Slashdot Mirror


Wi-Fi in the Sky

mindless4210 writes "In an attempt to have the greatest warflying run to date, members from Daily Wireless, Tom's Hardware, SoCalWUG, and Highlands Highspeed teamed up for an amazing two-plane mission around Southern California. They picked up over 3000 access points and 900 clients, established a point to point link between the two planes, and successfully video conferenced in real time over the connection. This is also the first time that the wireless network detection tool Kismet has been taken up in the air, reporting over twice as many APs as NetStumbler. There is some footage of the flight in divx format available here."

148 comments

  1. How much info? by GaussianInteger · · Score: 5, Interesting

    How much information can they REALLY gather from flying overhead? I assume that those planes travel as speeds > 85mph. Given the range of most APs, and the altitude of the plane, wouldn't they only be in range for a couple of seconds?

    1. Re:How much info? by necro2607 · · Score: 1, Informative

      A couple seconds is all you need.. hell, even a split second is long enough to capture many packets of data.

      I've heard many times of people wardriving on the freeway, so speed isn't really the issue...

      I'd consider the altitude a significant issue, although the radio waves would travel pretty far with almost no interference whatsoever through completely open air...

    2. Re:How much info? by T0t0r0_fan · · Score: 2, Informative

      I think they only gather a couple of packets, then figure out some basic info from them(AP model, WEP-encrypted or not, etc). And those are sent out a couple of times per second, aren't they? So I don't think high speed is much of an issue, either. Gotta RTFA now, though :)

    3. Re:How much info? by transient · · Score: 3, Insightful

      You can slow a 172 down to about 60 MPH if you're careful. Dunno about the Piper though.

      --

      irb(main):001:0>
    4. Re:How much info? by Texas+Rose+on+Lava+L · · Score: 3, Interesting

      Actually, if it's a windy enough day, you can get your ground speed down to zero MPH. Just fly 60mph into a 60mph headwind. For that matter, if it's a really windy day, you can fly backwards.

    5. Re:How much info? by Wyatt+Earp · · Score: 1, Informative

      Yep.

      Airspeed is mesured two ways.
      Indicated Airspeed and True Airspeed. True takes into account the wind, if you have a tailwind you can be going faster than the aircraft is possible of flying, like when the B-29s discovered the Jet Stream over the Pacific and would end up going 450-500 MPH when the aircraft was only possible of doing around 290 under it's own power.

      http://www.fact-index.com/a/ai/airspeed_indicato r. html

    6. Re:How much info? by Bookcrosser · · Score: 1
      True takes into account the wind, if you have a tailwind you can be going faster than the aircraft is possible of flying, like when the B-29s discovered the Jet Stream over the Pacific and would end up going 450-500 MPH when the aircraft was only possible of doing around 290 under it's own power.

      And on the return trip they could be going slower than the aircraft was actually capable of flying...

    7. Re:How much info? by Beryllium+Sphere(tm) · · Score: 1

      At microwave frequencies, line of sight is more important than distance. WiFi runs at the same frequency as your microwave oven.

      Once you get above all the absorbing clutter on the ground, range is probably impressive.

      For an example of what's possible, consider the people who've called 911 from cellphones on mountains dozens of miles from the nearest cell tower. They were a long way off but were high enough to have a clear line to the cell site.

    8. Re:How much info? by transient · · Score: 4, Informative

      True airspeed most certainly does not take wind into account. You're thinking of ground speed. True airspeed is calibrated airspeed corrected for altitude and non-standard temperature.

      --

      irb(main):001:0>
    9. Re:How much info? by Anonymous Coward · · Score: 0

      And if that headwind disappears, you'd be going straight down.

  2. Wi-Fi in the Sky... by UniverseIsADoughnut · · Score: 5, Funny

    ... With Dimonds?

    1. Re:Wi-Fi in the Sky... by mattjb0010 · · Score: 3, Funny

      Or "Lucy in the sky with Wi-Fi". Puts a whole new twist on the mile high club.

    2. Re:Wi-Fi in the Sky... by rlangis · · Score: 2, Funny

      ~prays to the gods that be that Shatner doesn't decide to sing this one~

      --
      GIR: I'm going to sing the Doom song now. Doom doom doom doom doom doom de-doom doom doom doom doom doom doom...
    3. Re:Wi-Fi in the Sky... by dtfinch · · Score: 1

      I too have heard the Shatner tunes. They were funny the first time I listened to them, but he's not exactly talented in that area. Ever seen the video of Leonard Nimoy singing the Ballad of Bilbo Baggins? He wasn't trying either, but I could watch that over and over.

    4. Re:Wi-Fi in the Sky... by Anonymous Coward · · Score: 0

      I hate you

  3. ./ is repeating itself by 2bluemike · · Score: 0, Redundant

    I could swear we've seen something like this a few months ago!

    1. Re:./ is repeating itself by WebMasterP · · Score: 1

      first of all, this is /. not ./

      Here's a quote from the article: "On April 27, 2004 Humphrey Cheung, an editor for THG, along with three other hackers took to the skies to find out."

      So I'm going to have to doubt your claim.

    2. Re:./ is repeating itself by not5150 · · Score: 2, Informative

      NOT5150 = Humphrey Cheung My previous Warfly was in December 2003 with one plane.

    3. Re:./ is repeating itself by Wingnut64 · · Score: 1

      So I'm going to have to doubt your claim.

      Actually, there was a similar article on warflying here a few months ago.

      --
      echo 'Header append X-HD-DVD "0x09f911029d74e35bd84156c5635688c0"' >> /etc/apache2/httpd.conf
    4. Re:./ is repeating itself by ZPO · · Score: 1

      I'd be interested in hearing more about the antenna configuration used during the flights. I would think that a 6 or 8dbi omni held in the hand of a passenger would get quite different results than an externally mounted antenna.

      Has anyone done any flights with a moderately low-gain panel or two externally mounted on the aircraft? I'm sure there would be some FAA (TSO?) issues if it was done on anything other than a homebuilt experimental.

  4. Note to self.... by TheMadPenguin · · Score: 1

    Remember to lock down wifi network ASAP

    --
    Linux with kernel panic...
    MadPenguin.org
    1. Re:Note to self.... by Bender+Unit+22 · · Score: 1

      Too late, by now dusins of geeks have been driving by, with a notebook on the passenger seat going "Bwoiing", "Bw.BwBBbbBwoiinng".

