The Beginner's Guide to Defending Against Wi-Fi Hacking « Null Byte :: WonderHowTo

Hacking Wi-Fiis a lot easier than most people think, but the ways of doing so are clustered around a few common techniques most hackers use. With a few simple actions, the average user can go a long way toward defending against the five most common methods of Wi-Fi hacking, which include password cracking, social engineering, WPS attacks, remote access, and rogue access points.Our video covers everything you need to know, but you can also read through the article below for more details on each method. And, of course, it's always here if you like following written guides more than video tutorials.Method 1: Password CrackingPassword cracking is a tried-and-true method of breaking into a Wi-Fi network that generally relies on the user picking a bad password. While there are many ways this attack can unfold, in general, there are two ways that a user can be fall victim to this attack.The first is by taking advantage of a target using an insecure type of encryption called WEP to lock their Wi-Fi rather than the more modern WPA that is standard for most networks. Using a WEP key allows even a sophisticated password to be broken in minutes, rendering it not very effective.There are many tools available to hack WEP networks, but simple command-line programs likeBesside-ngare able to locate and crack WEP networks usingKali-compatible wireless network adapters.More Info:Hunting Down & Cracking WEP-Protected Wi-Fi NetworksAircrack-ng 1.2 rc4

    [00:00:02] Tested 14115 keys (got 20198 IVs)

KB  depth   byte(vote)
 0  0/  1   61(30208) 68(26112) DC(26112) E3(24832) 5D(24576) 6E(24576) ED(24320) 08(24064) 43(24064)
 1  1/ 16   4C(26368) BD(26112) 6F(25600) AE(25088) 00(25088) A5(24832) A6(24576) A4(24320) EF(24320)
 2  0/ 36   46(25856) CE(25600) D1(25088) DE(24832) E1(24832) 89(24832) C7(24576) C8(24320) E3(24320)
 3  1/  4   79(26880) 10(25088) 25(25008) 51(24832) 6F(24832) D2(24832) 45(24576) 6C(24576) 70(24576)
 4  1/  8   4F(27648) 64(26368) E4(25600) 5D(25600) 97(25344) FD(25088) 05(25088) AC(24576) 59(24320)

