Is looking for Wi-Fi access points purely passive?

http://superuser.com/questions/128166/is-looking-for-wi-fi-access-points-purely-passive/128200

by lelf • 13 years ago

102 46 13 years ago

nmc• 13 years ago

As mentioned in the top answer, not only will the AP know the MAC address of your device, it will also know the SSID you are looking for.

There are exploits allowing an AP to dynamically switch SSID, in order to impersonate the "known AP" you were scanning for. (Looking for a reference...)

EDIT: reference (student paper) -> https://www.os3.nl/_media/2012-2013/courses/ssn/open_wifi_ss...

NKCSS• 13 years ago

Very cool paper, thanks!

jonmrodriguez• 13 years ago

The slang term you want is "wifi pineapple". You can even buy pre-programmed ones online.

https://www.google.com/search?q=wifi+pineapple

vezzy-fnord• 13 years ago

The attack in particular is named KARMA.

noselasd2• 13 years ago

And it's even very easy to exploit. You connected your phone/whatever to an open wifi network once ?

Well, now it'll probably go looking for that network wherever you go, since the device will basically go and broadcast "Where is SSID XYZ ?". Making it easy for anyone to switch the SSID on their AP, turn off authentication , and your phone connects to it - and probably starts pulling updates from your services. Just hope that's done over SSL/HTTPS and that the app validates the certificates.

user243• 13 years ago

Not only that but also, as SSIDs are often unique, it's possible to completely passively track all the locations your device has been. More info in this talk: https://www.youtube.com/watch?v=03iEaKPRb9A

uptown• 13 years ago

So with this technique, would someone be able to change the SSID of their router to match that of another nearby router where devices are likely to be attempting to connect in an effort to intercept the passwords being supplied to establish the connection to the router originally using that SSID?

VMG2• 13 years ago

Why wouldn't the default behavior be to not connect with the AP if the required authentication doesn't match the stored one?

Then the attacker would at least have to try different auth modes until the device connects.

lmm• 13 years ago

If you're trusting the network you've already lost. It's not like the open internet is safe.

If we assume all connections are over SSL/SSH with certificate checking, what can a malicious AP do to you? (Another comment points out your location can be tracked by your device's radio; anything else?)

7952• 13 years ago

It would be interesting to build something to detect an impersonating AP. You could just search for a random non-existent SSID and log when a connection is made.

stygiansonic• 13 years ago

This would be a good honeypot. Randomly generate a 32-character SSID and send out a probe request with that. To have greater confidence, you could randomly generate another SSID and send out another probe request. If both are accepted with a similar signal and noise level, perhaps it is one of these karma APs. (The process could be fine-tuned, generating N number of random SSIDs and specifying the range for signal noise levels)

You could then war drive to amass a location of suspected karma APs.

inoop• 13 years ago

And here's a neat trick: as soon as you detect a device from overhearing its probe request, spam it with CTS messages. As per 802.11 spec, it will have to reply with an RTS as long as its not associated.

You'll be able to track devices if you have multiple APs deployed, or just detect whether someone is within a ~100-meter radius.

dzhiurgis2• 13 years ago

How are shops not doing this yet?

If you are shop owner, you could pretty accurately know where are your customers living.

dictum• 13 years ago

Tangential: http://online.wsj.com/news/articles/SB1000142405270230345300... (HN: https://news.ycombinator.com/item?id=7055115)

guidopallemans• 13 years ago

check this guy's work out: he uses the SSID's of cellphones to route people on mass events:

https://uhdspace.uhasselt.be/dspace/report?type=author&id=24...

VMG2• 13 years ago

Link to pdf: https://uhdspace.uhasselt.be/dspace/bitstream/1942/15450/1/A...

gipsies2• 13 years ago

Ha, I've read that paper before, Mr. Guido Pallemans :)

davedx• 13 years ago

So for a secure WiFi connection that's saved in your phone: if you encounter one of these WiFi pineapples/rogue routers, what does your phone do once the router says "yes, that SSID is me, connect to me if you like!"? Does it try to authenticate to what it thinks is the secured WiFi router? Is this another vulnerability?

icebraining2• 13 years ago

If the WiFi network is WPA-protected, spoofing won't work, since during the 4-Way Handshake the client verifies that the AP knows the passphrase.

http://stackoverflow.com/questions/17935197/authenticating-c...

cupcake-unicorn• 13 years ago

I hadn't thought about this before until something came up about a British ad agency using this to target personalized ads for the MAC ids of devices. I think that got shut down.

But it did get me to thinking about why this isn't exploited more often or that more people don't know about it. I thought of the example of having a home break in, and having my router log all the MAC ids of the devices nearby. Couldn't I effectively pinpoint the subject if I had a novel MAC id being logged at the time of the crime? Even better, log the name of the network it's looking for (or better yet a Wifi Pineapple), and maybe I could even track the guy down myself.

gipsies2• 13 years ago

When you turn your WiFi on, you can be tracked and attacked very easily. This is been known for a while, though not widely enough.

If at one time you connected to an open network, your devices continues to scan for that network. I can spoof that network, you connect to it, and then I intercept all traffic. A full framework has been created for this, complete with the ability to fingerprint your browser/OS and send exploits to your device [1]. Even if you only connect to password protected networks, it's possible (without access to the real AP) to let your clients send parts of the EAPOL handshake, and then perform a bruteforce attack. Weak passwords are cracked, meaning I can again intercept all traffic and possibly exploit your device.

So you only connect to one single network, strong password. Good. I can still track your MAC address. Even with one single device I can estimate the distance and the angle of your signal [2]. Hence I know your location, at all times. So you prevent MAC address tracking by using an identifier-free link layer protocol [3] (this doesn't exist in practice, only researchers made a demo showing its possible). Though a lot better, even with such a system it's possible to track the movement of devices purely based on the fingerprint of the physical WiFi signal [4]. Given sufficient location data it's likely to again (automatically) de-anonimize the dataset and track your movements (it's more complicated, yes, but still possible).

[1] http://www.sensepost.com/blog/7557.html

[2] Avoiding Multipath to Revive Inbuilding WiFi Localization

[3] Improving Wireless Privacy with an Identifier-Free Link Layer Protocol Ben

[4] SecureArray: improving wifi security with fine-grained physical-layer information

icebraining2• 13 years ago

So you prevent MAC address tracking by using an identifier-free link layer protocol [3] (this doesn't exist in practice, only researchers made a demo showing its possible).

Or you could just randomize your MAC occasionally. If you're not even connected to a network (which is the situation we're discussing), just scanning, there's no reason for keeping a static MAC.

zwieback2• 13 years ago

At the driver level it's totally possible to do a purely passive scan that would be nearly impossible to detect, it's just not very practical so most OSes don't even allow you to force your radio to do that.

I think there's s some theoretical possibility that you could "see" the absorption of the RF energy in the antenna of a purely passive device but I think that would be extremely hard unless you're in an RF shielded box.

I'd answer the question "it can be purely passive but it's not usually done that way", which the top SU answer also states.

lcedp• 13 years ago

The technique is widely used for Wi-Fi sniffing. Indeed not all combinations of OSs/cards/drivers are supported.

hershel• 13 years ago

Why is passive mode not practical?

zwieback2• 13 years ago

Because you never know how often the AP will broadcast it's SSID so the passive listener doesn't know how long to listen on any particular channel. In the case where the AP doesn't broadcast the SSID it's even worse, the passive listener relies on other clients actively scanning and the AP responding with its SSID.

Rabidgremlin• 13 years ago

If you want to check this out for yourself try this python/scapy script http://pen-testing.sans.org/blog/2011/10/13/special-request-...

herf• 13 years ago

Just a few years ago, this was different: devices would listen for the SSID broadcast every few seconds. But that's too power-intensive for phones, because they have to leave the wifi radio on for very long amounts of time.

Now instead they now beacon on all the channels in order to connect faster (which gives you the included privacy issues.)

ChuckMcM3• 13 years ago

Personally I think this is an excellent way to turn your WAP into a burglar alarm. Burglars are too stupid to put their phone in Airplane Mode before they break into your house, so your WAP says "Hey unknown phone is in da house!" and calls the cops.

zellyn• 13 years ago

Or next door...

ChuckMcM3• 13 years ago

Perhaps, on my DD-WRT WAP its pretty easy to tell who is in the house and who is next door with their signal strengths.

gallamine• 13 years ago

I was thinking it'd be a fun project to take my laptop with my as a commute to-and-from work and log the Probe Request and MAC address that it sees from cars around me. It would make for interesting data mining to see if I regularly travel with the same cars.

Does anyone know a simple way to log this information via Python?

jasomill2• 13 years ago

No, but you could capture with Wireshark, export pertinent data, and process it with Python.

technimad• 13 years ago

It's active. Interesting article about mapping social graphs at events based on wifi probes: http://conferences.sigcomm.org/imc/2013/papers/imc148-barber...

Is looking for Wi-Fi access points purely passive?

Related Stories