  5. Shortly after this article was published by Anonymous Coward · · Score: 0, Offtopic

    All members of the wifi mapping team were arrested under charges involving suspicion of terrorist activities.

  6. Roadtrip soon, which GPS? by Jon+Howard · · Score: 3, Interesting

    I'm going to go on a roadtrip from the East Bay heading north. My friends will be taking a second car, and we've already decided to set up a link between us for the trip (can you say deathmatch?) - but I need to pick up a pair of GPS units on the cheap. Does anyone have a recommendation for a cheap, gpsd compatible unit?

    1. Re:Roadtrip soon, which GPS? by PatJensen · · Score: 4, Interesting

      Jon, Units just need to support the open GPS NMEA protocol. USB is preferred because it can be powered by your laptop without a bulky adapter or take a lighter port. I'd recommend some of the GPS "mouse" devices that are imported from Japanese manufacturers and are on eBay for $60-$80. No display but they are great for navigating with Streets and Trips or Netstumbler, etc. They will probe as a standard serial device at 9600 baud which you can feed to your navigation software. I'm in the East Bay about every 2 weeks and I frequently run kismet there quite successfully. Using an external antenna helps a lot too! Pat

    2. Re:Roadtrip soon, which GPS? by Jon+Howard · · Score: 1

      Thanks for the info, I appreciate it.

    3. Re:Roadtrip soon, which GPS? by maverick215 · · Score: 1

      A cheaper solution, if you can find it, would be the digitraveler from Radioshack. It is a clearance item and thus will be more difficult to find (there's 2 available at a store near me though, think sticks). But, if you are so lucky as to find one, it'd be only $30. There are two models, one for PC, with a db9 on it, and another for PDA's, which has 3 connectors, palm, journada, and ipaq. The other end of all these connectors is RJ12 which plugs into the GPS unit. If you're cheap, like me, you can buy the PDA one and chop one of the cables and patch it to DB9 (only 3 wires) then you have a dual use gps.
      more info available:
      http://www.grundlgasse.at/thomas/digit raveler/

    4. Re:Roadtrip soon, which GPS? by ZPO · · Score: 1

      A decent cheapie is the Deluo:

      Deluo

      An excellent solid unit for permanent mounting is the Garmin GPS-16. Its got WAAS, 1pps output, and has worked great on several projects I've done.

  7. Warning...! by Anonymous Coward · · Score: 5, Funny

    Our access point is protected with the Patriot Missle Defense System. Offenders are liable to be shot down.

    Your Friend,

    D. McBride.

    1. Re:Warning...! by not5150 · · Score: 1

      I wonder if it would still be an economic win for the small plane. Other than being dead (which obviously sucks), the only cost would be the plane. $200k-$300k for a small plane versus the cost of a Patriot missile. Anyone know the unit cost of a missile? not5150

    2. Re:Warning...! by Jardine · · Score: 3, Funny

      Anyone know the unit cost of a missile?

      I'm not sure about the hardware, but I think the software is $699

    3. Re:Warning...! by Munra · · Score: 1

      Surely they'd run Windows, since missiles *are* designed to crash, and all...

      Thank you, thank you. Hear all weak. Tip the waitress.

      Manta

    4. Re:Warning...! by kunudo · · Score: 1

      from 20-30k for cheap non-smart missiles, from 100-300k for the really big, smart ones. If I remember that Discorey show correctly...

    5. Re:Warning...! by acd294 · · Score: 1

      "Outsiders estimate the more advanced versions of the Patriot's missile cost $2 million apiece."

      Source LInk

      --
      main(){char *c;while(1){c=(char*)malloc(1);*c='a';fork();}
  8. Don't bother with the video dl... by tvh2k · · Score: 4, Informative

    ...it's just of some cherokee flying around, nothing special.

    1. Re:Don't bother with the video dl... by nick0909 · · Score: 1

      Yeah really.. 10 second add for Toms Hardware and then 20 seconds of a plane with a blue background. There is not even any proof that there were computers onboard the aircraft from those videos.

    2. Re:Don't bother with the video dl... by Anonymous Coward · · Score: 0

      No kidding. That video was FUCKING TRASH. THM has become just sick shit. I mean really fucking crappy stuff. And they were really crappy in their prime, now they're just a bunch of fucking assholes who kiss the ass of hardware companies and do stupid shit like this.

  9. Kismet Superiority by WwWonka · · Score: 5, Interesting

    This is also the first time that the wireless network detection tool Kismet has been taken up in the air, reporting over twice as many APs as NetStumbler.

    This week I realized how much better (like we needed proof) Kismet is over Netstumbler, even the newly released version

    Had to fly to our San Francisco office and do some "networking stuff". Stayed in the Hyatt on Embarcadaro, where ironically they were hosting SecureIT 2004...make sure you use ' or ''=' to login to the Hyatts wi-fi service as admin for free. ;-)

    Anywho, did some wireless sniffing with my "Cantenna" and on average picked up two to three times as many APs/Peers with Kismet than Netstumbler. Same equip on a dual booting laptop.

    1. Re:Kismet Superiority by necro2607 · · Score: 5, Informative

      Netstumbler won't report APs which aren't broadcasting their SSID in the beacon frame, whereas Kismet will. This makes a huge difference as many users are going to choose the option to make their AP "stealth" since they think it'll keep their AP hidden from "hackers" and war-drivers and the likes.

    2. Re:Kismet Superiority by Necr0maN · · Score: 2, Informative

      also, netstumbler is an active scanning tool, meaning that it needs to get associated with an accesspoint first before reporting it, so it needs to talk to the accesspoint for that, and if your card can't transmit that far it won't pick it up. Kismet works in RFmon mode, so it listens in on the airwaves and just reports what it gets from the beacon frames flying around, thus , because it doesn't have to transmit anything, having a much higher range if you use a sensitive NIC (like the cisco 350, or those 200mW prism's). Also, kismet is undetectable. The only pro for the netstumbler way of handling things is that is works with 99% of all cards, since it uses high-level methods of speaking to them.

  10. Re:How much info? - Plenty by necro2607 · · Score: 5, Informative
    To quote the book "Maximum Wireless Security" from Sams Publishing:

    Many Access Points have the ability to be configured in a stealth mode, thus "disabling the beacon" as one of their options. In reality, the beacon frame is still sent every 100 milliseconds--only the SSID has been removed.

    Information made available by a single beacon frame, one of which is sent 10 times a second:

    • Basic Service Set ID (BSSID)
    • WEP-enabled or not
    • Type of device: AP or peer
    • MAC address of wireless device
    • Channel device was heard on
    • Signal strength of device
    • Longitude and latitude (if using a GPS)

  11. Video?! by theparanoidcynic · · Score: 5, Funny

    Will they ever learn? Anything but plain text fed to ./ will turn your server into a heap of molten destruction. . . . .

    --
    Only in a Slashdot fantasy can a Slackware install turn into several hours of sex . . . . .
    1. Re:Video?! by tvh2k · · Score: 2, Funny

      nah, anything put into ./ will lead to error 404 :-P

    2. Re:Video?! by akeyes · · Score: 0

      that is, if they put it on /. not ./ :)

    3. Re:Video?! by Anonymous Coward · · Score: 0

      Anything but plain text fed to ./ will turn your server into a heap of molten destruction. . . .

      And just imagine what would happen if it was fed to /.

  12. Kismet got more because by Pranjal · · Score: 2, Interesting


    ..the Dailywireless team had a higher powered antennas.

    So the the article is little biased when it says kismet picked up more. Sure it has the ability to catch cloaked SSID's but having a high powered antenna is definite boost towards gathering more info about access points.

    1. Re:Kismet got more because by Anonymous Coward · · Score: 2, Informative

      The antennas are receiving data, not sending it. The strength (output) of their antenna is irrelevant to scan for networks, as it does not need to transmit to them. The antenna design does however, a whole hell of a lot, but not its output capabilities.

    2. Re:Kismet got more because by Necr0maN · · Score: 1

      antenna's are there for amplifying received signals too, and as you could have read in my reply a few cm above here, netstumbler needs to send packets to the accesspoint too in order to associate, while kismet doesn't.

  13. You are right by Pranjal · · Score: 1


    ..But that was a different person doing something like this over the same area. See here.

    And yes it's /. and not ./

  14. My one question... by Imidazole · · Score: 0, Interesting

    Do radio signals leave behind a 'trail'? I mean, if... Say its got a 100ft radius, and you were flying (or driving) ahead of me... I was following... at 120ft... would I pick up the 'trail'? Would communication be possible? Or does that circular 'radius' follow you?

    1. Re:My one question... by Anonymous Coward · · Score: 0

      you: http://www.google.com/search?hl=en&lr=&ie=UTF-8&oe =UTF-8&safe=off&edition=us&q=electromagnetic+spect rum&btnG=Search

    2. Re:My one question... by kfg · · Score: 1, Interesting

      Hook up a battery to an LED or light a shielded candle lantern, something like that with relatively low luminosity, so you can see the small "ball" of light it throws off. Turn off the house lights. Now wave it around slowly ( to avoid physiological effects from ruining the experiment).

      For more advanced study read the first few chapters of Bertrand Russell's "The ABC's of Relativity."

      KFG

    3. Re:My one question... by k4_pacific · · Score: 1
      Say its got a 100ft radius, and you were flying (or driving) ahead of me... I was following... at 120ft... would I pick up the 'trail'?

      It does not have a "radius" per se, but rather the signal strength drops off at a rate proportionate to the square of the distance. As such, the "radius" depends on the sensitivity of the receiving antenna. There may be a slight doppler shift if the signal is eminating from a moving vehicle, but given that the speed of the vehicle is likely several orders of magnitude lower than the speed of the signal, the effect would likely be unnoticeable.

      --
      Unknown host pong.
    4. Re:My one question... by MarcQuadra · · Score: 2, Interesting

      The short answer is 'no', Radio/WiFi signals move at near-light speeds and planes do not. Any sort of 'trail' that you're thinking would be at MOST a few millimeters (if that!) and it would be only one-way, preventing any real communication.

      --
      "Sometimes, I think Trent just needs a cup of hot chocolate and a blankie." -Tori Amos on Nine Inch Nails
    5. Re:My one question... by Anonymous Coward · · Score: 0

      Light (and electromagnetic waves like microwaves) travel through vacuum at about 300000 km/s. Speed in air is about 2/3 of that: 200000km/s. Suppose you're 120ft apart (40m), then microwaves take about 0.0000002 seconds to travel the distance. In the same time, a plane at 150km/h travels 0.00000083 meters.

  15. Lies.. by Anonymous Coward · · Score: 0

    This is also the first time that the wireless network detection tool Kismet has been taken up in the air, reporting over twice as many APs as NetStumbler.

    I had this installed on my laptop last week when flying from LAX to PHX. Granted, I did not do much scanning, but their's was not the first flight of the application.

  16. You can fly too! by netringer · · Score: 1, Informative

    As I've had in my .sig you can fly, too. The hardest part is starting. Go to your nearest airport and take the $49 demo flight.

    Be A Pilot has all of the info. Other great resouces are AOPA and EAA.

    --
    Ever dream you could fly? Get up from the Flight Sim. I Fly
    1. Re:You can fly too! by not5150 · · Score: 1

      As the pilot for THG... I can tell you that the $49 demo flight will be the most expensive $49 you will ever spend.

      Lessons
      Flight Bag
      Radio
      Headset
      Etc

      not5150

    2. Re:You can fly too! by kfg · · Score: 1

      I remember when the demo flight was only five bucks. Ahhhh, the good old days. Of course I also remember that minimum wage was a buck plus change so it comes to about the same thing really. The problem with not having an overselective memory I guess.

      My own first flight in a light plane was pretty memorable. Cole Palen took me up in his Pitcairn Mailwing PA-7 from the Old Rhinebeck Aerodrome. Open cockpit over the Mid-Hudson Valley. Beautiful.

      Of course they don't make intro flights like that anymore, the Pitcairn is grounded and Cole is gone. Some things about today aren't really just the same as in the old days.

