6

If I'm on an open wireless network, can a 3rd party capture packets and see all the internet traffic to and from my computer? What if WPA encryption is used, but someone has the key already? If I use HTTPS, can someone with direct access to the router decrypt the traffic and view it somehow?

1
  • Belongs to ServerFault/SuperUser.
    – LiraNuna
    Sep 28, 2009 at 5:55

4 Answers 4

8

If I'm on an open wireless network, can a 3rd party capture packets and see all the internet traffic to and from my computer?

Yes

What if WPA encryption is used, but someone has the key already?

Same as if the network was un-encrypted

If I use HTTPS, can someone with direct access to the router decrypt the traffic and view it somehow?

Unlikely. They would need to have both the Private Key and the Public Key for your HTTPS host, which is unlikely. The other possibility is what's called a "man in the middle" attack, where they replace the certificates with ones that they know, so that it appears to be encrypted, but the man-in-the-middle does a translation on your HTTPS traffic so that it can read it.

Short answer: If you're on a wifi network, don't do anything you don't want to be made public.

9
  • MitM attack, just what I was thinking =)
    – Qwerty
    Sep 28, 2009 at 6:59
  • You can't do a MitM attack on a really secure SSL connection (with a trusted certificate chain and all). If the certificates are replaced the browser will inform the user that they can't be trusted. Sep 28, 2009 at 11:02
  • Unless you're on a AD that has its own CA and you issue a certificate for that website that comes from your own internal trusted CA. I bet most people wouldn't even notice that the EV is missing from banking websites. Sep 28, 2009 at 21:13
  • Arp poisoning is such a trivial thing to accomplish, that most people should be VERY afraid of using wireless for anything besides basic web surfing.
    – GregD
    Sep 28, 2009 at 22:04
  • Keep in mind there is a difference between the key used for encryption (PTK) and the pass-phrase (PMK) people think of as "the key". If you know the PTK (PMK + session specific data), you can decrypt packets, but the PMK alone is not enough to decrypt. That said, it is easy enough to get the session specific data by capturing the 4-way handshake.
    – ctuffli
    Sep 29, 2009 at 19:16
2

If someone is on the same wireless network as you or you are on an open network they can see your raw traffic. Now if that traffic is encrypted, for example with HTTPS, then they can only see the encrypted traffic. As far as I know there is no easy way to decrypt HTTPS traffic.

1

HTTPS is between your browser and the webserver, so that traffic is encrypted, though someone can capture the packets and try to break the encryption.

Given enough motive, just about any wifi encryption can be broken. You can see the traffic using some freely available tools as it is broadcast out, but someone would need to separate out what is meant for you and someone else. The wifi adapter can determine that, so programs exist to determine that.

How secure your wifi is is based on how strong and secure your key is and the encryption algorithm.

Here is an article about wifi security, and you can google and get more info on various encryption algorithms, such as WPA, and see how secure they are.

http://pogue.blogs.nytimes.com/2007/01/04/04pogue-email/

1
  • "Given enough motive, just about any wifi encryption can be broken." No, that is not true. For WPA2 with a strong passphrase, there is no known attack, not even a theoretical one. However, note that (using only lowercase characters & digits), a full-strength passphrase (256 bit) would need about 50 characters.
    – sleske
    Oct 22, 2009 at 9:41
1

To sniff the actual traffic traversing a wireless network requires a wireless adapter and driver that support RF monitor mode, which few adapters in the retail market do. Adapters of these type are usually found in the wireless testing and engineering industries and are usually cost prohibitive for the average user.

While it's true that a determined hacker will eventually circumvent just about any security mechanism, I wouldn't count on the average Joe being able to do this. That being said, I don't recommend using publicly available open wireless networks.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .