I often see these myths in YouTube
comments and other places where people
say that they can secure their Wi-Fi
network by for example hiding the Wi-Fi
name now that's not true and I'll show
you that in this video I'm going to show
you various myths and show you why
they're not true as an example people
believe that hiding their SSID will stop
an attacker from attacking their Wi-Fi
network let's stop believing that myth
I'm going to show you in this video
using kly Linux and a Wi-Fi adapter such
as this that I can attack a Wi-Fi
network that has hidden its S S ID now
this Wi-Fi adapter very popular Alpha
network adapter only supports 2.4 GHz
but there are other Wi-Fi adapters that
you could use such as this one that
supports Wi-Fi 6E 802.11 ax so you don't
have to use this Wi-Fi adapter but this
is a really popular Wi-Fi adapter so
I'll use that for these demonstrations
I'm going to attack my own Wi-Fi
networks so in this example I've got a
TP Link router that I'll Attack I have
given myself permission to attack that
device never attack Wi-Fi networks that
you don't have permission to attack now
the reason I want to show you this
practically is that it's one thing for
someone to say look doing this won't
protect your network but it's another
thing to demonstrate what attackers can
do so I'm going to show you that I can
attack this network even if I hide the
SSID people believe that doing certain
things will protect their Network now
it's good to have a laid approach when
it comes to security but don't believe
that these things are going to protect
your Wi-Fi network okay so without
further Ado let me show you some of the
myths with regards to to Wi-Fi security
and how attackers can break through
those configurations or settings that
people have configured on their Wi-Fi
networks don't believe the myths with
regards to Wi-Fi I want to thank proton
for sponsoring this video but I have a
question on their website they say that
they support endtoend encryption but how
does that actually work if you're
sending an email to someone who doesn't
have a proton mail account makes sense
that you can encrypt messages from one
proton email user to another but what
happens if someone uses Gmail so in this
example I'm using my proton email
account and I'll send an email to a
Gmail user so this is a secure email so
notice I can set a time for this message
to expire so I could use the default or
specify something else I can also say
that I'm sending this to a nonproton
mail user and then specify a password so
I'll just specify some random password
here this is my password obviously
you're going to want to use a password
than that but let's assume that's the
password for this email and I'll say set
and then send the email so email has
been sent I can see that this message is
now arrived so if I select that notice
I'm told you have received an encrypted
email from David Bumble it expires at
this time password hint is none but I
can click unlock message to unlock the
message I'll put my password in and now
I can read the message notice again we
told that that it expires in 7 days but
here is the email message that we sent
so you can send confidential messages to
people that don't have proton mail by
agreeing a password out of band as an
example so I could phone you or use an
encrypted messaging service or something
else to send you the password out of
band that encrypted message isn't part
of Gmail all I see on Gmail is that I
can decrypt the message by using the
link provided proton mail is my
recommended solution if you're
interested in privacy you don't want
companies such as Google or others and
governments reading your email messages
proton supports endtoend encryption they
cannot decrypt your messages because
they don't have access to your private
key encrypted using your public key only
your private key can decrypt those
messages and your private key is
encrypted with a password that only you
know not even proton can decrypt your
messages if you lose your password big
thanks to proton for sponsoring this
video and supporting my channel use my
link to sign up to proton mail highly
recommend that you use them again if
you're interested in privacy the first
so-called myth is that hiding your SSID
or your Wi-Fi name will protect your
Wi-Fi network now doing these things can
add a sort of a level of of security but
doesn't really stop someone who knows
what they're doing from attacking your
Wi-Fi network now to do this I'm running
Ki Linux within a virtual machine on my
computer in front of me I've also got an
alpha network adapter here this is a
very popular Alpha Network ad adapter to
use for Wi-Fi attacks supports
monitoring and ejection mode the problem
with this one is it only supports 2.4
GHz but there are others that support 5
GHz and other frequencies so I'll plug
that into my computer and I'm going to
connect that to my virtual machine in
this case kly Linux
20241 and I'll click okay so that's now
connected so what I'll do is open up a
terminal okay so first thing I'll do is
iwd and as you can see the Wi-Fi
interface is connected but but it's in
managed mode now there are older
commands that you can use so you could
use commands like if config to see the
interfaces on the virtual machine as you
can see here ethernet is displayed but
it hasn't got an IP address and that's
because I've disconnected the wired
interface the wired interface isn't
connected this virtual machine is
configured to use Nat or network address
translation but I've disabled the
ethernet connection so that's not used
by the virtual machine you can also see
that w l zero this Wi-Fi adapter is
connected you can see that the light is
on indicating that it's working now some
people will complain if they use old
commands so you could use IP address to
show you something similar notice lb
back ethernet no IP address W land zero
