Nov 15 2013 Version 1.4.5 released.
This app is for those, who are tired of being kicked from the network by WifiKill. And for those, who are a little bit paranoid, because they know it's quite easy to read the Wi-Fi traffic with tools like DroidSheep, ettercap, FaceNiff, Cain & Abel and others. Such programs use the same technique to prevent you from accessing the network or to sniff your data. You can defend yourself with a single app.
What is Wifi Protector?
Wifi Protector is a Android security app specifically designed to detect and prevent ARP spoofing attacks against your phone in Wi-Fi networks.
How does it work?
Wifi Protector is continuously monitoring network related parameters. When abnormal behaviour is detected, an alert is triggered. The type of alert can be configured. Detection, basic protection and alert work on all phones. On rooted phones it is also possible to reconfigure the phone to make it immune against the attack.
Get it!
You can download the attached free version or get it for free from Google Play (mobile link).
Comments, questions, bug reports are welcome.
If you find the app useful please donate to this Bitcoin address: 19jqzdWFYTf5KZKnS6CJfG9vMX86ghysJQ
FAQ
Q: What is a MAC address?
A: The Media Access Control address is a hardware address of a network interface. Every device in the (Wifi) network has a unique MAC address.
Q: What is ARP?
A: ARP stands for Address Resolution Protocol. When two devices want to communicate via Internet Protocol (IP) in a (Wifi) network they need to know each others MAC address. The ARP protocol is used to resolve the MAC address for a given IP address.
Q: What is the ARP cache?
A: The ARP cache is a temporary storage on your phone that holds pairs of IP and MAC addresses that belong together.
Q: What is ARP cache poisoning?
A: ARP cache poisoning is a method to inject false information into your phone's ARP cache by sending forged packets to the (Wifi) network.
Q: What is DOS attack (Denial Of Service) through ARP cache poisoning?
A: An attacker changes the ARP cache on your phone in a way that invalid MAC addresses are associated with certain IP addresses. Very popular is to inject a false MAC address for the default gateway of your phone. This is an effective way to prevent your phone from accessing the internet. The attack is very lightweight, so a single attacker can disturb large networks. With Wifi Protector on a rooted phone you are immune to this kind of attack.
Q: What is MITM attack (Man In The Middle) through ARP cache poisoning?
A: Like in DOS attacks an attacker changes the MAC address of your phone's default gateway in your phone's ARP cache. Instead of injecting an invalid MAC address he places the MAC address of his own device into the cache. If possible, he also poisons the ARP cache of the default gateway in the Wifi network and changes the MAC address associated with your phone's IP address in the gateway's ARP cache. If the default gateway is vulnerable, the attacker has established a full-routing MITM. He can now read and change everything you send and receive over the network, in some special cases even if you use encryption. If the default gateway is not vulnerable, the attacker has established a half-routing MITM. He can then read and change everything you send, but not the data you receive. With Wifi Protector on a rooted phone you are immune against half-routing and - to some extent - against full-routing MITM. In the full-routing MITM scenario Wifi Protector prevents the attacker to read and change everything you send, but not the data to receive. In any cases you get an alarm.
Changelog
Code:
1.4.5
- OTHER: Added ACCESS_SUPERUSER permission
1.4.4
- OTHER: Changed su handling which fixes issues with outdated su binaries
1.4.3
- BUGFIX: Notification icon no longer disappears when "Clear notification" button is pressed
- FEATURE: Added option to force start at boot, which is useful on devices that don't signal Wi-Fi start at boot
- OTHER: Added CHANGE_NETWORK_STATE permission, which is required on some Samsung tablets running Android 3.2 in order to disable Wi-Fi on attack
1.4.2
- BUGFIX: Fixed ANR on some devices that happened in rare cases when app is started first time
- BUGFIX: Fixed rare FC when restarting service from Expert Perspective
1.4.1
- BUGFIX: If notification settings haven't been configured the notification icon disappeared if main activity was closed. Fixed
- OTHER: Improved error messages
1.4.0
- FEATURE: Notification icon can be hidden
1.3.0
- FEATURE: Wi-Fi can be automatically disabled on attack (optional). This is useful on non-rooted phones
- FEATURE: App can be brought to the front on attack (optional)
- OTHER: Improved compatibility with battery saving apps
1.2.0
- BUGFIX: Attack notification ringtone didn't honor phone volume on some devices. Fixed
- BUGFIX: Vibration didn't honor phone silent mode. Fixed and made it configurable
- FEATURE: All spoofing attempts are logged, including SSID, BSSID, Gateway IP, Gateway MAC, Attacker MAC, Attacker IP. Vendors are resolved and shown in detailed log view. Logs are cleaned automatically. Log size can be configured
- FEATURE: Expert perspective shows BSSID vendor as well as SSID
- FEATURE: On attack vibrate in a given pattern. Duration, repeats and gaps configurable
1.1.4
- BUGFIX: Fixed crash on ICS when Expert is selected
- BUGFIX: On ICS a wrong phone IP address was shown. Fixed
- BUGFIX: Fixed minor bugs
- FEATURE: Internal arp command included
1.1.2
- BUGFIX: Database cursor closing properly
- BUGFIX: If manually clearing gateway ARP entry fails, an error message appears
- BUGFIX: If manual countermeasures fail, an error message appears
- BUGFIX: BSSID mode attack detection precision improved
- FEATURE: Background image can be switched off to save RAM
- OTHER: OUI database performance improved
- OTHER: Unused permissions removed
- OTHER: Size of internal buffers reduced to conserve resources
1.1.1
- BUGFIX: Fixed wireless connection state handling
- BUGFIX: Fixed FC on wireless connection change
- BUGFIX: Fixed BSSID display in expert perspective
1.1.0
- FEATURE: IEEE 802.11 BSSID analysis. Detects the situation when a network is joined, which is already under attack.
- FEATURE: Three BSSID analysis levels. Light: Vendor compare. Deep: 5 octet compare. Extreme: Exact match.
- FEATURE: Expert perspective shows current BSSID.
- FEATURE: Home screen shows attack detection method.
1.0.0
- Initial public release.
MD5: WifiProtector-48.apk = 21bc43ba941a7f6bb75471e25e5dbd37
MD5: WifiProtector-46.apk = 5a2acdec7be1ea9faf1cfc3fb480d747
Anyone test this yet?How is the battery consumption when running in backround?
@Imjjames
One of the design goals was efficiency. Nonetheless the battery consumption is under your control by setting the Collection Interval.
With default value the consumption is about 1% on a Samsung Nexus S. You can reduce the consumption by increasing the Colletion Interval.
I'll try this one, I think it's useful when connecting to open networks, you never know.
Well done sir, now we have the first ARP-Watch on Android !!
I just tested against ettercap (pc) and it's working (running on Ideos stock rom):
When the network is clean and the pc starts spoofing, I get the alarm on phone correctly.
When the network is already under attack by the pc and I join in with the phone, I get no alarm as the app seems to flag the attacker as the legit router, and therefore when the attack stops, the app thinks that the real router is the attacker.
It happens that when I go to Expert and manually start-stop the service 3-4 times, the app stop responding or crashes, but then it respawns in a couple seconds ! Nice !!!
Let's just remember that this is effective against arp-based attacks, if someone is sniffing passively, this won't fire any alert and the sniffer can still capture your data.
Thanks for this app !
ell3 said:
Well done sir, now we have the first ARP-Watch on Android !!
I just tested against ettercap (pc) and it's working (running on Ideos stock rom):
When the network is clean and the pc starts spoofing, I get the alarm on phone correctly.
When the network is already under attack by the pc and I join in with the phone, I get no alarm as the app seems to flag the attacker as the legit router, and therefore when the attack stops, the app thinks that the real router is the attacker.
It happens that when I go to Expert and manually start-stop the service 3-4 times, the app stop responding or crashes, but then it respawns in a couple seconds ! Nice !!!
Let's just remember that this is effective against arp-based attacks, if someone is sniffing passively, this won't fire any alert and the sniffer can still capture your data.
