wifi安全以及IoT传输杂谈#

做了一些实验，现在常见的家用WiFi还在大量使用wpa2

几乎没有遇到3的。以下会阐述一些实验性结论和研究

因为自身的设备是支持802.11a协议，在wpa扫描的情况发现是存在一些丢包的

同时，私有地址以及轮替的mac地址追踪是在跨路由的设备追踪的，而不是一直轮替

所以还是可以抓到4次握手的管理帧，并且其实aireplay 的 deauth也是非常方便进行攻击的

在有密码后其实有很多的攻击思路，http是直接明文传输的，

https的话走tls，当然，如果针对个人的话，如果可以拿到tls更好

再者为Iot，这边用的设备只能收点BLS广播

比如说如下示例

1
#include <zephyr/kernel.h>
2
#include <zephyr/sys/printk.h>
3
#include <zephyr/bluetooth/bluetooth.h>
4
#include <zephyr/bluetooth/conn.h>
5
#include <zephyr/bluetooth/gatt.h>
6
#include <zephyr/bluetooth/uuid.h>
7

8
#define BT_UUID_LAB_SERVICE \
9
  BT_UUID_DECLARE_128(BT_UUID_128_ENCODE(0x12345678, 0x1234, 0x5678, \
10
            0x1234, 0x1234567890ab))
11

12
#define BT_UUID_LAB_STATUS \
13
  BT_UUID_DECLARE_128(BT_UUID_128_ENCODE(0x12345679, 0x1234, 0x5678, \
14
            0x1234, 0x1234567890ab))
15

16
#define BT_UUID_LAB_COMMAND \
17
  BT_UUID_DECLARE_128(BT_UUID_128_ENCODE(0x1234567a, 0x1234, 0x5678, \
18
            0x1234, 0x1234567890ab))
19

20
static uint8_t status;
21

22
static ssize_t read_status(struct bt_conn *conn,
23
         const struct bt_gatt_attr *attr,
24
         void *buf, uint16_t len, uint16_t offset)
25
{
26
  return bt_gatt_attr_read(conn, attr, buf, len, offset,
27
         &status, sizeof(status));
28
}
29

30
static ssize_t write_command(struct bt_conn *conn,
31
           const struct bt_gatt_attr *attr,
32
           const void *buf, uint16_t len,
33
           uint16_t offset, uint8_t flags)
34
{
35
  if (offset != 0 || len != 1) {
36
    return BT_GATT_ERR(BT_ATT_ERR_INVALID_ATTRIBUTE_LEN);
37
  }
38

39
  uint8_t command = ((const uint8_t *)buf)[0];
40

41
  if (command == 0x00 || command == 0x01) {
42
    status = command;
43
    printk("status = %d\n", status);
44
    return len;
45
  }
46

47
  return BT_GATT_ERR(BT_ATT_ERR_VALUE_NOT_ALLOWED);
48
}
49

50
BT_GATT_SERVICE_DEFINE(lab_service,
51
  BT_GATT_PRIMARY_SERVICE(BT_UUID_LAB_SERVICE),
52

53
  BT_GATT_CHARACTERISTIC(BT_UUID_LAB_STATUS,
54
    BT_GATT_CHRC_READ,
55
    BT_GATT_PERM_READ,       /* 故意：不要求验证 */
56
    read_status, NULL, NULL),
57

58
  BT_GATT_CHARACTERISTIC(BT_UUID_LAB_COMMAND,
59
    BT_GATT_CHRC_WRITE,
60
    BT_GATT_PERM_WRITE,      /* 故意：不要求验证 */
61
    NULL, write_command, NULL)
62
);
63

64
static const struct bt_data ad[] = {
65
  BT_DATA_BYTES(BT_DATA_FLAGS, BT_LE_AD_GENERAL | BT_LE_AD_NO_BREDR),
66
  BT_DATA_BYTES(BT_DATA_UUID128_ALL,
67
    BT_UUID_128_ENCODE(0x12345678, 0x1234, 0x5678,
68
           0x1234, 0x1234567890ab)),
69
  BT_DATA(BT_DATA_NAME_COMPLETE, CONFIG_BT_DEVICE_NAME,
70
    sizeof(CONFIG_BT_DEVICE_NAME) - 1),
71
};
72

73
int main(void)
74
{
75
  int err = bt_enable(NULL);
76
  if (err) {
77
    printk("Bluetooth init failed: %d\n", err);
78
    return 0;
79
  }
80

81
  err = bt_le_adv_start(BT_LE_ADV_CONN_FAST_1,
82
            ad, ARRAY_SIZE(ad), NULL, 0);
83
  if (err) {
84
    printk("Advertising failed: %d\n", err);
85
    return 0;
86
  }
87

88
  printk("BLE-LAB advertising\n");
89
  return 0;
90
}