sniffwifi

Just another WordPress.com site

Archive for the ‘Android security’ Category

An Android Change for the Better (Maybe)

with one comment

Chatty smartphones have been an issue for years.  Whether you’re concerned with security or performance (or both), the amount of Probing being done by unconnected iPhones, Galaxies and the like has been worrisome.  

Today, things have changed.  Smartphones don’t Probe as much.  This is probably for the better, but there could be a catch.

I’m an Apple guy.  Even when I was using PCs in college (things were different back in the 90’s, I tell ya), it was always because they were free.  Once I finally had to buy a computer, I went straight to the very first iBook in 2001.  I own an iPod, iPad, iPhone and MacBook Air.  My next computing purchase will probably be an iMac (to better record those promised-but-not-yet-delivered online training videos on WiFi that I touted six months ago).  So, I like the company.  And I like bashing its competitors sometimes.  (Not my most magnanimous trait, but nobody’s perfect.)

I liked pointing out that Google’s Android operating system had worst wireless security than Apple’s iOS.  Including:

-Apple requires server certificate validation by default for WPA2 Enterprise authentications (even if it is user-controlled), while Android does not.

-Apple smartphones and tablets Probe only for hidden SSIDs, like so:

(That’s a Probe Request filter in WildPackets OmniPeek.  The SSIDs that you see in those Probe Requests are all hidden SSIDs, with the exception of “Google Starbucks”.  Read on to learn why my local Starbucks’ SSID is showing up in there.)

-Android smartphones and tablets Probe for all saved SSIDs.

At least, they used to.

I was demonstrating the inferiority of Android’s wireless security recently when I learned something new.  They’re not inferior anymore.  Some time recently (or, at least in between the time of my previous Android OS update and my recent update to Android 4.2.2) Google changed Android devices’ wireless behavior to match that of Apple’s.  Android smartphones and tablets started Probing for hidden SSIDs and staying quiet for broadcasting SSIDs, like so:

Of course, I was ambivalent.  GOOD that Android devices’ wireless security has improved!  BAD that I can no longer tout Apple devices’ wireless security superiority in comparison!

So, there you go.  A begrudging admission that Android’s wireless security has been shorn up to match the level of Apple’s.  (In fact, Android’s wireless security is even considered superior in some circles because Android has an option to eliminate user-based verification of server certificates during WPA2 Enterprise authentication.  But we don’t need to discuss that right now.)

But… (and, there’s always a But)

…this may actually be bad for mobility.

Apple iOS and Android devices don’t Probe unless they connect to a hidden SSID.  Nice.  But, let’s take a step back.  Why is Probing in the IEEE 802.11 standard to begin with?

Probing (a process where a client/station device sends a Probe Request frame in order to elicit a Probe Response frame from an access point [AP]) is in the 802.11 standard to facilitate mobility.  Roaming.  Handoff.  Whatever you want to call it when someone moves out of the range of one AP and into the range of another.  Probing also helps devices connect more quickly when starting/waking up and can help devices find an AP in areas that are congested with neighboring WiFi devices and APs.

So, Probing can be a good thing.  Especially for mobile devices in crowded areas.  And now Android devices (like Apple iOS devices) do less of it.

If you say to yourself, “gosh, this iPhone/iPad/Galaxy/HTC One seems to really crap out when I go to a crowded place” (like the Starbucks by my place in Los Angeles), then you might want to ADD Probing to your device.  How?  By tricking your device into thinking that the SSID is hidden.

That’s what I did at my local Starbucks.  My phone sends out these Probe Requests…

…because I manually added the “Google Starbucks” SSID to my phone.  Instead of tapping on “Google Starbucks”, I tapped Settings -> Wi-Fi -> Other… (ellipse in the GUI, not added by me) once I got in line for a Tall Skinny Peppermint Mocha, Hold The Whipped Cream and then typed in “Google Starbucks”.  I don’t know if it helps a whole heck of a lot (Starbucks still uses the darned Captive Portal, which will slow down any wireless connection), but it does optimize a couple of things.
In summary, Android’s move to Apple-like wireless behavior is good for security and overall channel performance.  But if your problems are mobility and speed of connectivity, then you might want to un-do what Android has done by adding your SSID manually.
***
If you like my blog, you can support it by shopping through my Amazon link or donating Bitcoin to 1N8m1o9phSkFXpa9VUrMVHx4LJWfratseU

ben at sniffwifi dot com

Twitter: @Ben_SniffWiFi

Written by sniffwifi

December 19, 2014 at 8:33 pm

Wardriving: Problemo o No Problemo?

leave a comment »

Happy (belated) Cinco de Mayo!  In honor of Mexico (whose El Tri I actually like a heck of a lot less than Les Bleus), today’s discussion of Guerra de Conduccíon has a Spanish language title.  

