gdead
@eisg.net
| reply to Sisqo
Defensive Techniques
Howdy,
So I've been involved in the Airsnarf project (I presented with Beetle at BlackHat Federal in DC a few months ago on the project). I've got a few things to say about this tool and the write-up about this.
First off, the type of attack that airsnarf carries out is not rocket science. It is not about breaking encryption but rather about tricking the client. The attack can be fully explained in about 5 minutes to a level that anyone with familiarity with 802.11 can fully understand it.
HOWEVER, not a single OS vendor, security tool provider, or driver vendor alert the user that this kind of attack is being performed. This is completely a layer 2 attack that should be caught by any wireless security tool. At the point of our talk at BH, nothing existed that would tell the user "hey, bad things are afoot... you should stop using this network". Airsnarf is a wakeup call to the vendors.
To that end, we also wrote the hotspot defense kit (HSDK). It's designed to alert the user that there is a layer 2 attack underway. It can be downloaded from the airsnaft page. Currently it only runs on OS X, but we are working on a windows port.
Finally, I am not a 3l337 blackhat hacker.  I coauthored 802.11 Security through O'Reilly. I also try to educate as many people as I can about wireless security through talks, mailing lists, etc.
later |
