even kismet cant crack this

TheSovereign · 02-22-2003

updated firmware on my roamabout AP 1000
(same as orinoco ap)

well their is now a secure access button
it essently broadcasts a fake ssid as blank
even though my access point has a ssid called "pcroom"
netstumbler, kismet.....all the rest see it as blank ssid
so if u dont know it you cant associate right?
i mean stop me if im wrong but if you dont know the ssid you cant hack it can you

lincomatic · 02-23-2003

nope, that won't protect you against kismet. when you have a card associated w/ the AP, it sends the SSID in every packet. so kismet will see the SSID once someone connects to your AP.

btw, if you want to block the beacons completely, you need to use apple's firmware. more info here:

http://www.personaltelco.net/index.c...rmwareSwapping

Wanderer · 02-23-2003

Wouldn't turning of the beacons completely break 802.11b? I can understand that beacons with a empty SSID are borderline okay, but doesn't everything stop working if you stop sending beacons?

Tell me more...

BTW, the link that you posted goes to some discussion about x-scale... Whatever that is...

TheSovereign · 02-23-2003

no beacons arent required if u hard write the ssid in the client card

linco is right
it doesnt show the bssid in kismet until a client does connect

but at least the scriptkiddies cant get at it

dyddykong · 02-23-2003

Even if beaconing is Turned off, there is a neat way in Linux to send DeAUTH packets, essentially forcing the Client/Server connection to give up the SSID on reauth.

lincomatic · 02-24-2003

Quote:

Originally posted by Wanderer
BTW, the link that you posted goes to some discussion about x-scale... Whatever that is...

oops. i fixed the link above

Dr3D1zzl3 · 02-25-2003

dydd is right, all it takes is some effort and you can "un-cloak" SSID'S that have been cloaked.

jgb1503 · 03-01-2003

I can definatley see where stopping the SSID broadcast is helpful. ANother layer in the security and all that. PLUS the fact that if someone is doing a random driveby, they wouldn't even know that an AP was there (with net/mini-stumbler).

As for blanking out the SSID, that offers no protection at all! I have a Orinoco AP-200 that blanks out the SSID, and I have tested it with netstumbler and ministumbler - If I have the REconfigure ard AUtomatically setting on (obviously this is before I throw on wep or mac address filtering), I'm surfing the web in no time. So a blank ssid with not other protection is no protection at all.

dyddykong · 03-01-2003

To be completely secure, you have to Run IPsec over WLAN, or else it can be cracked with a doable (not Linux supercomputer clusters) effort. WEP takes about 2 days to crack. Mac addresses are easily spoofable, and SSID hiding can be forced out.

TheSovereign · 03-01-2003

Quote:

Originally posted by jgb1503
I can definatley see where stopping the SSID broadcast is helpful. ANother layer in the security and all that. PLUS the fact that if someone is doing a random driveby, they wouldn't even know that an AP was there (with net/mini-stumbler).

As for blanking out the SSID, that offers no protection at all! I have a Orinoco AP-200 that blanks out the SSID, and I have tested it with netstumbler and ministumbler - If I have the REconfigure ard AUtomatically setting on (obviously this is before I throw on wep or mac address filtering), I'm surfing the web in no time. So a blank ssid with not other protection is no protection at all.

just tried it
it doesnt work
u have to have the correct ssid

lincomatic · 03-01-2003

Quote:

Originally posted by TheSovereign
just tried it
it doesnt work
u have to have the correct ssid

i agree. dunno what the guy's talking about. NS can't magically determine the blank SSID. the reconfigure automatically feature just switches the SSID to whatever NS sees.

jgb1503 · 03-02-2003

All i can say is it worked for me.

Running an Orinoco AP-200, and a Orinoco Gold f/w 8.42 (whatever the latest is).

Used the CLOSED SYSTEM setting on the AP, which blocked out the SSID.

Fired up NetStumbler (AND MiniStumbler), both of them found the AP, hit the Reconfigure card automatically, and I'm surfing the net in 5 seconds flat...

Don't know if it makes any different, but I have changed the SSID on my orinoco CLIENT (not the ap) to 'ANY', instead of default.... And no, my ap isn't set to any.. Its set to 'Peek_a_Boo'...

And like i said, it worked for me.. Don't know if it was a fluke or what.. But it worked on my win2k box, with both an Orinoco Gold and a Orinoco A/B ComboCard... Plus on my iPAQ h5455 w/ the Orinoco gold..

jgb1503 · 03-02-2003

I was suprised to, and I am not such a n00b that I was seeing things either.

I tested and re-tested this thing.. I even contacted Orinoco tech support about it, and they said it was possible (but then again, I don't usually put any faith in anyones tech support nowadays.)

I was actually evaluating this AP for work, so I have everything documented, everything that I did.. and i tell ya, i did nothing special. outside of changing my default SSID on the client to 'ANY'....

