Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Shark on the Network

blog.nodenexus.com

Post reply on HN
Print view View original

21–30 of 54 posts

Re: A Shark on the Network

#21

Post by stinos »

nisa wrote: post #19
stinos wrote: post #17

Earlier quoted context omitted.

Are you saying if the neighbours use an encrypted connection it makes it impossible to just look at packets and see for which host they are or where they are coming from - i.e. the XKCD example as given doesn't work then anymore?

If they use WPA/WPA2 the WiFi signal is encrypted so can't see anything without the key. You can make assumptions about the traffic volume and the involved machines but the data is insivisible. If you are able to get the key or they use no encryption or WEP you can look at the packets and get metadata for SSL sessions and all unencrypted traffic.

the data is insivisible

And that includes source/destination IP? Didn't know that..

Re: A Shark on the Network

#22

Post by mschuster91 »

What bothers me is that neither the author nor anyone here metioned that HTTPS does leak metadata in the form of the SNI extension which provides the server with the requested host before the cert exchange.

Re: A Shark on the Network

#23

Post by Couto »

lelandbatey wrote: post #20
leeber wrote: post #16

I'm always connected to a VPN that I set up on throwaway cloud servers from AWS, digitalocean, or whatever your preference is. Even on my phone. So all you'd see from me is encrypted stuff being sent to a random IP address.

How do you do this?

https://github.com/jlund/streisand is a nice and quick way to achieve this.

Re: A Shark on the Network

#25

Post by anon4 »

leeber wrote: post #16

I'm always connected to a VPN that I set up on throwaway cloud servers from AWS, digitalocean, or whatever your preference is. Even on my phone. So all you'd see from me is encrypted stuff being sent to a random IP address.

Well, if your traffic is mainly facebook domains, then you're chatting with friends. If you're visiting wikileaks and freedom.press you're an armchair freedom-fighter. And if all your traffic goes to random AWS IPs packed in encrypted VPN frames, then you're most definitely a terrorist.

Re: A Shark on the Network

#26

Post by cranklin »

"A Shark on the Network" is more appropriate than "How to listen in on wireless network traffic" for this particular post. If it's a "how to listen in...", I would expect the article to introduce better passive attacks (in monitor mode) and raw packet injection attacks that don't require you to be associated to a particular access point, and finally the different wifi chipsets that allow you to perform these types of attacks.

Re: A Shark on the Network

#27

Post by geoah »

justquest wrote: post #18

This is pretty standard wireshark stuff; showing data that was on an unencrypted network. What I've been wondering about for a while now is, can wireshark show data on an encrypted network, assuming it has the key? Can wireshark take a known WEP/WPA2 key and use it to decrypt the packets on an encrypted network on the fly? I haven't found any CLI's or GUI's that have been able to do this out of the box. But surely so…

You can decrypt keys in wireshark once you have the key, you can also provide a key to wireshark to decrypt streams on the fly using said key.

http://wiki.wireshark.org/HowToDecrypt802.11

Re: A Shark on the Network

#28

Post by furyg3 »

I feel like there is a major opening for access point makers to simplify 802.1x rollout for all networks. Now it requires a whole bunch of steps only IT admins can do (RADIUS server, etc).

Maybe your new Dlink router comes with an 'app' which generates unique logins (with optional expiration times) that you can give out to users. There's a whole market of coffeeshop/restaurant wifi providers but they usually use no/shared encryption and a captive portal for managing authentication. That's great for dispensing logins and handling expirations, but is horrible for your user's security and user experience.

Re: A Shark on the Network

#29

Post by KaiserPro »

geoah wrote: post #14

The author seems to be making the assumption that the "target" is an unencrypted network. They provide no information on wireless network security and its effects on the attack and the conditions that need to be met for someone to be able and perform it. Protected networks require more effort depending on the method used, WEP is utterly broken, WPA/WPA2 can be broken but require considerably more effort and processin…

Encryption of wireless isn't really a barrier, it can be easily broken. As its very rare to not have a shared key, once you've joined the "encrypted" network you can see all the traffic flowing through it.

WEP stands for wireless equivalent privacy, and it is. its trivial to break. (just like monitoring wired connections)

Re: A Shark on the Network

#30

Post by mbrownnyc »

anon4 wrote: post #25
leeber wrote: post #16

I'm always connected to a VPN that I set up on throwaway cloud servers from AWS, digitalocean, or whatever your preference is. Even on my phone. So all you'd see from me is encrypted stuff being sent to a random IP address.

Well, if your traffic is mainly facebook domains, then you're chatting with friends. If you're visiting wikileaks and freedom.press you're an armchair freedom-fighter. And if all your traffic goes to random AWS IPs packed in encrypted VPN frames, then you're most definitely a terrorist.

I think the use of a VPN solves last mile security.
Post reply on HN