http://secdocs.lonerunners.net Latest security documents RSS feed for tag WiFi en-us <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1672-martin-vuagnoux">Martin Vuagnoux</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/104-chaos-communication-congress-27th-27c3-2010">Chaos Communication Congress 27th (27C3) 2010</a> <br/><b>Abstract</b>: In this paper, we present several weaknesses in the stream cipher RC4. First, we present a technique to automatically reveal linear correlations in the PRGA of RC4. With this method, 48 new exploitable correlations have been discovered. Then we bind these new biases in the PRGA with known KSA weaknesses to provide practical key recovery attacks. Henceforth, we apply a similar technique on RC4 as a black box, i.e. the secret key words as input and the keystream words as output. Our objective is to exhaustively find linear correlations between these elements. Thanks to this technique, 9 new exploitable correlations have been revealed. Finally, we exploit these weaknesses on RC4 to some practical examples, such as the WEP protocol. We show that these correlations lead to a key recovery attack on WEP with only 9,800 encrypted packets (less than 20 seconds), instead of 24,200 for the best previous attack. Mon, 14 May 2012 23:48:48 +0200 http://secdocs.lonerunners.net/documents/details/5354-news-key-recovery-attacks-on-rc4wep http://secdocs.lonerunners.net/documents/details/5354-news-key-recovery-attacks-on-rc4wep <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1672-martin-vuagnoux">Martin Vuagnoux</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/104-chaos-communication-congress-27th-27c3-2010">Chaos Communication Congress 27th (27C3) 2010</a> <br/><b>Abstract</b>: In this paper, we present several weaknesses in the stream cipher RC4. First, we present a technique to automatically reveal linear correlations in the PRGA of RC4. With this method, 48 new exploitable correlations have been discovered. Then we bind these new biases in the PRGA with known KSA weaknesses to provide practical key recovery attacks. Henceforth, we apply a similar technique on RC4 as a black box, i.e. the secret key words as input and the keystream words as output. Our objective is to exhaustively find linear correlations between these elements. Thanks to this technique, 9 new exploitable correlations have been revealed. Finally, we exploit these weaknesses on RC4 to some practical examples, such as the WEP protocol. We show that these correlations lead to a key recovery attack on WEP with only 9,800 encrypted packets (less than 20 seconds), instead of 24,200 for the best previous attack. Mon, 14 May 2012 23:35:45 +0200 http://secdocs.lonerunners.net/documents/details/5350-news-key-recovery-attacks-on-rc4wep http://secdocs.lonerunners.net/documents/details/5350-news-key-recovery-attacks-on-rc4wep <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1672-martin-vuagnoux">Martin Vuagnoux</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/104-chaos-communication-congress-27th-27c3-2010">Chaos Communication Congress 27th (27C3) 2010</a> <br/><b>Abstract</b>: In this paper, we present several weaknesses in the stream cipher RC4. First, we present a technique to automatically reveal linear correlations in the PRGA of RC4. With this method, 48 new exploitable correlations have been discovered. Then we bind these new biases in the PRGA with known KSA weaknesses to provide practical key recovery attacks. Henceforth, we apply a similar technique on RC4 as a black box, i.e. the secret key words as input and the keystream words as output. Our objective is to exhaustively find linear correlations between these elements. Thanks to this technique, 9 new exploitable correlations have been revealed. Finally, we exploit these weaknesses on RC4 to some practical examples, such as the WEP protocol. We show that these correlations lead to a key recovery attack on WEP with only 9,800 encrypted packets (less than 20 seconds), instead of 24,200 for the best previous attack. Mon, 14 May 2012 23:34:12 +0200 http://secdocs.lonerunners.net/documents/details/5349-news-key-recovery-attacks-on-rc4wep http://secdocs.lonerunners.net/documents/details/5349-news-key-recovery-attacks-on-rc4wep <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/135-travis-goodspeed">Travis Goodspeed</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/103-chaos-communication-congress-28th-28c3-2011">Chaos Communication Congress 28th (28C3) 2011</a> <br/><b>Abstract</b>: New to 2011, Packet-in-Packet exploits allow for injection of raw radio frames