full-disclosure - WiFi question

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <419B6C64.9060907@secnetops.com>
From: kf_lists at secnetops.com (KF_lists)
Subject: WiFi question

fake ap....
http://bsdvault.net/bsdfap.txt
http://www.blackalchemy.to/project/fakeap/
-KF


Colin.Scott@...lc.com wrote:
> List,
> 
> I'm an expert in nothing so when I saw this I had to ask, as Im sure theres
> someone out there that is a WiFi expert.
> 
> Google has found no answer so here goes.
> 
> Last night we saw a new access point appear. No problems its an ad-hoc
> network so its someone's machine with XP on configured for their home W-LAN
> probably.  Running Netstumbler shows more on it though.
> 
> You get 2 Access Points showing this ESSID for a few seconds. Then you get
> a 3rd, then a 4rth. Then the first two drop off, this repeats forever.
> Always using a different MAC address when a new AP appears. The APs are all
> WEP enabled (which I cant crack cos I dont have the savvy or the tools :) )
> and this goes on forever.
> 
> The MACs are all from different pools (i.e. assigned to different
> manufacturers) so the only conclusion is that they are all spoofed MACs.
> 
> I have walked around the office and as far as I can tell its coming from
> this office (the IT dept), basing that assumption on signal strength.
> 
> Anyone seen any tools that do this?   I would love a little hand-held
> gadget that would help me find it (like the scanner in Alien!)
> 
> Answers on a post card :)
> 
> Colin.
> 
> 
> 
> 
> 
> **************************************************************************************
> 
> This e-mail is confidential and may contain privileged information.  If you 
> are not the addressee or if you have received the e-mail in error, it may
> be unlawful for you to read, copy, distribute, disclose or otherwise use the 
> information which it contains.  Under these circumstances, please notify 
> us immediately by returning this mail to 'mailerror@...lc.com' and deleting
> this e-mail from your system.
> 
> Any views expressed by an individual within this e-mail do not necessarily
> reflect the views of Cadbury Schweppes Plc or its subsidiaries.  Cadbury
> Schweppes Plc will not be bound by any agreement entered into as a result
> of this email, unless its intention is clearly evidenced in the body of the email.
> Whilst we have taken reasonable steps to ensure that this e-mail and
> attachments are free from viruses, recipients are advised to subject this mail
> to their own virus checking, in keeping with good computing practice. Please
> note that email received by Cadbury Schweppes Plc or its subsidiaries may be
> monitored in accordance with the prevailing law in the United Kingdom.
> 
> **************************************************************************************
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>