Thanks for this app !
Click to expand...
Click to collapse
Thanks for taking the time to test this. Will be interesting to see what this is capable of doing and any limitations.
Thanks to the developer too!
Sent from my GT-I9100 using XDA App
@OP Maybe this could be handy for an update: before running the main watching activity, make an arping on the net and warn about possible problems.
Normal arping reply:
Code:
00:16:01:AA:BB:CC at 192.168.0.1
00:18:4d:DD:EE:FF at 192.168.0.228
00:15:af:00:00:00 at 192.168.0.244
Arping reply when the net is under attack
Code:
[B][COLOR="Red"]00:15:af:00:00:00[/COLOR][/B] at 192.168.0.1
[B][COLOR="Red"]00:15:af:00:00:00[/COLOR][/B] at 192.168.0.182
00:18:4d:DD:EE:FF at 192.168.0.228
[B][COLOR="red"]00:15:af:00:00:00[/COLOR][/B] at 192.168.0.244
same MAC on different machines... hmmm... suspicious, maybe the attacker is already in.
what do you think ?
This is a great idea! Can you give us more details on what changes you make for rooted phones to be protected? I have implemented most of the sysctl tcp hardening techniques already and want to make sure they won't get overridden.
Hmm, the WiFi Protector app and service are taking up 20MB RAM. If you can optimize it a bit and cut the RAM usage to 5 or 10 you'll get more love
ell3 said:
When the network is already under attack by the pc and I join in with the phone, I get no alarm as the app seems to flag the attacker as the legit router, and therefore when the attack stops, the app thinks that the real router is the attacker.
Click to expand...
Click to collapse
It's true, when you join a network that is already under attack the app sees the attacker MAC as the MAC of the gateway. Although this will happen very rarely, there is a point on the roadmap to counteract this behaviour. Future version will build a local database of legit MAC-IP pairs of gateways in known networks. The database will be checked whenever you join a network. This way it is relatively easy to identify a network already under attack.
Update Nov 20 2011: Version 1.1.0 comes with IEEE 802.11 BSSID analysis and detects a network already under attack.
ell3 said:
@OP Maybe this could be handy for an update: before running the main watching activity, make an arping on the net and warn about possible problems.
Click to expand...
Click to collapse
Inspecting the whole network is an idea that was discarded at an early stage. Doing so would require actively sending ARP who-has frames to the network (like arping or iproute2 does). The idea behind Wifi Protector is to defend a single device and not to produce load on the network in any way. However, the suggestion was noted. Thanks for that. Maybe - in the far future - the app can be extended to act as a network admin's troubleshooting tool...
avgjoemomma said:
This is a great idea! Can you give us more details on what changes you make for rooted phones to be protected? I have implemented most of the sysctl tcp hardening techniques already and want to make sure they won't get overridden.
Click to expand...
Click to collapse
No need to worry, your TCP hardening on transport layer won't get overridden by code on data link layer. Wifi Protector does not modify any frames that reach your layer.
avgjoemomma said:
Hmm, the WiFi Protector app and service are taking up 20MB RAM. If you can optimize it a bit and cut the RAM usage to 5 or 10 you'll get more love
Click to expand...
Click to collapse
Erm... yes. The background image and the OUI database take a lot of RAM. There are plans to make this configurable.
gurkedev said:
The idea behind Wifi Protector is to defend a single device and not to produce load on the network in any way.
Click to expand...
Click to collapse
Ok you made the point. And the IP-MAC association for well known APs would help also!
gurkedev said:
Maybe - in the far future - the app can be extended to act as a network admin's troubleshooting tool...
Click to expand...
Click to collapse
Portable Network Troubleshooter...sounds cool !!!!
Great, thanks for the response So, can you details a bit about the countermeasures? I also have some iptables rules to help with SUNDAY and DDOS.
Oh and this might be a bit too nefarious but, would you be interested in adding a countermeasure? Once an attacker has been found you can pop up a nuke button that will either DDOS or SYN flood him
avgjoemomma said:
Oh and this might be a bit too nefarious but, would you be interested in adding a countermeasure? Once an attacker has been found you can pop up a nuke button that will either DDOS or SYN flood him
Click to expand...
Click to collapse
lol that would depend on OP's hat Detect - Protect - Prevent - Retailate!!
I don't think that would be much 'ethical', though it could be 'educative' .... i wonder how many specific kernel dos you could trigger remotely on a Android phone... hmmm that would be a good fuzzing
I find it somewhat disturbing that a network vandalism app receives much more positive feedback that a network defense app. Right now WifiKill, which costs $3, has over 300 thanks vs. 5 for your free app. I, for one, thank you for your efforts.
avgjoemomma said:
So, can you details a bit about the countermeasures?
Click to expand...
Click to collapse
What would you do on a stock linux box to correct an incorrect ARP cache entry?
avgjoemomma said:
Once an attacker has been found you can pop up a nuke button that will either DDOS or SYN flood him
Click to expand...
Click to collapse
How about sending packets to overheat the battery and make it explode?
Sup, I'm using an adblocker and it uses a VPN, however there's always a notification of the VPN running as shown in the screenshot. I tried going into settings to disable but it's a system notification so I can't get rid of it. Does anyone know a workaround for this? I would gladly appreciate it.
From what I know it's not​ possible without root. I think it's more to do with security so there's no VPN running without your knowledge.
Ah I see.. thanks
Try using Adhell if you haven't. It's also an ad blocker but without the notification.
I have a bit of a problem with Secure Folder. I have tried using disconnect pro, adhell, and adguard. So 2x knox blockers and 1x vpn blocker. All 3 of them are installed in the standard main partition of the device and work fine on apps not in the secure folder. Any app I have in the secure folder is apparently completely bypassing the ad blocking of all 3 blockers. The only way this is possible seems to be that anything in that folder is also bypassing the knox firewall AND any vpn you have set up. Surely your phone has ONE internet connection so all traffic has to go through it, this blocking should work on secure folder apps just the same? The apps and their data may be segregated but if I have a hosts file blocking certain IP's, I see no reason that should not effect every connection on the device! For security reasons alone you would not want secure folder apps bypassing a VPN for example.
I did try to install disconnect pro in the secure folder too but it just wouldnt work, it would not turn on, probably because it was already installed and running in the main partition and can't be running twice. I really wouldn't want to run it twice anyway due to the battery drain being double for no good reason.
So basically as far as I can see it is impossible to block ads in apps installed in secure folder?? (or for that matter, use your vpn with apps in the secure folder??)
I'm having the exact same issue. I was hoping for a resolution
I use blokada (a VPN based blocker) on my note8. You have to run it within the secure apps environment to block ads there as well. It's a bit counter intuitive but I actually love this. Even if I accidentally leave my work VPN open in the main OS my traffic from secure apps doesn't get sent through it. IMO this is brilliant.
A bit to late but has anyone figured this out yet, to filter the entries phones internet access through the main sides VPN... I found that using a direct DSN will help block ads in both primary and secondary, but one primary DSN is unstable for some websites
i basically only root my phone for ad away. was wondering is there any better option yet. not really looked into ad blocking for years
delboy79 said:
i basically only root my phone for ad away. was wondering is there any better option yet. not really looked into ad blocking for years
Click to expand...
Click to collapse
I use a DNS level adblocker, which works kinda good, but it's obviously not perfect.
Just go to the Private DNS settings and insert "dns.adguard.com". This is just one of the public and free adblock DNS, feel free to use any other or even create your own (e.g. PiHole).
You can use Adaway without root in VPN mode.
Only problem with DNS level ad blockers are that you have a stupid icon up in the top, and you have to keep going to the app every 5 minutes or else it will stop working
pojr said:
Only problem with DNS level ad blockers are that you have a stupid icon up in the top, and you have to keep going to the app every 5 minutes or else it will stop working
Click to expand...
Click to collapse
Can you not just turn off battery optimization for the app so it stays running consistently?
Also be aware if you block ads, the sexy local singles in your area will be unable to find you.