Wifi/Network Security General

In this thread we discuss attack and defense techniques for computer networks

WiFi is soykaf but so is the IP suite. Being in the same network already makes you vulnerable and these days there had been a recent outbreak of apps using beacons, generating multicast traffic or botent apps communicating through upnp/discovery and similar. Either you use ipset + wpa3 + 802.11w or get pwned by all kinds of soykaff. Other than that, I can say that using a wifi6 or 5.xGHz is better since not a lot of skript kiddie tools supporting these equipment or even script kiddies that afford them. Other than that, CVE-2017-9417. Keep an eye on similar publications.

I’m looking for a good alternative for my normal person soykaf router. I know for a fact that any non script kiddie hacker will take a good shot at compromising my entire network first. That’s what the NSA does at least. Anyhow, are there any alternatives other than a hardened Raspberry Pi? Before you suggest a TOR router; I already have one. I am talking about the main one that you’ll use on the vast majority of your devices. Threat model: Very capable Hacker who is good enough to write his own tools.

>>16446 Chummer, this won't sound nice at all, but if you manage to get a "very capable hacker" on your ass, you should probably rather think about keeping your sensitive data on separate hardware, and riding bare metal on the net. If someone who knows his soykaf really wants to fuarrrk yours, he will find a way. Soo, your best bet is to... Not get targeted. There's techniques for that, but they largely depend on what the potential enemy is after. Good opsec is always helpful. Other than that, keep your ass off public nets, or make sure to not transfer sensitive data over nets you didn't check the guts of.

>>15781 - Solution 1 - Lay a wire for every computer device that does not move. Yes, that TV soykafbox in the farthest corner room needs a wire, mom, yes, a laptop too. Wire is the simplest and cheapest way to get fast, low-latency, low-interference, secure network unless an attacker dares to break in and install a physical wire tap, and that's a higher offense and more obvious than wifi sniffing in any jurisdiction. Snowden says he uses Ethernet even on smartphone, it's not hard given the fact that a USB dongle costs less than $3. Wire also does not broadcast your MAC address and hostname in all directions. Speaking of wire, WEP, a simplest wifi encryption protocol cracked with dime-a-dozen microcontroller thingies at this point, used to stand for "Wire Equivalent Privacy". Heh, kinda gives you some thoughts. - Understand the problem - You have to understand that wifi "security" depends on a highly hardware-specific encryption algorithm that once gets bypassed, is impossible to fix on any of the endpoints. Hardware consolidation also "helps": what you call a "router" is in fact not just a router, but also a LAN switch, an access point, a half-assed file server (aka NAS) with FTP, and also a modem for optical/coaxial/telephone wire, and so on. These devices have a lifespan of 5 years, no more, and later no matter how many software updates you install, it simply won't support new encryption algorithms, and with feature/security patches bloat it becomes even less performant down the road. - Solution 2 - OpenWRT forum recommends to use separate hardware: one decent computer as the router, off-the-shelf Ethernet switch, off-the-shelf proprietary access point, especially if you want decent speeds. You can also try and consolidate into one computer with mini-pcie slot for wireless cards, which once their algorithm gets bypassed, you replace with newer card, but it's recommended to use a separate proprietary access points because apparently for OS distribution that calls itself "wireless freedom" supporting wireless radio hardware reliably is not possible. - Solution 3 - I also was pondering a following idea: to be completely independent of the hardware encryption, use purely software "mesh" tunnels like tinc or cjdns for communicating on local network, but for a middlebox like router to support it at gigabit speeds (to effectively route it for outside world), you have to again, use dedicated computer hardware, not mass-market "router" soykafboxes. This can also be paired with a rented computer in foreign country (VPS) also running tinc or cjdns to avoid spying on ISP level.

While wardriving I once found a wpa2e hidden ssid. I assumed I should avoid whatever is on the other end of it. Do military or high security groups use a higher security form of wifi? Could I upgrade to those 60gHz chipsets to avoid detection and protect myself?

Do routers auto update? If you didn't update your firmware and use the most secure protocols you would be so vulnerable. Imagine some skiddie on a bike running metasploit on his thinkpad in a park with a pringles cantenna messing with your moms router settings. We really traded security for convenience...

>>17733 Your moms probably uses default ISP router/modem. These get instant updates from da base. Skiddie can go suck ass.

