1

If we suspect that the WiFi network has been hacked and someone is using it to access sites, download files, etc can the origin of access be tracked or traced?

Improve this question
14
  • 2
    The AP/Router model that manages this WLAN would help, most have a connected devices list. You will probably only get the MAC address and possibly the computer name though... You won't be able to triangulate their position or anything they do on CSI though...
    – Supercereal
    Nov 14, 2011 at 19:06
  • 1
    Probably not. You can, however, make sure that they cannot access the router configuration, and set up MAC address filtering to prevent anyone from connecting.
    – Rob
    Nov 14, 2011 at 19:18
  • 1
    I was just stating that 'some' routers offer the computer/device name, not all. Again the make/model number would be helpful.
    – Supercereal
    Nov 14, 2011 at 19:54
  • 1
    Also Robs advice is correct, however if the person is intelligent enough to get unauthorized access and has an adapter that can go into promiscuous to make raw captures they can easily change/spoof a new MAC address (honestly the one they are using is probably already spoofed).
    – Supercereal
    Nov 14, 2011 at 19:57
  • 1
    More specifics would be helpful. What is the make/model of the wireless router(s) on your network? What sort of environment (home, small office, enterprise, retail) are you operating in? How many authorized users are there on your network? How do you know you've been hacked?
    – Iszi
    Nov 14, 2011 at 20:46

1 Answer 1

Reset to default
2

If you know the MAC address, then you should be able to locate the device rather easily. Some commercial tools that are useful for this are AirMagnet's Handheld Analyzer and Berkely Varitronics' Beetle B/A/N/G. There are probably some F/OSS solutions available for smartphones and/or laptops as well.

Once you've found a hardware/software solution that works for you, it's just a matter of playing "hot or cold" to hunt down the offending device by signal strength. A direction-finding antenna can help with this, but is not absolutely necessary.

Improve this answer
7
  • Thanks. I guess they would only work if the MAC addressed is not spoofed. Is that correct?
    – PeanutsMonkey
    Nov 15, 2011 at 0:38
  • 1
    Spoofed or not shouldn't matter. The strength of the radio signal doesn't change one one way or the other. You just need something to listen for. If the person is trying to actually use the network, then the MAC address is not going to be changing.
    – Zoredache
    Nov 15, 2011 at 0:58
  • @Zoredache = Why wouldn't it matter? Unless I am specifying a list of authorized users, the continual change of the MAC address shouldn't really matter.
    – PeanutsMonkey
    Nov 15, 2011 at 1:09
  • 1
    If I want to establish a two-way connection a remote system, frames/packets have to be able to return to me. This can only happen if I have am still listening for packets on the MAC/IP I initiated the request from. So for example if you were downloading a large file, you couldn't change your MAC/IP in the middle of the file transfer, or you would interrupt the transfer.
    – Zoredache
    Nov 15, 2011 at 1:12
  • @Zoredache - Thanks. I do appreciate it that I can't do that in the middle of a request but what I meant was the 'attacker' could change the IP address after a file has been downloaded.
    – PeanutsMonkey
    Nov 15, 2011 at 3:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .