How to counter karma

[oliverm]

Is there a way to tighten to up wireless networks to prevent the kind of karma intrusion that our WP4 demonstrates so well?

Now we know it can be done, is there anything that can realistically be done to help prevent it happening in the future?

Olly

[Foxtrot]

A good way to not be sucked in by Karma is to never use open access points, and delete the ones you have saved.

[potato]

I remeber Darren saying something about Cisco access points being able to detect their probes being faked and deauth the clients from the pineapple, never got arround to looking into it. Probably has to do with the Aironet series only and not the soho routers, also it would only help in some sitiatuions.

[blueAlien]

I remeber Darren saying something about Cisco access points being able to detect their probes being faked and deauth the clients from the pineapple, never got arround to looking into it. Probably has to do with the Aironet series only and not the soho routers, also it would only help in some sitiatuions.

Most new enterprise grade wireless equipment does have a "rogue access point deauth" feature, but this requires using one of the MIMO antennas, which means less bandwidth. This means that most of these access points will not be configured to utilize these features unless the company is specifically having problems with it happening. I've only used it once in an arena setup to combat MyFi devices stomping on our channels when the media would bring them in.

Another thing to consider is that the target rich environments will not be using this level of equipment. Small coffee shops, bars and other SMBs will be using consumer grade routers purchased at Office Depot. Also, you have to be at the location running deauth. Usually the encryption on enterprise gear is done on a proxy server or the back end, not the actual access point, leading to another open SSID for Karma to use...

Like already said, the only way to fully protect in public is to clean up all the saved open networks. Maybe someone should write an app for that. Another thing to consider is to use a VPN or other encryption service alongside a known good DNS server. That way if you do connect to a rogue AP, there's no way to redirect to phishing pages and packet capture is useless.

[oliverm]

Would changing the wifi access password regularly help, or is it actually having the wifi network saved in the OS that is the issue?

[DrDinosaur]

Would changing the wifi access password regularly help, or is it actually having the wifi network saved in the OS that is the issue?

As long as you have saved open access points, that's all that matters.

[oliverm]

Thanks for clarifying. I'm pretty sure that you can prevent Windows from saving wifi networks via group policy in AD so I'll look there.

I'm also looking at the VPN suggestion as well.

Olly