>>17733 ACS update CPE through TR-069, but even then ISPs/router companies don't give 2 soykafs and most still have old software on it vulnerable to simple command injection attacks lmao

>>15790 >use wpa3 and 5GHz network WPA3 devices are still being phased in. I don't think I've even seen WPA3 in the wild yet. Soon though, maybe. As for 5GHz, I can actually agree because it's much easier to fuarrrk around on WiFi with 2.4GHz rather than 5 due to hardware limitations. My old laptop only has a 2.4GHz NIC and I'm scared to buy another laptop which might not have the NIC I'm looking for (needs to be dual band, with promi+injection mode) Thanks for posting the CVE, lainon >>17732 I don't know about 60gHz chipsets, but I do know I can pick up a lot of different frequencies with a software defined radio. If your messages are in the clear (unencrypted) then no it isn't safe. Then again, first time I'm hearing about the 60GHz band. >>17733 Depends on which one

I want to share my personal research on the subject. I was interested in 802.11 exploitation ever since I was a wee little skiddie. Anyway, I'm going to come at this from the point of view of someone who wants to fuarrrk with your systems. Purely for science, of course. All my experiments were well documented and controlled. Here are a few things I found: ON THE TOPIC OF HANDSHAKE CAPTURE FOR THE PURPOSE OF BRUTE FORCE: >Handshake capture + brute force is pretty unreliable unless you have a good dictionary and/or they have a weak password. Tools which succeed at capturing handshakes include WiFite, FERN, and airmon-ng. You can honestly just craft your own packets and frames in Python. In order to perform deauth, you need to be able to switch your MAC >Deauth frames are not subtle, and an admin can often trace them back to you through timing, especially if you keep repeating the attempt. Most admin logs are unread, however. It takes an intricate AI and a vigilant admin to detect potential deauths, and even then a strong password will still adequately protect you >You can passively sniff a handshake if you wait for a client to get authenticated >Your device must find at least one client in the airspace nearby, in addition to the router. This information is gathered through the unencrypted header information because WPA2-PSK lacks forward secrecy >handshake capture works on WPA2-PSK and as far as I'm aware it doesn't work on WPA2-Enterprise because of the RADIUS authentication server. More research is required into this topic. >Not everything can be deauthed automatically through skiddie tools. I've tested this with WiFite. Even if it could find a client, sending a deauth frame to it was often not successful. There seem to be ways to defend against deauthentication, which I don't understand enough. Perhaps crafting a custom packet will succeed where an automated tool failed? >Rogue base station still works better, but implementation may change with WPA3, or it could stop working altogether. IDK, I have not researched these very much yet. >WPA3 makes handshake capture harder or impossible depending on whether modp group or elliptic curve encryption is used >WPA3 is apparently vulnerable to dual-stack downgrade, and side channel attacks. These attacks will have a period of obscurity before the skids get scripts to automate it all (such as WiFite) >In conclusion, there are much better ways to get someone's WiFi password ON THE TOPIC OF DOS (DENIAL OF SERVICE) "get off the network, fool": https://www.youtube.com/watch?v=iGXB5NanUK4 >Far easier than handshake capture, but of far less practical use >Can be done from inside or outside a network, but tactics will be different >Many skiddie tools like evillimiter exist >If your device can control its MAC fully (FullMAC, think GNU macchanger) then it's possible to make the packets look like they're all coming from different MACs so it gets much harder for the router to ignore requests through blacklisting >Possible to jam all WiFi near you if you know the frequency you're jamming on >Possible to jam a specific network near you, if you know how to isolate and destructively interfere the traffic on that network only (learn Python) >In conclusion, the only use I have for jamming is to get back at people who bully me. Only to have them turn on LTE data. Pointless, kind of. Please correct me if I'm wrong anywhere.

>>17733 customer premises equipment provided by ISPs do auto update. this includes plain routers, modem routers, wimax routers. they have tr069 and if you happen to have similar device with it such as modems you had purchased yourself, it's probably a good idea to block them (for security purposes) but for isp provided routers you have a dilemma to whether leave it be (for possible security updates and reconfiguration) or you disable them (if you're into security as we all know there had been lots of botnets that abuse ACL-TR069 that auto pwns several routers and lastly devices connected to the router like a windows machine).