Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I may be misunderstanding something, but wouldn't TCP stream injection be terribly easy on an unencrypted LAN? My University's campus-wide WiFi is unencrypted (bad, I know) and all I have to do is bring up Wireshark and I can see a crapload of TCP sessions and exactly what their current sequence numbers are.

Most people worry about the fact that their data is unencrypted - but imagine no longer being able to trust an HTTP server's response. It would be trivial to inject a response with the correct SEQ and ACK, IP src, dst, ports, etc. in time before the server responds with the valid data, since you're so much closer. Once the client ACK's your fake packets, it's going to cause some trouble, but I can see a small GIF or IM being accepted as legit with no ARP poisoning or anything like that...

The only problem I can think of is that in 802.11 Managed Mode, all packets must be sent to the AP first, so maybe the router would see the fake source IP, notice it is outside of the network and drop it.

share|improve this question
My guess is that the campus wide WiFi network you're referring to is a segregated wireless network for the students and the network admins don't care what happens. Could that be the case? –  joeqwerty Jan 26 '11 at 12:39
Apparently yes, lol –  Caleb Hearon Jan 26 '11 at 17:08

1 Answer 1

up vote 2 down vote accepted

It's not just an unencrypted network, it's a shared medium. You can do basically anything, as long as you are faster than the other server. The encryption offers little protection against this.

Managed mode offers no protection, since the frames are trivally spoofed, especially with a second wifi card.

One such project is airpwn, which was revealed to the public in a most hilarious way at a security conference. They injected background images into html (yes, in the middle of the stream).

Note that in that other "fully shared medium" that wired ethernet once was (coax rings and hubs), Kevin Mitnick himself used this technique to hijack tcp sessions and gain admin rights.

share|improve this answer
Yeah, in local networks there is much more trust, but as I understand it WPA creates an encrypted session between each client and the AP, basically creating a "switched" network, in which sniffing SEQ#s would be impossible, right? That project looks incredible, I might have some fun with that... Awesome reply by the way, thank you –  Caleb Hearon Jan 26 '11 at 8:55
WPA does that indeed, if it weren't trivial to break. WPA2 offers some protection, but even then it's fairly easy to force clients off one AP to another. Wifi security is still a bit of a mess :( –  Joris Jan 26 '11 at 9:34
Wow, I don't understand how this isn't a bigger deal! Thanks for the response. –  Caleb Hearon Jan 26 '11 at 17:23
I don't understand that either. Really, once you start looking into security you don't really sleep at night ;-) –  Joris Jan 26 '11 at 19:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.