So I don't know anything about this stuff but looking at the XKCD example it looks really easy to see virtually everything my neighbours are doing on the web. What am I missing? Or is it really this insecure to use wireless?
[deleted]
A Shark on the Network
11–20 of 54 posts
Re: A Shark on the Network
#12So I don't know anything about this stuff but looking at the XKCD example it looks really easy to see virtually everything my neighbours are doing on the web. What am I missing? Or is it really this insecure to use wireless?
Wireless communications are, by their definition, broadcast in every direction. (Let's ignore point-to-point laser links for now, okay?)
If you can hear the signal, you can capture the traffic.
Re: A Shark on the Network
#13So I don't know anything about this stuff but looking at the XKCD example it looks really easy to see virtually everything my neighbours are doing on the web. What am I missing? Or is it really this insecure to use wireless?
>What am I missing?
Encryption. Your neighbours hopefully have protected their wifi with a password. This prevents casual snooping but of course can't really keep out a dedicated attacker. There are automated tools to break WPA encryption.
Additionally, if your neighbours are browsing using SSL/TLS then you theoretically cannot eavesdrop on those sessions.
Re: A Shark on the Network
#14The author seems to be making the assumption that the "target" is an unencrypted network. They provide no information on wireless network security and its effects on the attack and the conditions that need to be met for someone to be able and perform it.
Protected networks require more effort depending on the method used, WEP is utterly broken, WPA/WPA2 can be broken but require considerably more effort and processing power. More concrete methods exists (802.1x) but are almost never used outside enterprise or educational facilities.
Finally, the chances that reversing an ip address will result in a correct hostname is most likely never the case.
The author is either very ill informed on how wireless networks actually work or is trying to make people scared without explaining why these things happen and how they can protect themselves - any of which I really do not like.
Re: A Shark on the Network
#15The author seems to be making the assumption that the "target" is an unencrypted network. They provide no information on wireless network security and its effects on the attack and the conditions that need to be met for someone to be able and perform it. Protected networks require more effort depending on the method used, WEP is utterly broken, WPA/WPA2 can be broken but require considerably more effort and processin…
There are many unencrypted networks around: hotels, cafes, hotspots at airports and train stations, inside trains and planes and even cities start to provide their own wireless networks. And I expect less than 10% of the regular users to use VPNs or to keep track of only using HTTPS (or secure connections on other protocols).
Re: A Shark on the Network
#16I'm always connected to a VPN that I set up on throwaway cloud servers from AWS, digitalocean, or whatever your preference is. Even on my phone.
So all you'd see from me is encrypted stuff being sent to a random IP address.
Re: A Shark on the Network
#17So I don't know anything about this stuff but looking at the XKCD example it looks really easy to see virtually everything my neighbours are doing on the web. What am I missing? Or is it really this insecure to use wireless?
>What am I missing? Encryption. Your neighbours hopefully have protected their wifi with a password. This prevents casual snooping but of course can't really keep out a dedicated attacker. There are automated tools to break WPA encryption. Additionally, if your neighbours are browsing using SSL/TLS then you theoretically cannot eavesdrop on those sessions.
Are you saying if the neighbours use an encrypted connection it makes it impossible to just look at packets and see for which host they are or where they are coming from - i.e. the XKCD example as given doesn't work then anymore?
Re: A Shark on the Network
#18This is pretty standard wireshark stuff; showing data that was on an unencrypted network.
What I've been wondering about for a while now is, can wireshark show data on an encrypted network, assuming it has the key? Can wireshark take a known WEP/WPA2 key and use it to decrypt the packets on an encrypted network on the fly? I haven't found any CLI's or GUI's that have been able to do this out of the box. But surely someone has made this somewhere.
Wireshark is straightforward for revealing data on unencrypted wireless, but I haven't discovered how it could be used to monitor network users when someone has deciphered the key unbeknownst to the users who assume they are operating on an encrypted network such as WEP/WPA2.
Does the nature of the encrypted handshake make this impossible?
Re: A Shark on the Network
#19Earlier quoted context omitted.
>What am I missing? Encryption. Your neighbours hopefully have protected their wifi with a password. This prevents casual snooping but of course can't really keep out a dedicated attacker. There are automated tools to break WPA encryption. Additionally, if your neighbours are browsing using SSL/TLS then you theoretically cannot eavesdrop on those sessions.
Are you saying if the neighbours use an encrypted connection it makes it impossible to just look at packets and see for which host they are or where they are coming from - i.e. the XKCD example as given doesn't work then anymore?
If they use WPA/WPA2 the WiFi signal is encrypted so can't see anything without the key. You can make assumptions about the traffic volume and the involved machines but the data is insivisible.
If you are able to get the key or they use no encryption or WEP you can look at the packets and get metadata for SSL sessions and all unencrypted traffic.
Re: A Shark on the Network
#20I'm always connected to a VPN that I set up on throwaway cloud servers from AWS, digitalocean, or whatever your preference is. Even on my phone. So all you'd see from me is encrypted stuff being sent to a random IP address.
How do you do this?