Source
r/sysadmin•
subredditbrowser

Spoofed APs

Have a Meraki environment with an MR32 and an MR18. When these are broadcasting, there is a device hidden somewhere spoofing both the main and guest networks. Disconnect the APs and the spoofed network goes away.

In the Meraki portal with AirMarshal I can see spoofs and malicious broadcasts reported. I have used inSSIDer to try to pinpoint where the signal is coming from, but was not able to make any headway. With inSSIDer you can clearly see MACs that are not the Merakis broadcasting the spoofed network. These MACs are not on our LAN.

Meraki has said it's not their issue and can confirm it's not something wrong with our APs.

At this point I'm still not sure if it is malicious in nature. Any ideas on how I can track down the rogue device?

Posted Jul 11, 2017, 4:29 PM UTC

1432
_MusicJunkieJr. Sysadmin•

That sounds like someone just plopped a Wi-Fi repeater to get better reception on the toilet.

30
rtfm_or_gtfo•

This is the most reasonable possibility.

Regardless, if you can't solve it by asking around or a scream test you may have to resort to doing things the old fashioned way.

  • Map the signal with inSSIDer or similar again to triangulate the location based on signal strength. This is going to take some <literal> leg work, wander all around the location including up and down floors until you get an idea of the AP's location.
  • Once you have an idea of it's location you can start wandering and poking around for something plugged in to an outlet that shouldn't be there.
  • Alternatively, get Facilities involved and (assuming it's safe to do so) start killing electrical circuits one at a time until the AP goes offline. Then you at least know what circuit it's drawing power from which should narrow your search.
  • If you have a MAC (assuming it's legitimate) you can look up the manufacturer. This isn't likely to be much help but more info rarely hurts.
10
AccidentalSandwich•

Might be time to employ the scream test. Consider blocking/denying the MAC addresses of the devices you believe to be rogue APs.

11
blackletum•

This might be stupid advice but I have an app on my phone called Signal Spy. It will tell you what networks it sees and the approximate distance of the signal, with some other useful information.

If _MusicJunkie is correct, this might help you find this hidden WiFi repeater (if that is truly what it is)

4
schizostaticManufacturing IT *Sigh*•

That is what inSSIDer is.

6
blackletum•

I'll have to look into inSSIDer then as well.

2
MyNameIsJerri•

I believe Air Marshal will allow you to contain the SSID (Spam DeAuth packets to anything connecting to it, effectively making it useless). I'd do that and wait for someone to come running.

4
schizostaticManufacturing IT *Sigh*•

Just remember this is technically illegal in some areas.

3
MyNameIsJerri•

Definitely check with legal first.

1
blackletum•

Sounds illegal af. Anywhere to look up where this IS legal, though?

0
ghyspranSpace Cadet•

I made a comment elsewhere in this thread, but based on a reading of one of the FCC's somewhat recent decisions, it seems like blocking the rogue AP by spamming deauth packets might actually be legal in the US in situations like this where the rogue AP is broadcasting using your SSID, since it's a legitimate effort to protect the security of your own network and the rogue AP itself is arguably operating illegally by maliciously interfering with the operation of your network by spoofing your SSID.

5
etherealeminence•

It also doesn't indiscriminately interfere with other communications - it's not like you're jamming the airwaves and screwing with everything.

3
schizostaticManufacturing IT *Sigh*•

Must be somewhere as a lot of manufacturers have the ability.

2
timchi•

This sounds a lot like the Meraki mesh issue where Meraki AP's create a hidden WEP network in certain scenarios. It's annoying but non-malicious. Very entertaining writeup on it here:

4
Govan888•

Never sorted this out, but i had a similar experience which got me all excited some one was spoofing our SSIDs... Could never track it down or quite figure it out. Actually forgot about it till now. I'll take a look at our air marshall if i remember tomorrow.

2
AgentSmith27IT Manager•

Do you have encryption on these devices? If you do, its not going to be able to intercept traffic without extra work. Can you connect to these devices without a password? If not, then its probably just a blind repeater and relatively harmless.

You don't need to spoof an encrypted AP to try and decrypt traffic, so if it isn't letting people on without a password, then its probably not malicious. Obviously that doesn't mean you should leave it, but obviously less of a concern.

2
NibeP•

Does this only affect MR32´s or also MR18´s ?

How does the MAC compare to the MAC of the AP's? Dedicated Security Radio may be this "spoofed AP".

2
frX1337Jr. Sysadmin•

Funny thing, had the same issue with our MR33's today! Traced it to one of our AP, rebooted it and I haven't seen it in Airmarshall since.

Im not sure yet but I think it starten when one of the stacked switches lost it's uplink, hence creating a wierd semi-mesh-mode on the AP-side.

EDIT: Spelling..

2
subredditbrowserOP•

Update: Airmarshal is showing spoofs and malicious broadcasts, not rogue SSIDs.

Using a laptop with a better WiFi card, inSSIDer was able to narrow down the area. The device is somewhere within ~2 meters of our MR 18. I checked most of the surrounding ceiling area and found nothing.

Changing the SSID but keeping the original password resulted in the new SSID being spoofed within about 15 minutes.

The MACs doing the broadcasting do not belong to any manufacturer and are only 1 digit/letter off of the legitimate APs in some of the groupings, otherwise they look nearly identical.

2
benjgvpsWISP•

What if you remove that AP, bring it to another part of the building and reconnect it? Do you still see that same MAC? I have zero experience with Meraki gear, though if you're seeing the "rogue device" so close to the AP, I would think that rules out any sort of repeater and I would lean more towards the AP doing something funky.

