Using "Hot Spots" for Malicious Activity

I was driving home from work one night and actually pondering the ease of using wireless "hot spots" for malicious purposes and I was wondering, could it really be that easy to use hot spots for malicious activity all the while masking your identity just as easily? Nevermind proxy servers, IP masking, backdoors and tapping into zombie computers....this just seems...well, too easy for anyone with enough smarts to realize it.

Let me elaborate. (correct me if I'm wrong too, I always welcome constructive criticism)

I'll use the Linksys DI-784 for my sample because that's the one I'm using, as well as my neighbor. Now, out of the box defaults:
DHCP IP range: 192.168.0.100 - 192.168.0.199
MAC Filtering: OFF
WEP/WPA: Disabled (it defaults to Open System)
(I'm not going to get into default channels and SSID broadcasts as I'm trying to keep this as simple as possible to explain).

This is the current state of my neighbor's wireless Linksys (the default setup). I know this because when I asked him if he secured it, he looked at me like I had 3 heads and kindly replied "No, I just plugged it in, used the wizard and starting using the internet". Not only that, but anytime I reset my Linksys (it restarts when you make changes to the router config and you temporarily loose the connection), my laptop found his network and connected to it. I did inform him as to the dangers of not securing it, and notified him that I've connected to his network before (not on purpose) and it was almost as if he was insulted, like I was calling him an idiot to his face. And I know what you're thinking right now, "why don't you just turn off the damn "Automatically connect to Non-Preferred Networks" option." Trust me, I did. :D

Now, here's my hypothetical situation:
Let's say I have a laptop with wireless capabilities. Let's say I go and find myself a a nice little MAC spoofing program. Let's say I go drive around and find a nice little "hot spot" like my neighbor's non-secured Linksys. I go ahead and spoof my MAC, connect to his network and start doing all kinds of malicious things. From what I know of my Linksys, the only information it logs for wireless connections is the time/date/MAC address and some other trivial information. So, let's think about this for a second.
I can use his network to do what I need to do, spoof my MAC so even with the router logs, it's of no help in finding me. Add to that, that all traceroutes would lead back to the Linksys and even if we scoured the Linksys routing table, we'd wind up finding a spoofed MAC attached to 192.168.0.x.

Now, here's my question: Can it seriously be that easy to use a non-secured wireless network for malicious purposes? With the simple use of a laptop with wireless capabilities and a MAC spoofing program and a little free time? please say it ain't so.

Quote:

---

Originally posted here by ShagDevil

Now, here's my question: Can it seriously be that easy to use a non-secured wireless network for malicious purposes? With the simple use of a laptop with wireless capabilities and a MAC spoofing program and a little free time? please say it ain't so.

---

Yes.

And the nicest part? It's as easy as

Code:

---

ifconfig wlan0 hw ether macaddress

---

if you're running linux with the wireless tools.

Sleep well...

lmao keysersoze "sleep well" and ShagDevil thats just life i guess. Thinkj about it though, the same people who dont know enough to call their computer anything but a "modem" and the people who do not know what word and excel are for are now setting up wireless networks.

The issue is technology gets easier to use but it can only be so secure for somethin that easy. If i invent soemthin as easy to setup as the new routers that automaticlyl sets up an ACL, Encyption, etc then I WOULD BE ONE RICH MAN!!!

ShagDevil, you've already answered your own question. This is one of the reasons why the 'free hotspot' craze that was first imagined and trumpeted didn't really take off. Many businesses were concerned about the liability of being used as the launch point for Slammer 2.0, or for the cracking of some porn site and the theft of several thousand credit card numbers. With solutions such as the T-Mobile paid hotspot, they have some sort of tracking and authentication. With the freebie ones, they don't really have any control. Yes, one can say "user beware" and "we can not be held responsible for the use of this service"...but those are just phrases you read on signs. When the company is hauled into a district courtroom on a negligence case, their idea of a 'free hotspot to generate more business' won't seem nearly as appealing.

Quote:

---

Sleep well...

---

Oh I will, trust me. Here's my recipie for a good night's rest if you own a wireless network:
1 part MAC filtering
1 part WPA-PSK or WPA
1 part limited IP ranges
1 part disabling SSID (optional)
6 beers
4 donuts (preferably Boston Creme)
stir ingredients together, bake at 450. enjoy :D

In any event then, this begs the question: Should wireless routers come more secure out of the box? What about making it mandatory in the Setup Wizard to at least enable MAC filtering? Maybe some documentation on how to discover what your MAC address is and how to add it to the router's filter? Maybe a little addition to the Setup Wizard that asks how many computers will be connected to the router and then establishing an IP range based on the user's answer (instead of the default range the Linksys hands out)?
Or are we to go with the other school of thought: screw the user if they won't take the time to learn about securing their wireless router and let the rest of us who do care have to deal with the consequences?

Zencoder..................interesting point:

Quote:

---

When the company is hauled into a district courtroom on a negligence case, their idea of a 'free hotspot to generate more business' won't seem nearly as appealing

---

I only have to go to my local railway station to get a (legitimate) free wireless "hot spot". Over here the legal view would be that you can supply a telephone, and it does not make you responsible for someone using it for drug dealing, terrorism, blackmail, ransom demands etc...............it is the same with wireless and the net?..............the technology is not bad...............only some of the users?

:)

Ive got to go with nihil on this one. It would be like someone trying to hold lynksys responsable for a hack because thier product was used. Or its jack daniels fault someone got drunk and drove.

But on the other side of the coin we are talking about 2 completely different things. There is a world of difference between a company providing a free service to the public like nihil's example and a private individual setting up wireless for his home. Legaly he may not be responsable but moraly he should be. Any one with a wireless network should do everything reasonable to prevent it from being missused.

Now im not very familiar with wireless networking so I have a question along a similar line. Is there an application of some sort that will alert computers on a network when another computer joins? I know it would probably have to be built into the firmware. If it doesnt exsist it wouldnt be a bad idea. Then also a way to dissconnect a connection. For example Joe Blow is sitting at home surfing the net. He knows his wife is in the bedroom on her laptop talking to her boyfriend in another state. Nobody else is home. All of the sudden an alert pops up on his screen saying a 3rd computer has connected to the network. After about 30 seconds of checking to make sure its not another legitamite user Joe has the option to push a button and basicaly say "not on my watch, buddy".

Now I know there are going to be any number of posts as to why that wouldnt work. People arent on their computers 24/7. True but it would make a signifigant decrease in the amount of unauthorized use. Or how would you keep the hacker from recieving the same message and severing everyone elses connection to that network. Easy, Have the message sent to one specific IP address and set a box on the network to a static IP.

As others have said, it really is very easy to get onto an unsecured WAP.

Most WAPs don't have the logs enabled by default... so in many cases, it will log nothing.
If there are logs, (and they are not logging to a syslogd server) then it'll be overwritten pretty quickly. The buffer and memory size for logfiles in those SOHO routers are not much. Easy enough to flood any of your activity out of the files.

Quote:

---

Originally posted here by nihil
I only have to go to my local railway station to get a (legitimate) free wireless "hot spot". Over here the legal view would be that you can supply a telephone, and it does not make you responsible for someone using it for drug dealing, terrorism, blackmail, ransom demands etc...............it is the same with wireless and the net?..............the technology is not bad...............only some of the users?

---

I agree completely, if you are offering it for free, you're doing a service! But the state of legal practice in the US is pitiable at best. Our court system heard (and ruled on) a civil case where an elderly woman bought a cup of coffee from a McDonalds drive-thru, took the lid off to drink it (while still in her car), spilled it in her lap and received some serious burns due to the temperature of the drink. McDonalds stated they serve coffee very hot so it will be an acceptably warm temperature when the customer arrives at their location and can consume the drink. She sued...and won, I believe. It say's on the menu HOT COFFEE but the court ruled in her favor.

