Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WiFi deauthentication attacks and home security

mjg59.dreamwidth.org

Post reply on HN
Print view View original

121–130 of 232 posts

Re: WiFi deauthentication attacks and home security

#121

Post by Someone1234 »

cwingrav wrote: post #94
oefrha wrote: post #46

> The most interesting one here is the deauthentication frame that access points can use to tell clients that they're no longer welcome. These can be sent for a variety of reasons, including resource exhaustion or authentication failure. And, by default, they're entirely unprotected. Anyone can inject such a frame into your network and cause clients to believe they're no longer authorised to use the network, at which…

A man-in-the-middle attack is what can happen here. Deauth and then the device tries to reauth. At that point, the attacker can pose as the router and collect the password hash. The WiFi spec has serious problems.

WiFi doesn't work the way you're claiming. You can use Deauth to be obnoxious/DoS but MITM could be accomplished without Deauth (via higher signal strength + cloned SSID) and WiFi Auth doesn't involve sending a "password hash" over the air that can be "collected."

WiFi is protected via PSK (pre-shared [encryption] key), public cryptography (via CA generated key-pairs), or RADIUS. With RADIUS auth you may be able to harvest the username but the password is used as a PSK which is a shared secret between the client and RADIUS server. This is a two way check (i.e. the client confirms the RADIUS backed WiFi AP has the password too). After they both confirm each other has the password, a different encryption key is used.

There's no WiFi Auth protocol that I know of that involves sending a password over the air (hashed or otherwise).

Re: WiFi deauthentication attacks and home security

#122

Post by [deleted] »

istjohn wrote: post #108
jedimastert wrote: post #104

Earlier quoted context omitted.

> You may not record what happens in public spaces on security cameras In America this could be up for debate. Much of this kind of law depends on a "reasonable expectation of privacy", meaning that if anyone could see you there, it's not an issue to record or take pictures. An apartment hallway actually may or may not count as a public space, depending on whether or not the building is access controlled.

In America, as a rule, anything in public can be filmed.

[deleted]

Re: WiFi deauthentication attacks and home security

#123

Post by berbec »

vorticalbox wrote: post #116
iso947 wrote: post #112

Earlier quoted context omitted.

Define public

Anywhere you don't have reasonable expectation of privacy.

Strange example - in a hotel, with an open window, on the 45th floor. If paparazzi with a telephoto lens can see you, it is considered fair game.

Re: WiFi deauthentication attacks and home security

#124

Post by punnerud »

the8472 wrote: post #115
punnerud wrote: post #28

In Norway/Oslo there is a lot of people with equipment sending deauthentication packages, jamming neighboring equipment, and one of the main reason for slow Internet (lot of jitter). Did some research on this together with The Norwegian Communications Authority (NKOM) to isolate the problem. If you want to check for yourself if someone close by i sending deauthentication packages; fire up a Mac and: 1. Open Wi-Fi-dia…

> by supporting WPA3 and PMF (encrypt management frames). OpenWRT 19.07 adds wpa3 support and the linux kernel supports 802.11w so probably many more APs could be secured.

Supported by almost all Raspberry Pi. Thank you for the comment!

Now I have a good and cheap solution to get it solved for friends/family.

Re: WiFi deauthentication attacks and home security

#125

Post by picselated »

looperhacks wrote: post #106
gmueckl wrote: post #86

I am NOT a laywer, but I checked how much of what the article describes is illegal in Germany. The answer is just about everything. Installing a doorbell with a camera that looks into the hallway is illegal. You may not record what happens in public spaces on security cameras. And even inside your home, you still have to ask for consent to make an audio recording. Otherwise, this constitutes a crime. Also, sniffing W…

You might find it interesting that some German universities [1] actively send out deauthentication packages to clients that connect to SSIDs that are not on their internal whitelist to "protect" the clients from "rogue APs". A lecturer from my Hochschule was fired for protesting this practice. [1]: https://meinehochschulebehindertdaswlan.de/

From a network admin's perspective- this is necessary to protect the integrity of the air space. It discourages the use of rogue AP's which wreck the channel utilization for everyone. It's common to find this feature in enterprise wifi systems. Some actively spoof the SSID of the rogue AP in order to draw the client back to the institution's network.

