies asking for help with their deauther projects.

Re: WiFi deauthentication attacks and home security

#86

Post by gmueckl » Fri, Dec 27, 2019, 12:33 PM UTC

I am NOT a laywer, but I checked how much of what the article describes is illegal in Germany. The answer is just about everything.

Installing a doorbell with a camera that looks into the hallway is illegal. You may not record what happens in public spaces on security cameras. And even inside your home, you still have to ask for consent to make an audio recording. Otherwise, this constitutes a crime.

Also, sniffing Wifi for data not aimed at you is illegal. The law is quite broad and covers unencrypted data. Sniffing MACs of devices that don't communicate with your own network falls under that. Sending deauthenticarion packages using those MACs proves the intent to deliberately obtain that data. Thus might even result in a prison sentence. Deliberately interfering with the operation of a Wifi network may also constitute computer sabotage, but the bar for that is higher.

EDIT: I also forgot: creating the program that is intended to specifically interfere with the doorbell is also punishable. This is one of the rare cases where the preparation of a crime constitutes a separate crime in itself. The same goes for the distribution of such tools.

Re: WiFi deauthentication attacks and home security

#87

Post by cwingrav » Fri, Dec 27, 2019, 12:33 PM UTC

crazysim wrote: post #75

cwingrav wrote: post #72

I need help with something much more nefarious. I know of a location in a downtown area where someone has set up a malicious wifi "thing". I'm guessing the PWNAGOTCHI since the device changes patterns and comes and goes? It has learned how to use deauth to do man-in-the-middle attacks and absolutely closed down wifi in a half block radius by sending RTC packets of 12 second wait times and also waiting for others to s…

Did you talk to the FCC? Eg. https://www.fastcompany.com/3050060/company-that-blocked-wi-...

Yes, I told the people about this precedent. And the FCC. Not really my place to get them to call.

I think people don't believe a technical glitch is a real world problem. I've tried to tell them that it is definitely impacting their business (restaurants and cafes) and so there is in addition, a monetary impact, just as if someone was causing damage to their business that drove away customers.

Re: WiFi deauthentication attacks and home security

#88

Post by cwingrav » Fri, Dec 27, 2019, 12:36 PM UTC

mehrdadn wrote: post #78

cwingrav wrote: post #72

I need help with something much more nefarious. I know of a location in a downtown area where someone has set up a malicious wifi "thing". I'm guessing the PWNAGOTCHI since the device changes patterns and comes and goes? It has learned how to use deauth to do man-in-the-middle attacks and absolutely closed down wifi in a half block radius by sending RTC packets of 12 second wait times and also waiting for others to s…

Confused, it seems you realize this might be a crime, but you've talked to everyone except the most obvious point of contact—law enforcement. Is there a reason that's not an option?

Agreed. But evidence? I've tried to convince the businesses to talk to the police. But, what they heck do the police/businesses do? How do you prove that there is a crime? They probably would believe me and would probably knock on doors and probably get a warrent. Then what? I'm not a professional cyber security person so how do I prove that device if found is causing damage?

Also, the device is intermittent. I can collect traces, but who do I send them to?

Re: WiFi deauthentication attacks and home security

#89

Post by punnerud » Fri, Dec 27, 2019, 12:44 PM UTC

mehrdadn wrote: post #79

punnerud wrote: post #28

In Norway/Oslo there is a lot of people with equipment sending deauthentication packages, jamming neighboring equipment, and one of the main reason for slow Internet (lot of jitter). Did some research on this together with The Norwegian Communications Authority (NKOM) to isolate the problem. If you want to check for yourself if someone close by i sending deauthentication packages; fire up a Mac and: 1. Open Wi-Fi-dia…

Would you have any recommendation for those of us without a Mac?

Boot Kali Linux with USB/CB or use VM (that support mapping USB): https://www.kali.org

Use a WiFi Dongle that support Monitor mode, as described here: https://www.aircrack-ng.org/doku.php?id=faq#what_is_the_best...

Re: WiFi deauthentication attacks and home security

#90

Post by cwingrav » Fri, Dec 27, 2019, 12:44 PM UTC

punnerud wrote: post #76

cwingrav wrote: post #72

I need help with something much more nefarious. I know of a location in a downtown area where someone has set up a malicious wifi "thing". I'm guessing the PWNAGOTCHI since the device changes patterns and comes and goes? It has learned how to use deauth to do man-in-the-middle attacks and absolutely closed down wifi in a half block radius by sending RTC packets of 12 second wait times and also waiting for others to s…

Use the guide I posted here to locate the device responsible using the signal-strength in Wireshark (search for NKOM). Could be you can break the device by flooding it with fake SSID, using AirPlay-ng. A bit more technical but should be possible with every Mac or most WIFi dongles that support monitor-mode (could be illegal).

I did follow it and found roughly where it is. But, have not talked to that landlord. It is a 3 story building with a handful of apartments in an old stone and brick building locked at the ground floor (i.e. refection is a problem but I imagine signal strength outside the door would be a good indicator once inside).

Not sure about breaking the device by flooding with SSIDs? Sorry, not my area here. From what I know, it isn't on any network (it does appear to have a network with an SSID though), but it is attacking up and down all nearby devices regardless of channel or SSID.