The Dark Side Of DefCon's Wireless Network

An anonymous reader writes "While there's been a few postings on events happening at DefCon 12, one event seems to have been overlooked. A new wireless packet injection tool was quietly released (unleashed?) during DefCon: AirPwn. Here's a write-up of the tool as deployed by its author and crew at DefCon 12."

Comments

Ethereal dump?

[scubacuda]

Anyone have an ethereal dump of what all of this looks like?

Re:Ethereal dump?

[thinkfat]

figure you'd see a regular HTTP response packet that fits your TCP sequence numbers quite nicely, and a RST afterwards because the numbers got messed up as the faked response didn't have the same length as the real server response. Perhaps they hold down the server by injecting RST packets, too, like juggernauts TCP stream capturing mode did...

i was owned

[daevux]

I was a victim of this at defcon, but since I was using lynx, I really didn't see any of the images mentioned. Actually, most of the surfing I did at defcon was using links or w3m over ssh (on a home box).

There could be uses

[Rob_Warwick]

This could actually be a fairly annoying tool in the hands of advertisers. It also has some pretty good uses I can think of.

Three scenarios to point this out.

You're at Joes Internet Cafe, munching on your slightly overpriced muffin and glad for the free Wi-Fi access since you're out of town, and don't get to check your email much on the road. You hit the link to a message you want to read on webmail, when all of a sudden, an ad comes up. Nothing too bad, but it seems that Joe has decided that instead of charging people directly for 'net access, he'll rig up an old desktop with wireless to transmit the ad source for every 100th HTTP request that comes through his system.

This is a potentially annoying way of using the technology, but it also sounds like it could be a good way for Joe to help recoup his costs on the internet. Not a place I'd mind going.

Scenario Two

You're at Joes Internet Cafe, munching on your slightly overpriced bagel, glad for the...well, you know. This time the 'net access isn't free, but Joe's giving it out for $1 an hour, more than reasonable. 58 minutes in, you make an HTTP request, and a small javascript window pops up informing you that you've just got a couple minutes left, more time can be bought at the counter. After 60 minutes, instead of locking you out, all your requests simply get a screen advising you that if you want to keep going, Joe's going to need a dollar at the counter.

Seems useful to me.

Scenario Three

You're in Joes Internet Cafe, sipping some slightly overpriced coffee and you try to get online. After you've payed your dollar to the friendly man at the counter.

You keep gettings ads. You click out, thinking that it's a popup window, and no, you really don't need to enlarge that, it's fine how it is.

All browser windows closed. You try again.

No, I don't really need those drugs...

Or those pieces of software

Or...

You get the idea. Turns out, that guy in the corner is making some quick cash by spamming everyone in the place. The only sites that are coming through are from those ads. He leaves after about 15 minutes, because it can't be long until someone figures it out, but you've just lost 15 minutes of your time.

I realize it's an extreme example, but you think someone won't try it?

Joe, if you're out there, we need to talk. I've got some ideas for you.

Re:There could be uses

[SKorvus]

If you're at Joe's cafe, there's there's no need for Joe to use AirPwn. He already pwns the net connection you're connecting through (wirelessly). He can intercept & replace any packet he wants to anyway.

The point of AirPwn is intercepting wifi traffic on someone else's network; the uses of which are overwhelmingly malicious than benign, to my thinking. Exactly like Scenario 3. Or worse, detecting passwords, requests for secure connections to eBay, banks, etc.

My question to the crowd is, how effective would existing wireless encryption standards be at disabling AirPwn?

Re:awesome . . .

[Lord Kano]

I have two extra wifi cards sitting in a box. But if you don't, why not just use two USB wifi adapters?

LK

ahh, how clever

[Anonymous Coward]

reminds me of when I was a kid and I'd fuck with people using an incredibly overpowered and possibly illegal FM transmitter

But I'm a little surprised that this is "new", I thought stuff like this would've been written already a long time ago.

Bad News...

[Piranhaa]

I wonder what this will be for people at home browsing the internet on their wireless computers. There's nothing parents can do to stop their children from seeing images that are being injected like this with Frank next door beaming modified HTTP requests through the neighbourhood. The only way to do that would be a) Disabling *ALL* images displayed on their web browser b) Running wires through the house. I'll be this will be another push for WEP and other forms of wireless encryptions. I wouldn't want my 4 year old nephew opening up internet explorer to find a Playboy bunny sitting on the top of their MSN.ca startup page! Anyways... back to sleep...

Re:Bad News...

[Homology]

You can setup IPSec for your wireless network. Or if that becomes to troublesome to setup, you can use OpenVPN that is easy to configure and has a client for Windows as well.

After reading a few posts on this thread, I find it peculiar that so many slashdotters don't know that IPSec or related vpn products can be used to secure wireless.

A few questions

[mcrbids]

1) does SSL prevent this attack from working?

2) What about the data stream that ocmes thru the wire legimately?

3) What effect does WEP encryption have on the new "sploit"?

4) What about SSL? Do HTTPS websites remain at all vulnerable to this attack? Nearest I can tell, the answer is "no".

So, what we have herei is a lame way to spoof packets for unsecuredd onnections. So.... secure your IP already!

