Any Idea how to achieve this rather advanced attack ? (similar to traffic analysis attack)

[minanagehsalalma]

I made a video demonstrating the idea

traffic.portal.mp4

what i am lost at is ... how to know if a user just opened an app like FB for example... so the attack become convenient

[mhils]

Cool idea, I wonder though if you can make the captive portal screen appear on a network which already provided a working connection before. :)

[minanagehsalalma]

I wonder though if you can make the captive portal screen appear on a network which already provided a working connection before

@mhils yup this possible , my router already does that if the data plan goes out.

it can be simply done using DNS hijacking , if you didn't notice ... on android phones if the network connection goes out you can see that on the wifi icon ... it shows network status which means it keeps doing passive probing in the background.

it uses these

NetworkCapabilities.NET_CAPABILITY_VALIDATED indicates that Android OS successfully validated connectivity on this network.

if the network connection validated check were to be redirected by a captive portal , then that would be detected too

here is a video of me replicating it the router
i made it show the notification then made it remove it without needing to disconnect and reconnect to the network

ddd.mp4

on windows

NCSI passive monitoring, the MSN Portal page, and the network status alert
In addition to the active probes that this article describes, NCSI monitors the network activity of other applications on the computer. This passive monitoring process continues even if the active probe process fails. NCSI adjusts its network status determination based on whether other applications can make successful TCP connections. If a network alert appears because of a failed active probe, it disappears when a passive probe succeeds.

the source which is the most extensive one on the matter

sorry for the late reply , hope i was able to answer your reply well.

[minanagehsalalma]

@mhils so... what do you think ?

[mhils]

Still sounds like a cool attack! I unfortunately can't help you implement it, but have fun! :)

[minanagehsalalma]

I unfortunately can't help you implement it
@mhils i just need the tip of the string 😥

what i am lost at is ... how to know if a user just opened an app like FB for example... so the attack become convenient

but have fun! :)

thanks i will try : )