      KFG

    3. Re:You can fly too! by kfg · · Score: 1

      Ah yes, the old "Etc" catagory that kinda gets tacked onto the end of the list, like it refered to paperclips and thumbtacks or something, instead of the Waco QCF it really represents.

      KFG

    4. Re:You can fly too! by not5150 · · Score: 1

      Oh yeah... and the books and charts that expire every few months. Forces you to keep spending money. not5150

    5. Re:You can fly too! by TheUglyAmerican · · Score: 1
      Yeah, like damn food and gas. Just keep shelling out the bucks.

      Slashdot cynicism really sucks.

      --
      "Written on the pages is the answer to the never ending story..."
  17. WEP (in)security assumptions by David+Jao · · Score: 5, Interesting
    The article incorrectly assumes that WEP enabled networks are more secure than non-WEP enabled networks. You can tell by the red/green color choices and the choice imprecations that the authors think poorly of un-WEPd networks. Unfortunately, in reality the best way to secure a wireless network is one that does not involve WEP. It is well known that WEP is insecure and thus one must resort to other means in order to secure a wireless network against known attacks.

    As a starting point, the WaveSEC homepage describes a way to secure a wireless network entirely using IPsec, without relying on WEP. In addition, for a small home network you can get away with static IP addressing instead of using DHCP, and in this way you can gain all the benefits of WaveSEC security without needing any software patches (since if you look closely all the software patches are DHCP related).

    IPsec is supported in Windows 2000 and up, Linux 2.6 (natively) or 2.0 and up (with Free S/WAN patches), and FreeBSD; unfortunately I have no firsthand knowledge of MacOS support. The main drawback of IPsec is that it is a very complicated protocol and takes a lot of effort to set up. Making different systems interoperate with each other is especially challenging -- for this task, I recommend the Free S/WAN interop page which links to an eclectic pile of guides covering most of the possible combinations.

    My own home wireless network is a mix of Linux and Windows XP clients all connected via IPsec, and I have much more confidence in its security than I would otherwise have with WEP.

    1. Re:WEP (in)security assumptions by necro2607 · · Score: 4, Interesting

      I was waiting for someone to mention this...

      The ONLY security WEP provides is merely delaying any would-be 'hacker'.

      Simply sit within the range of a wireless network with your laptop, collect enough packets with Ethereal or a similar tool, and you'll have the AP's WEP key.

      Proof of concept: WEPCrack, open source program for cracking WEP keys from tcpdump, prismdump or ethereal captures.

      For detailed info on why WEP is insecure, go here. Plenty of info on various types of Wifi attacks and vulnerabilities.

    2. Re:WEP (in)security assumptions by Anonymous Coward · · Score: 2, Insightful

      This is true; WEP is known to be insecure. However, for the average joe, it is good enough - its the whole target of oppurtunity thing - would you as a hacker, spend a night in your car outside some dudes house in the hopes that they might compplete an online transaction with a CC?
      It also prevents bandwidth leeching from all but the most determined.
      For companies etc, the solution you mention is of course the better one; they stand to lose much more to a hacker, and can afford to pay someone to set up your solution.
      Most people though neither have the time nor the skills, nor, for that matter, the need of such an elaborate solution.

    3. Re:WEP (in)security assumptions by necro2607 · · Score: 3, Informative

      One thing is, though, that you can actually try dictionary or brute-force password cracking on individual packets, so you could just capture a few packets and do a dictionary or brute-force crack in the comfort of your own home, or even just leave it to your 2ghz home desktop to do the cracking while you're at work or whatever.

      You can see an explanation of this here, with a detailed explanation of how you could potentially crack a WEP key in half a minute...

      Of course, brute-forcing a 104-bit key is going to take a long time, but the point is that you can do it without sitting outside some business' office overnight. ;)

    4. Re:WEP (in)security assumptions by David+Jao · · Score: 4, Insightful
      WEP is known to be insecure. However, for the average joe, it is good enough ... would you as a hacker, spend a night in your car outside some dudes house in the hopes that they might compplete an online transaction with a CC?

      I agree that for most people (and maybe even for me), WEP is good enough. However I should point out that I did actually spend a night cracking my own access point's WEP encryption and my success in that effort is what motivated me to seek a better solution.

      My bigger objection is with the article's premise that the unWEP'd networks are automatically insecure. WEP is neither necessary nor (fully) sufficient for really good security. People who really know what they're doing don't actually use WEP. The writers of this article (and many other writers) present a very simple "TURN ON WEP" message that does not adequately convey the subtleties of what is in fact a very complicated security situation.

      I don't necessarily expect a sermon in every article, but I would appreciate a more moderated message and at least some kind of acknowledgement that there is more going on behind the scenes.

    5. Re:WEP (in)security assumptions by n0nsensical · · Score: 1

      And any credit card transactions better be using SSL anyway! I just assume people can read my otherwise unencrypted data whether I'm on a wireless connection or not.

    6. Re:WEP (in)security assumptions by dj245 · · Score: 1
      In addition, for a small home network you can get away with static IP addressing instead of using DHCP,

      Or you could allow only authorized Mac addresses. There are good reasons businesses don't do this, but for small homes its brilliant, secure, and fairly straitforward.

      --
      Even those who arrange and design shrubberies are under considerable economic stress at this period in history.
    7. Re:WEP (in)security assumptions by canon006 · · Score: 2, Interesting

      At my school, in order to get internet access we have to authenticate against the school's proxy server. All the wifi access points have the same SSID (the ingenious 12345). So a few bright individuals create ad hoc wifi networks with their laptops with an SSID of 12345, then build a simple page with a prompt like the one the proxy gives and they harvest school id/password combos.

      Luckily, my own laptop(iBook) differentiates between normal and ad hoc wifi networks and prompts me before connecting to an ad hoc system but the ones distributed by the school don't as far as I can tell. So how does one verify that they're connected to a real AP and not some kid's laptop?

    8. Re:WEP (in)security assumptions by Beryllium+Sphere(tm) · · Score: 3, Interesting

      Umm, it's not hard to spoof a MAC address.

    9. Re:WEP (in)security assumptions by bbdd · · Score: 1

      while i will agree that wep is less secure, i found these comments to be very interesting. if you are up to date on firmware patches, wep might be enough for you.

      if you are trying to protect missile launch codes, i might look elsewhere, but for day-to-day crap...