Re: WiFi deauthentication attacks and home security

#126

Post by amarshall »

Spooky23 wrote: post #117
istjohn wrote: post #108

Earlier quoted context omitted.

In America, as a rule, anything in public can be filmed.

It can be filmed, but audio may not be unless you are a party to the conversation. Doing so is a felony is many places.

This does vary by U.S. state, though. Most are “one-party”, but some are “two-party”.

https://en.wikipedia.org/wiki/Telephone_call_recording_laws#...

Re: WiFi deauthentication attacks and home security

#127

Post by oefrha »

cwingrav wrote: post #94
oefrha wrote: post #46

> The most interesting one here is the deauthentication frame that access points can use to tell clients that they're no longer welcome. These can be sent for a variety of reasons, including resource exhaustion or authentication failure. And, by default, they're entirely unprotected. Anyone can inject such a frame into your network and cause clients to believe they're no longer authorised to use the network, at which…

A man-in-the-middle attack is what can happen here. Deauth and then the device tries to reauth. At that point, the attacker can pose as the router and collect the password hash. The WiFi spec has serious problems.

I’m not asking for an explanation of what the problem is (and your explanation is wrong), I’m asking about why WiFi spec is designed with this very specific, seemingly obvious flaw (anyone can fake deauth to DoS anyone else). I doubt this wasn’t considered during the design process, and I don’t think the rationale is “screw you”, so there’s gotta be a reason.

Edit: According to other comments, it seems that “spoofed” deauth does have legit use cases (other than DoS’ing neighbor’s internet of shit devices).

Re: WiFi deauthentication attacks and home security

#128

Post by Avamander »

picselated wrote: post #125
looperhacks wrote: post #106

Earlier quoted context omitted.

You might find it interesting that some German universities [1] actively send out deauthentication packages to clients that connect to SSIDs that are not on their internal whitelist to "protect" the clients from "rogue APs". A lecturer from my Hochschule was fired for protesting this practice. [1]: https://meinehochschulebehindertdaswlan.de/

From a network admin's perspective- this is necessary to protect the integrity of the air space. It discourages the use of rogue AP's which wreck the channel utilization for everyone. It's common to find this feature in enterprise wifi systems. Some actively spoof the SSID of the rogue AP in order to draw the client back to the institution's network.

Too bad for the admins then that newer standards don't tolerate this fuckery.

Re: WiFi deauthentication attacks and home security

#129

Post by Avamander »

cwingrav wrote: post #72

I need help with something much more nefarious. I know of a location in a downtown area where someone has set up a malicious wifi "thing". I'm guessing the PWNAGOTCHI since the device changes patterns and comes and goes? It has learned how to use deauth to do man-in-the-middle attacks and absolutely closed down wifi in a half block radius by sending RTC packets of 12 second wait times and also waiting for others to s…

Turn on protected management frames on the equipment, should make it at least more difficult to deauth.

Re: WiFi deauthentication attacks and home security

#130

Post by Avamander »

the8472 wrote: post #115
punnerud wrote: post #28

In Norway/Oslo there is a lot of people with equipment sending deauthentication packages, jamming neighboring equipment, and one of the main reason for slow Internet (lot of jitter). Did some research on this together with The Norwegian Communications Authority (NKOM) to isolate the problem. If you want to check for yourself if someone close by i sending deauthentication packages; fire up a Mac and: 1. Open Wi-Fi-dia…

> by supporting WPA3 and PMF (encrypt management frames). OpenWRT 19.07 adds wpa3 support and the linux kernel supports 802.11w so probably many more APs could be secured.

You don't have to have WPA3 to have PMF though. You just have to search more which APs support 802.11w.
Post reply on HN