8
subredditbrowserOP•

Will give it a shot later this week. Not sure what else there is to try aside from the yagi suggestion. Thanks.

1
fourpotatoes•

I've never tried it with 802.11 gear or anything so low power, but if the signal is reading full-scale and you don't have an attenuator, it might be worth trying the old foxhunting trick of unplugging your antenna.

3
BeefyousTurn on and officer•

Use InSSIDer with a yagi?

2
vigilemSysadmin•

What vendor do the MACs belong to? It certainly sounds like a repeater.

1
platformterrestial•

Air marshal it and ignore until you have the spare time to hunt it down.

0
edneilMSP (God help me!)•

Ignore it and illegally broadcast on the 2.4GHz band (= spam deauth frames) is most assuredly not a valid solution.

OP needs to pick up a directional antenna and go on a walk around the building.

The directional antenna is the key here, without it it becomes an excersise in frustration.

3
jeuface•

Ignore it and illegally broadcast on the 2.4GHz band (= spam deauth frames) is most assuredly not a valid solution.

If it was illegal i'm pretty sure the FCC would have made Cisco get rid of the feature. Or at least would have locked the feature out of the US regulatory domain on the APs.

And it is a valid solution, its the very reason why this feature exists.

4
edneilMSP (God help me!)•

FCC have already stepped in before: http://time.com/3685802/hotel-wi-fi/

I'm sure the same applies to 'fake ap containment' which has a big disclaimer slapped on to it that Cisco / whoever is not responsible for it.

At least, I wouldn't want to be the one up against the FCC for using that crap...

3
ghyspranSpace Cadet•

Consider this FCC ruling against M.C. Dean, Inc., for blocking personal hotspots at the Baltimore Convention Center: https://apps.fcc.gov/edocs_public/attachmatch/FCC-15-146A1.pdf

The ruling explicitly includes these lines when referencing prior rulings:

Marriott admitted that the Wi-Fi users it blocked did not pose a security threat to the Marriott network.

and

Similarly, Smart City submitted no evidence that the deauthentication was done in response to a specifically identified security threat.

Later, in the discussion of that specific case, we see this:

M.C. Dean claims without any evidentiary support that its blocking was necessary to provide a reliable and secure Wi-Fi service at the BCC. But M.C. Dean was not authorized to block any lawful third-party Wi-Fi device under Section 333 of the Act, regardless of its desire to support its network. Wi-Fi operates in shared spectrum in which no user is entitled to block another in order to reduce congestion. In addition, M.C. Dean misplaces its reliance on the federal cybersecurity guidelines it cites. The recommendations in those guidelines that federal network operators have wireless intrusion detection and prevention systems do not authorize M.C. Dean (which is not a federal agency) to use those systems to send deauthentication frames to Wi-Fi users who are operating their stations as authorized to establish personal networks. In any case, M.C. Dean failed to provide any evidence supporting its claim that its blocking activity actually targeted any devices that threatened the reliability or security of its Wi-Fi network or the users of its Wi-Fi network. The record, rather, points to M.C. Dean using automatic blocking only to benefit itself commercially, to improve its system’s performance, and to limit competition.

The legal arguments advanced by M.C. Dean to justify its Wi-Fi blocking are meritless. As addressed above, Wi-Fi blocking is “malicious interference” prohibited by Section 333, as demonstrated by the plain language and legislative history of the statute. In contrast to M.C. Dean’s claim that Section 333 is limited to interference caused by jammers and other unauthorized operations, the statute also prohibits malicious interference to any radio communications by an authorized station. Additionally, M.C. Dean has not explained how its indiscriminate Wi-Fi blocking could be considered a permissible network management tool. The company’s automatic Wi-Fi blocking did not support the management of M.C. Dean’s own network, but rather the prevention of others from operating their own networks apart from M.C. Dean’s service.

That excerpt repeatedly points out that M.C. Dean's actions were not an effort to protect the security of their network, but to interfere with the operation of other networks. While not explicitly stated, the implication is that, under some circumstances, such interference could be legal for the purpose of securing your network. As well, note that it says (emphasis added):

M.C. Dean was not authorized to block any lawful third-party Wi-Fi device

Given that, it seems to me that you could make a pretty solid case that spamming deauth packets to block a rogue AP operating using your SSID is perfectly legal―especially if the rogue device changes its SSID to match whenever yours does―based on the fact that

  1. the rogue AP is willfully or maliciously interfering with the operation of your network by using your SSID, making it not a legally operating device.
  2. you are blocking the rogue AP for the express purpose of securing your network by preventing your own devices from connecting to the rogue AP by mistake

IANAL, though.

3
jeuface•

Did you read your own citation?

The agency issued an enforcement advisory Tuesday explicitly prohibiting hotels from interfering with Wi-Fi hotspots that customers may set up using their mobile phones and data plans. The ban also extends to convention centers and other commercial establishments.

Is this OP? Of course not. Do you know what a apple and oranges comparison is?

I'm sure the same applies

Well it looks like you certainly dont know what a apple and oranges comparison is then.

has a big disclaimer slapped on to it that Cisco

There is no disclaimer - https://documentation.meraki.com/MR/Monitoring_and_Reporting/Air_Marshal_Containment

2
platformterrestial•

Not very illegal when it's on his network and on his property.

1
edneilMSP (God help me!)•

It's not his spectrum.

Just like it's highly illegal for me to jam the 3G band on my land.

I have no right whatsoever to that spectrum. Causing a denial of service attack against another device operating in that band is illegal. The configuration (just so happens to share SSID) is irrelevant here.

2