VIRTUAL BANK,TOOL HACKING,PAYPAL

Showing posts with label Cracking WEP with BackTrack. Show all posts

Home > Posts filed under Cracking WEP with BackTrack

Internet Speed Test: 5 utilities to test your speed

On Saturday, November 2, 2013 Labels: Cracking WEP with BackTrack, Internet Speed Test: 5 utilities to test your speed

<div style="background-color: white; color: #333333; font-family: Helvetica, arial, sans-serif; font-size: 14px; line-height: 20px; width: 480px;">
An internet speed test can give you the down-low on your download and upload speeds, detailing whether or not your internet service provider is living up to its end of the broadband contract.</div>
<div style="background-color: white; color: #333333; font-family: Helvetica, arial, sans-serif; font-size: 14px; line-height: 20px; margin-top: 10px; width: 480px;">
Of course, there are a lot of options out there to test your internet bandwidth, and some sites and apps offer more statistics than others.</div>
<div style="background-color: white; color: #333333; font-family: Helvetica, arial, sans-serif; font-size: 14px; line-height: 20px; margin-top: 10px; width: 480px;">
To help narrow the broad range of broadband testing services out there, we have put together a list of the five internet testing destinations to try out in browsers and through iOS and Android apps.</div>
<h3 style="background-color: white; color: #333333; font-family: Helvetica, arial, sans-serif; font-size: 20px; letter-spacing: -0.5px; line-height: 1em; margin: 20px 0px 10px; padding-bottom: 10px; width: 480px;">
1. Speakeasy / MegaPath Speed Test Plus</h3>
<div style="background-color: white; color: #333333; font-family: Helvetica, arial, sans-serif; font-size: 14px; line-height: 20px; width: 480px;">
One of the most popular destinations for an internet speed test has been Speakeasy.net, which began analyzing 56K and broadband connections in the 1990s. Today, the site simply redirects to <a href="http://www.megapath.com/speedtestplus/" style="color: #0099cc; font-weight: bold; text-decoration: none;">MegaPath Speed Test</a>, which provides a similar function, but MegaPath still keeps the popular and much-cooler-sounding Speakeasy brand around.</div>
<ul style="background-color: white; color: #333333; font-family: Helvetica, arial, sans-serif; font-size: 16px; line-height: 19px; list-style: none; margin: 20px 0px; padding: 0px;">
<li style="font-size: 14px; line-height: 20px; list-style: disc; margin: 0px 0px 0px 20px; padding: 0px; width: 480px;"><a href="http://www.techradar.com/news/internet/broadband/best-broadband-are-you-paying-too-much--1146234" style="color: #0099cc; font-weight: bold; text-decoration: none;">Are you paying too much for broadband service? Find a better service now</a>.</li>
</ul>
<div style="background-color: white; color: #333333; font-family: Helvetica, arial, sans-serif; font-size: 14px; line-height: 20px; width: 480px;">
But MegaPath now gives the millions of people who test their broadband connection new reason to hop on over to the new site: the MegaPath Speed Test Plus. This enhanced version features packet loss, latency and jitter tests in addition to download and upload speeds calculations.</div>
<div style="background-color: white; color: #333333; font-family: Helvetica, arial, sans-serif; font-size: 14px; line-height: 20px; margin-top: 10px; width: 480px;">
Sure, MegaPath Speed Test Plus takes a few minutes longer and scares users with a couple of "needs to access your computer" warning messages. But it can determine if there's something wrong with your internet line besides the average download and upload speeds.</div>
<h3 style="background-color: white; color: #333333; font-family: Helvetica, arial, sans-serif; font-size: 20px; letter-spacing: -0.5px; line-height: 1em; margin: 20px 0px 10px; padding-bottom: 10px; width: 480px;">
2. Speedtest.net</h3>
<div style="background-color: white; color: #333333; font-family: Helvetica, arial, sans-serif; font-size: 14px; line-height: 20px; width: 480px;">
</div>
<div style="background-color: white; color: #333333; font-family: Helvetica, arial, sans-serif; font-size: 14px; line-height: 20px; margin-top: 10px; width: 480px;">
It's always good to get a second opinion, and that's why <a href="http://www.speedtest.net/" style="color: #0099cc; font-weight: bold; text-decoration: none;">Speedtest.net</a>should be the very next website you visit to test your internet speed. More than 50 million people do just that on this flashier-looking broadband performance evaluator, which happens to be owned by Ookla, the very same company that licenses MegaPath's underlying engine.</div>
<div style="background-color: white; color: #333333; font-family: Helvetica, arial, sans-serif; font-size: 14px; line-height: 20px; margin-top: 10px; width: 480px;">
However, Ookla's Speedtest.net does a little more for frequent testers - it allows users to create an account, save their results and rate their ISP. It's then possible to flip to another page and compare the speed test results to other broadband owners in your area.</div>
<h3 style="background-color: white; color: #333333; font-family: Helvetica, arial, sans-serif; font-size: 20px; letter-spacing: -0.5px; line-height: 1em; margin: 20px 0px 10px; padding-bottom: 10px; width: 480px;">
3. Official ISP Speed tests</h3>
<div style="background-color: white; color: #333333; font-family: Helvetica, arial, sans-serif; font-size: 14px; line-height: 20px; width: 480px;">
Ookla is also used as the underlying engine for ISP-branded speed tests, but it's still a smart idea to use them to sample your download and upload quality. After all, ISPs can't argue when you're using their own tests to determine the poor quality of your internet connection.</div>
<div style="background-color: white; color: #333333; font-family: Helvetica, arial, sans-serif; font-size: 14px; line-height: 20px; margin-top: 10px; width: 480px;">
<a href="http://speedtest.charter.com/" style="color: #0099cc; font-weight: bold; text-decoration: none;">Charter Communications</a>, <a href="http://speedtest.comcast.net/" style="color: #0099cc; font-weight: bold; text-decoration: none;">Comcast</a>, <a href="https://idm.east.cox.net/coxlogin/ui/internettools?TYPE=33554432&REALMOID=06-b6c69bf3-75c3-1017-a6a3-84a733520cb3&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-ZJOGVvuyc%2bCvrPvWwBaEKN4pxa8K6uGuSAOMjV5DF1jFYlHrA4PMFmXZ2KnuwP9s&TARGET=-SM-https%3a%2f%2fmyaccount.cox.net%2finternettools%2fspeedcheck%2fspeedcheck.cox" style="color: #0099cc; font-weight: bold; text-decoration: none;">Cox Communications</a>, <a href="http://www.timewarnercable.com/en/residential-home/support/speed-test.html" style="color: #0099cc; font-weight: bold; text-decoration: none;">Time Warner Cable</a> and <a href="http://my.verizon.com/services/speedtest/" style="color: #0099cc; font-weight: bold; text-decoration: none;">Verizon FiOS</a> are some of the ISPs that ping your download and upload speeds. <a href="http://www.att.com/speedtest/" style="color: #0099cc; font-weight: bold; text-decoration: none;">AT&T did have a speed test</a> for its DSL and U-Verse fiber optic customers, but in perfect AT&T fashion, this is down and just points everyone to use <a href="http://www.speedtest.net/" style="color: #0099cc; font-weight: bold; text-decoration: none;">Speedtest.net</a>.</div>
<h3 style="background-color: white; color: #333333; font-family: Helvetica, arial, sans-serif; font-size: 20px; letter-spacing: -0.5px; line-height: 1em; margin: 20px 0px 10px; padding-bottom: 10px; width: 480px;">
4. SpeedOf.Me, the HTML5 internet speed test</h3>
<div style="background-color: white; color: #333333; font-family: Helvetica, arial, sans-serif; font-size: 14px; line-height: 20px; width: 480px;">
On the forefront of internet speed tests is <a href="http://www.speedof.me/" style="color: #0099cc; font-weight: bold; text-decoration: none;">SpeedOf.Me</a>, which skips the flash and the java required by all of the aforementioned broadband testing services. Its use of HTML5 technology means that it works with iPhone, iPad, Android and <a href="http://www.techradar.com/reviews/pc-mac/software/operating-systems/windows-phone-8-1086692/review" style="color: #0099cc; font-weight: bold; text-decoration: none;">Windows Phone 8</a> mobile devices.</div>
<div style="background-color: white; color: #333333; font-family: Helvetica, arial, sans-serif; font-size: 14px; line-height: 20px; margin-top: 10px; width: 480px;">
While it's claim of being "the smartest and most accurate online bandwidth test," remains up for debate, it can be considered the flashiest internet speed test without the flash. Big wavy lines that stretch the width of your computer screen make up this unique website.</div>
<h3 style="background-color: white; color: #333333; font-family: Helvetica, arial, sans-serif; font-size: 20px; letter-spacing: -0.5px; line-height: 1em; margin: 20px 0px 10px; padding-bottom: 10px; width: 480px;">
5. Speed test apps for iPhone, iPad, Android</h3>
<div style="background-color: white; color: #333333; font-family: Helvetica, arial, sans-serif; font-size: 14px; line-height: 20px; width: 480px;">
Apps dedicated to testing your mobile device's speed can be found in the<a href="http://www.techradar.com/news/software/applications/we-did-it-well-someone-out-there-hit-50b-app-store-downloads-1151792" style="color: #0099cc; font-weight: bold; text-decoration: none;">Apple App Store</a> as well as <a href="http://www.techradar.com/news/phone-and-communications/mobile-phones/getting-more-from-google-play-1127867" style="color: #0099cc; font-weight: bold; text-decoration: none;">Google Play</a>. Ookla cornered the market on iPhone and has a big following among Android devices with its Speedtest.net Mobile Speed Test application.</div>
<div style="background-color: white; color: #333333; font-family: Helvetica, arial, sans-serif; font-size: 14px; line-height: 20px; margin-top: 10px; width: 480px;">
However, this isn't available as a native app on the iPad this app. Owners of Apple's popular tablet can download Speedtest X HD for free instead. Another company looking to get in on the mobile internet speed testing craze is Speed A.I., which offers an alternative to Ookla's Android app with the app-ly named Internet Speed Test.</div>

An internet speed test can give you the down-low on your download and upload speeds, detailing whether or not your internet service provide...