into remote wireless networks. In these exploits, an attacker crafts a string that when transmitted over the air creates the symbols of a complete and valid radio packet. When radio interference damages the beginning of the outer packet, the receiver is tricked into seeing only the inner packet, allowing a frame to be remotely injected. The attacker requires no radio, and injection occurs without a software or hardware bug. This lecture presents the first implementation of Packet-in-Packet injection for 802.11B, allowing malicious PHY-Layer frames to be remotely injected. The attack is standards-compliant and compatible with all vendors and drivers. Unlike the simpler implementations for 802.15.4 and 2FSK, 802.11B presents a number of unique challenges to the PIP implementer. A single packet can use up to three symbol sets and three data-rates, switching rates once within the header and a second time for the beginning of the body. Additionally, a 7-bit scrambler randomizes the encoding of each packet, so the same string of text can be represented 128 different ways at the exact same rate and encoding. This lecture presents the first implementation of Packet-in-Packet injection for 802.11B, allowing malicious PHY-Layer frames to be remotely injected. The attack is standards-compliant and compatible with all vendors and drivers. As a demo, we intend to present a malicious string which can be embedded in any file with lots of slack space, such as an ISO image. When this image is downloaded over HTTP on 802.11B, beacon frames will be injected. For the demo, we will be injecting the SSID stack buffer overflow frames from Uninformed Volume 6. Wed, 07 Mar 2012 06:55:09 +0100 http://secdocs.lonerunners.net/documents/details/4989-80211-packets-in-packets http://secdocs.lonerunners.net/documents/details/4989-80211-packets-in-packets <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/135-travis-goodspeed">Travis Goodspeed</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/103-chaos-communication-congress-28th-28c3-2011">Chaos Communication Congress 28th (28C3) 2011</a> <br/><b>Abstract</b>: New to 2011, Packet-in-Packet exploits allow for injection of raw radio frames into remote wireless networks. In these exploits, an attacker crafts a string that when transmitted over the air creates the symbols of a complete and valid radio packet. When radio interference damages the beginning of the outer packet, the receiver is tricked into seeing only the inner packet, allowing a frame to be remotely injected. The attacker requires no radio, and injection occurs without a software or hardware bug. This lecture presents the first implementation of Packet-in-Packet injection for 802.11B, allowing malicious PHY-Layer frames to be remotely injected. The attack is standards-compliant and compatible with all vendors and drivers. Unlike the simpler implementations for 802.15.4 and 2FSK, 802.11B presents a number of unique challenges to the PIP implementer. A single packet can use up to three symbol sets and three data-rates, switching rates once within the header and a second time for the beginning of the body. Additionally, a 7-bit scrambler randomizes the encoding of each packet, so the same string of text can be represented 128 different ways at the exact same rate and encoding. This lecture presents the first implementation of Packet-in-Packet injection for 802.11B, allowing malicious PHY-Layer frames to be remotely injected. The attack is standards-compliant and compatible with all vendors and drivers. As a demo, we intend to present a malicious string which can be embedded in any file with lots of slack space, such as an ISO image. When this image is downloaded over HTTP on 802.11B, beacon frames will be injected. For the demo, we will be injecting the SSID stack buffer overflow frames from Uninformed Volume 6. Wed, 07 Mar 2012 06:55:09 +0100 http://secdocs.lonerunners.net/documents/details/4990-80211-packets-in-packets http://secdocs.lonerunners.net/documents/details/4990-80211-packets-in-packets <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/135-travis-goodspeed">Travis Goodspeed</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/103-chaos-communication-congress-28th-28c3-2011">Chaos Communication Congress 28th (28C3) 2011</a> <br/><b>Abstract</b>: New to 2011, Packet-in-Packet exploits allow for injection of raw radio frames into remote wireless networks. In these exploits, an attacker crafts a string that when transmitted over the air creates the symbols of a complete and valid radio packet. When radio interference damages