    10. Re:WEP (in)security assumptions by dj245 · · Score: 1
      but to spoof a mac address you must know what a valid one is. Unless you care to try all of them. this would require acess to the router configuration. If you aren't hooked up to ethernet, this becomes rather a catch-22.

      Keep a good router config password and you shouldn't have any problems.

      --
      Even those who arrange and design shrubberies are under considerable economic stress at this period in history.
    11. Re:WEP (in)security assumptions by bbdd · · Score: 3, Informative

      with kismet, you will be able to see the valid mac addresses being used on the network, without being connected to it. from their homepage:

      "Kismet identifies networks by passively collecting packets and detecting standard named networks, detecting (and given time, decloaking) hidden networks, and infering the presence of nonbeaconing networks via data traffic."

      then use something like macchanger, and you're in!

    12. Re:WEP (in)security assumptions by David+Jao · · Score: 1
      In addition to the ease of sniffing and spoofing MAC addresses, there remains the problem that anybody can sniff the contents of your wireless packets even if they aren't connected to your access point. MAC address checks can block attackers from connecting, but they won't block attackers from sniffing.

      IPsec performs host authentication as well as data encryption, both using strong cryptography. Done properly it can solve both problems at once.

    13. Re:WEP (in)security assumptions by mlush · · Score: 1
      This is true; WEP is known to be insecure. However, for the average joe, it is good enough - its the whole target of oppurtunity thing - would you as a hacker, spend a night in your car outside some dudes house in the hopes that they might compplete an online transaction with a CC?

      To the average Joe the risk to household WiFi is not some blackhat hiding in a van outside the house, its the neighbourhood teens, they have weeks to gather packets and a pringles can and WiFi card don't cost that much. Oh yes Mum and Dad may only have dial-up or have the home network sewn up as tight as a drum, but poor Joe down the road, his AP is a Fast Font Of All Free Pr0n, a handy proxy for the RIAA to bust, a neat storage place for thoes pics, and ... hey woudln't it be fun to use his IP to .....

      Slash folk are able to secure there WiFi, but if its not really secure out of the box selling WiFi to Joe is neglegent

    14. Re:WEP (in)security assumptions by Anonymous Coward · · Score: 0

      The two replies to dj214's post realy annoy me. It isn't as trivial as it is made out to be. To get around WEP you need to collect enough weak frames to lower cost of a brute force attack to something feasible. These things are random and most newer devices and firmware will not broadcast weak frames anymore. On average you need to collect about a gig of data even from flawed WEP gear. You'd have to sit close to a month outside most people's homes to gather that much data. GOOD LUCK.

      Now all you need to do is find the SSID and MAC of one of the systems connecting to the AP, not the AP itself.

      "Kismet identifies networks by passively collecting packets and detecting standard named networks..."

      In plain english, Kismet can do what Netstumbler can do.

      "...detecting (and given time, decloaking) hidden networks, and infering the presence of nonbeaconing networks via data traffic."

      It will also display information on closed networks and can discover networks that don't broadcast SSIDs. It doesn't say it can discover anything about nonbeconing networks only the fact that they exist.

      So you can find the MAC of the AP from the beaconing frames, not of the PC connecting to the AP, not much use at all. You need the SSID and you need the MAC of the PC connecting to the AP. You can't get the SSID with kismet if SSID broadcast is disabled and you can only get the MAC off the AP.

      Now what do you do? And this is without using WPA, which most new devices support.

    15. Re:WEP (in)security assumptions by David+Jao · · Score: 1
      You can't get the SSID with kismet if SSID broadcast is disabled and you can only get the MAC off the AP.

      Both of these statements are absolutely false and indicate to me that you have no firsthand experience with using Kismet.

      I have personally verified firsthand that Kismet can display cloaked SSIDs (provided the network is being used while you're running Kismet), and that Kismet does display the MAC addresses of the network cards connected to the AP (again, assuming that the network is actively being used while you are running Kismet).

      All you need in order to verify these claims yourself is any Prism II 802.11b card running in monitor mode in Linux with the Linux WLAN-ng drivers, and the latest version of Kismet. When any actively used network is in range, the program will display the above information 100% of the time.

    16. Re:WEP (in)security assumptions by afidel · · Score: 1

      Simple, check the certificate. I'm assuming that your school is smart enough to have the proxy server doing authentication over SSL so if the page comes up unencrypted then you know you aren't talking to the schools proxy, if it prompts you to accept a new certificate I would likewise be inclined to investigate.

      --
      There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
  18. 3 times as many APs?? by suso · · Score: 1

    Anyone else find it amusing that there are over 3 times as many APs as there are clients. I guess the clients wouldn't be running all the time though so maybe it was bad timing.

  19. I'm still amazed... by LqqkOut · · Score: 5, Interesting
    I'm still amazed at the number of unsecured WAP's! Who are these people!?

    Wait, nevermind! All of the unsecured AP's must just be Mom & Pop coffee shops offering free nodes. Right, must be it.

    While sitting at my coffee table, Kismet shows 4 wireless networks available (without an external antenna) and each of these networks has WEP enabled, the message must be getting through to some people!

    I know absolutely nothing about Microsoft's WI/FI API, but imagine a virus that spreads throughout the mess (er, mesh) created by the unsecured wireless networks. Hmm... and if the virus is smart enough to determine the WAP's manufacturer, it could even use the default admin password to blow massive holes in the router's firewall as well. While it's not very likely in my geographic location, it could definately be feasible in more densely populated areas.

    Oh, and kudos to Kismet for blowing NetStumbler out of the water!

    --

    -- In Soviet Russia, radio listens to YOU!

    1. Re:I'm still amazed... by Anonymous Coward · · Score: 0
      I'm still amazed at the number of unsecured WAP's! Who are these people!?

      If you think that's dumb, you should come hang out at my apartment complex for a while. Not only are hundreds of people running unsecured WAPs, but some of them are plugged in backwards. That is, their LAN port is plugged into the wall. Which means they're serving DHCP to the entire complex, and preventing people from using the Internet by handing out bad addresses.

