How rediculous is the 802.11 craze..?

So here I am at work, working on the configuration of one of my access points when an idea hits me... I had a little time to spare so I grabbed my laptop and did a quick site test, then proceeded to download some software and break into my network to see how easy it really is...
needless to say the results were startling. I walked across the street from my building and I was still connected via my WAP... Now, I will state that when I did this testing I had 128 bit WEP turned on, broadcasting of the SSID off, and mac filtering enabled.

my mac address was not in the allowed mac address list. I didn't have the key inputted , and I had no idea what the SSID was(atleast my computer didn't).
I fired up the program I had downloaded and wham...in the time it takes to get an IP address, I had already discovered the SSID of my WAP, its operating channel, and its mac address, and the type of encryption being used.....

Are you getting the idea yet ?

It is that easy folks. For another test of sorts I walked to my car and turned on my laptop. I was on the way to the mall for some new books and decided this would be fun. all I had was my laptop and wireless NIC.(orinoco gold if you must know)
The instant I logged into my machine I was on the internet, some poor chap in the house near where I park was wireless too. I checked the web connection and it was stable at 5.5Mbps...not bad for being in my car. I drove to the corner after laughing a bit, and boom...picked up 3 overlapping signals. They were starting to roll in and I hadn't even travelled 500ft yet.... I drive down the street a little more and they are really rolling in now.. my program is beeping every few seconds with another WAP discovered. needless to say this was exciting and very very alarming.

I drive down a few more roads ( 5 in total on this trip) and get on the highway to the mall. about 2 miles from the airport I get a very startling beep from my monitor
DOA-NOC-AIRPORT pops up.... WTF!?!?!?! and its not encrypted....anyone else see something wrong with that ?

anyways...I will attach my log of my quick drive to the mall for people to see.....
all I have to say is, SECURE YOUR ****ING 802.11 nets to the max they are capable of..
This 802.11 craze is too rediculous.
By the way, I used netstumbler on this trip.
www.netstumbler.com

Ive been studying 802.11 security for a while now. Actually there is not much to study.....its insecure!!!

www.wardriving.com provides some good insight on the hardware and software needed to do this type of testing. It seems like ever since Shipley released his perl script to find AP's this thing has been going up and up and up.

I am working on writing a secure guide to implementing 802.11b right now and will be posting it soon.

Go to airsnort.shmoo.com to get the latest version of the popular WEP cracking tool Airsnort. This tool has been getting better and better and now supports the Hermes chipset (Orinoco). For all of you with Orinoco cards, they have an external antenna attachment so support for these cards is good. While testing Airsnort in a lab environment I cracked WEP with about 3500 "interesting" packets (packets with weak key sections) in only 2 hours.

I do agree that 802.11 is getting a bit out of control because I cant turn around before another script kiddie puts up a website claiming he is a hacker because he wardrove his local neighborhood. 802.11 is really cool but extremely dangerous because it is so cheap and easy to implement and people just dont know the security implications of it.

Check out the presentation section of www.blackhat.com . They have some great presentations on 802.11 security, advanced explout techniques, and basically anything else you would ever want to know about it.

~Xe

xenon

xenon
Have you tried kismet yet ? www.kismetwireless.net for those that don't know....

And also, linux is still the premier OS for wardriving as it has all the tools readily available to it., not that I am a cracker or wardriver etc....this was all in experimentation and to widen the eyes of others....

I just remembered. Wanna play a good joke on a script kiddie???

Search Google for FakeAP.

This is a program that uses PrismII cards to generate thousands of fake AP beacons. Netstumbler will pop up thousands of access points!! :)

I tested this thing out on a friend of mine. The look on his face was priceless.

FakeAP is not a viable security option though (security through obscurity)


~Xe

Yes. Kismet is phenomenal. Definatly the standard for Linux warXing.

I was reading about that, I thought of trying it out to see.. However I know that none of these unencrypted ones were fake as I connected through them....

Linux is the premier tool for everything :) Sorry, i couldnt resist.

indeed it is....I wanted something fast and ugly though as I thought of it at the last minute.

Sorry this is unrelated but real quick. I accidentally hit the "Ignore" button while trying to send you a PM. How do I take you off this list?

Damn touchpads.

~Xe

nevermind. I found it.