the beginning of the outer packet, the receiver is tricked into seeing only the inner packet, allowing a frame to be remotely injected. The attacker requires no radio, and injection occurs without a software or hardware bug. This lecture presents the first implementation of Packet-in-Packet injection for 802.11B, allowing malicious PHY-Layer frames to be remotely injected. The attack is standards-compliant and compatible with all vendors and drivers. Unlike the simpler implementations for 802.15.4 and 2FSK, 802.11B presents a number of unique challenges to the PIP implementer. A single packet can use up to three symbol sets and three data-rates, switching rates once within the header and a second time for the beginning of the body. Additionally, a 7-bit scrambler randomizes the encoding of each packet, so the same string of text can be represented 128 different ways at the exact same rate and encoding. This lecture presents the first implementation of Packet-in-Packet injection for 802.11B, allowing malicious PHY-Layer frames to be remotely injected. The attack is standards-compliant and compatible with all vendors and drivers. As a demo, we intend to present a malicious string which can be embedded in any file with lots of slack space, such as an ISO image. When this image is downloaded over HTTP on 802.11B, beacon frames will be injected. For the demo, we will be injecting the SSID stack buffer overflow frames from Uninformed Volume 6. Tue, 06 Mar 2012 06:27:49 +0100 http://secdocs.lonerunners.net/documents/details/4988-80211-packets-in-packets http://secdocs.lonerunners.net/documents/details/4988-80211-packets-in-packets <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/425-vivek-ramachandran">Vivek Ramachandran</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/100-black-hat-abu-dhabi-2011">Black Hat Abu Dhabi 2011</a> <br/><b>Abstract</b>: This workshop will provide a highly technical and in-depth treatment of Wi-Fi security. The emphasis will be to provide the participants with a deep understanding of the principles behind various attacks and not just a quick how-to guide on publicly available tools. We will start our journey with the very basics by dissecting WLAN packet headers with Wireshark, then graduate to the next level by cracking WEP, WPA/WPA2 and then move on to real life challenges like orchestrating Man-in-the-Middle attacks and taking on the live Wi-Fi CTF! Mon, 06 Feb 2012 23:40:08 +0100 http://secdocs.lonerunners.net/documents/details/4864-workshop-advanced-wi-fi-security-penetration-testing http://secdocs.lonerunners.net/documents/details/4864-workshop-advanced-wi-fi-security-penetration-testing <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1531-franck-veysset">Franck Veysset</a> <a href="http://secdocs.lonerunners.net/authors/details/1234-laurent-butti">Laurent Butti</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/95-black-hat-usa-2006">Black Hat USA 2006</a> <br/> Thu, 12 Jan 2012 06:47:19 +0100 http://secdocs.lonerunners.net/documents/details/4723-wi-fi-advanced-stealth http://secdocs.lonerunners.net/documents/details/4723-wi-fi-advanced-stealth <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/913-jonathan-squire">Jonathan Squire</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/95-black-hat-usa-2006">Black Hat USA 2006</a> <br/> Thu, 12 Jan 2012 06:47:18 +0100 http://secdocs.lonerunners.net/documents/details/4718-30-30-minutes-30-networks-project-cowbird http://secdocs.lonerunners.net/documents/details/4718-30-30-minutes-30-networks-project-cowbird <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/225-bruce-potter">Bruce Potter</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/92-black-hat-usa-2005">Black Hat USA 2005</a> <br/> Mon, 26 Dec 2011 06:49:47 +0100 http://secdocs.lonerunners.net/documents/details/4621-rogue-squadron-evil-twins-80211intel-radical-radius-and-wireless-weaponry-for-windows http://secdocs.lonerunners.net/documents/details/4621-rogue-squadron-evil-twins-80211intel-radical-radius-and-wireless-weaponry-for-windows <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1308-chris-hurley">Chris Hurley</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/91-black-hat-asia-2005">Black Hat Asia 2005</a> <br/> Sat, 17 Dec 2011 14:43:35 +0100 http://secdocs.lonerunners.net/documents/details/4566-identifying-and-responding-to-wireless-attacks http://secdocs.lonerunners.net/documents/details/4566-identifying-and-responding-to-wireless-attacks <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1449-brian-wotring">Brian Wotring</a> <a