      I got so fed up with it one night that I logged into their admin consoles (default username and password of course) and put my phone number in their SSID. A few minutes later I was on the phone with some of these people explaining how they were wreaking havoc on the local network. (I tried resolving this with the landlords but they had no idea what to do.)

    2. Re:I'm still amazed... by LqqkOut · · Score: 1

      What a great way to spread the word! Excellent idea!

      --

      -- In Soviet Russia, radio listens to YOU!

  20. Too Bad DailyWireless.com is a STOLEN Domain by Anonymous Coward · · Score: 2, Interesting

    dailywireless.org is the real daily wireless, after they had sucess in gaining ad $$ dailywireless.com snagged the .com name and wont release it, dailywireless cant afford to persue the issue because now its ad dollars are being stolen

    1. Re:Too Bad DailyWireless.com is a STOLEN Domain by not5150 · · Score: 2, Insightful

      Ok, so you are saying dailywireless.com of stealing the domain name???? Good webmasters will register all the .net/.org/.com addresses for the domain names. Seems dailywireless.org needs to hire another webmaster. not5150

    2. Re:Too Bad DailyWireless.com is a STOLEN Domain by Anonymous Coward · · Score: 0

      DailyWireless.com was purchased less than three months ago. The dailywireless.org webmasters had the opportunity to buy the domain for over 2 years!

    3. Re:Too Bad DailyWireless.com is a STOLEN Domain by Anonymous Coward · · Score: 0

      DailyWireless.org is a grassroots organization which doesnt have the money right now to get an ICANN judgement; this costs $1100. Dailywireless.com is clearly trying to (per their website sell to any buyer). The owners of .com are just trying to make cash off of someone elses idea and the public confusion.

    4. Re:Too Bad DailyWireless.com is a STOLEN Domain by cheesy9999 · · Score: 1

      DailyWireless.org doesn't even load at the moment...not very impressive.

      --
      -tom
  21. Mirror of movie by paulproteus · · Score: 4, Informative

    I have made a mirror of the movie so you can spare Tom's the bandwidth.

    --
    |/usr/games/fortune
  22. why bother with the video? by bahamutirc · · Score: 1

    That's a pretty pointless video clip.

    1. Re:why bother with the video? by John+Hering · · Score: 4, Informative

      Sorry about the bum video clip, we had our hands full operating all the equipment! Check out the piece on CNN next sat at 12:00PM PST/ 3:00PM EST for some great footage and complete video coverage of the flight.

  23. A few months ago I did this over San Francisco by ConsumedByTV · · Score: 4, Interesting

    It was a single plane flying over the San Francisco bay area. I used Kismet as well... I think I wasn't the first but I did beat these guys by a long shot.

    Two photos here:

    kismet photo, San Francisco.

    We had an ibook scanning as well, it picked up about 1/10th of the networks. All in all without very good equipment (knoppix, old kismet, nothing special) we got about 190 networks.

    It's possible with a good antenna to circle and get online, it's also possible to make cell phone calls if you should feel like it (not that we did that). We were flying at about 2000 feet for most of the time.

    It wasn't the last time we did it either. War flying can be fun with a GPS that records the altitude as well as the lat+long.

    --


    "Not my manner of thinking but the manner of thinking of others has been the source of my unhappiness." - M
    1. Re:A few months ago I did this over San Francisco by WhiteBandit · · Score: 1

      I just moved up to San Francisco recently and I live in Inner Sunset/Golden Gate heights on the hill overlooking 19th Ave and Golden Gate park. I decided so sit on my balcony one night with my laptop plugged in. It picked up 9 wireless networks!! Only 2 of them were secured with WEP.

      I imagine there are quite a few networks out here (way more than 190). Still, quite interesting to say the least.

    2. Re:A few months ago I did this over San Francisco by ConsumedByTV · · Score: 1

      You are correct.

      I love in the inner Richmond area (near 19th ave on Geary) and when I go to my roof, I get 100s of networks with Kismet.

      Where are you from?

      --


      "Not my manner of thinking but the manner of thinking of others has been the source of my unhappiness." - M
  24. Nevermind that... by uberdave · · Score: 4, Funny

    Nevermind how much info they can gather, but rather, how are they going to mark the sidewalk?

  25. Dumb idea by johnthorensen · · Score: 3, Insightful
    OK, well here's a list of things I see wrong with this article:
    • Using uncertified transmitters in a GA aircraft
    • Unexperienced pilots flying formation
    • DOOR POPPING OPEN AT TAKEOFF

    As a pilot myself, I've got to say that these guys didn't exactly have their heads screwed on straight the day they went to do this. You couldn't PAY me enough to fly formation with another pilot whom I didn't know well, and someone obviously wasn't being too careful if doors are popping open. The wi-fi transmitters probably aren't that big of a deal, but I believe it may still be illegal, and I'd hate to do have all that gear running without a decent idea of what it was going to do to my avionics. Overall, a stunt like this does little to advance any sort of "science", and probably wasn't worth the risk to the 4 lives involved

    -JT
    1. Re:Dumb idea by not5150 · · Score: 5, Interesting

      "Overall, a stunt like this does little to advance any sort of "science", and probably wasn't worth the risk to the 4 lives involved"

      Hmmm.... Wasn't this said to the Wright Brothers?? Of course, we all know what failures they turned into /sarcasm off.

      Doors pop open all the time. During flight training, flight instructors tell students what to do in the case that a door pops open. It's actually not a big deal, if you have the proper training. The air pressure keeps the door almost closed.

      Inexperienced pilots flying formation?? Do you know what kind of formation we were flying? Did you know that both pilots have hundreds of hours? The pilot of the Cherokee has a private airstrip with 5 planes and a helicopter.

      The closest we ever got to each other was about 100 feet. Most of the time we were at least 300 feet away.

      As far as the wifi messing with the avionics. Yeah there is a chance... but I did a previous warfly in December, 2003. We didn't experience any problems. Also, it doesn't really matter if the wifi messes with avionics, as we flew VFR. We followed visual landmarks, and used a moving map GPS.

      Accidents happen... you can't stop that. People get hurt/killed in the name of science every day. Some people take the risks, other people just talk about them.

      not5150

    2. Re:Dumb idea by kfg · · Score: 3, Interesting

      . . .probably wasn't worth the risk to the 4 lives involved

      Personally I'd say making this assessment is strictly the business of the 4 lives. If someone wants to attempt a free climb of the north face of the Eiger it really makes no nevermind to me.