It is just that sort of thing that keeps businesses wary of these sorts of practices. I agree, if they offer the service as a benefit to the community with the self-serving goal of attracting more business (which I believe is completely acceptable. Thats just good business.) you shouldn't be held accountable. But then this lady sues McDonalds and our mom-and-pop owned book store that wants to give free WiFi-broadband reconsiders, thinking that if something happened, they could get sued and lose everything they own.

On the flipside of the coin, i pondered some people setting up hot spots to further there malicious activities. For instance, lets say your neighbor really did know what he was doing, and just played dumb. You connect to the access point, on accident, or on purpose because your just looking for free bandwith and you never know what setup he has on his end. You assume that its just a router or AP, but it's really routed through another computer with ethereal and he's picking up all your dropped packets. He could also have some kind of script running where he could try to copy your network shares. I'm not sure about the feasibility of all this, as i haven't seriously tried to think and develop a system around it. but anyone with enough time and a good location could do some serious datamineing with something as simple as a public hotspot. I would think twice about it, but would alot of other people? And also with Windows XP, its such a nobrainer that you could get connected to it without even thinking. I had someone in my office, that would always connect to an AP 2 floors above our office and they didn't even know it until they couldn't access our network shares. I kind of wonder how many Trojan Public Hotspots there could actually be out there.

That's a good point. Never thought of that. But still if you do that you wont know who is connected to you. They could spoof their mac address, and you could have multiple neighbor's with notebooks. Does the computer connected keep any other kinds of logs of networks it attached to, using say XP?

Quote:

---

Is there an application of some sort that will alert computers on a network when another computer joins?

---

I'm pretty sure that their is. I know they have something like that for netstumbler. With that software it could also email you if someone connects with the details (mac address, date, time, etc..) that way you know something is going on. Doesnt really sound that hard to make. Why isnt this included with most routers?

Keith

programs like that solidify my point, because lets say our trojan access point has a program like that, it could have a script set up to read the email or log file setup, so that all the automated process has to do, is mount the shared directories using Samba and then just dump all the files onto their hard drives, then even if the client disconnects, the server still has backed up copies to mull over at their leisure. another point, ALOT of people have default C$ shares, and just set up a brute force routine to crack the passwords, and then just try to copy the interesting folders. I know SP2 doesn't play nice when you try to download C:\Documents and Settings\ and then you have all the time in the world to get what you want out of em. cookies taste good to some malicious minded people. Another vector of attack i've thought of, is reminiscent of the old school AOL booters that floated around back in 96-97. Where it used Send Keys in VB to preform automated tasks. get all your key combinations right, and then you can perform just about any trick in the book, and unless the user is fast enough, everything will be performed as the user themselves. Not sure if this works anymore, but it worked wonders in win95. Combine that with an unpatched exploit, a tool that was posted on this forum a bit ago (at least i think so, it was an attack demonstrated at one of the many CONS around, and {bear with me, this is only from memory} it had the ability to replace all requested pages with an attacker specified one, or replace all images with one attacker specified, in the demonstrations case - the infamous goatse) and you just opened up a giagantic whole. of course, it all relies on if Send Keys still works in VB, and if the modern Windows OSes still let that kind of code do what it wants. All from a public access point. I posted all this just to give everyone something to think about, don't try this at home, and don't get me in any trouble for posting this.

Quote:

---

On the flipside of the coin, i pondered some people setting up hot spots to further there malicious activities.

---

Just out in the UK on the TV as well, so it MUST be true .................

EVIL TWINS.
A legitimate wireless network sets up.
Along comes a not so legit set up :eek: and they set up their network to match the first / legit one [pay attention at the back] Now customers of the legit can be 'fooled' into logging onto the EVIL TWIN ...............Phishing comes of age :(

PS: the telly called them 'Hackers' *groan* and their experts [ex = a has been. spurt = a drip under pressure.] showed just how easy it was to do ..........................
All I needed was the VCR running, and I would have had my very own "How to Hack" movie.

