Hotel blocking personal router

sammo · 2020-02-11T23:51:03.266Z

Connecting your router to their LAN does not help. They are actively jamming AP. What you need is a Faraday cage.

alzhao · 2020-02-12T02:17:30.602Z

sammo:

So they are jamming your AP, Nothing can be done.

Does it work if you turn off your AP, connect your pc to the LAN port and only set up repeater connection to their network?

Or can we jam cisco ap as well?

sfx2000 · 2020-02-12T04:49:18.899Z

rp201rp:

I wasn’t aware of usb150 does client mode. is that with the latest testing version 3.1? thanks in advance.

“Client Mode” is Repeater with the AP turned off… which effectively turns the USB150 into a client station, as it’s not sending out beacon/management frames, as one is only connected over the USB ethernet to the laptop.

I do find this handy, as I’ve got it running as a WG client

sammo · 2020-02-12T04:56:31.376Z

They are actively scanning and jamming foreign AP. Jamming works both. By jamming them you can’t connect to their AP. I wasn’t kidding about a Faraday cage aka tin foil. You will need 2 routers linked by ethernet. The client router connects to hotel AP. The AP’s router is protected behind the Faraday cage. Or you can boycott the hotel

Would also works with usb tethering with a long usb cable.

sammo · 2020-02-12T05:20:58.358Z

Another option is move to WPA3.

news.ycombinator.com

WiFi deauthentication attacks and home security

545 points — 222 comments — edward — 7:48 AM - 27 Dec 2019

WPA3 is the way to go. You can have the client on WPA2 and your AP on WPA3. Android, Apple and Microsoft supports the protocol.

alzhao · 2020-02-12T06:22:50.119Z

Does it work if you make the SSID hidden, not turned off?

sfx2000 · 2020-02-12T06:59:50.117Z

Still sends out Beacon and Management Frames - so the AP will be deauthed…

sfx2000 · 2020-02-12T07:00:49.020Z

WPA3 won’t help here…

sammo · 2020-02-12T07:39:20.467Z

Can you shed some light why WPA3 does not prevent deauth attacks?

Wi-Fi alliance has made it mandatory for WPA3 devices to support PMF (Protected Management Frames). PMF implies that management frames (E.G. – Deauthentication) are protected and would prevent spoofing by unauthenticated clients or rogue devices.

Almahadeus · 2020-02-12T09:52:13.641Z

Thanks alzhao. I will attempt to connect to PC (if I can find one in the hotel) via LAN but will the router still theoretically be able to use connect to hotel WiFi in the repeater if wireless radio is off? BTW, I have managed to easily use a Huawei Mifi unit as a WiFi extender (without a SIM) to connect to the hotel WiFi and then use cable tethering to the GL.iNet unit and this daisy chain setup appears to have been working perfectly but I am quite surprised that the huawei device doesn’t appear to have been blocked by the hotel system. Is this possibly due to fact that the device is primarily designed to work as LTE router rather than a WiFi repeater/hotspot?

alzhao · 2020-02-12T09:54:59.934Z

If you turn off the wifi you can still set up repeater via a cable.

If you can connect via Huawei Mifi and use GL.iNet as AP, then it seems not ap jam.

There must be something else.

Almahadeus · 2020-02-12T13:00:01.659Z

Not much of an update really but connecting the router to a PC via LAN, disabling wireless of the router and trying to connect to hotel WiFi has not worked. Also cloning the hotel’s MAC and then the desktop PC’s MAC to the router (without cloning SSID) have also not made any difference. I am starting to suspect that this could all be due to some sort of an incompatibility issue with GL.iNet as all other devices (phone, tablet, firestick, desktop PC and MiFi unit) have been able to connect to the hotel WiFi with no issues at all.

lostdog · 2020-02-12T16:40:22.473Z

Not that it will help with the repeater setup, but check around your room for a standard LAN port in the walls and plug in to that. I have found quite a few times they are forgotten and hidden behind the bed or couch but still active.

Another thing to look at is the TV. I’ve found in Marriott (and sometimes other) properties many times the TV is hooked up to a box (attached to the back of the TV) that acts as a client for their network based television system. I’ve found there is often a LAN port on this and sometimes it’s unblocked full speed internet. At a place I was staying at a few weeks ago I was getting about 35Mbs from it without even hitting their captive portal. Going through their standard Wifi it was about 5Mbs.

sfx2000 · 2020-02-13T03:26:55.350Z

sammo:

Can you shed some light why WPA3 does not prevent deauth attacks?

Wi-Fi alliance has made it mandatory for WPA3 devices to support PMF (Protected Management Frames). PMF implies that management frames (E.G. – Deauthentication) are protected and would prevent spoofing by unauthenticated clients or rogue devices.

Won’t help for a long, long time, as a vast majority of the devices out there are WiFi 4/5, and PMF is optional there - so they just deploy that.

sfx2000 · 2020-02-15T05:56:46.871Z

Keeping an eye on this topic - might have a chance to see things first hand…

Have tools and knowledge to explore further

rp201rp · 2020-02-16T19:28:45.198Z

Looking to make sure I understand the the issue… when users router connects wirelessly in repeater mode to hotel wifi, and users router which has a single wireless adapter shares an access point for clients using that adapter also. the hotel wireless security software sees the bssid of one of it’s clients connected to it (you) and that client (you), also is sending out AP beacons for it’s clients(pc phone tvbox). They(hotel wifi routers) then send out de-auth wireless packets to your wifi router or just deauth your client connection to them internally

Johnex · 2020-02-16T19:36:41.632Z

My understanding is that they would deauth all routers in the area, so all devices connected to your GL router would get disconnected constantly. My guess is they could also ban the client connected with the same name as the rouge AP’s as well.

So the trick i wrote a few posts up would work. Getting the MAC of one of their own AP’s and use it against them.

Almahadeus · 2020-02-16T21:56:16.309Z

Can the hotel system actually be picking up the OS of these routers and blocking the OpenWrt routers rather than the AP beacon or even the MAC address? If this is the case, then is there a way to mask this to test?

tlymer · 2020-02-17T21:11:39.419Z

Have you got Cloudflare DNS selected? I just wonder if you took DNS from their system if they were redirecting you to a login page. If Cloudflare is selected you might not see the captive page.

sfx2000 · 2020-03-07T22:54:44.258Z

Johnex:

My understanding is that they would deauth all routers in the area, so all devices connected to your GL router would get disconnected constantly. My guess is they could also ban the client connected with the same name as the rouge AP’s as well.

Yes and no - e.g. one can use a MiFi type device providing WiFi from LTE as a private network, so as long as the LTE rateplan allows tethering/hotspot that will work.

Looking at both Hilton and Marriott properties in Bothell, WA, Austin, TX, and Boca Raton, FL - they are aggressively targeting repeaters - and they can detect things fairly easily by looking at the layer 2 headers in the packets, so WPA3 with PMF wouldn’t actually work to hide things, as layer 2 cannot be encrypted (even though the layer 3 and above can be)

They don’t deauth the clients attached to the repeater, they deauth the repeater itself…