(Silent illusion) Fake Gateway serious weakness in WLAN

ii Guys

One Day I asked My self simple question :

all the traffic in wlan are send to specific MAC (Gateway Mac) <<<wireless router

So simply to direct all wlan traffic to my pc I have to be The gateway

you know that there is only 1 gateway mac in the wlan & if you try to change your mac to be identical to the gateway mac <<<< you can't associate or even connect to the wlan

Finally I get it :

using any virtual machine software like (virtualbox) & with any router based software like (mikrotik router software)

I can make a fake duplicate gateway in my wlan

result:

all the wlan clients associate to my fake gateway

http://i.imagehost.org/0577/1_71.jpg


simply I redirect all wlan traffic to my pc , with aid of (mikrotik router software) which installed on virtual machine I can respond to any authentiction type the clients request

so I got all authentication session privs.

using wireshark as sniffer I captured wep based protocol traffic & simply crack the wep in less than 1 min

So I called this attack " silent illusion" which reffer to "silent" undetectable attack and "illusion" fake gateway

foregive me for my bad english <<<<<<<< I'm from Iraq

what you think about that attck???

Very hard to read this post I don't know if you're asking or telling us. Anyways...

Quote:

---

Originally Posted by PaRaN0!D

So I called this attack " silent illusion" which reffer to "silent" undetectable attack and "illusion" fake gateway

foregive me for my bad english <<<<<<<< I'm from Iraq

what you think about that attck???

---

Other people call this mitm or rogueAP. Hard to tell which one you think you're doing exactly.

What's with all the plugs for that router software btw? It should hardly matter which router you're using so why mention it?

Hi,
congratulation about your findings,
to me it sound like a man in the middle attack, but it is a fair try.

A nice sort of re inventing the wheel ? :D

Regards

Quote:

---

Originally Posted by hhmatt

Very hard to read this post I don't know if you're asking or telling us. Anyways...



Other people call this mitm or rogueAP. Hard to tell which one you think you're doing exactly.

What's with all the plugs for that router software btw? It should hardly matter which router you're using so why mention it?

---

Sorry for bad expression

My point from this post is to see what you think of this attack is't effective may be we can develope it?

first off all you know that MITM is difficult with new router software technologies .

Rouge AP attack is limited to the nearst clients to your position or else it fail ( using silnet illussion I can direct traffic of wlan which 15 KM to my position with only ALFA USB wireless adapter)

Quote:

---

Originally Posted by kernelpanic

Hi,
congratulation about your findings,
to me it sound like a man in the middle attack, but it is a fair try.

A nice sort of re inventing the wheel ? :D

Regards

---

You can call it Hardware MITM and it's diffrent from Usual MITM in:


1- It's work on new MITM protectefd WLANs

2- You don't need to poisn every client in the wlan

3- You do't need to complete the traffic routing ( you just recieve the requests & the fake router respond to complete the sessions)


The wheel is invented by ........?:D

Quote:

---

Originally Posted by PaRaN0!D

The wheel is invented by ........?:D

---

Whoever gave the writers of airbase-ng the idea ;)

Like the others said, congratulations on figuring out the attack vector, presumably on your own, but I'm not seeing anything new here. You've just over-complicated the process by adding virtualisation layers and other routing software.

Truth be told Gitsnik there are entire cultures that thrive on "over-complicating things".

@OP is there a point to this before I consider it spam and delete it? Because I still don't understand what you are trying to achieve here.

First, I am sorry to discuss the ideas of beginners in the Department of experts

Purpose of my idea is to simplify the complex and multiple attacks at the present time to be a single attack and simple scalable

I would like to add that this attack may be used as a trap for clients in the wireless network ... Able of guiding clients to the login page which be used as a trap

I would present another form of attack (I hope I don't bother you)


all off you know th Rouge AP attack

to be really effective I add some Improvments:

1- changing the wireless adapter MAC address to be Identical to the Victim wlan MAC address (BSSID)
& changing my Rouge AP (ESSID) to be Identical to the ESSID of the Victim WLAN I got:


the above improvment ensure that the v ictim wlan clients are suddenly disconnected from thier real wlan and connect to my fake one

2- using virtulized router software I can re-route the clients to Internet and respond to all autentication requests.

I post what I know here to see your replys so I can evaluate my level

Regards

Quote:

---

Originally Posted by PaRaN0!D

First, I am sorry to discuss the ideas of beginners in the Department of experts
I post what I know here to see your replys so I can evaluate my level

Regards

---

Evaluate your level. You seem to be learning and wanting to share. this is grate. just be sure to read through others work on the same subjects. mitm spoofing routing etc.....and be easy using this software if you live in a no no zone broadcasting 15 km now your really hot