I apologize for hogging this thread but I remembered I have this great whitepaper that gives a good overview of the issues surrounding 802.11. It also lists all the common testing programs out there in one of the appendix.

Enjoy :cool:

~Xe

nice whitepaper...time to read...

Quote:

---

Originally posted here by Xenon
I just remembered. Wanna play a good joke on a script kiddie???

Search Google for FakeAP.

This is a program that uses PrismII cards to generate thousands of fake AP beacons. Netstumbler will pop up thousands of access points!! :)

I tested this thing out on a friend of mine. The look on his face was priceless.

FakeAP is not a viable security option though (security through obscurity)


~Xe

Yes. Kismet is phenomenal. Definatly the standard for Linux warXing.

---

This may not be an option for security (nothing should ever be a substitute for good security), but it's a good deterrent. If you're looking at millions of available networks as a skidiot only to find that most of them are bunk, would you sit there mindlessly plunking away at each network looking for a good one, or would you move on to a more readily available target?

I also wonder if this technology (FakeAP) could be utilized to construct some honeypots. Kind of like WAP minefields that could communicate with other attempted networks to triangulate the origin of the skidiot and report the vulnerable location in long/lat coordinates?

I'm not so sure how long FakeAP would be effective, because someone could write a program to systematically scan, so they could just set up a laptop and let it figure out which ones are real networks and which are the decoys. But it would still make it difficult even with an automated program.

Yes I agree with Syini666. I am not a good programmer at all but I would figure a script could be written that would run through the AP's sending an ACK type of package (however 802.11 works) and could eliminate the fake ones quickly.

~Xe

unless you set up real ones that looped to the localhost IP, and were firewalled for all outgoing connections to them...then you could spend a while playing with something that was real, gave real signals, but didn't let you get anywhere.

Kismet on my Sharp Zaurus. Drool. 'nuff said :)

you get gpsdrive on it too ???

The serial cable is hard to come by and expensive to boot so I ain't got it yet. I have a beautiful garmin GPS that'd handle that end of the buisness just lovely :)

now since the original intent of this was not to start a wardriving mania...I want to talk about securing methods..

What do people know of EAP, PEAP, and LEAP ? are any methods of these available for linux or non windows XP SP1 computers or cisco ?

You should check out the latest 2600 quarterly. Vol. 19, # 2. There's a good article on 802.11b, WEP, active and passive scanning, and equipment. Quite informative.

v_squared_over_r

2600 sucks and is nothing compared to what it used to be... the single most informative paper on it is that one by idefense, in my opinion anyways....

Anyone have any info based on my last post about auth methods ?

haha good story
im actually curious now might borrow a card and go for a drive and see how many i can pick up :D
(might become a new game!!)

Linksys has some trouble with their firmware too.. you can download a file (via tftp) wich contains the password used for the webinterface configuration..

you could lock ppl out of their own linksys if you'd want to..

but I can't tell much more about this right now.. (Sworn to secrecy)

I just started getting into 802.11b networking and I've gotta say that this is some great info. I'm going to have to look into how secure our network is.

-gunder

Well, I have been working with wireless for a while and you can secure wireless, it just costs money :). We are running a VPN inside our wireles network that runs dynamic WEP. IT IS secure from two different aspects.

The first is dynamic WEP changes the WEP encryption key every 10 minutes so a hacker may be able to capture packets and crack your WEP. Then he would be able to look at captured packets but he would not be able to attach to your network.

The second is running a VPN inside our WLAN. Even after a hacker breaks the WEP all he will see is garbage because the VPN traffic is encrypted to a point that would not be hackable.

what are you using for your vpn ?

Did you know that everyone in ASPEN COL. (USA) Has free 802.11 access...

We are using a CISCO 3030. We are using it for not only our WLAN but also for remote access. I also like the fact that I can brand the client it make for easier distribution and installation support. The 3030 is a pretty big box. You could use a smaller version with no issues.

are you using a radius server as well ? if so for what use, mac auth, and or other things ? if using a radius server, what piece of software commercial or GNU ?

For remote clients as our first tier of security we are manually distributing the branded client.

For authentication foe both remote and WLAN clients we have the 3030 accessing ADS.

We are also testing digital certs on a USB token for additional remote authentication.