Re:A few questions

[westyvw]

Nope. Nothing about wireless should be considered secure. WEP doesnt guarantee security, the tools are already out there to crack that (although it takes time).
Additionally, copied from Jim Geier's article at wi-fi planet.com:

"You can view the frames sent back and forth between a user's radio NIC and access point during the association process. As a result, you'll learn information about the radio card and access point, such as IP address of both devices, association ID for the radio NIC, and SSID of the network.

With this information, someone can setup a rogue access point (on a different radio channel) closer to a particular user to force the user's radio NIC to reassociate with the rogue access point. Because 802.11 doesn't provide access point authentication, the radio NIC will happily reassoicate with the rogue access point. Once reassociation occurs, the rogue access point will capture traffic from unsuspected users attempting to login to their services. Of course this exposes sensitive user names and passwords to a hacker who has an interface with the rogue access point.

Someone can also use man-in-the-middle techniques using a rogue radio NIC. After gleaning information about a particular wireless LAN by monitoring frame transmissions, a hacker can program a rogue radio NIC to mimic a valid one. This enables the hacker to deceive the access point by disassociating the valid radio NIC and reassociating again as a rogue radio NIC with the same parameters as the valid radio NIC. As a result, the hacker can use the rogue radio NIC to steal the session and carryon with a particular network-based service, one that the valid user had logged into."

Goatse!

[randyest]

Anyone else freaked out by goatse being on the /. font page? Not a direct link, I know, but were the server not melted, you'd definitely have seen the goatse horrorshow images that are there.

And you'd be yucked out. But the repost of the article explaining the wireless goatse injection is +5 informative. That's weird too.

If you're confused (RIP goatse) see wikipedia.com and search slashdot.

I wrote the man page for airpwn

[ConsumedByTV]

Hi.

I wrote the manual page for airpwn.

All I see in this discussion is either people joking, bitching or having no idea how airpwn works.

Let's just set things straight.
First of all, there is no arp posioning.
Do you disagree? Well it's a GPL app, go read the source, show me the arp posion part of the code. What's that you can't find it? Oh, well jesus, it's because it doesn't do that.

You can hijack any tcp connection with this, it cannot be blocked without blocking the legit traffic.

This is accomplished by using raw frame injection.
One network card listens on a given channel (or in the case of a cisco card, all channels) and the other card simply injects custom frames with perfect replies. If your reply (it's up to you how big it is) is the right size, it's injected so perfectly that the connection not only still works, all of your webpage stuff still works, images just load as whatever the attacker wants.

It works with ftp, http, aim or whatever.
You can just have a ball.

It would be entirely possible to write regex that replied over aim or icq or any of that crap with a raw frame telling the other people in the conversation that they were coming out, it's up to you.

The software uses a very customizable framework to allow for use of regular expressions for matching. It's really useful for things other than goatse, but at defcon, they deserve the best.

Anyway, the totally clueless people here that claim to know how it works haven't even compiled it, so don't listen to them.

If you have any questions, feel free to ask.

Re:I wrote the man page for airpwn

[drinkypoo]

How the fuck can you expect to be taken seriously when you distribute that crap?

I've never even bothered to attend defcon and I can field this one. Defcon is not about being taken seriously by the mainstream. It's about networking (in the older sense, and the newer) with other geeks, it's about alcohol, it's about strippers, and it's about destroying hotels. I've heard even seasoned geeks speak with glee about the destruction of property, which is kind of amusing and kind of sad.

The people who they want to be taken seriously by, the only people they care about, will take them seriously (or not) based on the code and the results, and will get a chuckle out of the images. Those people are their peers.

I'm new to wireless

[Anonymous Writer]

I just got an Airport Express recently and during the setup process it gave me the option of using WEP or WPA, which it said was more secure, so I chose the latter. Why hasn't anyone mentioned WPA in this discussion? I don't really know anything about it other than it is supposed to be a more secure alternative to WEP, yet I've never heard anyone mention it even from the store I bought the Airport Express from.

Also, is there IPSEC for OS X? It's not mentioned anywhere in the Airport Admin Utility. Is it built-in? I Googled for it, and some of the first few links mention vulnerabilities in Mac OS X IPSEC. What's this all about?

Re:I'm new to wireless

[mgv]

I just got an Airport Express recently and during the setup process it gave me the option of using WEP or WPA, which it said was more secure, so I chose the latter. Why hasn't anyone mentioned WPA in this discussion? I don't really know anything about it other than it is supposed to be a more secure alternative to WEP, yet I've never heard anyone mention it even from the store I bought the Airport Express from.

I don't think that alot of wireless vendors implement WPA. Apple has chosen to do so for a while now, because they actually seem to understand default security alot better than the windows world.

The trouble with WPA is mostly getting windows machines to look on the network for it - most of my windows boxes cant see WPA, and using them wirelessly requires me to turn off WPA (which I do as little as possible)

By the way, its totally reasonable to have unsecured public access wireless at defcon - there is no point in securing a public network. If they used WEP, they would have to give everyone at the conference the key - thus negating the security.

The point of this discussion relates more to private networks where you are assuming that it is trusted.

My 2c

Michael

SSH port forward is your friend

[freelunch]

When using WIFI, I generally always use an SSH port forward to encrypt and tunnel my traffic back to a 'safe' host.

At home, my AP is connected to a dedicated interface that only allows SSH. You could add port knocking for additional security.

Sure, SSH port forwards can still be disrupted or messed with. But not like plain HTTP.

BTW, nice hack!