href="http://secdocs.lonerunners.net/authors/details/225-bruce-potter">Bruce Potter</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/88-black-hat-usa-2004">Black Hat USA 2004</a> <br/> Sun, 04 Dec 2011 06:28:33 +0100 http://secdocs.lonerunners.net/documents/details/4488-tracking-prey-in-the-cyberforest http://secdocs.lonerunners.net/documents/details/4488-tracking-prey-in-the-cyberforest <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1308-chris-hurley">Chris Hurley</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/88-black-hat-usa-2004">Black Hat USA 2004</a> <br/> Fri, 02 Dec 2011 21:32:00 +0100 http://secdocs.lonerunners.net/documents/details/4494-worldwide-wardrive-4 http://secdocs.lonerunners.net/documents/details/4494-worldwide-wardrive-4 <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1422-mike-schiffman">Mike Schiffman</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/85-black-hat-usa-2002">Black Hat USA 2002</a> <br/> Tue, 22 Nov 2011 06:48:47 +0100 http://secdocs.lonerunners.net/documents/details/4403-the-need-for-an-80211b-toolkit http://secdocs.lonerunners.net/documents/details/4403-the-need-for-an-80211b-toolkit <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1423-dan-veeneman">Dan Veeneman</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/85-black-hat-usa-2002">Black Hat USA 2002</a> <br/> Tue, 22 Nov 2011 06:48:47 +0100 http://secdocs.lonerunners.net/documents/details/4404-wireless-overview-protocols--threat-models http://secdocs.lonerunners.net/documents/details/4404-wireless-overview-protocols--threat-models <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1421-mike-lynn">Mike Lynn</a> <a href="http://secdocs.lonerunners.net/authors/details/1420-robert-baird">Robert Baird</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/85-black-hat-usa-2002">Black Hat USA 2002</a> <br/> Mon, 21 Nov 2011 06:30:47 +0100 http://secdocs.lonerunners.net/documents/details/4401-advanced-80211b-attack http://secdocs.lonerunners.net/documents/details/4401-advanced-80211b-attack <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1396-mandy-andress">Mandy Andress</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/81-black-hat-usa-2001">Black Hat USA 2001</a> <br/> Sun, 06 Nov 2011 06:44:57 +0100 http://secdocs.lonerunners.net/documents/details/4304-wireless-lan-security http://secdocs.lonerunners.net/documents/details/4304-wireless-lan-security <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1386-tim-newsham">Tim Newsham</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/81-black-hat-usa-2001">Black Hat USA 2001</a> <br/> Fri, 04 Nov 2011 06:46:37 +0100 http://secdocs.lonerunners.net/documents/details/4288-cracking-wep-keys http://secdocs.lonerunners.net/documents/details/4288-cracking-wep-keys <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1385-ian-goldberg">Ian Goldberg</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/81-black-hat-usa-2001">Black Hat USA 2001</a> <br/> Thu, 03 Nov 2011 06:43:26 +0100 http://secdocs.lonerunners.net/documents/details/4285-breaking-80211-wep http://secdocs.lonerunners.net/documents/details/4285-breaking-80211-wep <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1349-steve-riley">Steve Riley</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/76-black-hat-windows-security-2003">Black Hat Windows Security 2003</a> <br/> Fri, 21 Oct 2011 09:00:33 +0200 http://secdocs.lonerunners.net/documents/details/4207-securing-wireless-networks-with-8021x-eap-tls-and-peap http://secdocs.lonerunners.net/documents/details/4207-securing-wireless-networks-with-8021x-eap-tls-and-peap <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1349-steve-riley">Steve Riley</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/76-black-hat-windows-security-2003">Black Hat Windows Security 2003</a> <br/> Fri, 21 Oct 2011 09:00:33 +0200 http://secdocs.lonerunners.net/documents/details/4208-securing-wireless-networks-with-8021x-eap-tls-and-peap http://secdocs.lonerunners.net/documents/details/4208-securing-wireless-networks-with-8021x-eap-tls-and-peap <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/225-bruce-potter">Bruce Potter</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/73-black-hat-federal-2003">Black Hat Federal 2003</a> <br/> Sat, 01 Oct 2011 13:49:16 +0200 http://secdocs.lonerunners.net/documents/details/4097-rogue-ap-101 http://secdocs.lonerunners.net/documents/details/4097-rogue-ap-101 <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1284-diego-sor">Diego Sor</a> <a href="http://secdocs.lonerunners.net/authors/details/1283-leandro-meiners">Leandro