no IP address at the moment I could also
use IW config older commands to see
something similar so w l zero mode
managed use the commands that you used
to people have have been doing this for
a long time as an example are in the
habit of using the older commands rather
than the newer commands both set of
commands work on collie okay next thing
we're going to do is clear all the
background processes so we're going to
use pseudo M on N check kill I'll put in
my collie password and as you can see
the WPA supplicant has been killed okay
next thing we're going to do is put the
interface into monitor mode notice
current interface is W land Z that
interface has been put into monitor mode
so that we can inject packets and
monitor the network we can confirm that
by using the command iwd notice
interface is wlan0 Monon whereas
previously it was wlan0 okay what I'll
do is clear the screen and what we're
going to do now is find all Wi-Fi
networks in range now various networks
are shown we can see the
bssid we can see the essid the essid is
hidden for some of these networks but
that's not going to stop us I'll stop
the scan the network that I want to
attack is this one now I know that
because I'm attacking a network that I
own this is why some people would say
this is better than showing your SSID
because there are various hidden IDs
here so I could end up attacking the
wrong Network now I'm seeing a bunch of
networks here but where you are there
may be fewer hidden networks and a
determin attacker may just decide to
attack all of them or look at the power
of the network and determine which
network is closer and attack that
Network so I'm obviously really close to
this wi-fi network so that's the one I'm
going to attack so I'll make a note of
the bssid I don't know what the name of
the network is but I see a length of 12
another note here is that the channel is
Channel 4 so I'll say Channel 4 I need
that information for the next command so
what I'm going to do now is run Arrow
dump NG the bssid that I'm going to
attack is this SS ID the channel I'm
going to use is Channel 4 and the
interface is
wlan0 mon so I can start attacking that
Network notice at the moment I don't see
the name or ESS ID of the network now
what I do notice is that a client has
connected to that Network so I'm seeing
that this station or this client has
connected to that VSS ID and now I can
attack that client so I'll open up
another terminal what we're going to do
now is run a de athor attack against
that client so the command I'm using is
pseudo air replaying time out is 30
seconds Mac address that we're going to
attack is this Mac address and the
interface we're going to use is
wl01 notice the ESS ID is not visible at
the moment but what we're doing now is
attacking that client so what I'll do on
the client is just make sure that I've
connected to the network okay what you
might have noticed now is is that the
essid is visible so I was able to send
deor messages to the client and through
that process I was able to learn the
name of the network so the ESS ID is now
this so don't believe the myth that
hiding your SSID will stop people from
attacking you through the simple process
I've been able to work out what the
essid is or what the name of the Wi-Fi
network is and now I can simply attack
it so just to wrap up this part of the
video I'll show you how to reenable
services and then I'll run an attack
against the network so what I'll do is
stop WLAN zon we basically want to stop
monitor mode and put the interface back
into managed mode you can see it's now
back to managed or if I use the older
command you can see once again it's in
managed mode I'll start the WPA
supplicant once again and now my network
card can be used once again as a normal
network card if you like I'm also going
to start the network manager service
light is back on so I can disconnect
myself from the ethernet Network and now
I'd be able to connect to the internet
if this device was connected to the
internet but basically what I've done
now is I've restored this interface to
being a normal interface that I could
use rather than being used for monitor
mode and injection mode okay so don't
believe that hiding your SSID is going
to give you Total Protection it might
give you a little bit of protection
because it makes a attacker job more
difficult but I've been able to find the
SSID quite easily and then I could run a
tool like Wi-Fi or something else to
attack that Wi-Fi network so what I'll
do now is run Wi-Fi it's putting this
interface card back into monitor mode
and then it's looking for the SS IDs
okay so I'm going to press contrl + C
now now I don't need to know the name of
your Wi-Fi network to attack it so you
can see this is the Wi-Fi network that
we previously discovered the name of I
don't need that to attack the Wi-Fi
network I can simply attack it based on
the Mac address so I'll specify one
various attacks are launched pixie dust
attack is the first one I'll skip out of
that I'm going to continue to the next
attack npin is another attack I'll skip
out of that but continue pin attack is
another one I'll skip out of that and
I'll continue and basically what I'm
going to do is Skip through all of these
and look for capturing of a handshake
you can see it's discovered a new client
so this phone is connected to the Wi-Fi
network and is trying to deor it you can
see it's done that now so it's deor the
client captured the handshake from the
client and saved it and then it's
cracking that and it's found the
password of Spider-Man so just to
reiterate the BSS ID of the network is
this I've discovered the name simply by
running Wi-Fi against the attack but
I've also shown you how I can discover
the name of the network using other
tools so don't believe that hiding your
SSID is going to stop an attack against
your SSID it kind of makes the job more
difficult because now I if I see a bunch
of hidden ssids I need to determine
which one I'm going to attack but it
doesn't stop me from launching an attack
against a Wi-Fi network now once again
because this is on YouTube I need to
reiterate that this is my Wi-Fi network
and I've given myself permission to
attack it I just want you to realize
that there are various myths out there
with regards to Wi-Fi security and one
of them is that if you hide your SSID
so the name of your network then you
protected that's not true a determined
attacker can simply work around that and
use the MAC address of your Wi-Fi access
point or find out the name of your Wi-Fi
network and then attack it now another
common myth is that using Mac filtering
will protect your Wi-Fi network so in
this example on this TP Link router you
can see that I've gone to access control
and I have enabled Access Control using
a wh list and the devices in the Whit
list are this physical laptop which is
connected via an ethernet cable to the
router as well as this Galaxy phone so
these two devices are the devices that
are online and are permitted onto the
Wi-Fi network now let's test how good
this rou is and let's see if I can
connect to the Wi-Fi network at the
moment I am not seeing available Wi-Fi
networks here and that's probably
because I need to reenable my interface
so if I do iwd notice it's in monitor
mode at the moment so we need to
put it back into managed mode so to do
that I'm going to stop monitoring so
that's been done I'm going to start the
WPA supplicant notice this interface at
the moment everything's
disconnected but when I start the
network manager things should get better
as in I should be able to connect to a
wide Network and now I see available
Wi-Fi networks and now I can connect to
a hidden Wi-Fi network I have worked out
that the name of this wi-fi network is
this and I know that the password is
Spider-Man so I can put that in there
most people in home networks are going
to be using WPA and WPA 2 personal so I
can connect it to that Network and
notice it's trying to connect at the
moment and there you go I've connected
so IP
address I've been given an IP address
and I should be able to Ping
the other devices in the network
assuming that the filtering is not
working properly so hopefully you can
see that I can ping those devices in
other words I can send traffic to
devices in the Wi-Fi network including
the phone even though a whiteless is
configured so this route is not
implementing things properly so if I go
to access control again notice it's
picked up that collie is connected via
Wi-Fi to the network according to this
router if I enable access control and
specify a wh list only devices in the
Whit list should be allowed access to
the network but that's obviously not
what's happening in this example so if
you want to allow access only from the
devices in the white list below select
Whit list so that's what I've done but
for some reason this is not working very
well and I can send traffic from collie
so first thing is don't necessarily
trust the settings on your devices
because this is not working so what I've
done is I've got another R here and I'll
test the Whit list on this R so I'll
turn this on and let's see if this does
a better job than this router with
regards to the white list so I'll turn
off this little router here so that's
now off and let's test if I can get onto
this network rather than that Network
and bypass the filter or Access Control
list or Whit list whatever you want to
call it to permit or deny traffic onto
the network okay so I've connected to
the router again that's this router over
here a new TP Link router that's got
Access Control enabled as you can see
here my Galaxy phone is connected that's
permitted as well as my laptop my laptop
is connected via Ethernet the Samsung
phone is connected via Wi-Fi access
control is enabled using a whit list so
only these devices should be allowed on
the network so in collie what I'll do is
try and connect to that Network so I'll
connect to it as you can see at the top
here it's trying to connect no IP
address is allocated at the moment we
can't get access to that Network because
Access Control has been enabled on the
network so at the moment we not getting
an IP address it's trying to connect but
nothing happens so even though Carly
keeps trying to connect to the network
no IP address is allocated on the TP
Link router we can see that only these
two devices are allowed going to the
network map only two clients are allowed
the Galaxy s22 and the laptop one using
5G one using ethernet okay so to get
around the wh list the first thing we're
going to do is kill any conflicting
processes so we've killed the WPA
supplicant service we're going to put
our network card into monitor mode once
again so w land 0 is now put into
monitor mode and becomes wl0 mon so iwd
will show us that notice interface is W
LAN
zeron so the next step is to run Arrow
dump NG against the bssid of the network
I previously discovered the BSS ID of
the network have a look at the previous
part of the video where I showed you how
to get the BSS ID this one is a
different one so I simply used Wi-Fi to
determine the MAC address of the network
or you could use the command that I
showed you previously this is the band
so are we using a b or G in this case
it's 2.4 GHz I'm using BNG and I'm going
to run that against W l0 Monon so you
can see ESS ID is over there there's the
BSS ID of the network so what we want to
look for is a station that connects to
that Network so what I'll do is get this
phone to connect back to the network
okay so there's the client Mac address
so I can take that Mac address now and
then use that Mac address so change my
col's Mac address to that so that I
pretend to be that client okay so what
I'll do is turn off monitor mode so iwd
shows me that we back in managed mode
I'll start the WPA supplicant once again