        KEY FOUND! [ 61:4C:46:32:4F ] (ASCII: aLF20 )
    Decrypted correctly: 100%

root@skickar:~# _The second kind of password cracking attacks the more secure WPA method of encryption and involves brute-forcing the password. By kicking devices off the target network for a few seconds, a hacker can force devices to connect back to the network and exchange a sequence of packets called a four-way handshake.This handshake is enough for a hacker to go home and try guessing a huge list of passwords against the captured handshake. Using their computer's processing power, a hacker can try millions of passwords very quickly, allowing them to break bad passwords in minutes or hours. The tools for WPA cracking are increasingly sophisticated and includeAirgeddon, Besside-ng, andAircrack-ng. These tools can be used to capture and crack network passwords from the intercepted handshake.For the end user, this means that you must assume that anyone could grab a four-way handshake from your network. If your password is weak or you use it in other places, that could be serious cause for concern depending on how much time an attacker has to spend brute-forcing it.More Info:How to Automate Wi-Fi Hacking with Besside-ngSolution: Better PasswordsHackers rely on a few common habits to be effective with password cracking.Using stolen passwordswhich have been harvested from real user accounts is a common tactic that preys on the tendency for users to reuse their favorite passwords, increasing the chance that the passwords will be lost by some service you've signed up for. Don't reuse passwords as a rule, because that forces you to trust every service you sign up for to never lose your password.Using password managers likeLastPassandKeePassXcan make it easier to useunique passwords, but you should avoid passwords like phone numbers, addresses, or anything especially obvious. Instead, choose longer passwords that are unique and don't rely on any information or interests you've made public.Instructions:How to Create Stronger Passwords (Advice from a Real Hacker)You can also use tools to detect whether someone has joined your network that doesn't have permission to. By downloading the free, cross-platform Fing application to your smartphone, you can scan and take an inventory of any network you are connected to. If a device is connected that shouldn't be, you have the proof that an unauthorized user is connected and can take steps to kick them out by changing the password or resetting the router.More Info:Map Networks & Connect to Discovered Devices Using Your PhoneImage by SADMIN/Null ByteMethod 2: Social-Engineering AttacksSocial-engineeringattacks can look very different, and this is partially what makes them so hard to spot. Generally, a social-engineering attack will rely on tricking the user rather than using a technical exploit, so a victim may not realize anything has happened.More Info:How to Use Persuasion to Compromise a Human TargetThere are a lot of reasons why you shouldn't give someone your work or home Wi-Fi password, and very few reasons why you should if you don't trust them. It's important to remember a few facts about Wi-Fi:Wi-Fi allows direct communication with devices on your network, like webcams, desktop computers, and other devices that may be wired rather than wireless. Having the Wi-Fi password means you can attempt to log into or attack these devices.Having the Wi-Fi password can allow an attacker to change the information you or others on your network see when you visit webpages or use the internet.Once someone is into your network, they can access the router and build apersistent remote backdoor, preventing you from kicking them out even if you change the password.Passwords are easy to give out, but once someone has access, it's hard to dislodge them.Image by SADMIN/Null ByteKnowing this, a social engineer may attempt to approach someone who knows the Wi-Fi password to gain access. This may be as obvious as a stranger who has no reason for having the Wi-Fi other than simply asking for it or as elaborate as calling the target as the target internet service provider and asking an employee help them fix a problem with the internet.Solution: Always Be SuspiciousWhen recognizing a social-engineering attack, you can generally spot a few things that could tip you off that someone wants access to something they're not supposed to have. If someone presents a story where the solution is to hand over your Wi-Fi credentials, try to present an alternative solution, like "I can look that up for you," and see if they pivot to stay focused on the password.Many networks include the ability to create a guest network that does not allow for communication with other devices on the network, preventing users from logging into the router or trying to brute-force passwords. These systems should also be isolated from anything critical, and guest networks should restrict any users to their own subnets to minimize the risk of a password being shared. It's also recommended to change your Wi-Fi password periodically, at least once every six months or so, and keep track of who has access.Finally, practice the principle of least privilege, meaning only give out your password on a need-to-know basis. If someone has a burning desire to get the Wi-Fi password, ask yourself why, and treat it as seriously as giving out a PIN for a bank account. If you don't have the time to secure your network above and beyond what the average person does, don't risk letting anyone in that you don't trust.Method 3: WPS PIN AttacksWPS setup PIN attacks have been widely used since they were discovered, enabling brute-forcing attacks likeReaverto chew through possible setup PIN guesses and break into any affected router in around seven hours. This is due to poor choices in the way the password is validated, and the attack completely bypasses the password set by the user. Even with the most secure, secret password in the world, a router vulnerable to Reaver can be broken into and completely pwned by anyone in range.The WPS setup PIN typically can't be changed, unlike a password.Image by audioreservoir/FlickrWhile Reaver was scary enough, a new generation of vulnerabilities emerged with the development ofWPS Pixie-Dust. This attack took advantage of flaws in the way many routers set random values and dramatically changed the way that hackers took advantage of WPS setup PINs. With WPS Pixie-Dust, an affected router could be compromised in minutes or seconds, not hours.More Info:Hack WPA & WPA2 Wi-Fi Passwords with a Pixie-Dust AttackOnce an attacker has your WPS setup PIN, they will always be able to dump your router's password, no matter how many times you change it. Since many routers do not let you change the PIN, this means the router is permanently compromised as long as the setting is left enabled. This will often also get them administrative access to the router and represents a huge hole in the security of a network that has otherwise strong security.Solution: Disable WPS & Verify with TestingWhile many routers offer the convenience of WPS setup PINs, most can be disabled to prevent Reaver or Pixie-Dust attacks from succeeding. To do so, you'll need to log into the settings of your router and look for the part of the page that references the "WPS Setup" or "WPS Access" settings. Once there, disable the WPS setup PIN. Once this is done, restart the router and check to see if the setting is still disabled.While this may be enough for some routers, some older models may say they've disabled the WPS setup PIN when in reality they still respond to WPS and Pixie-Dust attacks. If you suspect this may be the case, it would be wise to run a tool like Wash, which will locate every network nearby which has the WPS PIN enabled. If your router appears on this list even after you changed the setting, it's probably time to buy a new router.On Kali Linux, you can run thewashcommand if you have acompatible wireless network adapter. If you do, put it into monitor mode and type the following to display any nearby vulnerable networks.wash -i {monitor-interface}You should see something like the output below. Here, we can see a network called TRENDnet on channel 9 using WPS version 1.0. This means the device either has the setting enabled or it might not be possible to disable the setting on that particular model of router.root@kali:~/reaver-wps-fork-t6x/src# wash -i mon0

Wash v1.5.2 WiFi Protected Setup Scan Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner <cheffner@tacnetsol.com>
mod by t6_x <t6_x@hotmail.com> & DataHead & Soxrok2212 & Wiire & kib0rg

BSSID                Channel   RSSI   WPS Verison   WPS Locked    ESSID
--------------------------------------------------------------------------------------

D8:EB:97:13:BF:D9       9       00        1.0           No       TRENDnetMethod 4: Remote-Access AttacksWhile remote access can be a handy feature, having this feature turned on by default is a terrible idea. The reason this is ill-advised stems from the way devices are discovered and indexed on services likeShodan. This search engine indexes any devices with ports which are directly exposed to the internet, such as IP cameras, routers, and IoT devices. While this should not be enabled by default, many devices come with this setting enabled for convenience and also come set with easy-to-guess default credentials.Image by OccupyTheWeb/Null ByteThe risk of remote access comes from two different sources, external and internal. Once a device has been discovered by Shodan, it's only a matter of time before someone, be it a hacker or a bot, tries to log in. When they do, an external attacker will usually be relying on a list of default passwords for that particular device. Once in, they can pivot to other devices in the network. This is especially bad if the router is exposed because an attacker compromising the router can take over the entire network.Don't Miss:How to Automate Shodan Scans for Vulnerable Devics with PythonThe internal risk of this attack is that someone with temporary access via LAN or the Wi-Fi password can enable remote administration and then simply leave and bide their time. Any time they want to connect to the network remotely, they can simply log in with the credentials they set up to do so. Many times routers will have this feature and make easy to enable, allowing an attacker to take advantage of momentary access to plant a permanent back door.Solution: Disable Remote Access & Port ForwardingThe first step you can take to ensure your devices aren't exposing ports directly to the internet is to log into the administrative portal and look for a tab that mentions "Port Forwarding" rules or settings. This is the section of the router where you can add port forwarding rules, and it may be located under the "Advanced" tab on some devices. When you find the page, you should expect to see no port forwarding rules there, as seen in the image below.Image by Takhion/Null ByteIf, however, your router's port forwarding page already has rules entered, you will want to immediately determine if they were enabled for a legitimate or necessary reason. If not, you should disable these settings immediately. While these rules may allow things like access to webcams from an external network or an app, if you don't recognize them, it's generally not worth the risk.Method 5: Rogue Access PointsA rogue access point is a W-Fi network designed to trick users into connecting. After doing so, it's capable of stealing passwords, controlling your internet experience, and spying on connected devices. Hackers deploying rouge access points don't need an expensive setup, as there are tools like theWi-Fi Pumpkinwhich run on simple, low-cost hardware like theRaspberry Pi.More Info:Build a Pumpkin Pi, a Pocket-Sized Rogue AP & MITM FrameworkA simple setup like this can force a user off their normal network with a series of deauthentication attacks. Once the frustrated user finds they can't use their normal network, a similarly named network with no password is provided to tempt the user.Image by SADMIN/Null ByteAfter connecting, this fake network will often act like the router is installing an update or otherwise restarting, and request a password to reboot. While this might seem suspicious, the average user focusing on their work will simply be wanting to deal with the distraction quickly, often entering their Wi-Fi password without a second thought.Tools likeAirgeddonallow tremendous flexibility for a hacker in creating fake APs, and the "Evil Twin attack" module uses a customizable phishing page to allow hackers to automatically generate phishing pages in different languages. While these attacks are impressive, the reason they work is that they trick a user into connecting to a network other than one they trust.More Info:Stealing Wi-Fi Passwords with an Evil Twin AttackThe way your laptop and phone searches for Wi-Fi can also be enough to take over your connection if you use a lot of free Wi-Fi networks that don't require a password. When your phone or laptop sends probe frames asking if any recently connected to networks are available, attackers can create a fake Wi-Fi network with the same name as the one your device is searching for. If the network didn't have a password, your device will connect seamlessly without warning you.Solution: Spot Signs of a Rogue APWhen you're using Wi-Fi, you should always be aware of what network your computer is connected to. It's easy to test this by turning on the personal hotspot on your phone and naming the network the name of a coffee shop you've used the Wi-Fi of lately and no password. If your computer connects automatically, it's likely that you wouldn't even know if an attacker were to take over your internet connection.The ways that computers store the wireless networks they've joined isn't very smart, and most computers will automatically join any network with the same name of a network they've joined