Unsecured WAP's are the way of the future for anonymous malicious activity. It's just too easy... Netstumble your way through the residential area of your city and see how many, (50%), of the available WAP's have the default SSID and no WEP/WPA. You know for a start that the user who set it up doesn't know what a log is and wouldn't know what it told them if you slapped them silly with it. If you want to be really cautious there isn't much to stop you checking and deleting any that might exist..... After that the world is your oyster..... Then, having dutifully marked it as "used" by noting the GPS co-ords you never use that one again.... job done....

There is a proggie out there, I have it on this laptop, called AirSnare, that monitors your wireless network and allows you to mark MACs as trusted that logs other MACs attempting to connect and what activity they try to carry out.... It's pretty basic in the version I have but it works.

As Foxy rightly pointed out, "Evil Twins" are also a no brainer and probably trivial to set up.... You might need more powerful gear, (read costly), but if your reward outweighs the cost it's worth it and very difficult to get caught if you don't "outstay your welcome", then move on to an unprotected WAP to reap your profit....

Let's be realistic... Unprotected WAPs are the biggest hole in the internet. They allow unfettered access by anyone at any time to do anything they please..... It doesn't take a lot of "pondering" to realize the possibilities.....

From the front page of AO :
http://www.enterpriseitplanet.com/se...le.php/3462041

Quote:

---

Then, having dutifully marked it as "used" by noting the GPS co-ords you never use that one again.... job done....

---

Assuming you do not have something like Intels failed processor id running or WMP uneque id.
Why not spoof your cards mac or use a different one and go back.

Quote:

---

Why not spoof your cards mac or use a different one and go back.

---

Jinx... You will never be a successful criminal.... Give it up now.... ;)

The old adage that a criminal always returns to the scene of the crime would indicate to the LEO's that, despite the fact your MAC is different, you are the crim.... They only need 1 chap with computer forensics experience, (but not much), to point out to them that he MAC was spoofed and you are the same person that did the dirty deed. Then, depending upon the dirty deed, they will spend enough money to catch you which may include a proper forensic investigation of your box.... and your computer too... ;)

If you don't think like a successful criminal you will never be a successful security person either... They don't _want_ to be caught so you need to look at the system and decide how they _couldn't_ get caught.... then mitigate..... ;)

Quote:

---

Jinx... You will never be a successful criminal.... Give it up now.

---

I have known that! since my scrumbing days, being caught with loads of apples hidden (not so well)
In my tracky bottoms. The copper slapped me around the legs and produced none alcholic cider............But then I was easily led a stray :D

I am fully aware of what forencic evidence can be gleaned from a pc. I recently recovered a lost drive for a Mormon aquaintance, complete with their MSN chat friends regaled in scimpy underware.
Rowing the boat home (i'm sure you know what i mean) .

I may be green but I can assure you, I am know cabbige patch kid.

Jinxy... It was a joke.... :D

My point was more that with a gazillion unsecured WAP's out there why would you ever need to return to the scene of the crime.... Just slide on over to the next street and start anew.... It's not like getting onto a shiney new unsecured WAP is a lifetime's work.... ;)

http://www.vnunet.com/news/1160672
It's also out on VNUNet.
Anyone care to speculate about just how you can go about making a CITY safe ?

I suppose they could just ASK the people to be good .......................

Lots and lots of places are offering "Free hotspots", such as hotels for their guests. Within a 5 minute walk of where I work, I can hit 4 or 5 different hotspots that are wide open. When it isn't -18 outside, myself and a couple of co workers will have lunch on the grass at one such place and surf on my Vaio. A buddy and I have hit and used over 75 different unsecured APs. My location is a TINY area, I would think that a city would have thousands.
A couple of the places (homes) even have unsecured shares. So I would think that "Yes" it is that easy.....

I live in a small (1mil) city in Australia. Not many people here really know how to secure their Wifi network. Except obviously the major companies...