Possible screwup on this ap?? Dunno... I flashed it to the most current rom (v1.1.1).. Possibility it screwin up... Netstumber (and mini) show the mac address and all other information. just not the SSID.. but again - and I made sure this was a machine that NEVER connected to this AP before, as soon as I hit REconfigure card, i was able to surf the net... so I don't know if it was NetStumbler, or the ANY setting, or what..

When i get into work tomorrow, I am going to run the test again, this time I am going to check to see if I can get to the internet before i click the reconfigure option. Per-chance windows 2k ( and wince) are just autoconfiguring themselves or something.

will let you know in the morning what happened again.

jb

TheSovereign · 03-02-2003

i even tried it on my other labtop it doesnt work

jgb1503 · 03-03-2003

Ok, this is wierd... Both AP's have been off all weekend (and in my truck - freezing)...

By both, i mean I have a D-Link DWL-6000ap (dual band) and the Orinoco AP-200...
1st off, the D-Link is supposed to have a 'shared key' feature which will supposively will not issue a SSID broadcast unless you have the proper wep key. I have never gotten this to work right, I could always see it in net/ministumber. Called there tech support and they verified it wasn't working right, their proble, potentional fix in the next f/w upgrade.

And we all know about the Orinoco AP already from my previous posts.

So, I got into work today, fired both APs up and went into my lab.. Got netstumbler running on a laptop with win2k, using a orinoco a/b combo card. Got a ipaq running ministumbler using an orinoco gold, and I have kismet running on a laptop (redhat 8.0) using another orinoco gold...

Kismet will see both AP's, and references the one that it doesn't have an SSID with it (the orinoco), yet it gives the SSID to the D-Link....

Netstumbler, ONLY sees the .11a side of the D-Link AP - the .11b side and the Orinoco aren't showing up AT ALL..

Ministumbler only sees the Orinoco, and it shows that it has a blank SSID, and THIS time I can't get to the net from it..

What gives??

02-22-2003	#1 (permalink)
TheSovereign Master of the universe Join Date: Jun 2002 Location: chicago Posts: 658	even kismet cant crack this updated firmware on my roamabout AP 1000 (same as orinoco ap) well their is now a secure access button it essently broadcasts a fake ssid as blank even though my access point has a ssid called "pcroom" netstumbler, kismet.....all the rest see it as blank ssid so if u dont know it you cant associate right? i mean stop me if im wrong but if you dont know the ssid you cant hack it can you __________________ SO SAYS TheSovereign

02-23-2003	#2 (permalink)
lincomatic Squaaawk! WiFi! WiFi! Join Date: Apr 2002 Location: Tinsel Town Posts: 1,682	nope, that won't protect you against kismet. when you have a card associated w/ the AP, it sends the SSID in every packet. so kismet will see the SSID once someone connects to your AP. btw, if you want to block the beacons completely, you need to use apple's firmware. more info here: http://www.personaltelco.net/index.c...rmwareSwapping __________________ ~lincomatic Last edited by lincomatic : 02-24-2003 at 09:08 AM.

02-23-2003	#3 (permalink)
Wanderer Registered Member Join Date: May 2002 Posts: 70	Huh... Wouldn't turning of the beacons completely break 802.11b? I can understand that beacons with a empty SSID are borderline okay, but doesn't everything stop working if you stop sending beacons? Tell me more... BTW, the link that you posted goes to some discussion about x-scale... Whatever that is...

02-23-2003	#4 (permalink)
TheSovereign Master of the universe Join Date: Jun 2002 Location: chicago Posts: 658	no beacons arent required if u hard write the ssid in the client card linco is right it doesnt show the bssid in kismet until a client does connect but at least the scriptkiddies cant get at it __________________ SO SAYS TheSovereign

02-23-2003	#5 (permalink)
dyddykong Registered Member Join Date: Aug 2002 Location: Rockland, NY Posts: 12	Even if beaconing is Turned off, there is a neat way in Linux to send DeAUTH packets, essentially forcing the Client/Server connection to give up the SSID on reauth. __________________ Just for Fun, all for fun

02-25-2003	#7 (permalink)
Dr3D1zzl3 Mental Penis Fencer Join Date: Apr 2002 Posts: 371	dydd is right, all it takes is some effort and you can "un-cloak" SSID'S that have been cloaked. __________________ O praeclarum custodem ovium lupum!