before. The exception to this rule is if the network has different security settings from the one that was visited prior, like suddenly requiring a password.On Windows, you can disable the setting of automatically connecting when in range.You should go into your computer's Wi-Fi settings and delete any networks you no longer wish to connect to. Above, you can see the wireless settings for a network on a Windows system. Below, a macOS system provides the options to prioritize or delete networks previously joined.If you don't want your computer's connection to be taken over by a random network you forgot you connected to weeks ago, make sure to delete these and test to make sure your computer doesn't connect to networks with the same name.Next, it's smart to avoid connecting to unknown networks whenever possible, and instead, use your phone's hotspot or a trusted network. Make sure to use a VPN whenever possible to ensure that even if your connection is intercepted, it won't be as easy as injecting content into webpages to steal your credentials. Even while using aVPN, be suspicious whether it's connecting to a conveniently available "Google Starbucks" Wi-Fi network miles from the nearest coffee shop or just resorting to using a new one when your trusted network doesn't work.Stay Safe Out There!Wi-Fi hacking can take many forms, but by hardening your defenses and ensuring there are no easy routes into your network, you can make it a lot harder for someone wanting to break into your network. There are two parts to staying safe when it comes to Wi-Fi, securing your personal Wi-Fi network, and ensuring you're being careful and skeptical when you're using any network you don't control.In general, VPN services are helpful because they allow you to create an encrypted tunnel of traffic that prevents the owner of the traffic from seeing what you're doing, but this doesn't by any means protect you from the other risks of connecting to unknown networks. Stay safe, and if you need to use Wi-Fi and the only option is a network you don't trust, consider using your phone's hotspot instead.I hope you enjoyed this guide to defending against Wi-Fi hacking! If you have any questions about this tutorial or Wi-Fi hacking guides, feel free to leave a comment or reach me on Twitter@KodyKinzie.Don't Miss:How to Protect Yourself from Facebook Password CrackersFollow Null Byte onTwitter,Flipboard, andYouTubeFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by Kody/Null Byte (unless otherwise noted)RelatedHow to Hack Wi-Fi:Cracking WPA2-PSK Passwords Using Aircrack-NgHow to Hack Wi-Fi:Get Anyone's Wi-Fi Password Without Cracking Using WifiphisherHow To:Automate Wi-Fi Hacking with Wifite2How To:Hack Wi-Fi & Networks More Easily with Lazy ScriptHow To:Hack Wi-Fi Networks with BettercapHow to Hack Wi-Fi:Selecting a Good Wi-Fi Hacking StrategyHow To:Null Byte & Null Space Labs Present: Wi-Fi Hacking, MITM Attacks & the USB Rubber DuckyAndroid Basics:How to Connect to a Wi-Fi NetworkHow To:Hack WPA & WPA2 Wi-Fi Passwords with a Pixie-Dust Attack Using AirgeddonHow to Hack Wi-Fi:Disabling Security Cameras on Any Wireless Network with Aireplay-NgHow To:Your iPhone's Using More Data Than It Needs, but This Could Stop ItHow to Hack Wi-Fi:Cracking WPA2 Passwords Using the New PMKID Hashcat AttackHow To:Having Connection Issues on Android Pie? Turn Off 'Turn on Wi-Fi Automatically'How To:This App Saves Battery Life by Toggling Data Off When You're on Wi-FiHow To:Hack 5 GHz Wi-Fi Networks with an Alfa Wi-Fi AdapterHow To:This Widget Lets You Open Wi-Fi Settings Faster, Share Passwords & More on Your iPhoneHow to Hack Wi-Fi:Cracking WEP Passwords with Aircrack-NgNews:Project Zero Finds iPhone & Android Open to Bugs in Broadcom's Wi-Fi ChipsHow To:Turn on Google Pixel's Wi-Fi Assistant to Get Secure Access on Open NetworksHow to Hack Wi-Fi:Getting Started with the Aircrack-Ng Suite of Wi-Fi Hacking ToolsHow To:Save Battery Power by Pairing Wi-Fi Connections with Cell Tower Signals on Your Galaxy Note 3How to Hack Wi-Fi:Cracking WPA2-PSK Passwords with CowpattyHow To:Share Wi-Fi Adapters Across a Network with Airserv-NgBuyer's Guide:Top 20 Hacker Holiday Gifts for Christmas 2017How To:iOS 6 Broke Your Wi-Fi? Here's How to Fix Connection Problems on Your iPhone or iPadHow To:Build a Beginner Hacking Kit with the Raspberry Pi 3 Model B+How to Hack Wi-Fi:Breaking a WPS PIN to Get the Password with BullyHow To:Easily Store Your iPhone's Wi-Fi Passwords & Share Them with Anybody — Even Android UsersHow to Hack Wi-Fi:Choosing a Wireless Adapter for HackingHow To:Fix the Wi-Fi Roaming Bug on Your Samsung Galaxy S3How To:Easily See Passwords for Wi-Fi Networks You've Connected Your Android Device ToHow to Hack Wi-Fi:Hunting Down & Cracking WEP NetworksHow To:Crack Wi-Fi Passwords—For Beginners!WiFi Prank:Use the iOS Exploit to Keep iPhone Users Off the InternetHow To:Protect Yourself from the KRACK Attacks WPA2 Wi-Fi VulnerabilityHow To:See Who's Using Your Wi-Fi & Boot Them Off with Your AndroidHow To:Recover a Lost WiFi Password from Any DeviceHow To:Hack Anyone's Facebook, Twitter or YouTube Account with Your Android DeviceNews:Maxine Waters Article with VideoNews:Solar Powered Tent!!!