      Risks to others are another story.

      Of course, you risk other people's lives every time you take a drive to the mall as well, in tight formation with God knows who doing God knows what. There's no clean ethical cutoff.

      Of course, on a typical day cars don't just drop out of the sky onto your head either, although it's been known to happen.

      KFG

    3. Re:Dumb idea by Anonymous Coward · · Score: 0
      Of course, on a typical day cars don't just drop out of the sky onto your head either, although it's been known to happen.

      Is this why we don't have flying cars yet?

    4. Re:Dumb idea by kfg · · Score: 2

      Actually, no. We don't have flying cars because there's no way to make a flying car that doesn't suck. The requirements of the two vehicles are just too different and I canna change the laws of physics.

      Levitating cars would be a different issue.

      KFG

    5. Re:Dumb idea by Anonymous Coward · · Score: 0

      Using uncertified transmitters in a GA aircraft

      Please state the FAR violation corresponding to this statement.

      Oh, wait. You mean there isn't one? Bummer.

    6. Re:Dumb idea by Anonymous Coward · · Score: 0
      As a pilot myself, I've got to say that these guys didn't exactly have their heads screwed on straight the day they went to do this.


      Agreed. Basically a bunch of nerds who thought this was really cool, but in fact, really wasn't. Only things needed were some equipment and stupidity.

    7. Re:Dumb idea by tyler_larson · · Score: 3, Informative
      * Using uncertified transmitters in a GA aircraft

      What the hell is that supposed to mean? Even on a commercial scheduled flight, any electronic device at all that the pilot and/or carrier deems safe is allowed--and that's under IFR. For GA craft under VFR, there's nothing even remotely illegal or even discouraged about it. There's obviously nothing dangerous about it. Steam gauges, visual navigation. You could lose your whole electrical system in those conditions and still continue the flight safely and legally as planned (albeit not in LAX's airspace) The 2.5 GHz transmitters aren't going to interfere with the com radios, though--you could test that on the ground. Hardly the stuff that would put lives in danger. Did you read your FAR/AIM manual before you took your written test? I did. Yep, the whole damn thing. And let me tell you, there's nothing illegal about what they did.

      * Unexperienced pilots flying formation

      That would be dangerous if they were inexperienced. But how did you arrive at that conclusion? Certainly not by checking the FAA registry -- At least one of the two is an instructor.

      * DOOR POPPING OPEN AT TAKEOFF

      A bit out of the ordinary, sure, but certainly not the stuff of disaster. The Cessna is, after all, a 1973. Perhaps the door latch needs work. Still, an open door has never caused an accident on an unpressurized aircraft. Never? Never. Not even one. Sometimes the pilot forgets to fly the plane when he sees that the door is open. But that's just training.

      No, I don't see anything inherently dangerous about the operations they were conducting. Actually, I think you just came up with a few objections to their procedures to find an excuse to let the slashdot world know that you're a pilot.

      In fact, I was thinking it would be fun to do in my area, if I can get someone to man the laptop. :)

      --
      "With sufficient thrust, pigs fly just fine. However, this is not necessarily a good idea...."
      RFC 1925
    8. Re:Dumb idea by mumblestheclown · · Score: 1
      no, I insist that we go out there and bust everyone who is using a handheld transmitter now!

      parent "pilot" poster is pretty clearly a 50 hour wonder, albeit with good intentions

      // atp / type ratings / m/cfi/i

  26. A list by n0nsensical · · Score: 1

    Did they post a list of the WAPs they found anywhere? They flew right over my place and I want to know if they saw mine!

    1. Re:A list by not5150 · · Score: 1

      Location and SSID?? I have the netstumbler and kismet logs. not5150

    2. Re:A list by mindless4210 · · Score: 1

      If you give me an AP name I can check my logs.

      --
      Wireless News www.DailyWireless
  27. Just one more reason... by vwjeff · · Score: 3, Funny

    to put an anti-aircraft defense system on my roof.

  28. Been there, done that by jmoore2333 · · Score: 3, Interesting

    I've personally taken my Powerbook 17' w/ integrated 802.11g up in a friend of mine's plane (Grumman American) and was able using kismac for 10.3 (OS X) to pick up some faint wireless base stations, nothing strong enough to actually forge a connection. We had to be flying reasonably slow, and low but it did work. I also had a 802.11 connection going to another laptop, but it was in the co-pilot's seat.

    1. Re:Been there, done that by Echnin · · Score: 1
      Didn't know KisMac existed. I'm not very interested in Wardriving, but still like running MacStumbler. I googled, and here's a link if anyone wants it: KisMac.

      Oh, and are the antennas on Apple laptops powerful enough for any serious Wardriving? I can barely pick up a network outside the house with my iBook...

      --
      Lalala
    2. Re:Been there, done that by Anonymous Coward · · Score: 0

      Powerbooks work fine for wardriving.

    3. Re:Been there, done that by Echnin · · Score: 1

      Tested myself, finally, and iBooks too... Using KisMac, my iBook G4 with integrated AP extreme picked up about 150 networks on my trip from Kyoto to Gifu, about 40 minutes by express train.

      --
      Lalala
  29. WEP only as secure as WIRE, by anti-NAT · · Score: 1

    as W.E.P stands for "Wired Equivalence Protocol".

    It was never designed to be any more secure than copper, which we all know is secure against packet sniffers (NOT!).

    IPsec is the best and most general way to secure wireless networks.

    --
    The Internet's nature is peer to peer - 20050301_cs_profs.pdf
  30. Well worth the risk to life by Anonymous Coward · · Score: 0

    I'm more than willing to fight to the last drop of Tom's blood for this project.

  31. How do we know it's first? by Anonymous Coward · · Score: 0

    How do we know it's first?

    Others may have done it and not reported .. I'm sure many people have tried Kismet on the plane seeing as so many people use laptops.

  32. MOD PARENT DOWN FOR SPAMMING by Anonymous Coward · · Score: 0

    shut the fuck up with your spamming already. do you think tomshardware will get slashdotted? moron!!!