How To Overclock your Android Device with SetCPU

Labels: Cracking WEP with BackTrack, How To Overclock your Android Device with SetCPU

<div class="featured-image" style="box-sizing: border-box; font-family: Oxygen, sans-serif; font-size: 16px; line-height: 24px; margin-bottom: 15px;">
<img alt="Android SetCPU" class="attachment-featured-image img-responsive wp-post-image" height="818" src="http://cdn.theunlockr.com/wp-content/uploads/2011/08/galaxy-s-ii-1.5.png" style="border: 0px; box-sizing: border-box; display: block; height: auto; margin: 5px auto; max-width: 100%; vertical-align: middle;" width="986" /></div>
<div class="fsb-social-bar" data-post-id="34227" data-socialite="true" id="fsb-social-bar" style="background-color: white; border-bottom-color: rgb(219, 219, 219); border-bottom-style: solid; border-bottom-width: 1px; border-top-color: rgb(219, 219, 219); border-top-style: solid; border-top-width: 1px; box-sizing: border-box; clear: both; float: left; font-family: Oxygen, sans-serif; font-size: 16px; line-height: 24px; margin: 0px 0px 20px; padding: 10px 0px; position: relative; width: 718px;">
<div class="fsb-share-facebook" style="box-sizing: border-box; float: left; height: 25px; padding: 3px 0px 2px; width: 120px;">
<a class="socialite facebook fsb-facebook" data-fsb-service="facebook" data-href="http://theunlockr.com/2011/08/27/how-to-overclock-your-android-device-with-setcpu/" data-layout="button_count" data-send="false" data-show-faces="false" data-width="60" href="http://www.facebook.com/sharer.php?u=http://theunlockr.com/2011/08/27/how-to-overclock-your-android-device-with-setcpu/" rel="nofollow" style="-webkit-backface-visibility: hidden; -webkit-transition: 0.25s; background-attachment: scroll; background-image: url(http://cdn.theunlockr.com/wp-content/plugins/floating-social-bar/images/fsb-sprite.png); background-position: -231px -10px; background-repeat: no-repeat no-repeat; border: 0px !important; box-sizing: border-box; color: #333333; display: block; font-family: Arial, Helvetica, sans-serif; font-size: 12px; height: 25px; line-height: 25px; position: relative; text-decoration: none; transition: 0.25s; vertical-align: middle; width: 89px;" target="_blank"><span class="fsb-count" style="box-sizing: border-box; display: inline-block; margin: 0px 0px 0px 52px; text-align: center; width: 30px;">17</span></a></div>
<div class="fsb-share-twitter" style="box-sizing: border-box; float: left; height: 25px; padding: 3px 0px 2px; width: 135px;">
<a class="socialite twitter fsb-twitter" data-fsb-service="twitter" href="https://twitter.com/share?original_referer=http%3A%2F%2Ftheunlockr.com%2F&source=tweetbutton&text=How+To+Overclock+your+Android+Device+with+SetCPU&url=http%3A%2F%2Ftheunlockr.com%2F2011%2F08%2F27%2Fhow-to-overclock-your-android-device-with-setcpu%2F&via=theunlockr" rel="nofollow" style="-webkit-backface-visibility: hidden; -webkit-transition: 0.25s; background-attachment: scroll; background-image: url(http://cdn.theunlockr.com/wp-content/plugins/floating-social-bar/images/fsb-sprite.png); background-position: -13px -10px; background-repeat: no-repeat no-repeat; border: 0px !important; box-sizing: border-box; color: #333333; display: block; font-family: Arial, Helvetica, sans-serif; font-size: 12px; height: 25px; line-height: 25px; position: relative; text-decoration: none; transition: 0.25s; vertical-align: middle; width: 105px;" target="_blank" title="3 retweets so far"><span class="fsb-count" style="box-sizing: border-box; display: inline-block; margin: 0px 0px 0px 69px; text-align: center; width: 30px;">3</span></a></div>
<div class="fsb-share-google fsb-hide-count" style="box-sizing: border-box; float: left; height: 25px; margin-right: 30px; overflow: hidden; padding: 3px 0px 2px; width: 33px;">
<a class="socialite googleplus fsb-google" data-fsb-service="google" data-href="http://theunlockr.com/2011/08/27/how-to-overclock-your-android-device-with-setcpu/" data-size="medium" href="https://plus.google.com/share?url=http://theunlockr.com/2011/08/27/how-to-overclock-your-android-device-with-setcpu/" rel="nofollow" style="-webkit-backface-visibility: hidden; -webkit-transition: 0.25s; background-attachment: scroll; background-image: url(http://cdn.theunlockr.com/wp-content/plugins/floating-social-bar/images/fsb-sprite.png); background-position: -136px -10px; background-repeat: no-repeat no-repeat; border: 0px !important; box-sizing: border-box; color: #333333; display: block; font-family: Arial, Helvetica, sans-serif; font-size: 12px; height: 25px; line-height: 25px; position: relative; text-decoration: none; transition: 0.25s; vertical-align: middle; width: 75px;" target="_blank"><span class="fsb-count" style="box-sizing: border-box; display: inline-block; margin: 0px 0px 0px 41px; text-align: center; width: 30px;">0</span></a></div>
</div>
<div class="fsb-clear" style="box-sizing: border-box; clear: both; font-family: Oxygen, sans-serif; font-size: 16px; line-height: 24px;">
</div>
<div style="box-sizing: border-box; font-family: Oxygen, sans-serif; font-size: 16px; line-height: 1.71109; margin-bottom: 10px;">
<iframe allowfullscreen="" frameborder="0" height="315" src="http://www.youtube.com/embed/qBYn-BnaWuE?rel=0" style="box-sizing: border-box;" width="560"></iframe></div>
<div style="box-sizing: border-box; font-family: Oxygen, sans-serif; font-size: 16px; line-height: 1.71109; margin-bottom: 10px;">
Want to get better performance with your rooted Android device? Use a free application called SetCPU to overclock your device, boosting it’s performance and, in some cases, also extending it’s battery life.</div>
<h3 style="background-color: #333333; box-sizing: border-box; color: white; font-family: Oswald; font-size: 25px; font-weight: lighter; line-height: 1.2; margin: 5px -15px; padding: 15px;">
I. Before you begin.</h3>
<div style="box-sizing: border-box; font-family: Oxygen, sans-serif; font-size: 16px; line-height: 1.71109; margin-bottom: 10px;">
1. You must have a rooted Android device. If you would like to root your phone and haven’t yet, head on over <a href="http://theunlockr.com/how-tos/how-tos-advanced/android-how-tos/" style="-webkit-backface-visibility: hidden; -webkit-transition: 0.25s; box-sizing: border-box; color: #1a7c9b; text-decoration: none; transition: 0.25s;" target="_blank">here</a> to our How to section to find your specific device. 2. You must have previously installed a custom kernel on your phone. If you haven’t, head on over <a href="http://theunlockr.com/2011/08/22/how-to-install-a-custom-kernel-on-a-rooted-android-device/" style="-webkit-backface-visibility: hidden; -webkit-transition: 0.25s; box-sizing: border-box; color: #1a7c9b; text-decoration: none; transition: 0.25s;" target="_blank">here</a>, to  learn our “how to flash a custom kernel” tutorial. 3. To save from an potential headaches, I recommend doing a back up to easily revert to in case something goes wrong.</div>
<h3 style="background-color: #333333; box-sizing: border-box; color: white; font-family: Oswald; font-size: 25px; font-weight: lighter; line-height: 1.2; margin: 5px -15px; padding: 15px;">
II. Installing SetCPU.</h3>
<div style="box-sizing: border-box; font-family: Oxygen, sans-serif; font-size: 16px; line-height: 1.71109; margin-bottom: 10px;">
1. Open up the Android market application. 2. Search for “setcpu” (without quotations). 3. Select download, then select install.</div>
<h3 style="background-color: #333333; box-sizing: border-box; color: white; font-family: Oswald; font-size: 25px; font-weight: lighter; line-height: 1.2; margin: 5px -15px; padding: 15px;">
III. Using SetCPU.</h3>
<div style="box-sizing: border-box; font-family: Oxygen, sans-serif; font-size: 16px; line-height: 1.71109; margin-bottom: 10px;">
1. Open up the application. 2. Once open, select “Auto Detect Speeds”. 3. When asked to allow root access, select OK. 4. Select both the maximum and minimum speeds you would like to use (BE CAREFUL here, DO NOT go to high or too low as your phone may stop operating. Do not choose “set on boot” until you are comfortable with the set up). If it stops become responsive, pull the battery, go into recovery and do a system restore. 5. Once you get the satisfactory speeds, select when you would like the application to kick in (i.e…user space, performance or on demand).</div>

17 3 0 Want to get better performance with your rooted Android device? Use a free application called SetCPU to overclock your...

5 Ways to Speed Up Your Android Phone in Under 5 Minutes

Labels: 5 Ways to Speed Up Your Android Phone in Under 5 Minutes, Cracking WEP with BackTrack

Speed Up Your Android Phone
You used to love your Android handset, but now that it has slowed down considerably, the bloom is off the rose. When you hit the home button or launch a new app, it takes what seems like an eternity to switch to the new task or back to the desktop. Maybe your Android phone has become so slow that letters appear a second or two after you type them. Fortunately, you can rekindle the romance and speed up your Android phone in under 5 minutes if you use these simple tips. Talk about a quickie!

1. Clear Your App Cache (30 seconds)
Over time, your programs write to the app cache on your phone and eat up precious system resources while slowing everything down. You can clear the cache on any individual app by visiting its property page in the Settings menu and tapping the clear cache button, but with dozens of apps on most phones, it could take an eternity to do this manually.

Clear Cache Settings

App Cache Cleaner, a free app, makes it easy to delete the cache on all your apps at once with just a couple of taps. After installing and launch App Cache Cleaner, simply tap Clear All and you’re done.

Cache Cleaner

Of course, the cache will fill  up again over time, and you’ll want to delete it again. App Cache Cleaner has an Auto Clear feature. If you enter its settings menu, tap Auto Clear Interval and select a duration, it will automatically clear the cache on a regular basis. However, this means that the app needs to run in the background.

Auto Clear Interval in App Cache Cleaner

Installing and using App Cache Cleaner for the first time should take around 30 seconds.

2. Disable or Uninstall Unused Apps (60 seconds)
You may not know it, but many of the apps you never even use may be running in the background, eating up precious system resources. From the app that you tried for 5 minutes last month to the shopping app that came preloaded on your phone, every unused app has the potential to weigh your phone down. It’s easy to uninstall apps you’ve downloaded yourself, but crapware is a little harder to dispose of.

If you have rooted your phone, you can completely remove every trace of your preloaded apps. If not, you can still disable those apps through the settings menu. It should take about 10 seconds to uninstall or disable each app you don’t want. It should take you approximately one minute to get rid of 6 apps, longer if you have more crapware to dump.

MORE: How to Remove Android Crapware

3. Install a New App Launcher (30 seconds)
Your phone’s app launcher controls your desktop, lock screen apps menu, and other critical parts of the UI. Though every Android phone comes with its own preloaded app launcher, you can install a third party launcher that will not only change the look and feel of your device, but also speed the time it takes it to navigate around the OS. There are many different launchers available in the app store, but we found Lightning Launcher Home to be among the fastest and easiest to use.

To use Lightning Launcher or another launcher of your choice:

Install Lightning Launcher from the Google Play store.
Tap the Home Button. A menu appears asking you which launcher you want.
Select Lightning Launcher and Tap Always.
 Set to Lightning Launcher and Select Always
Downloading the Lightning Launcher, and setting it to run as your default should take 30 seconds.
4. Remove Unnecessary Widgets and Shortcuts (30 seconds)
Even with a speedy App Launcher installed, your phone will use more memory the more widgets and shortcuts it has in memory. Look through your desktops for widgets you don’t absolutely need and remove them by long pressing and dragging them off screen.

Remove a Widget

A number of phones with widgets that advertise services such as media stores or news services. Unless you really want to look at a list of hot YouTube videos or Google Play Books on your home screen every day, remove these.

Dragging half a dozen shortcuts and widgets off  of your desktops should take 30 seconds.

5. Limit or Disable Background Data (10 to 60 seconds)
Your email, your Gmail, your Facebook, your Twitter and your backup app all want to ping the Internet for data on a regular basis. All that syncing not only eats up your battery, but also takes up system resources and slows your device down.

There are some services you may want to sync in real time, but there are others you can check manually. For example, if you don’t need to be alerted the moment you get a Facebook mention or receive an email to your personal account, you can prevent those from connecting in the background.

To disable background data for all apps:

Navigate to Settings.
Tap Data usage.
Select Data Usage 
Launch the context menu by tapping the three dots in the upper left corner of the screen or hitting the menu button (on Samsung and LG phones).
Select Data Usage
Toggle Autosync data to off and tap Ok on the warning that comes up.
Select Autosync Data
To disable background data for Gmail, Google+ and other Google Services:

Navigate to Settings. You can get to the Android settings menu from the notification drawer or apps menu.
Tap on Google under accounts.
Tap the Account You Want to Stop From Syncing 
Tap the account name.  If the sync icon next to the account name is green, it has sync permission. If it is gray, syncing is already disabled.
Select Your Gmail account
Toggle all types of data syncing to off, including email, contacts and calendar.
Toggle Sync to Off 
To turn off background data in other apps such as Facebook or the standalone email client,  you must go directly into their settings’ menus and find the option to never update or update manually. Disabling all your background at once should take just 10 seconds, but if you want to manually disable Gmail, Facebook and email client autosync separately, this process could take as long as a  minute.
Depending on how many apps you need to uninstall and services you wish to disable, you could finish speeding up your phone in as little as 2 minutes and 40 seconds. That’s a very small time investment to make your smartphone snappier.

Speed Up Your Android Phone You used to love your Android handset, but now that it has slowed down considerably, the bloom is off the rose. ...

Four tips to speed up your Android tablet

Labels: Cracking WEP with BackTrack, Four tips to speed up your Android tablet

If your Android tablet is starting to bog down and become unresponsive, these four tips may help. 
android_tablet_performance.jpg

I've seen it before with a number of devices; Android tablets starting to bog down to the point of not being responsive at all. What do you do? Is it time to reset that tablet to factory defaults? Probably not. Instead of scrapping the current state of your tablet, try these four quick tips to regain control of your wayward Android tablet.

Since every Android tablet is not created equally, some of these tips will either not work or their steps might vary. I'll be demonstrating on a Verizon-branded Samsung Galaxy Note with Android version 4.1.2. Let's begin with the most obvious tip and work our way down.

1. Restart
Sometimes, a restart is the fastest means of getting your tablet resources back. Of course, this is also (depending upon your device) the slowest method. Plus, if you're in the middle of working on a file or cloud resource, you could lose your work. However, if it's the only route to success, it must be done.

To restart your tablet, follow these steps:

Press and hold the power button
When prompted, tap Restart
Tap OK when prompted
Allow the device to restart
I would never say this is the best method of getting your resources back -- or controlling a wayward application. For that, I would use the built-in task manager. Let's now work through using that tool to manage your running tasks.

2. Task manager
Although you might not be currently using an app, said application could still be residing in your tablet's memory. Fortunately, task managers are always at the ready to help you close apps that currently reside in memory. Android has a very handy built-in Task manager that's quick to access and easy to use. It also attempts to close applications that haven't been used in a while. Most of the time, it does a good job -- but sometimes, an application will prove too stubborn for the Task manager to close. When that happens, it's time to go manual mode on that rogue app.

To access the Task manager, tap the multi-task button on the device panel (third from the left on Samsung Galaxy tablets). From the running app list, you can tap Close all (to close all running applications) or Task manager (to open the task manager tool).

Once you have the Task manager open (Figure A), you can tap End all (to close all running applications) or the End button associated with a particular application.

Figure A

Figure A
The Task manager on a Verizon-branded Samsung Galaxy Note tablet.

Be aware that the more applications you have in memory, the less memory will be available -- at least until either the Task manager starts closing some apps or you do it manually.

3. Watchdog
If the built-in Task manager doesn't seem to be catching rogue apps, there's a third-party application that does a great job of doing just that. The application is called Watchdog. This application monitors running apps so you can easily see if any have gotten out of hand and are eating up your CPU. There is a free version called Watchdog Task Manager Lite and a full version that costs $3.49 (USD) called Watchdog Task Manager. The paid app removes advertisements and includes a blacklist, which allows you to choose an app, assign a CPU threshold to it, and have Watchdog automatically kill the app should it exceed the set threshold.

The free version gives you quick access to what apps are using the CPU (and how much of the CPU they are using, as shown in Figure B).

Figure B

Figure B
The Watchdog CPU listing shows a pretty smoothly running system.

What isn't obvious about Watchdog is that from the CPU listing, you can kill, Whitelist, or launch an application. To do that, tap on the app listing and slide it to the right. A new popup will appear (Figure C) that allows you to take those actions.

Figure C

Figure C
How to act on a running application in Watchdog.

The Watchdog Alerts tab will show any application that is misbehaving. If anything pops up in this window, be sure to kill it (from the CPU tab).

4. Read reviews
Finally, I would like to say this: The Google Play Store doesn't have the Big Brother-like vetting system that the Apple App Store enjoys. Because of this, questionable apps can make their way into the Play Store -- and then onto your device. Make sure you read reviews of apps before you install them. Many times, when an app is questionable, it will be mentioned by at least one reviewer. If you see mention of malware in a review, avoid that app completely.

The Android platform makes for a smooth running tablet experience. There are times, however, when you'll need to know what to do should an app go rogue. Whether you use the built-in Task manager, a third-party tool, or simply reboot your device, it's pretty easy to get control of your apps and speed up the processing power of your Android tablet.

If your Android tablet is starting to bog down and become unresponsive, these four tips may help. android_tablet_performance.jpg I've ...

Apps to Increase Android WiFi Connection Speed

Labels: Apps to Increase Android WiFi Connection Speed, Cracking WEP with BackTrack

Sometimes you might creep in with some astonishing problems on your Android smartphone. One of them is having a bad Android WiFi connection speed. Since certain functions on your Android mobile phone needs WiFi connection. Having a bad WiFi connection can really spoil your mind.

If you are facing a bad connection speed. Just try out the following Android apps to increase your Android WiFi connection speed.

Internet Connection Booster

This is an awesome app that can speed up Android connection up to 20%. With this application installed on your device you can speed up instantly WiFi/GPRS/UMTS internet connections. Besides that it can also boost Bluetooth connections up to +20%.

The app works in two ways to speed up your connections:

By simply optimizing system configuration parameters of your Android device.
By dropping  your current connection when it finds a better connection. It could be a closer WiFi access point or a stronger cell tower which gives a better network signal.
wifi internet connection booster app
Download Internet Connection Booster.

Network Signal Booster

This application boosts your Android WiFi network connection by 30-40% just by pressing one button. It is probably the most advanced network signal booster on market. It  runs well-known commands and tweaks to improve 3G, 4G, and WiFi signal.

One thing you should be keep in mind here that this app is device dependent. Therefore, results on different devices may vary.

network signal booster app

Download Network Signal Booster.

WiFi Booster Easy Connect

As the name suggest this app not only boosts WiFi connection but also finds the best available WiFi access points. The app enables you to search for best available open WiFi networks with just one press.

android wifi booster easy connect

Download WiFi Booster Easy Connect.

Sometimes you might creep in with some astonishing problems on your Android smartphone. One of them is having a bad Android WiFi connection ...

Top 5 free Wi-Fi app for android to improve your Wifi Connection

Labels: Cracking WEP with BackTrack, Top 5 free Wi-Fi app for android to improve your Wifi Connection

Top 5 free Wi-Fi app for android to improve your Wifi Connection
For a smartphone owner, there’s nothing more frustrating than having run out your 3G or GPRS network, only leaving you with a hard time of making calls or sending text messages.  So here I have gathered a list of Wi-Fi apps for android, which allow you to find public Wi-Fi networks, turn your phone into a wifi hotspot and a bit more.

WiFi Manager1. WiFi Manager

This app allows you find, connect, and manage WiFi networks. It can also improve connection quality with a graphical channel radar. Of course the app supports discover open networks around you. Personally, the app it’s my favorite.

The app also includes home screen widgets: one displays detailed connection info, another lets you switch among your favorite networks with a single tap, and yet another toggles WiFi Access Point.

Free Zone WiFi2. Free Zone WiFi

Want cut your 3G some slack? Or save some money by stop use your 3g mobile networking? Then you must download this app.

Free Zone is the easiest way to find and connect to free Wi-Fi networks. As soon as you get into range of a free Wi-Fi network, you're connected automatically to the Internet. Very Easy to use.

WiFinder 3. WiFinder

This app can act as a nice and functional WiFi scanner, and allows you to connect all wifi networks: Open, WEP, WPA, and WPA2. Simple but useful.
Features:
List of network contains channel, graphic level, encryption.
Save/remove networks supported - Forget option.
Auto Scan function.

WiFi Booster Easy Connect4. WiFi Booster Easy Connect
You can connect to the best available WiFi access points in 2 taps with this amazing app! Having been to a place, like a mall or coffee place wondering if there are any open WiFi around you and not wanna go through all the menus just to check it out? Let this app do it for you!

Features:
One of the easiest most convenient WiFi Apps you'll find
Includes a wifi network speed booster
Includes 1 press search for best remembered wifi networks
Includes 1 press search for best open wifi networks
Very lightweight WiFi Connectivity Manager with Easy Connect and booster

WiFi Overview 3605. WiFi Overview 360
Finding the best and fastest Wi-Fi connection available is an easy task if you use WiFi Overview 360. You can use this app to manage and optimize your WiFi connections through its channel checker and channel radar. It will show you a detailed description of the wireless networks available, including the name, signal strength, channel number, and encryption ,open or not.

To optimize your connection, you can use the app to find a channel or frequency range where there are fewer or no wireless networks using it other than your network. To help you evaluate the wireless networks around you, the app gives you a graphical representation of all the wireless networks within its operating range. From there, the app helps you determine the best channel of choice. So if you want to optimize your network connection, try WiFi Overview 360 for free.

Just try these apps that have showed you in this article if you are on the way to find some app to boost your Wi-Fi connection.

Top 5 free Wi-Fi app for android to improve your Wifi Connection For a smartphone owner, there’s nothing more frustrating than having run ou...

5 Best Wi-Fi Apps for Android to Boost Mobile Network and Wi-Fi Signals

Labels: 5 Best Wi-Fi Apps for Android to Boost Mobile Network and Wi-Fi Signals, Cracking WEP with BackTrack, wifi booster android

5 Best Wi-Fi Apps for Android to Boost Mobile Network and Wi-Fi Signals
For smartphone owners, actually there is nothing more frustrating than having a poor network signal or Wi-Fi connection, which leaves you with a slow internet connection or a hard time to make calls and send text messages. No matter how powerful your device is, I bet you will not enjoy it much without a decent internet connection or a strong network signal to work with. To avoid you lost in a bad situation, here I have put together 5 best free Android Wi-Fi apps to boost your mobile network and Wi-Fi signals, find public Wi-Fi networks, turn your phone into a Wi-Fi hotspot and more.

1. Wi-Fi Analyzer

This is the most powerful Wi-Fi app for Android. Whether you are using home Wi-Fi or you are always using free public Wi-Fi access points, Wi-Fi Analyzer could help you boost your Wi-Fi connection. When setting up a Wi-Fi connection at home, you can use this app to evaluate the best channel to use so as to avoid overlapping with other Wi-Fi connections and essentially giving you better signal strength.

It also works great if you are in a public area where there are lots of Wi-Fi connections. You can use it to evaluate which wireless networks are the best to connect to. Quite easy to use Android Wi-Fi app. Recommended.

2. Wi-Fi Manager

Managing your Wi-Fi connections will be a piece of cake if you use Wi-Fi Manager. It lets you find, connect and manage Wi-Fi networks freely. Taking it into use, you can easily find open networks around you. If you have more than a handful of networks available, managing them would be quite easy via this app.

The app includes two home screen widgets: one displaying detailed connection info, another letting you switch among favorite networks with a single tap. It also includes graphical channel which helps improve the connection quality, giving your connection speed a boost every time you use the app. It is really a useful app to use and becomes my favorite.

3. OpenSignalMaps

Have you tried walking all around your house just to get a better signal for you phone? I bet you have done that at least once. It is a little hard to guess where you can get the best signal. Some even climb to the roof of their houses just to get a better signal, but you don’t have to do that when you use OpenSignalMaps. This app will literally show you where you can get a strong signal for your device.

When you use the app, it shows you the direction of the signal through an arrow, a map and even a radar where the location of cellular towers are shown. This way, you don’t have to guess and walk around to find a signal; instead you can follow the locations of the cellular towers where a strong network signal is surely available. Aside from helping you out with your network signal, it also shows where you are getting your Wi-Fi connection, helping you find free network connections wherever you are.

4.Wi-Fi Finder

If you are on the lookout for a nice and functional Wi-Fi scanner, you can consider using this app on my queue of Android Wi-Fi apps. It allows you to connect all Wi-Fi networks: Open, WEP, WPA and WPA2. Simple yet useful app.

Features:

List of network contains channel, graphic level, encryption. 
Save/remove networks supported - Forget option. 
Auto Scan function.

5. Free Zone - Free WiFi Scanner

Want to save money and cut your 3G fee? If so, this app is your must have. With free Zone Wi-Fi, you can save up on your 3G data package as this app keeps you posted about all available free networks. Unlike a number of other Android Wi-Fi apps which just display paid hotspots or those which refuse to work, this software lets you know about over 1,500,000 hotspots that are absolutely free. Whether you launch it or not, it continues to run in the background and search for available networks. As soon as you are in the vicinity of an open hotspot, your mobile will connect automatically to the Internet.

So, which Android Wi-Fi finder you are using now? Also in my list? If no, just share it with us in the comments!

5 Best Wi-Fi Apps for Android to Boost Mobile Network and Wi-Fi Signals For smartphone owners, actually there is nothing more frustrating th...

5 Best Wi-Fi Apps for Android to Boost Mobile Network and Wi-Fi Signals

Labels: 5 Best Wi-Fi Apps for Android to Boost Mobile Network and Wi-Fi Signals, Cracking WEP with BackTrack, wifi booster android

1. Wi-Fi Analyzer

2. Wi-Fi Manager

3. OpenSignalMaps

4.Wi-Fi Finder

Features:

List of network contains channel, graphic level, encryption. 
Save/remove networks supported - Forget option. 
Auto Scan function.

5. Free Zone - Free WiFi Scanner

So, which Android Wi-Fi finder you are using now? Also in my list? If no, just share it with us in the comments!

5 Best Wi-Fi Apps for Android to Boost Mobile Network and Wi-Fi Signals For smartphone owners, actually there is nothing more frustrating th...

Wi-fi Mythbuster: Do NOT hide your SSID

On Friday, November 1, 2013 Labels: Cracking WEP with BackTrack, Wi-fi Mythbuster: Do NOT hide your SSID

Wi-fi users are often advised to disable or hide the SSID (Service Set Identifier, or simply, the network name) of their routers as a security measure. This tip appears in numerous web pages, books, and magazines. It even shows up on the websites of wireless product manufacturers.

The idea behind disabling SSID is to make your wireless router “invisible” to hackers and other malicious users. Unfortunately, merely disabling SSID is not effective as a security measure, and any active wi-fi router can be revealed quite easily. Free tools like Netstumbler (www.netstumbler.com) will display all active wi-fi routers, regardless of whether their SSID is hidden. Worse, disabling SSID can actually degrade network performance.

The “hide SSID” myth was actually been debunked for years. No less than Robert Moskowitz, senior technical director at ICSA Labs warned against it as far back as Dec 2003, in a paper titled “Debunking the Myth of SSID Hiding” (PDF warning).

“Efforts to hide the SSID are at best half-measures which lead to a false sense of security and to a degradation of wireless network performance.” Moskowitz wrote.

Microsoft also advices against disabling SSIDs, as evidenced by these two pages from its TechNet website — “Non-broadcast Wireless Networks with Microsoft Windows,” and “Non-Broadcast Wireless SSIDs: Why hidden wireless networks are a bad idea.” So, you should merely change your router’s SSID, and not disable it.

For more robust security wi-fi measures, use WPA encryption, set a strong password, and turn on MAC address filtering.

Wi-fi users are often advised to disable or hide the SSID (Service Set Identifier, or simply, the network name) of their routers as a securi...

hacking wifi

Labels: Cracking WEP with BackTrack, hack wifi tutorial free

Wi-Fi has evolved over the years, and so have the techniques for securing your wireless network. An Internet search could unearth information that’s outdated and no longer secure or relevant, or that’s simply a myth.

We’ll separate the signal from the noise and show you the most current and effective means of securing your Wi-Fi network.
Myth No. 1: Don’t broadcast your SSID

Every wireless router (or wireless access point) has a network name assigned to it. The technical term is a Service Set Identifier (SSID). By default, a router will broadcast its SSID in beacons, so all users within its range can see the network on their PC or other device.
An SSID that isn't broadcast will still show up as
an 'Other Network' in Windows 7.

Preventing your router from broadcasting this information, and thereby rendering it somewhat invisible to people you don’t want on your network, might sound like a good idea. But some devices—including PCs running Windows 7 or later—will still see every network that exists, even if it can’t identify each one by name, and unmasking a hidden SSID is a relatively trivial task. In fact, attempting to hide an SSID in this way might pique the interest of nearby Wi-Fi hackers, by suggesting to them that your network may contain sensitive data.

You can prevent your router from including its SSID in its beacon, but you can’t stop it from including that information in its data packets, its association/reassociation requests, and its probe requests/responses. A wireless network analyzer like Kismet or CommView for WiFi, can snatch an SSID out of the airwaves in no time.
This wireless network analyzer showed the hidden SSID of 'cottage111' after I connected a device to the network. The analyzer captured the SSID from the association packets that the device exchanged with the router. (Click to enlarge.)

Disabling SSID broadcasting will hide your network name from the average Joe, but it’s no roadblock for anyone intent on hacking into your network, be they an experienced blackhat or a neighborhood kid just goofing around.
Myth No. 2: Enable MAC address filtering

A unique Media Access Control (MAC) address identifies every device on your network. A MAC address is an alphanumeric string separated by colons, like this: 00:02:D1:1A:2D:12. Networked devices use this address as identification when they send and receive data over the network. A tech myth asserts that you can safeguard your network and prevent unwanted devices from joining it by configuring your router to allow only devices that have specific MAC addresses.

Setting up such configuration instructions is an easy, though tedious, process: You determine the MAC address of every device you want to allow on your network, and then you fill out a table in the router’s user interface. No device with a MAC address not on that table will be able to join your network, even if it knows your wireless network password.

But you needn’t bother with that operation. A hacker using a wireless network analyzer will be able to see the MAC addresses of every computer you’ve allowed on your network, and can change his or her computer’s MAC address to match one that’s in that table you painstakingly created. The only thing you’ll have accomplished by following this procedure is to waste some time—unless you think that having a complete list of the MAC addresses of your network clients would be useful for some other purpose.
A wireless network analyzer scans the airwaves and shows the MAC addresses of the wireless routers and access points on your network, as well as all the computers and other devices connected to them. (Click to enlarge.)

MAC-address filtering might help you block the average Joe from connecting to your router from an unauthorized computer or other device, but it won’t stop a determined hacker. It will render your network more difficult for legitimate users to work with, however, because you’ll have to configure your router every time you add a new device to it or provide a guest with temporary access.
Myth No. 3: Limit your router’s IP address pool

Every device on your network must also be identified by a unique Internet Protocol (IP) address. A router-assigned IP address will contain a string of digits like this: 192.168.1.10. Unlike a MAC address, which the device sends to the router, your router will use its  Dynamic Host Control Protocol (DHCP) server to assign and send a unique IP address to each device joining the network. According to one persistent tech myth, you can control the number of devices that can join your network by limiting the pool of IP addresses your router can draw—a range from 192.168.1.1 to 192.168.1.10, for instance. That’s baloney, for the same reason that the next claim is.
Myth No. 4: Disable your router’s DHCP server

The flawed logic behind this myth claims that you can secure your network by disabling your router’s DHCP server and manually assigning IP address to each device. Supposedly, any device that doesn’t have one of the IP addresses you assigned won’t be able to join your network. In this scenario, you would create a table consisting of IP addresses and the devices they’re assigned to, as you would with a MAC addresses. You’d also need to configure each device manually to use its specified IP address.
Disabling your router's DHCP server and manually limiting the number of IP addresses it can assign are not effective security procedures. (Click to enlarge.)

The weakness that negates these procedures is that if a hacker has already penetrated your network, a quick IP scan can determine the IP addresses your network is using. The hacker can then manually assign a compatible address to a device in order to gain full access to your network. As with MAC address filtering, the main effect of limiting IP addresses (or assigning them manually) is to complicate the process of connecting new devices that you approve of to your network.
This scanning app reveals all of the IP addresses in use on a wireless network. (Click to enlarge.)
Myth No. 5: Small networks are hard to penetrate

This myth suggests that reducing your wireless router’s transmission power will make it harder for someone outside your home or place of business to sneak onto your network because they won’t be able to detect it. This is the dumbest security idea of them all. Anyone intent on cracking your wireless network will use a large antenna to pick up your router’s signals. Reducing the router’s transmission power will only reduce its range and effectiveness for legitimate users.
No myth: Encryption is the best network security

Now that we’ve dispensed with five Wi-Fi security myths, let’s discuss the best way to secure your wireless network: encryption. Encrypting—essentially scrambling—the data traveling over your network is powerful way to prevent eavesdroppers from accessing data in a meaningful form. Though they might succeed in intercepting and capturing a copy of the data transmission, they won’t be able to read the information, capture your login passwords, or hijack your accounts unless they have the encryption key.

Several types of encryption have emerged over the years. Wired Equivalent Privacy (WEP) provided the best security in the early days of Wi-Fi. But today WEP encryption can be cracked in a matter of minutes. If that’s the only security your router provides, or if some of your networked devices are so old that they can work only with WEP, it’s long past time for you to recycle them and upgrade to a newer standard.

Wi-Fi Protected Access (WPA) came next, but that security protocol had security problems, too, and has been superseded by WPA2. WPA2 has been around for nearly 10 years. If your equipment is old enough to be limited to WPA security, you should consider an upgrade.
WPA SecurityWPA2, with an AES-encrypted preshared key, is an effective security protocol for home networks. (Click to enlarge.)

Both WPA and WPA2 have two different modes: Personal (aka PSK, an acronym for Pre-Shared Key) and Enterprise (aka RADIUS, an acronym for Remote Authentication Dial In User Server). WPA Personal is designed for home use and is easy to set up. You simply establish a password on your router and then enter that password on each computer and other device that you want to connect to your Wi-Fi network. As long as you use a strong password—I recommend using 13 or more mixed-case characters and symbols—you should be fine. Don’t use words found in the dictionary, proper nouns, personal names, the names of your pets, or anything like that. A strong password might look like this: h&5U2v$(q7F4*.

Your router might include a push-button security feature called Wi-Fi Protected Setup (WPS). WPS enables you to join a device to your WPA2-secured wireless network by pushing a button on the router and a button on the client (if the client also supports WPS). A flaw in WPS leaves it vulnerable to brute-force attacks, however. If you’re particularly security-conscious, you might consider turning off WPS in your router.

Enterprise-mode WPA2 is designed for networks run by businesses and organizations. It provides a higher level of security than WPA, but it requires a RADIUS server or a hosted RADIUS service.

Now that you understand the best way to secure your network, spend a few minutes making sure that your router is configured properly.

Wi-Fi has evolved over the years, and so have the techniques for securing your wireless network. An Internet search could unearth informat...

5 Wi-Fi security myths you must abandon now

Labels: 5 Wi-Fi security myths you must abandon now, Cracking WEP with BackTrack, hack wifi

We’ll separate the signal from the noise and show you the most current and effective means of securing your Wi-Fi network.
Myth No. 1: Don’t broadcast your SSID

Enterprise-mode WPA2 is designed for networks run by businesses and organizations. It provides a higher level of security than WPA, but it requires a RADIUS server or a hosted RADIUS service.

Now that you understand the best way to secure your network, spend a few minutes making sure that your router is configured properly.

Wi-Fi has evolved over the years, and so have the techniques for securing your wireless network. An Internet search could unearth informat...

