WiFi exploit via duplicated SSID

I read a discussion on this potential exploit on another forum.
Unfortunately, that discussion descended into silliness (lame jokes).

So here it is: I am running a wireless network. Some rogue finds my SSID
and uses the same SSID himself, on his WiFi server.. One of my WiFi
clients (a notebook computer, say) connects to the rogue network instead
of my own network, because the SSIDs are identical. The rogue WiFi server
can now observe all my data.

Is this possible? I use WPA2 with pre-shared key. Can the rogue WiFi
server read my WPA2 password, along with all my network traffic?
--
David Arnstein (00)
arnstein+(E-Mail Removed) {{ }}
^^

(E-Mail Removed) (David Arnstein) hath wroth:

>I read a discussion on this potential exploit on another forum.
>Unfortunately, that discussion descended into silliness (lame jokes).

That's ok as long as they didn't borrow some of my lame jokes.

>So here it is: I am running a wireless network. Some rogue finds my SSID
>and uses the same SSID himself, on his WiFi server.. One of my WiFi
>clients (a notebook computer, say) connects to the rogue network instead
>of my own network, because the SSIDs are identical. The rogue WiFi server
>can now observe all my data.
>
>Is this possible? I use WPA2 with pre-shared key. Can the rogue WiFi
>server read my WPA2 password, along with all my network traffic?

That's NOT possible unless the evil hacker also has the WPA2 key.
There's no way he can "join" your networks without it. Even if he
simulates your access point in order to sniff key exchanges and
authentication attempts, these are hashed and encrypted, making
decryption unlikely.


--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558

In <(E-Mail Removed)> Jeff Liebermann <(E-Mail Removed)> writes:

>That's NOT possible unless the evil hacker also has the WPA2 key.
>There's no way he can "join" your networks without it. Even if he
>simulates your access point in order to sniff key exchanges and
>authentication attempts, these are hashed and encrypted, making
>decryption unlikely.

but the related question: If he sets up
a base station with the same SSID as
the legit folk, and some of the laptops
connect to it, can't he then sniff out
any unencrypted traffic?

thanks

--
__________________________________________________ ___
Knowledge may be power, but communications is the key
(E-Mail Removed)
[to foil spammers, my address has been double rot-13 encoded]

danny burstein <(E-Mail Removed)> hath wroth:

>In <(E-Mail Removed)> Jeff Liebermann <(E-Mail Removed)> writes:
>
>>That's NOT possible unless the evil hacker also has the WPA2 key.
>>There's no way he can "join" your networks without it. Even if he
>>simulates your access point in order to sniff key exchanges and
>>authentication attempts, these are hashed and encrypted, making
>>decryption unlikely.
>
>but the related question: If he sets up
>a base station with the same SSID as
>the legit folk, and some of the laptops
>connect to it, can't he then sniff out
>any unencrypted traffic?

Yes, unfortunately. The laptop can also be attacked directly.
Susceptibility to duplicated SSID exploits (rogue AP) varies with the
client manager.

Note: I'm not 100.0% sure of the following. I'll need to retest to
be sure.

Let's pretend that the user has setup their laptop to connect to their
own system SSID using WPA2 encryption. You would expect Windoze
Wireless Zero Config to remember this "profile" and always connect
using WPA2. Nope. If for some reason, the rouge access point has a
better signal, Windoze will try to connect to the rogue access point
(with the same SSID) first. It will then decide that the encryption
method has changed and offer a warning that you're connecting to an
unsecured access point. Most users will see the message, click "OK",
and connect merrily to the rouge access point. Windoze Wireless Zero
Config will then change the saved "profile" to be unencrypted on the
assumption that the owner has changed their method of encryption. If
they want to connect again to the real access point, they get to
tediously key in the WPA key (twice) from scratch. If you
mysteriously find yourself keying in the WPA key from scratch for no
obvious reason, it's because there's probably another access point out
there with no encryption and a duplicated SSID.