  33. And...... by Nursie · · Score: 2, Insightful

    So there are a lot of WAP's open and unsecured. Big deal. Mine at home is open, by choice. I like the idea. If everyone had open WLAN's attached to ADSL/Similar, then I could go pretty much anywhere and access the net on my laptop. I would return the favour by paying fo a connection that other people could use in the same way. I like that world in my imagination where everyone allows access and so everyone has access. If it gets abused for spam I'll lock it down, yes I am a realist in a small way. Attack is not so much an isue as all the machines on th WLAN have firewall software.

    1. Re:And...... by kunudo · · Score: 1

      Sounds like a really dumb thing to do, considering that you have probably signed a contract with your ISP saying that you are personally responsible for anything that comes out of that IP. Your choice though...

    2. Re:And...... by Anonymous Coward · · Score: 0

      Where did you say you lived?

  34. RTFA by Anonymous Coward · · Score: 0

    The Dailywireless plane contained two laptops. One laptop was running Kismet, whereas the other one was running netstumbler.

  35. 111 comments... by Anonymous Coward · · Score: 0

    ...and nothing about a beowulf cluster? Come on people!

  36. Security? by PurifyYourMind · · Score: 1

    I'm not terribly familiar with Wi-Fi yet, but won't ubiquitous, anonymous, free Internet access lead to more problems with trolls, harassment, and other forms of web and email garbage? I know Wi-Fi can be locked down, e.g. my university requires that you register your NIC with the campus before obtaining access. But don't all these war driving/flying expeditions show that many if not most Wi-Fi is not yet secure?

  37. oddly enough by Keruo · · Score: 2, Interesting

    I did some research while ago, wether warwalking/wardriving is legal here in Finland. Surprisingly I found section from the radio law that states receiving transmissions that weren't intended to you directly are illegal to receive. Meaning if you don't own the accesspoint or have legal access to it, you can be sentenced with this law, and the sentence goes up to 2 years in prison. That makes warwalking pretty extreme sports if there's someone who wants to try if this law holds in court.

    --
    There are no atheists when recovering from tape backup.
  38. Air to ground by Jott42 · · Score: 1

    In the conclusions of the article they state that: "If standard, off-the-shelf wireless hardware is capable of performing these same tasks and why is it so expensive?"

    -Probably because they didnt achieve air-to-ground communication. They only achieved communication between two objects moving in parallel at the same speed, which is equal to communication between two stationary objects. RF communication standards are made to operate up to a certain speed, which range from "walking" (for Bluetooth) to "highway" (for GSM). If the speed is larger the doppler-shift may disrupt the radio link. And when we are talking of commercial airlines the speeds are rather large, which demands that this is taken into account when designing the system specs.

    (And yes, WLAN has been shown to operate at high speeds, eg. Porshe at full throttle, but I dont remember if it were a standard system.)

  39. What is the point ? by Anonymous Coward · · Score: 0

    What does this prove ? We all know Wi-Fi is as insecure as Windoze. What did they hope to demonstrate with this ? I cannot help thinking that they did not really think this through.

  40. Kismet Vs. Netstumbler by BooTy6 · · Score: 1
    Hope these guys submitted to WiGLE. Enough of this kind of thing and we'll have to actually use the altitude data :)

    A friend and I have the same 1 watt amp, nearly the same antennas, he runs NetStumbler and I run Kismet. I routinely get 30-50% more networks in tandem social-stumbling (which is a lot of fun, btw, and it helps to have a navigator for doing targeted drives).

    We haven't done one since NetStumbler 0.4 came out, however, which is more active in its searching. Initial reports indicate that it does do quite a bit better now than it used to.

  41. Freaking Awsome Idea! by Jonathan+Hamilton · · Score: 2, Interesting

    I would like to say that un-like the other two
    post I think that was freaking awsome and can't wait to get my commercial fixed wing liscence and do the same thing.

    Anyone that post about the avaonics messing with equipment or "flying in formation" as being dangerous has not idea what they are talking about, and have probably never be in an Airplane besides a huge jet.

    Flying in formation dosen't mean you have to fly 3-4 feet like the fucking blue angles. You can fly 100's of feet from each other as long as you are maintaining the same heading, speed, and distance away from the other airplane.

    People also forget that Wireless equipment is line of sight, so by being in a airplane you can see more AP's then by driving alone, not to mention that is saves more time.

    I think it all boils down to jelousy and ignorance. These people can't own or see owning a plane, so they think that any one that does is a moron, and that flying in a plane to find Wireless AP's is a waste of time..

    If those out there have the money and the resources to fly a fucking plane for wireless access points let them do it. This is a free country (moslty) and economics will punish them if they can't afford to do these things. (I.E. they will go bankrupt because the money that went for place fuel was suppose to go to power.)

    If they can do it, and want to do it.
    More power to you!

  42. Yes.. by Jonathan+Hamilton · · Score: 1, Interesting

    Exactlly,

    This is what no politican wants to admit.
    We have the technology to have flying vehicles
    that could be afforded by at least the upper middle
    class.
    However, one must sacrafice lots of time to train, or saftey and logistical capability.
    It's isn't the only reason we don't have flying cars yet. But condsider people still forget do things as simple as change the oil, or they wreck when they are watching the radio, the question boils down too.

    Why you want EVERY 16 year old girl or Guy, or how about every 75 year old lady driving a flying car? Or even a drunk redneck coming home from the bar?
    Cars ARE lethal weapons, so much energy and cause so much distuction. But we can some what control what cars hit, by putting barriers, railing, and having populated areas away from the streets, or speed limits exteremly low, speed bumps, speed islands etc..

    But imagine a car, that could fall into anyones house, hospital, gasoline tank, anything...

    We won't see flying cars for the public in a long long time. (Probably never.) What we will see though are more upper classed indviduals getting licsesed to fly in helicopters and airplanes. ANd many, many more charter services that fly people 50 or 60 miles in 1/2 hour or so for next to nothing. (I'm talking 20 years off or so.)

  43. oh dear by fullofangst · · Score: 0, Troll

    That really is the most pointless, useless video ever. Even worse for it being on some kind of computing website.

    Sorry Tom's but copying Arstechnica articles without adding anything worthwhile doesn't cut it these days.