I go war-driving alot, mainly with my pda, cause my lappy now has more external HDD's than a ... normal laptop :/

Anyway. My point reason for all this, is simple. Most people have unsecured APs, i can find about 20 in 15minutes.

So if i went driving for say an hour. Thats ~80 in an hour. Of 80, say 50 have the internet (ie not a single reconfig needed) of those 50 people, we can find the house w/o problems of atleast 50% of them. Brings me to 25 houses with unsecured APs running the internet for anyone to use.

Now, being a very social creature myself, I managed to work my way into a Sales Rep. job at a medium IT contracting company. So i know what to say.

25 Houses, "Hi, i just connected to your AP" gather much more information and explain that they can easily blow your monthly downloads which could be very costly etc etc etc "however, i have the know how and can secure it for a small fee ($AUD50)". If only 10 of those people say yes, thats $AUD550 in your back pocket.


edit: keep in mind, a 100% success in every AP and client would mean a gross revenue of upto $AUD4000, not bad for a week or twos work. Best about it, nobody does it in Adelaide
Well, thats my plan for now, just gotta get my lappy back up and running nix wireless so i can add weak WEP encryption to my list.

I know they call this extortion, or protection money. But i have very little use for free internet, i have much use for a couple extra dollars i can put in my back pocket.

IMHO, we both win. And depending on the client (old / young / irritation / skiddies) the price can be adjusted.

Just an idea, but a little offers me much of a challenge...

From this article on ZDNet

http://news.zdnet.com/2100-1035_22-5552100.html

Quote:

---

Shipments of wireless routers jumped to nearly a billion units in 2004 and are expected to continue to grow at double-digit percentage rates over the next couple years.

---

Based on what study you read, only 10 - 20% of these will be secure so that's gotta be getting close to Tiger Shark's "gazillion" hotspots.

I liked this quote

Quote:

---

and even agreed to share his broadband connection with a neighbor across the street in exchange for beer.

---

He must live on Evergreen Terrace across from Homer. MMMMMM beer. :D

If his ISP caught him and called the police do you think he would be charged with a more serious offense because he's receiving compensation for sharing his internet connection?

Quote:

---

I agree completely, if you are offering it for free, you're doing a service! But the state of legal practice in the US is pitiable at best. Our court system heard (and ruled on) a civil case where an elderly woman bought a cup of coffee from a McDonalds drive-thru, took the lid off to drink it (while still in her car), spilled it in her lap and received some serious burns due to the temperature of the drink. McDonalds stated they serve coffee very hot so it will be an acceptably warm temperature when the customer arrives at their location and can consume the drink. She sued...and won, I believe. It say's on the menu HOT COFFEE but the court ruled in her favor.

---

This is a common-day myth, as too few have expanded upon the case. The woman did win, but only because that McDonalds in particular had their coffee temperature near 35 degrees above health saftey standards, and they had been warned before. That means this coffee was anywhere from 95-125 degrees F (the liquid was actually 190 degrees F). That's pippin hot! So she didn't win because she couldn't read the labels. She won because that company went FAR beyond health saftey standards, and had been warned multiple times on their coffee temperature and not taking the time to put the lids on all the way.


The point I'm trying to make is that most "unfair" and odd court rulings usually have a very good reason. Keep in mind that you can't be an idiot and make it into the court system, as it requires a TON of schooling and then knowing enough for you to get elected. The court cases that have rulings which seem "odd" are not because the judge was dumb, but because the losing party (in this case McDonalds) will begin to spread word about the case to the media as soon as it the case begins. So no one will look into the actual documentation of the casae and why she actually won, but instead just trust what they heard on the intarweb/Fox News.

sources:

http://corpreform.typepad.com/corpre...uth_about.html

http://lawandhelp.com/q298-2.htm

http://www.centerjd.org/free/mythbus..._mcdonalds.htm

http://www.lectlaw.com/files/cur78.htm