Meiners</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/71-black-hat-usa-2010">Black Hat USA 2010</a> <br/><b>Abstract</b>: Cisco access points support WPA migration mode, which enables both WPA and WEP clients to associate to an access point using the same Service Set Identifier (SSID). If WEP clients are still around, we can use the traditional WEP cracking arsenal against them. Therefore, we focused on analyzing the consequences of having this feature enabled when no WEP clients are present; for example after the migration to WPA has been carried out but this feature has been left enabled. We found that it is possible for an attacker to crack the WEP key under this scenario (i.e. no WEP clients). Once the key is recovered, it is possible to connect to the access point using this key (as it is operating in WPA migration mode) and access the network. Sat, 17 Sep 2011 22:53:20 +0200 http://secdocs.lonerunners.net/documents/details/4019-wpa-migration-mode-wep-is-back-to-haunt-you http://secdocs.lonerunners.net/documents/details/4019-wpa-migration-mode-wep-is-back-to-haunt-you <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1284-diego-sor">Diego Sor</a> <a href="http://secdocs.lonerunners.net/authors/details/1283-leandro-meiners">Leandro Meiners</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/71-black-hat-usa-2010">Black Hat USA 2010</a> <br/><b>Abstract</b>: Cisco access points support WPA migration mode, which enables both WPA and WEP clients to associate to an access point using the same Service Set Identifier (SSID). If WEP clients are still around, we can use the traditional WEP cracking arsenal against them. Therefore, we focused on analyzing the consequences of having this feature enabled when no WEP clients are present; for example after the migration to WPA has been carried out but this feature has been left enabled. We found that it is possible for an attacker to crack the WEP key under this scenario (i.e. no WEP clients). Once the key is recovered, it is possible to connect to the access point using this key (as it is operating in WPA migration mode) and access the network. Sat, 17 Sep 2011 22:53:01 +0200 http://secdocs.lonerunners.net/documents/details/4018-wpa-migration-mode-wep-is-back-to-haunt-you http://secdocs.lonerunners.net/documents/details/4018-wpa-migration-mode-wep-is-back-to-haunt-you <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1234-laurent-butti">Laurent Butti</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/69-black-hat-eu-2007">Black Hat EU 2007</a> <br/> Mon, 04 Jul 2011 22:00:35 +0200 http://secdocs.lonerunners.net/documents/details/3854-wi-fi-advanced-fuzzing http://secdocs.lonerunners.net/documents/details/3854-wi-fi-advanced-fuzzing <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1234-laurent-butti">Laurent Butti</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/69-black-hat-eu-2007">Black Hat EU 2007</a> <br/> Mon, 04 Jul 2011 22:00:07 +0200 http://secdocs.lonerunners.net/documents/details/3853-wi-fi-advanced-fuzzing http://secdocs.lonerunners.net/documents/details/3853-wi-fi-advanced-fuzzing <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1215-krishna-kurapati">Krishna Kurapati</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/68-black-hat-usa-2007">Black Hat USA 2007</a> <br/> Sat, 21 May 2011 07:54:46 +0200 http://secdocs.lonerunners.net/documents/details/3785-vulnerabilities-in-wi-fidual-mode-voip-phones http://secdocs.lonerunners.net/documents/details/3785-vulnerabilities-in-wi-fidual-mode-voip-phones <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1215-krishna-kurapati">Krishna Kurapati</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/68-black-hat-usa-2007">Black Hat USA 2007</a> <br/> Sat, 21 May 2011 07:54:25 +0200 http://secdocs.lonerunners.net/documents/details/3784-vulnerabilities-in-wi-fidual-mode-voip-phones http://secdocs.lonerunners.net/documents/details/3784-vulnerabilities-in-wi-fidual-mode-voip-phones <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1157-nathan-keltner">Nathan Keltner</a> <a href="http://secdocs.lonerunners.net/authors/details/388-shawn-moyer">Shawn Moyer</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/65-defcon-18">DEFCON 18</a> <br/> Thu, 10 Mar 2011 05:25:24 +0100 http://secdocs.lonerunners.net/documents/details/3534-wardriving-the-smart-grid-practical-approaches-to-attacking-utility-packet-radios http://secdocs.lonerunners.net/documents/details/3534-wardriving-the-smart-grid-practical-approaches-to-attacking-utility-packet-radios <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1157-nathan-keltner">Nathan Keltner</a> <a href="http://secdocs.lonerunners.net/authors/details/388-shawn-moyer">Shawn Moyer</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/65-defcon-18">DEFCON 18</a> <br/> Thu, 10 Mar 2011 05:25:24 +0100 http://secdocs.lonerunners.net/documents/details/3535-wardriving-the-smart-grid-practical-approaches-to-attacking-utility-packet-radios http://secdocs.lonerunners.net/documents/details/3535-wardriving-the-smart-grid-practical-approaches-to-attacking-utility-packet-radios <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1157-nathan-keltner">Nathan Keltner</a> <a href="http://secdocs.lonerunners.net/authors/details/388-shawn-moyer">Shawn Moyer</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/65-defcon-18">DEFCON 18</a> <br/> Thu, 10 Mar 2011 05:25:21 +0100 http://secdocs.lonerunners.net/documents/details/3533-wardriving-the-smart-grid-practical-approaches-to-attacking-utility-packet-radios http://secdocs.lonerunners.net/documents/details/3533-wardriving-the-smart-grid-practical-approaches-to-attacking-utility-packet-radios <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/734-md-sohail-ahmad">MD Sohail Ahmad</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/65-defcon-18">DEFCON 18</a> <br/> Sat, 15 Jan 2011 19:32:22 +0100 http://secdocs.lonerunners.net/documents/details/3294-wpa-too http://secdocs.lonerunners.net/documents/details/3294-wpa-too <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/734-md-sohail-ahmad">MD Sohail Ahmad</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/65-defcon-18">DEFCON 18</a> <br/> Sat, 15 Jan 2011 05:25:10 +0100 http://secdocs.lonerunners.net/documents/details/3293-wpa-too http://secdocs.lonerunners.net/documents/details/3293-wpa-too <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/734-md-sohail-ahmad">MD Sohail Ahmad</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/65-defcon-18">DEFCON 18</a> <br/> Fri, 14 Jan 2011 05:25:16 +0100 http://secdocs.lonerunners.net/documents/details/3292-wpa-too http://secdocs.lonerunners.net/documents/details/3292-wpa-too <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/734-md-sohail-ahmad">MD Sohail Ahmad</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/65-defcon-18">DEFCON 18</a> <br/> Fri, 14 Jan 2011 05:25:13 +0100 http://secdocs.lonerunners.net/documents/details/3291-wpa-too http://secdocs.lonerunners.net/documents/details/3291-wpa-too <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1004-david-bryan">David Bryan</a> <a href="http://secdocs.lonerunners.net/authors/details/346-luiz-eduardo">Luiz Eduardo</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/62-sector-2010">SecTor 2010</a> <br/> Thu, 25 Nov 2010 19:52:41 +0100 http://secdocs.lonerunners.net/documents/details/3173-building-the-defcon-network-making-a-sandbox-for-10000-hackers http://secdocs.lonerunners.net/documents/details/3173-building-the-defcon-network-making-a-sandbox-for-10000-hackers <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1004-david-bryan">David Bryan</a> <a href="http://secdocs.lonerunners.net/authors/details/346-luiz-eduardo">Luiz Eduardo</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/62-sector-2010">SecTor 2010</a> <br/> Thu, 25 Nov 2010 19:35:17 +0100 http://secdocs.lonerunners.net/documents/details/3172-building-the-defcon-network-making-a-sandbox-for-10000-hackers http://secdocs.lonerunners.net/documents/details/3172-building-the-defcon-network-making-a-sandbox-for-10000-hackers <b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/61-phreaknic-11">PhreakNIC 11</a> <br/><b>Abstract</b>: Presentation of awards for the Wifi Race and the Scavenger Hunt at PhreakNIC 0x0b. Sat, 20 Nov 2010 12:45:41 +0100 http://secdocs.lonerunners.net/documents/details/3160-presentation-of-awards-for-wifi-race-and-scavenger-hunt http://secdocs.lonerunners.net/documents/details/3160-presentation-of-awards-for-wifi-race-and-scavenger-hunt <b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/61-phreaknic-11">PhreakNIC 11</a> <br/><b>Abstract</b>: Wireless networks have been around for a few years, however the ways to extend, use and abuse them haven't changed too much. While not a completely new look at things, this presentation will touch on some previously undiscovered territory which should be of interest to any wireless security researcher, as well as discuss a few ideas on unusual uses of antennas and dishes, oddball antennas and just general wi-phun. Fri, 19 Nov 2010 10:16:34 +0100 http://secdocs.lonerunners.net/documents/details/3153-stupid-wifi-tricks