As noted by noted sarcastor Keith R. “The R Stands for Reassociation” Parsons, in some ways wardriving is a topic whose time has passed.  We’ve known about it for years.  Wardriving tells hackers where your network is.  Most WiFi networks are encrypted.  What else is there?  Hackers can try to connect, but if you use a long WPA2 Personal passphrase, they won’t be able to.  Hackers can try to sniff, but if you’re using WPA2 Enterprise, then decryption of data frames is impossible (as far as us non-NSA employees know).


But imagine you are an NSA employee.  Or the CEO of a noted defense contractor.  Or holder of some other high-profile job where the nation’s prosperity is dependent on your secrecy (like USC’s head football coach).  Then if a hacker knows where you live or work, it could be a problem even if your WiFi is encrypted.  Maybe.

The topic is of interest to the author after a recent discussion with a person who is, in fact, an employee of a noted defense contractor.  The author’s position is that Wardriving could be a problem.  His position is that it isn’t.

Yours truly’s scenario lays out as follows.  Important Person gets on an airplane.  Important Person opens her laptop and dutifully attaches her laptop privacy screen.  After browsing adult videos for an hour (that’s what Important People really do behind those screens, isn’t it?), Important Person does a little bit of work, all the while ensuring that she doesn’t connect to the airline’s potentially-unsecure WiFi.

What Important Person may be unaware of is her laptop is revealing her location.  Check out the capture of probe request frames I got on a recent MCO-LAX (WiFi-enabled) flight:


Highlighted in that Wireshark screenshot is a probe request frame looking for the SSID of “BHNTG862G2332”.  That means that somebody somewhere connected to a WiFi network with that SSID some time prior to fleeing Orlando.

If an enterprising hacker were to take advantage of wardrivers’ data, an enterprising hacker could pin down the location of this Important Person’s home or work.  Check out what Wigle shows when querying the SSID of “BHNTG862G2332”:


Eso mapa (returning to our Mayo de Mejico theme) tells us that somebody on the author’s flight lives pretty darned close to 2450 Euston Road, Winter Park, FL 32789.  

The argument that wardriving doesn’t matter boils down to this: What’s the hacker do now?  The hacker possibly has no idea which person has the probing device.  And even if the hacker does, additional information would be required to make this a National Security issue.

Still, “nadie sufre mas que un hombre pobre o una mujer fea” (I tried to find the Spanish cliché equivalent of “it’s better to be safe than sorry”, with no luck).  If you don’t like the idea that someone can find out where you work or live and you think that wardriving is un problemo, then you can do the following:
  • Disable WiFi when it’s not in use.  (Because no WiFi means no probing.)
  • Broadcast your SSIDs.  (Because most non-Android devices only probe for Hidden SSIDs.  With Android devices you’re unsecure no matter what.)
  • Avoid unique SSIDs.  (If our flyer on his/her way to America’s finest [or second-finest, depending how much you like Milwaukee] city had used a generic SSID like “Radius” at home, then a bunch of wardriving results would’ve popped up on Wigle.  That makes it near impossible for a hacker to narrow down a home or work location.)
Preventing your WiFi devices from revealing your location via wardriving data requires such simple steps.  Home users can just log in to their wireless routers/modems and make sure they have a generic SSID that is broadcasting.  Changes an enterprise’s WiFi configuration to make it tougher for hackers to know where your office is may take some work, but it’s a good idea to at least make that part of the plan the next time the WLAN gets an update.
Of course, all of this is moot if you’re an Android user.  Android smartphones and tablets probe for all saved WiFi networks, whether hidden or broadcasting.  With Android phones, the only way to keep hackers from get information that could reveal the location of su casa is to keep the WiFi turned off when it’s not in use.

Written by sniffwifi

May 23, 2013 at 8:55 pm