up vote 1 down vote favorite
share [g+] share [fb]

If we suspect that the WiFi network has been hacked and someone is using it to access sites, download files, etc can the origin of access be tracked or traced?

link|improve this question
91% accept rate
2  
The AP/Router model that manages this WLAN would help, most have a connected devices list. You will probably only get the MAC address and possibly the computer name though... You won't be able to triangulate their position or anything they do on CSI though... – Kyle Nov 14 '11 at 19:06
1  
Probably not. You can, however, make sure that they cannot access the router configuration, and set up MAC address filtering to prevent anyone from connecting. – Rob Nov 14 '11 at 19:18
1  
I was just stating that 'some' routers offer the computer/device name, not all. Again the make/model number would be helpful. – Kyle Nov 14 '11 at 19:54
1  
Also Robs advice is correct, however if the person is intelligent enough to get unauthorized access and has an adapter that can go into promiscuous to make raw captures they can easily change/spoof a new MAC address (honestly the one they are using is probably already spoofed). – Kyle Nov 14 '11 at 19:57
1  
More specifics would be helpful. What is the make/model of the wireless router(s) on your network? What sort of environment (home, small office, enterprise, retail) are you operating in? How many authorized users are there on your network? How do you know you've been hacked? – Iszi Rory or Isznti Nov 14 '11 at 20:46
show 9 more comments
feedback

1 Answer

up vote 2 down vote accepted

If you know the MAC address, then you should be able to locate the device rather easily. Some commercial tools that are useful for this are AirMagnet's Handheld Analyzer and Berkely Varitronics' Beetle B/A/N/G. There are probably some F/OSS solutions available for smartphones and/or laptops as well.

Once you've found a hardware/software solution that works for you, it's just a matter of playing "hot or cold" to hunt down the offending device by signal strength. A direction-finding antenna can help with this, but is not absolutely necessary.

link|improve this answer
Thanks. I guess they would only work if the MAC addressed is not spoofed. Is that correct? – PeanutsMonkey Nov 15 '11 at 0:38
1  
Spoofed or not shouldn't matter. The strength of the radio signal doesn't change one one way or the other. You just need something to listen for. If the person is trying to actually use the network, then the MAC address is not going to be changing. – Zoredache Nov 15 '11 at 0:58
@Zoredache = Why wouldn't it matter? Unless I am specifying a list of authorized users, the continual change of the MAC address shouldn't really matter. – PeanutsMonkey Nov 15 '11 at 1:09
1  
If I want to establish a two-way connection a remote system, frames/packets have to be able to return to me. This can only happen if I have am still listening for packets on the MAC/IP I initiated the request from. So for example if you were downloading a large file, you couldn't change your MAC/IP in the middle of the file transfer, or you would interrupt the transfer. – Zoredache Nov 15 '11 at 1:12
@Zoredache - Thanks. I do appreciate it that I can't do that in the middle of a request but what I meant was the 'attacker' could change the IP address after a file has been downloaded. – PeanutsMonkey Nov 15 '11 at 3:48
show 1 more comment
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.