If there are duplicated SSID's, there's also no indication as to which
access point is being used, as Windoze WZC does not display the MAC
address. Once connected to the rouge access point, the user checks
their email and unless it's encrypted or encapsulated in a VPN tunnel,
it's all sniffable. If they're running open shares or no firewall,
they can be attacked directly. It's happened to a customer that went
to a hotel and connected to the wrong AP.

At least that's the way I remember it working when I last tried it
about a year ago. I'll try it again when I have a chance.

In the meantime, find a connection manager that will display the MAC
address clearly, and offer separate connections for each different MAC
address even if the SSID is the same. So far, I've found the
following that will do this:
<http://wifihopper.com>
and possibly the Buffalo Client Manager 3 (not sure yet):
<http://www.buffalotech.com/technology/our-technology/client-manager-3/>
Incidentally, this CM3 claims to be able to support non-Buffalo
products which should be very useful.

There are probably others, but I haven't bothered to do any testing.

If your client manager or connection manager will show a list of
available networks, with one line for each access point even if they
have the same SSID, you can then distinguish between access point. If
it does that, it can also so the same in separate profiles.

--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558

In <(E-Mail Removed)> Jeff Liebermann <(E-Mail Removed)> writes:

>In the meantime, find a connection manager that will display the MAC
>address clearly, and offer separate connections for each different MAC
>address even if the SSID is the same. So far, I've found the
>following that will do this:
><http://wifihopper.com>
>and possibly the Buffalo Client Manager 3 (not sure yet):
><http://www.buffalotech.com/technology/our-technology/client-manager-3/>
>Incidentally, this CM3 claims to be able to support non-Buffalo
>products which should be very useful.

With Mac OS 9 there were some programs
which gave you detailed info about
the base stations in your "view", and
let you manually choose between the
five different ones that said "Linksys"
as their SSID.

I've yet to find one for OS X. (I've found
"istumbler" which shows the info but doesn't
offer the clickthrough).

Anyone know of one? Thanks.

--
__________________________________________________ ___
Knowledge may be power, but communications is the key
(E-Mail Removed)
[to foil spammers, my address has been double rot-13 encoded]

danny burstein <(E-Mail Removed)> wrote:

> With Mac OS 9 there were some programs
> which gave you detailed info about
> the base stations in your "view", and
> let you manually choose between the
> five different ones that said "Linksys"
> as their SSID.
>
> I've yet to find one for OS X. (I've found
> "istumbler" which shows the info but doesn't
> offer the clickthrough).

"Join" is the first button in iStumbler's default toolbar and the first
command in its "AirPort" menu. The keyboard shotcut is Command + Shift +
J.

"Jeff Liebermann" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> danny burstein <(E-Mail Removed)> hath wroth:
>
>>In <(E-Mail Removed)> Jeff Liebermann
>><(E-Mail Removed)> writes:
>>
>>>That's NOT possible unless the evil hacker also has the WPA2 key.
>>>There's no way he can "join" your networks without it. Even if he
>>>simulates your access point in order to sniff key exchanges and
>>>authentication attempts, these are hashed and encrypted, making
>>>decryption unlikely.
>>
>>but the related question: If he sets up
>>a base station with the same SSID as
>>the legit folk, and some of the laptops
>>connect to it, can't he then sniff out
>>any unencrypted traffic?
>
> Yes, unfortunately. The laptop can also be attacked directly.
> Susceptibility to duplicated SSID exploits (rogue AP) varies with the
> client manager.
>
> Note: I'm not 100.0% sure of the following. I'll need to retest to
> be sure.
>
> Let's pretend that the user has setup their laptop to connect to their
> own system SSID using WPA2 encryption. You would expect Windoze
> Wireless Zero Config to remember this "profile" and always connect
> using WPA2. Nope. If for some reason, the rouge access point has a
> better signal, Windoze will try to connect to the rogue access point
> (with the same SSID) first. It will then decide that the encryption
> method has changed and offer a warning that you're connecting to an
> unsecured access point. Most users will see the message, click "OK",
> and connect merrily to the rouge access point. Windoze Wireless Zero
> Config will then change the saved "profile" to be unencrypted on the
> assumption that the owner has changed their method of encryption. If
> they want to connect again to the real access point, they get to
> tediously key in the WPA key (twice) from scratch. If you
> mysteriously find yourself keying in the WPA key from scratch for no
> obvious reason, it's because there's probably another access point out
> there with no encryption and a duplicated SSID.
>
> If there are duplicated SSID's, there's also no indication as to which
> access point is being used, as Windoze WZC does not display the MAC
> address. Once connected to the rouge access point, the user checks
> their email and unless it's encrypted or encapsulated in a VPN tunnel,
> it's all sniffable. If they're running open shares or no firewall,
> they can be attacked directly. It's happened to a customer that went
> to a hotel and connected to the wrong AP.
>
> At least that's the way I remember it working when I last tried it
> about a year ago. I'll try it again when I have a chance.
>
> In the meantime, find a connection manager that will display the MAC
> address clearly, and offer separate connections for each different MAC
> address even if the SSID is the same. So far, I've found the
> following that will do this:
> <http://wifihopper.com>
> and possibly the Buffalo Client Manager 3 (not sure yet):
> <http://www.buffalotech.com/technology/our-technology/client-manager-3/>
> Incidentally, this CM3 claims to be able to support non-Buffalo
> products which should be very useful.
>
> There are probably others, but I haven't bothered to do any testing.
>
> If your client manager or connection manager will show a list of
> available networks, with one line for each access point even if they
> have the same SSID, you can then distinguish between access point. If
> it does that, it can also so the same in separate profiles.
>

Wow, I can't believe that WZC is that stupid.. (Actually I can.)

Why do people continue to use that crap and not just use the client that
came with their hardware?

I just temporarily disabled WPA2 on my WLAN SSID to see if DLink's client
would connect to it with the profile still set to use WPA2. It wouldn't...

In <1i2utz3.cobhmq5vm4qtN%(E-Mail Removed)> (E-Mail Removed) (Neill Massello) writes:

>danny burstein <(E-Mail Removed)> wrote:

>> With Mac OS 9 there were some programs
>> which gave you detailed info about
>> the base stations in your "view", and
>> let you manually choose between the
>> five different ones that said "Linksys"
>> as their SSID.
>>
>> I've yet to find one for OS X. (I've found
>> "istumbler" which shows the info but doesn't
>> offer the clickthrough).

>"Join" is the first button in iStumbler's default toolbar and the first
>command in its "AirPort" menu. The keyboard shotcut is Command + Shift +
>J.

Please excuse the loud sound as I thwack my forehead.

"Duh".

Thanks.


--
__________________________________________________ ___
Knowledge may be power, but communications is the key
(E-Mail Removed)
[to foil spammers, my address has been double rot-13 encoded]

Hi!

> There are probably others, but I haven't bothered to do any testing.

Put Intel's PROSet/Wireless (v 10.5.2.0, although I seem to remember
previous versions offering this as well) on your list. It's not right on the
front page, but if you click on an available Wireless Access Point that
shows up in the list of detected networks, you can then click the
"Properties" button to see the AP's MAC address.

William

On Aug 15, 7:12 am, danny burstein <dan...@panix.com> wrote:
> In <0ic4c35fntfsoa16t8lmcngl2g2t69v...@4ax.com> Jeff Liebermann <je...@cruzio.com> writes:
>
> >That's NOT possible unless the evil hacker also has the WPA2 key.
> >There's no way he can "join" your networks without it. Even if he
> >simulates your access point in order to sniff key exchanges and
> >authentication attempts, these are hashed and encrypted, making
> >decryption unlikely.
>
> but the related question: If he sets up
> a base station with the same SSID as
> the legit folk, and some of the laptops
> connect to it, can't he then sniff out
> any unencrypted traffic?
>
> thanks
>
If the WPA2 is using something like public key encryption method, it
is still impossible for attacker's to obtain the wpa2 passphase using
the key swapped in the air traffic, to understand this, please read:

http://en.wikipedia.org/wiki/Diffie-Hellman