03-01-2003	#8 (permalink)
jgb1503 Drunken Stumbler Join Date: Jan 2003 Posts: 179	Blank I can definatley see where stopping the SSID broadcast is helpful. ANother layer in the security and all that. PLUS the fact that if someone is doing a random driveby, they wouldn't even know that an AP was there (with net/mini-stumbler). As for blanking out the SSID, that offers no protection at all! I have a Orinoco AP-200 that blanks out the SSID, and I have tested it with netstumbler and ministumbler - If I have the REconfigure ard AUtomatically setting on (obviously this is before I throw on wep or mac address filtering), I'm surfing the web in no time. So a blank ssid with not other protection is no protection at all. __________________ No trees were harmed in the sending of this message.... Although, quite a few electrons were terribly inconvenienced.

03-01-2003	#9 (permalink)
dyddykong Registered Member Join Date: Aug 2002 Location: Rockland, NY Posts: 12	To be completely secure, you have to Run IPsec over WLAN, or else it can be cracked with a doable (not Linux supercomputer clusters) effort. WEP takes about 2 days to crack. Mac addresses are easily spoofable, and SSID hiding can be forced out. __________________ Just for Fun, all for fun

03-02-2003	#12 (permalink)
jgb1503 Drunken Stumbler Join Date: Jan 2003 Posts: 179	All I know, is what happened when I tested All i can say is it worked for me. Running an Orinoco AP-200, and a Orinoco Gold f/w 8.42 (whatever the latest is). Used the CLOSED SYSTEM setting on the AP, which blocked out the SSID. Fired up NetStumbler (AND MiniStumbler), both of them found the AP, hit the Reconfigure card automatically, and I'm surfing the net in 5 seconds flat... Don't know if it makes any different, but I have changed the SSID on my orinoco CLIENT (not the ap) to 'ANY', instead of default.... And no, my ap isn't set to any.. Its set to 'Peek_a_Boo'... And like i said, it worked for me.. Don't know if it was a fluke or what.. But it worked on my win2k box, with both an Orinoco Gold and a Orinoco A/B ComboCard... Plus on my iPAQ h5455 w/ the Orinoco gold.. __________________ No trees were harmed in the sending of this message.... Although, quite a few electrons were terribly inconvenienced.

03-02-2003	#13 (permalink)
jgb1503 Drunken Stumbler Join Date: Jan 2003 Posts: 179	Suprised I was suprised to, and I am not such a n00b that I was seeing things either. I tested and re-tested this thing.. I even contacted Orinoco tech support about it, and they said it was possible (but then again, I don't usually put any faith in anyones tech support nowadays.) I was actually evaluating this AP for work, so I have everything documented, everything that I did.. and i tell ya, i did nothing special. outside of changing my default SSID on the client to 'ANY'.... Possible screwup on this ap?? Dunno... I flashed it to the most current rom (v1.1.1).. Possibility it screwin up... Netstumber (and mini) show the mac address and all other information. just not the SSID.. but again - and I made sure this was a machine that NEVER connected to this AP before, as soon as I hit REconfigure card, i was able to surf the net... so I don't know if it was NetStumbler, or the ANY setting, or what.. When i get into work tomorrow, I am going to run the test again, this time I am going to check to see if I can get to the internet before i click the reconfigure option. Per-chance windows 2k ( and wince) are just autoconfiguring themselves or something. will let you know in the morning what happened again. jb __________________ No trees were harmed in the sending of this message.... Although, quite a few electrons were terribly inconvenienced.

03-02-2003	#14 (permalink)
TheSovereign Master of the universe Join Date: Jun 2002 Location: chicago Posts: 658	i even tried it on my other labtop it doesnt work __________________ SO SAYS TheSovereign

03-03-2003	#15 (permalink)
jgb1503 Drunken Stumbler Join Date: Jan 2003 Posts: 179	Confusion Ok, this is wierd... Both AP's have been off all weekend (and in my truck - freezing)... By both, i mean I have a D-Link DWL-6000ap (dual band) and the Orinoco AP-200... 1st off, the D-Link is supposed to have a 'shared key' feature which will supposively will not issue a SSID broadcast unless you have the proper wep key. I have never gotten this to work right, I could always see it in net/ministumber. Called there tech support and they verified it wasn't working right, their proble, potentional fix in the next f/w upgrade. And we all know about the Orinoco AP already from my previous posts. So, I got into work today, fired both APs up and went into my lab.. Got netstumbler running on a laptop with win2k, using a orinoco a/b combo card. Got a ipaq running ministumbler using an orinoco gold, and I have kismet running on a laptop (redhat 8.0) using another orinoco gold... Kismet will see both AP's, and references the one that it doesn't have an SSID with it (the orinoco), yet it gives the SSID to the D-Link.... Netstumbler, ONLY sees the .11a side of the D-Link AP - the .11b side and the Orinoco aren't showing up AT ALL.. Ministumbler only sees the Orinoco, and it shows that it has a blank SSID, and THIS time I can't get to the net from it.. What gives?? __________________ No trees were harmed in the sending of this message.... Although, quite a few electrons were terribly inconvenienced.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode