Wi-Fi Protected Access

Mm-hmm.

And yet it requires WPA3, and how do, how are people implementing that with Eduroam and making it be backward-forward compatible? That's, that's a big question out there.

Yeah.

So one of the things I've seen, when we asked in our survey, which the survey's still out there, um, I'd love more Eduroam admins to do it.

It's about half and half, actually.

So, so 52, almost 53% are using WPA2, so they're not, they're, they're unable to use 6 gigahertz.

Um, but the other half of the respondents are using either transition mode or WPA3.

Um, I actually noticed recently that in the Eduroam connector agreement, so the, the, like, worldwide agreement that sites sign, someone at your school signed it if [chuckles] you have Eduroam, um, it does actually call out WPA2, I think, with this idea of backwards compatibility.

They'll look for a different place to get their network connectivity and maybe wander over to your captive portal or other malicious network.

Um, but I'm gonna show another thing you can use it for, and that is to capture a password hash for WPA and WPA2.

Now WPA3 really improved on this, and so it's not as...

This isn't a method you'd use there.

But if you have a WPA or WPA2, most likely personal network, there's a hash of the password and some other information that gets exchanged over the air in a four, what's called a four-way handshake, and an attacker can try to capture that either when a client naturally connects to the network or by kicking that client off a network and watching it immediately reconnect, and that's what we'll try to do here.

So let me talk about what I've got set up.

I've got a virtual machine running, it's Ubuntu, and I've got a Wi-Fi adapter set up and it's in a promiscuous mode so it can sniff all the traffic, and I told it to watch channel one, which is where we just had our Flipper credential harvesting company captive portal running, and there's still a client connected because I believe my phone is still connected.

There's the phone.

Mm

... we can think about Wi-Fi 6, Wi-Fi 7, WPA, um, you know-

Mm-hmm

...

You still have to go back and do some of the tests that I was doing in 2012, right? But then you have to do the 11n, then the 11ac, then the Wi-Fi 6.

Oh, you're also doing 6 gigahertz? We gotta do those as well.

Uh, some of them, some of those tests are also duplicated where it's, say, like WPA3.

Oh, you gotta also redo those tests in 6 gig as well.