Slashdot Mirror

How about a reverse fake ap MAC address generator/packet injector whereas instead of Fake AP's, fake MAC addresses were injected into the wifi routers...... Wait no... One million more students detected may make them call in the military...

Why broadcast just 1 SSID when you can broadcast several thousand?

Fake AP is a tool that generates thousands of beacon frames so that your AP, named "12381" can get lost in the shuffle. It's not fool proof, but it is funny to hear netstumbler wet itself when you come in the vicinity of it.

Who needs 5 WAPs when you can use Fake AP and have 50,000 fake ones? Hide your one real access point in plain sight with a sea of beacon frames. Watch wardriver's heads explode when they cruise through your neighborhood!

go and grab a copy of this

and get you and a few friends to wander around campus with laptops running it.

it will completely hose the wifi police trying to find accesspoints cince the program broadcast's thousands of fake AP's.

great fun...

That said, kismet is a great stumbler! People who think they can hide by not broadcasting (netstumbler on windows doesn't see me, so I'm safe!) make me smile :)

Have 53,000 then.

"Wardriving" kiddiez make me smile... :)

Basically what this guy did was realize that the MAC-generation algorithm in spoofing software Wellenreiter has a weakness, namely that the OUI's it generates aren't all legit. (OUI is the organizational unique identified which is in the first few bits of the MAC address.) Also see helpful Sourceforge description of Wellenreiter.

He similarly points out limitations in denial of service tools: AirJack and FakeAP software. However, this isn't the same as giving a general technique for analyzing MAC addresses on 802.11b, something which was strongly implied in the original post.

Mentioned one month ago here on slashdot this fakeAP software sends out lots of 802.11b beacon message with different SSIDs. Hide in the noise for the good it will do you.