5 Wi-Fi security myths you must abandon now

Labels: 5 Wi-Fi security myths you must abandon now, Cracking WEP with BackTrack, hack wifi

We’ll separate the signal from the noise and show you the most current and effective means of securing your Wi-Fi network.
Myth No. 1: Don’t broadcast your SSID

Enterprise-mode WPA2 is designed for networks run by businesses and organizations. It provides a higher level of security than WPA, but it requires a RADIUS server or a hosted RADIUS service.

Now that you understand the best way to secure your network, spend a few minutes making sure that your router is configured properly.

Wi-Fi has evolved over the years, and so have the techniques for securing your wireless network. An Internet search could unearth informat...

Hacking Techniques in Wireless Networks

Labels: Cracking WEP with BackTrack, Hacking Techniques in Wireless Networks

This article is scheduled to appear in “The Handbook of Information Security”, Hossein Bidgoli (Editor-in-Chief), John Wiley & Sons, Inc., 2005.

1.    Introduction

2.    Wireless LAN Overview

2.1        Stations and Access Points

2.2        Channels

2.3        WEP

2.4        Infrastructure and Ad Hoc Modes

2.5        Frames

2.6        Authentication

2.7        Association

3.    Wireless Network Sniffing

3.1        Passive Scanning

3.2        Detection of SSID

3.3        Collecting the MAC Addresses

3.4        Collecting the Frames for Cracking WEP

3.5        Detection of the Sniffers

4.    Wireless Spoofing

4.1        MAC Address Spoofing

4.2        IP spoofing

4.3        Frame Spoofing

5.    Wireless Network Probing

5.1        Detection of SSID

5.2        Detection of APs and stations

5.3        Detection of Probing

6.    AP Weaknesses

6.1        Configuration

6.2        Defeating MAC Filtering

6.3        Rogue AP

6.4        Trojan AP

6.5        Equipment Flaws

7.    Denial of Service

7.1        Jamming the Air Waves

7.2        Flooding with Associations

7.3        Forged Dissociation

7.4        Forged Deauthentication

7.5        Power Saving

8.    Man-in-the-Middle Attacks

8.1        Wireless MITM

8.2        ARP Poisoning

8.3        Session Hijacking

9.    War Driving

9.1        War chalking

9.2        Typical Equipment

10.       Wireless Security Best Practices

10.1      Location of the APs

10.2      Proper Configuration

10.3      Secure Protocols

10.4      Wireless IDS

10.5      Wireless Auditing

10.6      Newer Standards and Protocols

10.7      Software Tools

11.       Conclusion

GLOSSARY

Cross References

References

Further Reading

Key Words

IEEE 802.11, wireless spoofing, cracking WEP, forged Deauthentication, rogue/ Trojan access points, session hijacking, war driving.

Abstract

This article describes IEEE 802.11-specific hacking techniques that attackers have used, and suggests various defensive measures. We describe sniffing, spoofing and probing in the context of wireless networks.  We describe how SSIDs can be determined, how a sufficiently large number of frames can be collected so that WEP can be cracked.  We show how easy it is to cause denial-of-service through jamming and through forged disassociations and deauthentications.  We also explain three man-in-the-middle attacks using wireless networks.  We give a list of selected open-source tools.  We summarize the activity known as war driving.  We conclude the article with several recommendations that will help improve security at a wireless deployment site.
1.  Introduction

Wireless networks broadcast their packets using radio frequency or optical wavelengths.  A modern laptop computer can listen in.  Worse, an attacker can manufacture new packets on the fly and persuade wireless stations to accept his packets as legitimate.

We use the term hacking as described below.

hacker n. [originally, someone who makes furniture with an axe] 1. A person who enjoys exploring the details of programmable systems and how to stretch their capabilities, as opposed to most users, who prefer to learn only the minimum necessary. 2. One who programs enthusiastically (even obsessively) or who enjoys programming rather than just theorizing about programming. 3. A person capable of appreciating hack value. 4. A person who is good at programming quickly. 5. An expert at a particular program, or one who frequently does work using it or on it; as in `a Unix hacker'. (Definitions 1 through 5 are correlated, and people who fit them congregate.) 6. An expert or enthusiast of any kind. One might be an astronomy hacker, for example. 7. One who enjoys the intellectual challenge of creatively overcoming or circumventing limitations. 8. [deprecated] A malicious meddler who tries to discover sensitive information by poking around. Hence `password hacker', `network hacker'. The correct term for this sense is cracker.

From The Jargon Dictionary http://info.astrian.net/jargon/

This article describes IEEE 802.11-specific hacking techniques that attackers have used, and suggests various defensive measures. It is not an overview of security features proposed in WPA or IEEE 802.11i.  We do not consider legal implications, or the intent behind such hacking, whether malevolent or benevolent.  The article’s focus is in describing techniques, methods,  analyses and uses in ways unintended by the designers of IEEE 802.11. 
2.  Wireless LAN Overview

In this section, we give a brief overview of wireless LAN (WLAN) while emphasizing the features that help an attacker.  We assume that the reader is familiar with the TCP/IP suite (see, e.g., [Mateti 2003]).

IEEE 802.11 refers to a family of specifications (www.ieee802.org/11/) developed by the IEEE for over-the-air interface between a wireless client and an AP or between two wireless clients.  To be called 802.11 devices, they must conform to the Medium Access Control (MAC) and Physical Layer specifications. The IEEE 802.11 standard covers the Physical (Layer 1) and Data Link (Layer 2) layers of the OSI Model.  In this article, we are mainly concerned with the MAC layer and not the variations of the physical layer known as 802.11a/b/g.
2.1           Stations and Access Points

A wireless network interface card (adapter) is a device, called a station, providing the network physical layer over a radio link to another station.  An access point (AP) is a station that provides frame distribution service to stations associated with it.  The AP itself is typically connected by wire to a LAN.

The station and AP each contain a network interface that has a Media Access Control (MAC) address, just as wired network cards do. This address is a world-wide-unique 48-bit number, assigned to it at the time of manufacture. The 48-bit address is often represented as a string of six octets separated by colons (e.g., 00:02:2D:17:B9:E8) or hyphens (e.g., 00-02-2D-17-B9-E8). While the MAC address as assigned by the manufacturer is printed on the device, the address can be changed in software.

Each AP has a 0 to 32 byte long Service Set Identifier (SSID) that is also commonly called a network name.  The SSID is used to segment the airwaves for usage. If two wireless networks are physically close, the SSIDs label the respective networks, and allow the components of one network to ignore those of the other. SSIDs can also be mapped to virtual LANs; thus, some APs support multiple SSIDs.  Unlike fully qualified host names (e.g., gamma.cs.wright.edu), SSIDs are not registered, and it is possible that two unrelated networks use the same SSID. 
2.2           Channels

The stations communicate with each other using radio frequencies between 2.4 GHz and 2.5 GHz. Neighboring channels are only 5 MHz apart.  Two wireless networks using neighboring channels may interfere with each other.
2.3           WEP

Wired Equivalent Privacy (WEP) is a shared-secret key encryption system used to encrypt packets transmitted between a station and an AP.  The WEP algorithm is intended to protect wireless communication from eavesdropping. A secondary function of WEP is to prevent unauthorized access to a wireless network.  WEP encrypts the payload of data packets.  Management and control frames are always transmitted in the clear.  WEP uses the RC4 encryption algorithm.  The shared-secret key is either 40 or 104 bits long.   The key is chosen by the system administrator.  This key must be shared among all the stations and the AP using mechanisms that are not specified in the IEEE 802.11. 
2.4           Infrastructure and Ad Hoc Modes

A wireless network operates in one of two modes. In the ad hoc mode, each station is a peer to the other stations and communicates directly with other stations within the network.   No AP is involved.  All stations can send Beacon and Probe frames. The ad hoc mode stations form an Independent Basic Service Set (IBSS).

A station in the infrastructure mode communicates only with an AP. Basic Service Set (BSS) is a set of stations that are logically associated with each other and controlled by a single AP. Together they operate as a fully connected wireless network.  The BSSID is a 48-bit number of the same format as a MAC address. This field uniquely identifies each BSS. The value of this field is the MAC address of the AP.
2.5           Frames

Both the station and AP radiate and gather 802.11 frames as needed.  The format of frames is illustrated below. Most of the frames contain IP packets.  The other frames are for the management and control of the wireless connection.

Figure 1 An IEEE 802.11 Frame

There are three classes of frames.   The management frames establish and maintain communications.  These are of Association request, Association response, Reassociation request, Reassociation response, Probe request, Probe response, Beacon, Announcement traffic indication message, Disassociation, Authentication, Deauthentication types.  The SSID is part of several of the management frames. Management messages are always sent in the clear, even when link encryption (WEP or WPA) is used, so the SSID is visible to anyone who can intercept these frames.

The control frames help in the delivery of data.

The data frames encapsulate the OSI Network Layer packets.  These contain the source and destination MAC address, the BSSID, and the TCP/IP datagram.  The payload part of the datagram is WEP-encrypted.
2.6           Authentication

Authentication is the process of proving identity of a station to another station or AP.  In the open system authentication, all stations are authenticated without any checking.  A station A sends an Authentication management frame that contains the identity of A, to station B.  Station B replies with a frame that indicates recognition, addressed to A.  In the closed network architecture, the stations must know the SSID of the AP in order to connect to the AP.  The shared key authentication uses a standard challenge and response along with a shared secret key.

Figure 2: States and Services
2.7           Association

Data can be exchanged between the station and AP only after a station is associated with an AP in the infrastructure mode or with another station in the ad hoc mode.  All the APs transmit Beacon frames a few times each second that contain the SSID, time, capabilities, supported rates, and other information.  Stations can chose to associate with an AP based on the signal strength etc. of each AP.   Stations can have a null SSID that is considered to match all SSIDs.

The association is a two-step process. A station that is currently unauthenticated and unassociated listens for Beacon frames. The station selects a BSS to join. The station and the AP mutually authenticate themselves by exchanging Authentication management frames.  The client is now authenticated, but unassociated.  In the second step, the station sends an Association Request frame, to which the AP responds with an Association Response frame that includes an Association ID to the station.  The station is now authenticated and associated.

A station can be authenticated with several APs at the same time, but associated with at most one AP at any time.  Association implies authentication.  There is no state where a station is associated but not authenticated.
3.  Wireless Network Sniffing

Sniffing is eavesdropping on the network.  A (packet) sniffer is a program that intercepts and decodes network traffic broadcast through a medium.  Sniffing is the act by a machine S of making copies of a network packet sent by machine A intended to be received by machine B.  Such sniffing, strictly speaking, is not a TCP/IP problem, but it is enabled by the choice of broadcast media, Ethernet and 802.11, as the physical and data link layers.

Sniffing has long been a reconnaissance technique used in wired networks.  Attackers sniff the frames necessary to enable the exploits described in later sections.  Sniffing is the underlying technique used in tools that monitor the health of a network.  Sniffing can also help find the easy kill as in scanning for open access points that allow anyone to connect, or capturing the passwords used in a connection session that does not even use WEP, or in telnet, rlogin and ftp connections.

It is easier to sniff wireless networks than wired ones. It is easy to sniff the wireless traffic of a building by setting shop in a car parked in a lot as far away as a mile, or while driving around the block. In a wired network, the attacker must find a way to install a sniffer on one or more of the hosts in the targeted subnet.  Depending on the equipment used in a LAN, a sniffer needs to be run either on the victim machine whose traffic is of interest or on some other host in the same subnet as the victim.  An attacker at large on the Internet has other techniques that make it possible to install a sniffer remotely on the victim machine.
3.1           Passive Scanning

Scanning is the act of sniffing by tuning to various radio channels of the devices. A passive network scanner instructs the wireless card to listen to each channel for a few messages.  This does not reveal the presence of the scanner.