http://secdocs.lonerunners.net/documents/details/3153-stupid-wifi-tricks <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1039-brian-blankership">Brian Blankership</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/60-phreaknic-13">PhreakNIC 13</a> <br/> Sun, 14 Nov 2010 12:17:25 +0100 http://secdocs.lonerunners.net/documents/details/3130-dd-wrt http://secdocs.lonerunners.net/documents/details/3130-dd-wrt <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1036-stan-brooks">Stan Brooks</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/58-shoecon-2010">ShoeCon 2010</a> <br/> Fri, 12 Nov 2010 06:13:26 +0100 http://secdocs.lonerunners.net/documents/details/3120-wi-fi-basics-for-geeks-how-wireless-really-works http://secdocs.lonerunners.net/documents/details/3120-wi-fi-basics-for-geeks-how-wireless-really-works <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/61-david-hulton">David Hulton</a> <a href="http://secdocs.lonerunners.net/authors/details/647-johnny-cache">Johnny Cache</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/53-layerone-2006">LayerOne 2006</a> <br/> Wed, 03 Nov 2010 15:11:36 +0100 http://secdocs.lonerunners.net/documents/details/3080-breaking-wifi-faster http://secdocs.lonerunners.net/documents/details/3080-breaking-wifi-faster <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/61-david-hulton">David Hulton</a> <a href="http://secdocs.lonerunners.net/authors/details/647-johnny-cache">Johnny Cache</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/53-layerone-2006">LayerOne 2006</a> <br/> Wed, 03 Nov 2010 15:10:29 +0100 http://secdocs.lonerunners.net/documents/details/3079-breaking-wifi-faster http://secdocs.lonerunners.net/documents/details/3079-breaking-wifi-faster <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1011-ken-caruso">Ken Caruso</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/53-layerone-2006">LayerOne 2006</a> <br/> Mon, 01 Nov 2010 13:11:12 +0100 http://secdocs.lonerunners.net/documents/details/3062-seattle-wireless http://secdocs.lonerunners.net/documents/details/3062-seattle-wireless <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/1011-ken-caruso">Ken Caruso</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/53-layerone-2006">LayerOne 2006</a> <br/> Mon, 01 Nov 2010 13:10:56 +0100 http://secdocs.lonerunners.net/documents/details/3061-seattle-wireless http://secdocs.lonerunners.net/documents/details/3061-seattle-wireless <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/346-luiz-eduardo">Luiz Eduardo</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/51-layerone-2008">LayerOne 2008</a> <br/> Fri, 29 Oct 2010 19:58:19 +0200 http://secdocs.lonerunners.net/documents/details/3035-echo--wifi--location http://secdocs.lonerunners.net/documents/details/3035-echo--wifi--location <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/346-luiz-eduardo">Luiz Eduardo</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/51-layerone-2008">LayerOne 2008</a> <br/> Fri, 29 Oct 2010 19:57:55 +0200 http://secdocs.lonerunners.net/documents/details/3034-echo--wifi--location http://secdocs.lonerunners.net/documents/details/3034-echo--wifi--location <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/135-travis-goodspeed">Travis Goodspeed</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/15-black-hat-dc-2009">Black Hat DC 2009</a> <br/> Mon, 30 Aug 2010 09:07:00 +0200 http://secdocs.lonerunners.net/documents/details/2832-reversing-and-exploiting-wireless-sensors http://secdocs.lonerunners.net/documents/details/2832-reversing-and-exploiting-wireless-sensors <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/135-travis-goodspeed">Travis Goodspeed</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/15-black-hat-dc-2009">Black Hat DC 2009</a> <br/> Thu, 19 Aug 2010 06:15:01 +0200 http://secdocs.lonerunners.net/documents/details/2831-reversing-and-exploiting-wireless-sensors http://secdocs.lonerunners.net/documents/details/2831-reversing-and-exploiting-wireless-sensors <b>Authors</b>: <a href="http://secdocs.lonerunners.net/authors/details/279-sergey-bratus">Sergey Bratus</a> <br/><b>Tags</b>: <a href="http://secdocs.lonerunners.net/tags/details/199-wifi">WiFi</a> <br/><b>Event</b>: <a href="http://secdocs.lonerunners.net/events/details/42-black-hat-usa-2008">Black Hat USA 2008</a> <br/> Mon, 28 Jun 2010 12:58:00 +0200 http://secdocs.lonerunners.net/documents/details/2599-active-80211-fingerpinting-a-secret-handshake-to-know-your-aps http://secdocs.lonerunners.net/documents/details/2599-active-80211-fingerpinting-a-secret-handshake-to-know-your-aps