Wi-Jacking: Accessing your neighbour’s WiFi without cracking

guest · Sep 6, 2018

Wi-Jacking: Accessing your neighbour’s WiFi without cracking
Abusing ‘by design’ behaviour to attack millions of WiFi networks.
September 4, 2018
https://www.surecloud.com/sc-blog/wifi-hijacking

UPDATE (5th September 2018). Since we published our original report, Google has now resolved the underlying vulnerability. The latest update of Chrome (tested against version 69.0.3497.81) addresses the issue we highlighted in this blog, where credentials are auto-filled on unencrypted HTTP pages.

It is important to note that the latest version of Opera is still vulnerable as of 2018-09-05 [...]
Click to expand...

During a recent engagement we found an interesting interaction of browser behaviour [...]
The browser behaviour relates to saved credentials. When credentials are saved within a browser, they are tied to a URL and automatically inserted into the same fields when they are seen again. The accepted home router weakness is simply the use of unencrypted HTTP connections to the management interfaces.

By combining these two components it was possible to gain access to various networks without cracking a single handshake, which is the currently most-used method of gaining access to a WPA/WPA2 network but requires a weak passphrase. The attack should work on most networks, but there are a few pre-requisites that need to be met for the attack to succeed: [...]

Without those five pre-requisites, the attack is not possible.
It is also important to note that the attack has been demonstrated against home routers by extracting the WiFi key directly from the web interface. However, other devices can be targeted if they have a semi-predictable URL that is exposed over unencrypted HTTP.
Click to expand...

Mitigations:

As highlighted we are exploiting ‘by design’ features, which will hopefully change with public release of this article. However, in the meantime there are a few key steps that can be taken to help protect yourself:

Only login to your router using a separate browser or incognito session

Clear your browser’s saved passwords and don’t save credentials for unsecure HTTP pages

Delete saved open networks and don’t allow automatic reconnection

As it is nearby impossible to tell if this attack has already happened against your network, change your pre-shared keys and router admin credentials ASAP. Again, use a separate/private browser for the configuration and choose a strong key.

Click to expand...

Log in or Sign up

Wi-Jacking: Accessing your neighbour’s WiFi without cracking

guest Guest

Log in or Sign up

Wi-Jacking: Accessing your neighbour’s WiFi without cracking

guest Guest

Useful Searches