An attacker can passively scan without transmitting at all.  Several modes of a station permit this. There is a mode called RF monitor mode that allows every frame appearing on a channel to be copied as the radio of the station tunes to various channels.  This is analogous to placing a wired Ethernet card in promiscuous mode. This mode is not enabled by default.  Some wireless cards on the market today have disabled this feature in the default firmware.  One can buy wireless cards whose firmware and corresponding driver software together permit reading of all raw 802.11 frames.   A station in monitor mode can capture packets without associating with an AP or ad-hoc network.  The so-called promiscuous mode allows the capture of all wireless packets of an associated network. In this mode, packets cannot be read until authentication and association are completed.

An example sniffer is Kismet (http://www.kismetwireless.net).   An example wireless card that permits RF monitor modes is Cisco Aironet AIR-PCM342.
3.2           Detection of SSID

The attacker can discover the SSID of a network usually by passive scanning because the SSID occurs in the following frame types: Beacon, Probe Requests, Probe Responses, Association Requests, and Reassociation Requests. Recall that management frames are always in the clear, even when WEP is enabled.

On a number of APs, it is possible to configure so that the SSID transmitted in the Beacon frames is masked, or even turn off Beacons altogether.  The SSID shown in the Beacon frames is set to null in the hope of making the WLAN invisible unless a client already knows the correct SSID.  In such a case, a station wishing to join a WLAN begins the association process by sending Probe Requests since it could not detect any APs via Beacons that match its SSID.

If the Beacons are not turned off, and the SSID in them is not set to null, an attacker obtains the SSID included in the Beacon frame by passive scanning.

When the Beacon displays a null SSID, there are two possibilities.  Eventually, an Associate Request may appear from a legitimate station that already has a correct SSID.  To such a request, there will be an Associate Response frame from the AP.  Both frames will contain the SSID in the clear, and the attacker sniffs these.  If the station wishes to join any available AP, it sends Probe Requests on all channels, and listens for Probe Responses that contain the SSIDs of the APs.  The station considers all Probe Responses, just as it would have with the non-empty SSID Beacon frames, to select an AP. Normal association then begins.  The attacker waits to sniff these Probe Responses and extract the SSIDs.

If Beacon transmission is disabled, the attacker has two choices.  The attacker can keep sniffing waiting for a voluntary Associate Request to appear from a legitimate station that already has a correct SSID and sniff the SSID as described above.  The attacker can also chose to actively probe by injecting frames that he constructs, and then sniffs the response as described in a later section.

When the above methods fail, SSID discovery is done by active scanning (see Section 5).
3.3           Collecting the MAC Addresses

The attacker gathers legitimate MAC addresses for use later in constructing spoofed frames. The source and destination MAC addresses are always in the clear in all the frames.  There are two reasons why an attacker would collect MAC addresses of stations and APs participating in a wireless network.  (1) The attacker wishes to use these values in spoofed frames so that his station or AP is not identified. (2) The targeted AP may be controlling access by filtering out frames with MAC addresses that were not registered.
3.4           Collecting the Frames for Cracking WEP

The goal of an attacker is to discover the WEP shared-secret key.  Often, the shared key can be discovered by guesswork based on a certain amount of social engineering regarding the administrator who configures the wireless LAN and all its users.  Some client software stores the WEP keys in the operating system registry or initialization scripts.  In the following, we assume that the attacker was unsuccessful in obtaining the key in this manner.  The attacker then employs systematic procedures in cracking the WEP.  For this purpose, a large number (millions) of frames need to be collected because of the way WEP works.

The wireless device generates on the fly an Initialization Vector (IV) of 24-bits.  Adding these bits to the shared-secret key of either 40 or 104 bits, we often speak of 64-, or 128-bit encryption. WEP generates a pseudo-random key stream from the shared secret key and the IV. The CRC-32 checksum of the plain text, known as the Integrity Check (IC) field, is appended to the data to be sent.  It is then exclusive-ORed with the pseudo-random key stream to produce the cipher text.   The IV is appended in the clear to the cipher text and transmitted. The receiver extracts the IV, uses the secret key to re-generate the random key stream, and exclusive-ORs the received cipher text to yield the original plaintext.

Certain cards are so simplistic that they start their IV as 0 and increment it by 1 for each frame, resetting in between for some events.  Even the better cards generate weak IVs from which the first few bytes of the shared key can be computed after statistical analyses.  Some implementations generate fewer mathematically weak vectors than others do.

The attacker sniffs a large number of frames from a single BSS.  These frames all use the same key.  The mathematics behind the systematic computation of the secret shared key from a collection of cipher text extracted from these frames is described elsewhere in this volume.  What is needed however is a collection of frames that were encrypted using “mathematically-weak” IVs. The number of encrypted frames that were mathematically weak is a small percentage of all frames.  In a collection of a million frames, there may only be a hundred mathematically weak frames.  It is conceivable that the collection may take a few hours to several days depending on how busy the WLAN is.

Given a sufficient number of mathematically weak frames, the systematic computation that exposes the bytes of the secret key is intensive.  However, an attacker can employ powerful computers.  On an average PC, this may take a few seconds to hours.  The storage of the large numbers of frames is in the several hundred-mega bytes to a few giga bytes range.

An example of a WEP cracking tool is AirSnort ( http://airsnort.shmoo.com ).
3.5           Detection of the Sniffers

Detecting the presence of a wireless sniffer, who remains radio-silent, through network security measures is virtually impossible.  Once the attacker begins probing (i.e., by injecting packets), the presence and the coordinates of the wireless device can be detected.
4.  Wireless Spoofing

There are well-known attack techniques known as spoofing in both wired and wireless networks.  The attacker constructs frames by filling selected fields that contain addresses or identifiers with legitimate looking but non-existent values, or with values that belong to others.  The attacker would have collected these legitimate values through sniffing.
4.1           MAC Address Spoofing

The attacker generally desires to be hidden.  But the probing activity injects frames that are observable by system administrators.  The attacker fills the Sender MAC Address field of the injected frames with a spoofed value so that his equipment is not identified.

Typical APs control access by permitting only those stations with known MAC addresses.  Either the attacker has to compromise a computer system that has a station, or he spoofs with legitimate MAC addresses in frames that he manufactures.  MAC addresses are assigned at the time of manufacture, but setting the MAC address of a wireless card or AP to an arbitrary chosen value is a simple matter of invoking an appropriate software tool that engages in a dialog with the user and accepts values.  Such tools are routinely included when a station or AP is purchased.  The attacker, however, changes the MAC address programmatically, sends several frames with that address, and repeats this with another MAC address.  In a period of a second, this can happen several thousand times.

When an AP is not filtering MAC addresses, there is no need for the attacker to use legitimate MAC addresses.   However, in certain attacks, the attacker needs to have a large number of MAC addresses than he could collect by sniffing.  Random MAC addresses are generated.  However, not every random sequence of six bytes is a MAC address.  The IEEE assigns globally the first three bytes, and the manufacturer chooses the last three bytes.  The officially assigned numbers are publicly available.  The attacker generates a random MAC address by selecting an IEEE-assigned three bytes appended with an additional three random bytes.
4.2           IP spoofing

Replacing the true IP address of the sender (or, in rare cases, the destination) with a different address is known as IP spoofing.   This is a necessary operation in many attacks.

The IP layer of the OS simply trusts that the source address, as it appears in an IP packet is valid.  It assumes that the packet it received indeed was sent by the host officially assigned that source address. Because the IP layer of the OS normally adds these IP addresses to a data packet, a spoofer must circumvent the IP layer and talk directly to the raw network device.  Note that the attacker’s machine cannot simply be assigned the IP address of another host X using ifconfig or a similar configuration tool. Other hosts, as well as X, will discover (through ARP, for example) that there are two machines with the same IP address.

IP spoofing is an integral part of many attacks.  For example, an attacker can silence a host A from sending further packets to B by sending a spoofed packet announcing a window size of zero to A as though it originated from B.
4.3           Frame Spoofing

The attacker will inject frames that are valid by 802.11 specifications, but whose content is carefully spoofed as described above.

Frames themselves are not authenticated in 802.11 networks.  So when a frame has a spoofed source address, it cannot be detected unless the address is wholly bogus.    If the frame to be spoofed is a management or control frame, there is no encryption to deal with.  If it is a data frame, perhaps as part of an on-going MITM attack, the data payload must be properly encrypted.

Construction of the byte stream that constitutes a spoofed frame is a programming matter once the attacker has gathered the needed information through sniffing and probing.   There are software libraries that ease this task.  Examples of such libraries are libpcap (sourceforge.net/projects/libpcap/), libnet (libnet.sourceforge.net/), libdnet (libdnet. sourceforge.net/)  and libradiate (www.packetfactory.net/projects/libradiate/ ).

The difficulty here is not in the construction of the contents of the frame, but in getting, it radiated (transmitted) by the station or an AP.  This requires control over the firmware and driver of the wireless card that may sanitize certain fields of a frame.  Therefore, the attacker selects his equipment carefully.  Currently, there are off-the-shelf wireless cards that can be manipulated.  In addition, the construction of special purpose wireless cards is within the reach of a resourceful attacker.
5.  Wireless Network Probing

Even though the attacker gathers considerable amount of information regarding a wireless network through sniffing, without revealing his wireless presence at all, there are pieces that may still be missing.  The attacker then sends artificially constructed packets to a target that trigger useful responses.  This activity is known as probing or active scanning.

The target may discover that it is being probed, it might even be a honey pot (www.honeynet.org/) target carefully constructed to trap the attacker.  The attacker would try to minimize this risk.
5.1           Detection of SSID

Detection of SSID is often possible by simply sniffing Beacon frames as describe in a previous section.

If Beacon transmission is disabled, and the  attacker does not wish to patiently wait for a voluntary Associate Request to appear from a legitimate station that already has a correct SSID, or Probe Requests from legitimate stations, he will resort to probing by injecting a Probe Request frame that contains a spoofed source MAC address.  The Probe Response frame from the APs will contain, in the clear, the SSID and other information similar to that in the Beacon frames were they enabled. The attacker sniffs these Probe Responses and extracts the SSIDs.

Some models of APs have an option to disable responding to Probe Requests that do not contain the correct SSID. In this case, the attacker determines a station associated with the AP, and sends the station a forged Disassociation frame where the source MAC address is set to that of the AP.  The station will send a Reassociation Request that exposes the SSID.
5.2           Detection of APs and stations

Every AP is a station, so SSIDs, MAC addresses are gathered as described above.

Certain bits in the frames identify that the frame is from an AP.  If we assume that WEP is either disabled or cracked, the attacker can also gather the IP addresses of the AP and the stations.
5.3           Detection of Probing

Detection of probing is possible.  The frames that an attacker injects can also be heard by the intrusion detection systems (IDS) of hardened wireless LAN.  There is GPS-enabled equipment that can identify the physical coordinates of a wireless device through which the probe frames are being transmitted.
6.  AP Weaknesses

APs have weaknesses that are both due to design mistakes and user interfaces that promote weak passwords, etc.  It has been demonstrated by many publicly conducted war-driving efforts (www.worldwidewardrive.org) in major cities around the world that a large majority of the deployed APs are poorly configured, most with WEP disabled, and configuration defaults, as set up the manufacturer, untouched.
6.1           Configuration

The default WEP keys used are often too trivial. Different APs use different techniques to convert the user’s key board input into a bit vector.  Usually 5 or 13 ASCII printable characters are directly mapped by concatenating their ASCII 8-bit codes into a 40-bit or 104-bit WEP key.  A stronger key can be constructed from an input of 26 hexadecimal digits. It is possible to form an even stronger104 bit WEP key by truncating the MD5 hash of an arbitrary length pass phrase.
6.2           Defeating MAC Filtering

Typical APs permit access to only those stations with known MAC addresses.  This is easily defeated by the attacker who spoofs his frames with a MAC address that is registered with the AP from among the ones that he collected through sniffing.  That a MAC address is registered can be detected by observing the frames from the AP to the stations.
6.3           Rogue AP

Access points that are installed without proper authorization and verification that overall security policy is obeyed are called rogue APs.  These are installed and used by valid users.  Such APs are configured poorly, and attackers will find them.
6.4           Trojan AP

An attacker sets up an AP so that the targeted station receives a stronger signal from it than what it receives from a legitimate AP.  If WEP is enabled, the attacker would have already cracked it.  A legitimate user selects the Trojan AP because of the stronger signal, authenticates and associates.  The Trojan AP is connected to a system that collects the IP traffic for later analyses.  It then transmits all the frames to a legitimate AP so that the victim user does not recognize the on-going MITM attack. The attacker can steal the users password, network access, compromise the user’s system to give himself root access.  This attack is called the Evil Twin Attack.

It is easy to build a Trojan AP because an AP is a computer system optimized for its intended application.  A general purpose PC with a wireless card can be turned into a capable AP.  An example of such software is HostAP (http://hostap.epitest.fi/ ).  Such a Trojaned AP would be formidable.
6.5           Equipment Flaws

A search on www.securityfocus.com with “access point vulnerabilities” will show that numerous flaws in equipment from well-known manufacturers are known.  For example, one such AP crashes when a frame is sent to it that has the spoofed source MAC address of itself.  Another AP features an embedded TFTP (Trivial File Transfer Protocol) server. By requesting a file named config.img via TFTP, an attacker receives the binary image of the AP configuration. The image includes the administrator’s password required by the HTTP user interface, the WEP encryption keys, MAC address, and SSID.  Yet another AP returns the WEP keys, MAC filter list, administrator’s password when sent a UDP packet to port 27155 containing the string “gstsearch”.

It is not clear how these flaws were discovered. The following is a likely procedure.  Most manufacturers design their equipment so that its firmware can be flashed with a new and improved one in the field.  The firmware images are downloaded from the manufacturers’ web site.  The CPU used in the APs can be easily recognized, and the firmware can be systematically disassembled revealing the flaws at the assembly language level.

Comprehensive lists of such equipment flaws are likely circulating among the attackers.
7.  Denial of Service

A denial of service (DoS) occurs when a system is not providing services to authorized clients because of resource exhaustion by unauthorized clients.  In wireless networks, DoS attacks are difficult to prevent, difficult to stop an on-going attack and the victim and its clients may not even detect the attacks. The duration of such DoS may range from milliseconds to hours.  A DoS attack against an individual station enables session hijacking.
7.1           Jamming the Air Waves

A number of consumer appliances such as microwave ovens, baby monitors, and cordless phones operate on the unregulated 2.4GHz radio frequency. An attacker can unleash large amounts of noise using these devices and jam the airwaves so that the signal to noise drops so low, that the wireless LAN ceases to function.  The only solution to this is RF proofing the surrounding environment.
7.2           Flooding with Associations

The AP inserts the data supplied by the station in the Association Request into a table called the association table that the AP maintains in its memory.  The IEEE 802.11 specifies a maximum value of 2007 concurrent associations to an AP.  The actual size of this table varies among different models of APs.  When this table overflows, the AP would refuse further clients.

Having cracked WEP, an attacker authenticates several non-existing stations using legitimate-looking but randomly generated MAC addresses.  The attacker then sends a flood of spoofed associate requests so that the association table overflows.

Enabling MAC filtering in the AP will prevent this attack.
7.3           Forged Dissociation

The attacker sends a spoofed Disassociation frame where the source MAC address is set to that of the AP. The station is still authenticated but needs only to reassociate and sends Reassociation Requests to the AP.  The AP may send a Reassociation Response accepting the station and the station can then resume sending data. To prevent Reassociation, the attacker continues to send Disassociation frames for a desired period.
7.4           Forged Deauthentication

The attacker monitors all raw frames collecting the source and destination MAC addresses to verify that they are among the targeted victims.  When a data or Association Response frame is observed, the attacker sends a spoofed Deauthentication frame where the source MAC address is spoofed to that of the AP.  The station is now unassociated and unauthenticated, and needs to reconnect.  To prevent a reconnection, the attacker continues to send Deauthentication frames for a desired period.  The attacker may even rate limit the Deauthentication frames to avoid overloading an already congested network.

The mischievous packets of Disassociation and Deauthentication are sent directly to the client, so these will not be logged by the AP or IDS, and neither MAC filtering nor WEP protection will prevent it.
7.5           Power Saving

Power conservation is important for typical station laptops, so they frequently enter an 802.11 state called Doze.   An attacker can steal packets intended for a station while the station is in the Doze state.

The 802.11 protocol requires a station to inform the AP through a successful frame exchange that it wishes to enter the Doze state from the Active state.

Periodically the station awakens and sends a PS-Poll frame to the AP. The AP will transmit in response the packets that were buffered for the station while it was dozing. This polling frame can be spoofed by an attacker causing the AP to send the collected packets and flush its internal buffers. An attacker can repeat these polling messages so that when the legitimate station periodically awakens and polls, AP will inform that there are no pending packets.
8.  Man-in-the-Middle Attacks

Man-in-the-middle (MITM) attack refers to the situation where an attacker on host X inserts X between all communications between hosts B and C, and neither B nor C is aware of the presence of X.  All messages sent by B do reach C but via X, and vice versa.  The attacker can merely observe the communication or modify it before sending it out.  An MITM attack can break connections that are otherwise secure.  At the TCP level, SSH and VPN, e.g., are prone to this attack.
8.1           Wireless MITM

Assume that station B was authenticated with C, a legitimate AP.  Attacker X is a laptop with two wireless cards.  Through one card, he will present X as an AP.  Attacker X sends Deauthentication frames to B using the C’s MAC address as the source, and the BSSID he has collected.  B gets deauthenticated and begins a scan for an AP and may find X on a channel different from C.  There is a race condition between X and C.  If B associates with X, the MITM attack succeeded.  X will re-transmit the frames it receives from B to C, and the frames it receives from C to B after suitable modifications.

The package of tools called AirJack (http://802.11ninja.net/airjack/) includes a program called monkey_jack that automates the MITM attack.  This is programmed well so that the odds of it winning in the race condition mentioned above are improved.
8.2           ARP Poisoning

ARP cache poisoning is an old problem in wired networks.  Wired networks have deployed mitigating techniques.  But, the ARP poisoning technique is re-enabled in the presence of APs that are connected to a switch/hub along with other wired clients.

ARP is used to determine the MAC address of a device whose IP address is known. The translation is performed with a table look-up.   The ARP cache accumulates as the host continues to network.  If the ARP cache does not have an entry for an IP address, the outgoing IP packet is queued, and an ARP Request packet that effectively requests “If your IP address matches this target IP address, then please let me know what your Ethernet address is” is broadcast. The host with the target IP is expected to respond with an ARP Reply, which contains the MAC address of the host.  Once the table is updated because of receiving this response, all the queued IP packets can now be sent. The entries in the table expire after a set time in order to account for possible hardware address changes for the same IP address. This change may have happened, e.g., due to the NIC being replaced.

Unfortunately, the ARP does not provide for any verification that the responses are from valid hosts or that it is receiving a spurious response as if it has sent an ARP Request. ARP poisoning is an attack technique exploiting this lack of verification.  It corrupts the ARP cache that the OS maintains with wrong MAC addresses for some IP addresses. An attacker accomplishes this by sending an ARP Reply packet that is deliberately constructed with a “wrong” MAC address.  The ARP is a stateless protocol.  Thus, a machine receiving an ARP Reply cannot determine if the response is due to a request it sent or not.

ARP poisoning is one of the techniques that enables the man-in-the-middle attack. An attacker on machine X inserts himself between two hosts B and C by (i) poisoning B so that C’s IP address is associated with X’s MAC address, (ii) poisoning C so that B’s address is associated with X’s MAC address, and (iii) relaying the packets X receives.

The ARP poison attack is applicable to all hosts in a subnet. Most APs act as transparent MAC layer bridges, and so all stations associated with it are vulnerable. If an access point is connected directly to a hub or a switch without an intervening router/firewall, then all hosts connected to that hub or switch are susceptible also. Note that recent devices aimed at the home consumer market combine a network switch with may be four or five ports, an AP, a router and a DSL/cable modem connecting to the Internet at large.  Internally, the AP is connected to the switch.  As a result, an attacker on a wireless station can become a MITM between two wired hosts, one wired one wireless, or both wireless hosts.

The tool called Ettercap ((http://ettercap.sourceforge.net) is capable of performing ARP poisoning.
8.3           Session Hijacking

Session hijacking occurs in the context of a “user”, whether human or computer.  The user has an on-going connection with a server.  Hijacking is said to occur when an attacker causes the user to lose his connection, and the attacker assumes his identity and privileges for a period.

An attacker disables temporarily the user’s system, say by a DoS attack or a buffer overflow exploit.  The attacker then takes the identity of the user.  The attacker now has all the access that the user has.  When he is done, he stops the DoS attack, and lets the user resume.  The user may not detect the interruption if the disruption lasts no more than a couple of seconds.  Such hijacking can be achieved by using forged Disassociation DoS attack.

Corporate wireless networks are often set up so that the user is directed to an authentication server when his station attempts a connection with an AP.  After the authentication, the attacker employs the session hijacking described above using spoofed MAC addresses.
9.  War Driving

Equipped with wireless devices and related tools, and driving around in a vehicle or parking at interesting places with a goal of discovering easy-to-get-into wireless networks is known as war driving.  War-drivers (http://www.wardrive.net/) define war driving as “The benign act of locating and logging wireless access points while in motion.”  This benign act is of course useful to the attackers.
9.1           War chalking

War chalking is the practice of marking sidewalks and walls with special symbols to indicate that wireless access is nearby so that others do not need to go through the trouble of the same discovery.  A search on www.google.com with key words “war driving maps” will produce a large number of hits.  Yahoo! Maps can show "Wi-fi Hotspots" near an address you give.

Figure 3: War Chalking Symbols
9.2           Typical Equipment

The typical war driving equipment consists of a laptop computer system or a PDA with a wireless card, a GPS, and a high-gain antenna.   Typical choice of an operating system is Linux or FreeBSD where open source sniffers (e.g., Kismet) and WEP crackers (e.g., AirSnort) are available.  Similar tools (e.g., NetStumbler) that run on Windows are available.

War drivers need to be within the range of an AP or station located on the target network.   The range depends on the transmit output power of the AP and the card, and the gain of the antenna.  Ordinary access point antennae transmit their signals in all directions.  Often, these signals reach beyond the physical boundaries of the intended work area, perhaps to adjacent buildings, floors, and parking lots. With the typical 30mW wireless cards intended for laptops, the range is about 300 feet, but there are in 2004 wireless cards for laptops on the market that have 200mW. Directional high-gain antennae and an RF-amplifier can dramatically extend the range.

Figure 4: War Drivers' Equipment
10.       Wireless Security Best Practices

This section describes best practices in mitigating the problems described above.
10.1     Location of the APs

APs should be topologically located outside the perimeter firewalls.  The wireless network segments should be treated with the same suspicion as that for the public Internet.  Additionally, it is important to use directional antennae and physically locate them in such a way that the radio-coverage volume is within the control of the corporation or home.
10.2     Proper Configuration

Statistics collected by www.worldwidewardrive.org show a distressingly large percentage of APs left configured with the defaults.

Before a wireless device is connected to the rest of the existing network, proper configuration of the wireless device is necessary.  The APs come with a default SSID, such as “Default SSID”, “WLAN”, “Wireless”, “Compaq”, “intel”, and “linksys”. The default passwords for the administrator accounts that configure the AP via a web browser or SNMP are well known for all manufacturers.  A proper configuration should change these to difficult to predict values.