now this wasn't enabled but I'll simply
make sure that network manager is
stopped that was previously stopped but
just make sure that you have that sto
before you change the MAC address I'm
going to take the W Lan zero interface
down so pseudo IP Link set Dev wlan0
down and now I can change the MAC
address of of the Wi-Fi interface so I'm
making my Wi-Fi interface this if I do
the command iwd but this is the new Mac
address of my interface IP
address will show us that this is the
new Mac address but this is the
permanent Mac address so I've now
changed the MAC address of my interface
card to be this now some people like mac
changer but we've had problems with Mac
changer so that's that's why we're doing
it this way next step is to bring the
WLAN zero interface up and start network
manager okay so hopefully now I'll be
able to connect to the Wi-Fi network so
I've disconnected the ethernet Network I
need to put in my password to connect to
the Wi-Fi network so I'll put that in
Spider-Man and hopefully now I'll be
able to connect to that Network so if I
look at IP address notice I've been
given an IP address previously I wasn't
given an IP address but the router has
now given me an IP address and I should
be able to Ping another device on the
network so if I look at the TPL link
router notice the whitel list has the
Galaxy s22 as well as the laptop if I
look at my network map and clients I've
got the laptop with IP address 41 here
and the Galaxy with IP address 29 that's
the IP address I've been given so I'll
paying the laptop so 41 and notice the
pings succeed I can send traffic from my
col virtual machine through the Wi-Fi
network to the physical laptop notice I
have disabled the wide connection on
this machine so the traffic is going via
the Wi-Fi network only connection I have
is Wi-Fi on this virtual machine so it's
going through the Wi-Fi to the physical
laptop the TPL link router believes that
my Galaxy phone is connected to the
network and my laptop those are the only
two devices that are allowed but I've
been able to circumvent the white list
by changing the MAC address of My Collie
machine to that Mac address again this
is the MAC address of Collie that is the
burnt in address or permanent Mac
address but this is the MAC address
that's being used so my TP Link router
believes that it's the phone that's
connected but in actual fact it's the
collie virtual machine that's connected
now some people may ask this can the
phone and the laptop be connected at the
same time so I'll connect the phone back
to the network and what I found is that
it sometimes works sometimes doesn't
work ideally what will happen is the
client will not be on the network when
the collie machine is connected to the
network otherwise they'll interfere with
one another so I can try and ping the
Windows computer but notice we're having
problems at the moment because even
though this is connected the phone is
also connected so if I disconnect the
phone now hopefully things will work
better and there you go I can ping the
Windows computer from the col machine
now this is a basic ethernet principle
or Wi-Fi principle if two devices are
using the same MAC address on the same
network that's going to cause problems
so ideally the client will get off the
network at some point and then I'll have
full access to the network using the
collie machine okay so there are two
myths hiding your network name will
protect you that's not true I can attack
your network just by using the MAC
address I don't need the name to attack
the network and I can discover the name
of the network so that's not going to
stop a DET termined attacker from
attacking a network and number two MAC
address filtering or whitelisting or
some kind of Access Control will stop a
device from accessing your network
that's also not true because the
attacker can find out the MAC address of
a client on your network and then change
their Mac address to be that client and
then they can access the network now
it's not going to always work perfectly
because if that client and the attacker
on the network at the same time there
may be issues with the sending of
traffic but the point is is that the
attacker could get access to your
network and then maybe change settings
in your network work now a question
people may have is how do you better
protect yourself now the first thing you
want to do is use a good password don't
use a password like Spider-Man don't use
a password that can easily be cracked so
make sure that you use a long
complicated password for your Wi-Fi
network second thing is make sure that
you use WPA 3 don't use WPA 2 here where
I can knock off clients or disconnect
clients so do a deauthentication attack
against the client and then capture the
handshake so use wpa3 if you can now
that may cause problems with some of the
clients in your Network so you may be
forced to use WPA2 but you can
strengthen WPA2 to stop this kind of
nonsense but ideally you'll be using
wpa3 which makes these kind of attacks a
lot more difficult so use strong
passwords use wpa3 where you can what
other tips have you got please put them
in the comments below ways that you can
better protect yourself on a Wi-Fi
network I'll throw one more in here
don't put iot devices on the same vline
or the same network as your important
devices so make sure that you put them
on a different Wi-Fi network or a
different VLAN something totally
separate to your important devices iot
devices are notoriously bad from a
security point of view so you want to
put your lights or any other type of iot
device on a separate Network to your
core important Wi-Fi network again if
you got any other tips please put them
below now if you enjoyed this video
please like it please consider
subscribing to my YouTube channel and
clicking on the Bell to get
notifications I'm David Bumble and I
want to wish you all the very best
[Music]