Note that the SSID serves as a simple handle, not as a password, for a wireless network.  Unless the default SSID on the AP and stations is changed, SSID broadcasts are disabled, MAC address filtering is enabled, WEP enabled, an attacker can use the wireless LAN resources without even sniffing.

The configuration via web browsing (HTTP) is provided by a simplistic web server built into an AP.  Often this configuration interface is provided via both wired connections and wireless connections.  The web server embedded in a typical AP does not contain secure HTTP, so the password that the administrator submits to the AP can be sniffed.  Web based configuration via wireless connections should be disabled.

WEP is disabled in some organization because the throughput is then higher.  Enabling WEP encryption makes it necessary for the attacker intending to WEP-crack to have to sniff a large number of frames.  The higher the number of bits in the encryption the larger the number of frames that must be collected is. The physical presence in the radio range of the equipment for long periods increases the odds of his equipment being detected.  WEP should be enabled.

The IEEE 802.11 does not describe an automated way of distributing the shared-secret keys.  In large installations, the manual distribution of keys every time they are changed is expensive. Nevertheless, the WEP encryption keys should be changed periodically.
10.3     Secure Protocols

If the WEP is disabled, or after the WEP is cracked, the attacker can capture all TCP/IP packets by radio-silent sniffing for later analyses.  All the wired network attacks are possible. There are real-time tools that analyze and interpret the TCP/IP data as they arrive.

All protocols that send passwords and data in the clear must be avoided.  This includes the rlogin family, telnet, and POP3.  Instead one should use SSH and VPN.

In general, when a wireless segment is involved, one should use end-to-end encryption at the application level in addition to enabling WEP.
10.4     Wireless IDS

A wireless intrusion detection system (WIDS) is often a self-contained computer system with specialized hardware and software to detect anomalous behavior.  The underlying software techniques are the same hacking techniques described above.  The special wireless hardware is more capable than the commodity wireless card, including the RF monitor mode, detection of interference, and keeping track of signal-to-noise ratios.  It also includes GPS equipment so that rogue clients and APs can be located.  A WIDS includes one or more listening devices that collect MAC addresses, SSIDs, features enabled on the stations, transmit speeds, current channel, encryption status, beacon interval, etc.  Its computing engine will be powerful enough that it can dissect frames and WEP-decrypt into IP and TCP components.  These can be fed into TCP/IP related intrusion detection systems.

Unknown MAC addresses are detected by maintaining a registry of MAC addresses of known stations and APs.  Frequently, a WIDS can detect spoofed known MAC addresses because the attacker could not control the firmware of the wireless card to insert the appropriate sequence numbers into the frame.
10.5     Wireless Auditing

Periodically, every wireless network should be audited.  Several audit firms provide this service for a fee.  A security audit begins with a well-established security policy.  A policy for wireless networks should include a description of the geographical volume of coverage.  The main goal of an audit is to verify that there are no violations of the policy.  To this end, the typical auditor employs the tools and techniques of an attacker.
10.6     Newer Standards and Protocols

Many improvements in wireless network technology are proposed through proprietary channels (e.g., Cisco Lightweight Extensible Authentication Protocol) as well as through the IEEE.  The new IEEE 802.11i (ratified in June 2004) enhances the current 802.11 standard to provide improvements in security.  These include Port Based Access Control for authentication, Temporal Key Integrity Protocol for dynamic changing of encryption keys, and Wireless Robust Authentication protocol.  An interim solution proposed by vendors is the Wi-Fi Protected Access (WPA), a subset of 802.11i, is only now becoming available in some products.  Time will tell if these can withstand future attacks.
10.7     Software Tools

Below we describe a collection of cost-free tools that can be used both as attack tools and as audit tools.

·         AirJack (http://802.11ninja.net/airjack/) is a collection of wireless card drivers and related programs.  It includes a program called monkey_jack that automates the MITM attack.  Wlan_jack is a DoS tool that accepts a target source and BSSID to send continuous deauthenticate frames to a single client or an entire network (broadcast address). Essid_jack sends a disassociate frame to a target client in order to force the client to reassociate with the network, thereby giving up the network SSID.

AirSnort (www.airsnort.shmoo.com ) can break WEP by passively monitoring transmissions and computing the encryption key when enough packets have been gathered.
    Ethereal (www.ethereal.com ) is a LAN analyzer, including wireless.  One can interactively browse the capture data, viewing summary and detail information for all observed wireless traffic.
    FakeAP (ww.blackalchemy.to/project/fakeap) can generate thousands of counterfeit 802.11b access points.
    HostAP (www.hostap.epitest.fi) converts a station that is based on Intersil's Prism2/2.5/3 chipset to function as an access point. 
    Kismet (www.kismetwireless.net) is a wireless sniffer and monitor.  It passively monitors wireless traffic and dissects frames to identify SSIDs, MAC addresses, channels and connection speeds.
    Netstumbler (www.netstumbler.com) is a wireless access point identifier running on Windows.  It listens for SSIDs and sends beacons as probes searching for access points.
    Prismstumbler (prismstumbler.sourceforge.net/) can find wireless networks.  It constantly switches channels and monitors frames received.
    The Hacker’s Choice organization (www.thc.org) has LEAP Cracker Tool suite that contains tools to break Cisco LEAP.  It also has tools for spoofing authentication challenge-packets from an AP. The WarDrive is a tool for mapping a city for wireless networks with a GPS device.
    StumbVerter (www.sonar-security.com/sv.html) is a tool that reads NetStumbler's collected data files and presents street maps showing the logged WAPs as icons, whose color and shape indicating WEP mode and signal strength.
    Wellenreiter (http://www.wellenreiter.net/) is a WLAN discovery tool.  It uses brute force to identify low traffic access points while hiding the real MAC address of the card it uses.  It is integrated with GPS.
    WEPcrack (www.wepcrack.sourceforge.net) cracks 802.11 WEP encryption keys using weaknesses of RC4 key scheduling.

11.       Conclusion

This article is an introduction to the techniques an attacker would use on wireless networks.  Regardless of the protocols, wireless networks will remain potentially insecure because an attacker can listen in without gaining physical access.  In addition, the protocol designs were security-naïve.  We have pointed out several existing tools that implement attack techniques that exploit the weaknesses in the protocol designs.  The integration of wireless networks into existing networks also has been carelessly done.  We pointed out several best practices that can mitigate the insecurities.
GLOSSARY

AP: Access Point.  Any entity that has station functionality and provides access to the distribution services, via the wireless medium for associated stations.

Association Table: The Association table is within an AP and controls the routing of all packets between the Access Point and the wireless devices in a WLAN.

Basic Service Set:  BSS is a collection, or set, of stations that are logically associated with each other and controlled by a single AP. Together, they operate as a fully connected wireless network.

Basic Service Set Identifier (BSSID): A 48-bit identifier used by all stations in a Basic Service Set as part of the frame header.

Beacon: A wireless LAN frame broadcast by access points that signals their availability.

Evil Twin Attack. An unauthorized AP whose goal is to masquerade as an existing legitimate/ authorized AP is called an Evil Twin.  The evil twin AP is designed and located so that client stations receive stronger signals from it.  Legitimate users are lured into the evil twin, and unknowingly give away user IDs and passwords.

Independent BSS: An IBSS is usually an ad-hoc network. In an IBSS, all of the stations are responsible for sending beacons.

IDS: Intrusion detection system.

MITM: Man in the middle.  See Section 8.

Service Set Identifier (SSID): All APs and stations within the same wireless network use an identifier that is up to 32-bytes long.

Social Engineering: Social engineering is a term, coined in jest that refers to all non-technical methods of collecting information about a person so that the passwords the person may use can be predicted.  The methods of collection range from dumpster diving, analyzing the publicly available information to making phone calls impersonating others.

STA: A wireless station.

WEP: Wired Equivalent Privacy (WEP) is a shared-secret key encryption system used to encrypt packets transmitted between a station and an AP.
Cross References

The following is a list of other articles in the handbook related to wireless networks.  Article numbers are as in the Handbook TOC.

26. Radio Frequency and Wireless Communications Security
27. Propagation Characteristics of Wireless Channels
43. Wireless Local Area Networks
44. Security Issues in Wireless Sensor Networks
46. Mobile IP (Internet Protocol)
48. TCP (Transmission Control Protocol) over Wireless Links
50. Wireless Internet
56. PKI (Public Key Infrastructure)
67. Wireless Application Protocol (WAP)
68. Wireless Networks Standards and Protocol (802.11)
74. Wireless Information Warfare
142. Hacking Techniques in Wireless Networks (mine)
150. Wireless Threats and Attacks
151. WEP (Wired Equivalent Privacy) Security
152. Wireless Security
153. Cracking WEP (Wired Equivalent Privacy)
References

John Bellardo and Stefan Savage, “802.11 Denial-of-Service Attacks: Real Vulnerabilities and Practical Solutions”, 2003, Usenix 2003 Proceedings.  http://www.cs.ucsd.edu/users/savage/papers/UsenixSec03.pdf  Retrieved Jan 20, 2004.
    Jon Edney and William A. Arbaugh, Real 802.11 Security: Wi-Fi Protected Access and 802.11i, 480 pages, Addison Wesley, 2003, ISBN: 0-321-13620-9
    Jamil Farshchi, Wireless Intrusion Detection Systems, November 5, 2003, http://www.securityfocus.com/infocus/1742  Retrieved Jan 20, 2004
    Bob Fleck and Jordan Dimov, "Wireless Access Points and ARP Poisoning: Wireless vulnerabilities that expose the wired network," October 2001. http://www.cigitallabs.com/resources/papers/download/arppoison.pdf. Retrieved on Jan 20, 2004.
    Rob Flickenger, Wireless Hacks: 100 Industrial-Strength Tips & Tools, 286 pages, O'Reilly & Associates, September 2003, ISBN: 0-596-00559-8
    Matthew S. Gast, 802.11 Wireless Networks: The Definitive Guide, 464 pages, O’Reilly & Associates, April 2002, ISBN: 0596001835.
    Vikram Gupta, Srikanth Krishnamurthy, and Michalis Faloutsos, “Denial of Service Attacks at the MAC Layer in Wireless Ad Hoc Networks”, Proceedings of 2002 MILCOM Conference, Anaheim, CA, October 2002.
    Chris Hurley, Michael Puchol, Russ Rogers, and Frank Thornton, WarDriving: Drive, Detect, Defend, A Guide to Wireless Security, ISBN: 1931836035, Syngress, 2004.
    IEEE, IEEE 802.11 standards documents, http://standards.ieee.org/wireless/ . Retrieved Jan 20, 2004
    Tom Karygiannis and Les Owens, Wireless Network Security: 802.11, Bluetooth and Handheld Devices, National Institute of Standards and Technology Special Publication 800-48, November 2002.  http://cs-www.ncsl.nist.gov/publications/ nistpubs/800-48/NIST_SP_800-48.pdf . Retrieved Jan 20, 2004
    Prabhaker Mateti, TCP/IP Suite, The Internet Encyclopedia, Hossein Bidgoli (Editor), John Wiley 2003, ISBN 0471222011.
    Robert Moskowitz, “Debunking the Myth of SSID Hiding”, Retrieved on March 10, 2004. http://www.icsalabs.com/html/communities/WLAN/wp_ssid_hiding. pdf.
    Bruce Potter and Bob Fleck, 802.11 Security, O'Reilly & Associates, 2002; ISBN: 0-596-00290-4.
    William Stallings, Wireless Communications & Networks, Prentice Hall, 2001, ISBN: 0130408646.
    War-chalking, http://www.warchalking.org/.  Retrieved Jan 20, 2004.
    Joshua Wright, “Detecting Wireless LAN MAC Address Spoofing”, Retrieved on Jan 20, 2004. http://home.jwu.edu/jwright/