Wireless Analysis With Monitor Mode On Android

← Back to Stories (view on slashdot.org)

Wireless Analysis With Monitor Mode On Android

Posted by timothy on Tuesday September 18, 2012 @01:45AM from the unfling-the-packets-for-examination dept.

An anonymous reader writes "We are a group of three researches, and in the last few weeks, we have been working on Wi-Fi monitor mode for Android devices, based on Broadcom BCM4329 and BCM4330 chipsets. Currently we have a successful PoC for Nexus One and Samsung Galaxy S 2. We've released all the info in our new blog."

49 comments

Min score:

Reason:

Sort:

You Brick My Phone by smittyoneeach · 2012-09-18 01:45 · Score: 2

You brick my phone
(And I'm not alone)
We'll find us time
For Amish crime
Burma Shave

Seriously: great project. As I'm connected using a Galaxy S 2 in hotspot mode as I write this, I may need to have a go at this project.

--
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
1. Re:You Brick My Phone by Beorytis · 2012-09-18 04:08 · Score: 1
  
  Amish crime
  
  Gotta love that the defendant's name is Mullet. Did he cut the beards short in front and leave them long in back?
2. Re:You Brick My Phone by smittyoneeach · 2012-09-19 00:22 · Score: 1
  
  Heh.
  
  --
  Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
BREAKING NEWS: SLASHDOT SOLD TO DICE by Anonymous Coward · 2012-09-18 01:46 · Score: -1

wow. Not sure if that's good or bad.
1. Re:BREAKING NEWS: SLASHDOT SOLD TO DICE by monkeyhybrid · 2012-09-18 02:01 · Score: 0, Offtopic
  
  Yep, Slashdot, SourceForge and Freecode for $20,000,000.
2. Re:BREAKING NEWS: SLASHDOT SOLD TO DICE by Anonymous Coward · 2012-09-18 02:23 · Score: -1
  
  Man, Dice got ripped off.
3. Re:BREAKING NEWS: SLASHDOT SOLD TO DICE by Anonymous Coward · 2012-09-18 02:38 · Score: -1
  
  The press release ends with "Dice Holdings acquired the business for $20 million in cash. In 2011, the online media properties generated $20 million in Revenues."
4. Re:BREAKING NEWS: SLASHDOT SOLD TO DICE by smittyoneeach · 2012-09-18 02:51 · Score: 2
  
  Fool!
  "Man, Dice got rolled."
  
  --
  Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
5. Re:BREAKING NEWS: SLASHDOT SOLD TO DICE by seandiggity · 2012-09-18 03:08 · Score: 0
  
  I, for one, welcome our new dice-rolling overlords.
  
  --
  Geeks like to think that they can ignore politics, you can leave politics alone, but politics won't leave you alone.-rms
6. Re:BREAKING NEWS: SLASHDOT SOLD TO DICE by Anonymous Coward · 2012-09-18 04:02 · Score: 0
  
  FU to the Android-hating AC who tried to hijack this thread.
This article is plain spam. by Anonymous Coward · 2012-09-18 01:53 · Score: -1, Flamebait

This article is plain spam.
1. Re:This article is plain spam. by Anonymous Coward · 2012-09-18 02:03 · Score: 0, Offtopic
  
  Yes it is. Probably a result of Slashdot being bought by dice. I bet we start seeing a lot more of this crap!
2. Re:This article is plain spam. by arielCo · 2012-09-18 02:19 · Score: 1
  
  How so? I can't find a single reference to Dice (it's a tech jobs site, right?) in TFA, and they're not selling anything. There's an overview, and they link the source+binaries for you to try (at your own risk).
  
  --
  This post contains no rudeness or derision of any kind. All arguments are friendly. Terms and exclusions may apply.
3. Re:This article is plain spam. by NerdmastaX · 2012-09-18 02:27 · Score: 1, Interesting
  
  yea im gettin away from slashdot if the monster.com equivalent for nerds just bought it.
4. Re:This article is plain spam. by fuzzyfuzzyfungus · 2012-09-18 02:34 · Score: 5, Insightful
  
  This article is plain spam.
  Wait: an article about some guys who reverse engineered a (very common) broadcom wireless chipset to add monitor mode to a linux kernel driver(complete with source and instructions on how to brick your own phone) is 'spam'?
  What is slashdot for, if not trolling and arguing about linux drivers?
5. Re:This article is plain spam. by kelemvor4 · 2012-09-18 02:48 · Score: 2
  
  This article is plain spam.
  Wait: an article about some guys who reverse engineered a (very common) broadcom wireless chipset to add monitor mode to a linux kernel driver(complete with source and instructions on how to brick your own phone) is 'spam'?
  What is slashdot for, if not trolling and arguing about linux drivers?
  I agree, this article = "News for Nerds."
6. Re:This article is plain spam. by Penurious+Penguin · 2012-09-18 03:20 · Score: 2
  
  When I don't prefer my spam with eggs, I often prefer my spam with plain spam. Nothing wrong with spam, is there? What more could you ask for anyway? It's already an exciting 3D representation of an entire pig stuffed into a single tin, with a few elements of modern science added.
  
  ~ Plain Spam - The Number One Choice for Spam Purists Since 1970
  
  --
  Forward! -- Emperor Norton, 2012
7. Re:This article is plain spam. by Anonymous Coward · 2012-09-18 06:12 · Score: 1
  
  I agree, this article = "News for Nerds."
  Although, not quite sure if it's "Stuff that Matters".
8. Re:This article is plain spam. by dave420 · 2012-09-19 01:58 · Score: 1
  
  I'm pretty sure one of the most popular Android devices ever getting monitor mode (and possibly injection further on down the line) matters...
Strengthen your passwords by AmiMoJo · 2012-09-18 02:02 · Score: 4, Informative

With modern graphics cards dictionary attacks on WPA2 passwords are realistic. Since everyone carries wifi radios around with them and can gather the necessary data you should probably expect more such attacks on your network in the future.

--
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
1. Re:Strengthen your passwords by BlackSupra · 2012-09-18 02:44 · Score: 1
  
  What is the best Wifi Encryption?
  My Router offers:
  * WPA(TKIP)
  * WPA2(AES)
  * WPA2 Mixed
2. Re:Strengthen your passwords by fuzzyfuzzyfungus · 2012-09-18 02:46 · Score: 3, Informative
  
  It doesn't help entities that are likely to be targets of directed attacks(either high value institutional targets, who ideally aren't using PSK and are rotating passwords properly, or people with psycho and/or prankster neighbors); but the easiest way to keep people out of your network, for most of us, might actually to be to give them some of what they want.
  APs with multiple radios, or chipsets capable of handling multiple SSIDs with distinct security and routing rules, are increasingly common and cheap. If you broadcast an open SSID(all traffic originating from there QoS tagged as lower priority than traffic from your internal network, naturally) that dumps anybody who connects straight to the internet, no connection to the internal network or router configuration interfaces(through Tor if you are really worried about somebody's warez and/or kiddie porn pointing back to you), that removes the bulk of most people's interest in cracking your network itself...
3. Re:Strengthen your passwords by L4t3r4lu5 · 2012-09-18 02:51 · Score: 4, Informative
  
  WPA2(AES) is the most secure, as long as your vendor implemented it properly.
  
  --
  Finally had enough. Come see us over at https://soylentnews.org/
4. Re:Strengthen your passwords by Penurious+Penguin · 2012-09-18 02:53 · Score: 3, Informative
  
  It uses the aircrack suite and supports injection. I imagine if people write convenient scripts for this software, it could get pretty popular. I've never owned a smartphone and don't know what their ranges are, but if they are close to a half-height mini-PCI, then this is a pocket sized menace indeed. Throw in the Cloud, rainbow tables, mega dictionaries and so on, and you get action. I have no doubt that many people will use such an application just as a novelty (because they can) -- but others may opt for more. Of course, those who don't use common ESSIDs and use peculiar passwords along with WPA2, they should have nothing to worry about. The rest, however, should definitely start with stronger passwords.
  
  For example, someone can crack your WEP regardless of your password; but to enter the router where the real fun can begin, they would encounter great difficulty if a strong password and unique user ID were set. Verizon figured this out some time ago. A strong password could limit an "attacker" to simply using your network. While stronger passwords are a good idea, it shouldn't be one's only recourse though.
  
  --
  Forward! -- Emperor Norton, 2012
5. Re:Strengthen your passwords by spectrokid · 2012-09-18 02:56 · Score: 4, Informative
  
  Use AES with a very long random gobbledigook password. Write the password down on the back of your router. from wikipedia:
  Weak password Shared-key WPA remains vulnerable to password cracking attacks if users rely on a weak password or passphrase. To protect against a brute force attack, a truly random passphrase of 13 characters (selected from the set of 95 permitted characters) is probably sufficient.[12] To further protect against intrusion, the network's SSID should not match any entry in the top 1000 SSIDs[13] as downloadable rainbow tables have been pre-generated for them and a multitude of common passwords.
  
  --
  10 ?"Hello World" life was simple then
6. Re:Strengthen your passwords by Anonymous Coward · 2012-09-18 03:04 · Score: 0
  
  Just use a friggin cable. End of story.
7. Re:Strengthen your passwords by Anonymous Coward · 2012-09-18 03:13 · Score: 0
  
  It's a wireless cable.
8. Re:Strengthen your passwords by Anonymous Coward · 2012-09-18 03:24 · Score: 1
  
  lol google REAVER.
  there is no strength that matters anymore. time is all you need.
9. Re:Strengthen your passwords by DickBreath · 2012-09-18 03:26 · Score: 2, Funny
  
  That is good advice. After you determine what you will use as a long cryptic password, you should set the SSID to be the same as the password to eliminate the possibility of forgetting the password. Also when guests are over, it is easy to tell them that the password is the SSID that their phone/laptop/tablet just scanned. Since the scanned SSID still has a lock icon next to it in the list of nearby WiFi routers, it is secure.
  
  --
  
  I'll see your senator, and I'll raise you two judges.
10. Re:Strengthen your passwords by srussia · 2012-09-18 03:30 · Score: 1
  
  Use AES with a very long random gobbledigook password. Write the password down on the back of your router.
  
  My handwriting constitutes a higher encryption level than AES-256, you insensitive clod!
  
  --
  Set your phasers on "funky"!
11. Re:Strengthen your passwords by Penurious+Penguin · 2012-09-18 04:12 · Score: 2
  
  And how much time would you need to crack a password such as:
  GrimTittyPat00shkinGarment
  ?
  Time is all we have. Why squander millennia on a mediocre password? Also, it's not the weakness of passwords, but the weakness of protocols here. Install proper firmware that does not support WPS and REAVER becomes little more than aircrack. With a solid WPA2 setup on open-wrt, I'd relax and not even bother monitoring my network traffic whilst surrounded by hostile REAVER users.
  
  --
  Forward! -- Emperor Norton, 2012
12. Re:Strengthen your passwords by Anonymous Coward · 2012-09-18 04:34 · Score: 0
  
  To further protect against intrusion, the network's SSID should not match any entry in the top 1000 SSIDs[13] as downloadable rainbow tables have been pre-generated for them and a multitude of common passwords.
  This is stupid. Why does this mean I need a weird SSID? Shoot, leave the default SSID if you want. Just pick a strong password.
13. Re:Strengthen your passwords by Anonymous Coward · 2012-09-18 04:46 · Score: 0
  
  Where do I plug in this cable on my phone and tablet?
14. Re:Strengthen your passwords by Anonymous Coward · 2012-09-18 05:24 · Score: 0
  
  GrimTittyPat00shkinGarment
  
  That's amazing. I've got the same combination on my luggage!
15. Re:Strengthen your passwords by Anonymous Coward · 2012-09-18 08:25 · Score: 0
  
  It doesn't support injection - that is on the list of future work. I have heard that injection support is a tough cookie to crack with Broadcom chips so I (no disrespect to the developers) won't hold my breath. WEP stations are quickly losing ground to WPA and becoming the exception rather than the rule so I don't think injection is as great a feature as it used to be for penetration testers.
16. Re:Strengthen your passwords by Anonymous Coward · 2012-09-18 08:45 · Score: 0
  
  Bad advice. Bad, bad advice.
  Bank manager: To deter thieves from stealing from us, the tellers must scatter some money on the floor of the branch every morning.
17. Re:Strengthen your passwords by Yvanhoe · 2012-09-18 10:09 · Score: 1
  
  I used to do that, then my government (France) declared that any act committed from my IP address was my responsibility and that if I don't protect my access, my connection can be cut. It kinda slowed me down...
  
  --
  The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
18. Re:Strengthen your passwords by mjwx · 2012-09-18 12:29 · Score: 1
  
  Of course, those who don't use common ESSIDs and use peculiar passwords along with WPA2, they should have nothing to worry about.
  This,
  
  The point of security is not to be uncrackable but to be so difficult and time consuming to crack that an attacker simply gives up (combined with the risk of being detected/caught). The threats to my wireless network consist almost entirely of local neighborhood script kiddies who want free internet, a 64 character randomly generated WPA2 key ensures they'll move onto softer targets before too long.
  
  --
  Calling someone a "hater" only means you can not rationally rebut their argument.
19. Re:Strengthen your passwords by neokushan · 2012-09-19 01:13 · Score: 1
  
  I would also like to know how that has any effect on the password.
  
  --
  +1 IDisagreeSoHeMustBeATrollOrAnAstroturferOrAShill
20. Re:Strengthen your passwords by neokushan · 2012-09-19 01:16 · Score: 1
  
  REAVER takes advantage of a vulnerability in the implementation of WPS in some (many?) routers. It's not the be-all and end-all, if the router is patched or simply not vulnerable, then the same rules apply.
  It also doesn't (currently) work on Android.
  
  --
  +1 IDisagreeSoHeMustBeATrollOrAnAstroturferOrAShill
N900 by Anonymous Coward · 2012-09-18 02:04 · Score: 0, Offtopic

This constitutes as news?
Why waste time waiting for years and then implementing something on the Android platform which doesn't lend itself well to porting that sort of thing when you can just get an N900 which already has all of those "common 802.11 pwnage tools" they're using.
1. Re:N900 by fuzzyfuzzyfungus · 2012-09-18 02:38 · Score: 2
  
  "As you know, ah, you write software to go with the hardware you have---not the hardware you might want or wish to have at a later time."
2. Re:N900 by neokushan · 2012-09-19 01:17 · Score: 1
  
  I don't know who you're quoting, but the random "ah" means I'm guessing it's John Carmack?
  He makes lots of odd noises in his speech.
  
  --
  +1 IDisagreeSoHeMustBeATrollOrAnAstroturferOrAShill
3. Re:N900 by dave420 · 2012-09-19 01:56 · Score: 1
  
  ... and none of the decent software available on Android. I know you're all butthurt because your favourite device is laughed at for being a massive, strange, ineffective beast of a phone, but that doesn't mean you should lash out at Android devices. If you really want a pissing competition, you can just read all the things Android does which the N900 doesn't. Grow the fuck up.
We are a group of three researches by Threni · 2012-09-18 02:12 · Score: 0

Take me to your researcher!!
Awww yeah aircrack-ng port to Android! by Anonymous Coward · 2012-09-18 04:01 · Score: 0

Monitor mode is the first step, I would like to see this app developed for da Droid. Should be an easy port...and since my old laptop with a 800Mhz PIII could find a wep key in about 3 minutes, I'm sure these new 1ghz dual core phone processors can do it in about 90 seconds or less. For penetration "research" purposes of course, I don't condone the use of such tools for nefarious resaons. Yadda Yadda Yadda, you know the deal.
1. Re:Awww yeah aircrack-ng port to Android! by norminator · 2012-09-18 07:26 · Score: 1
  
  You realize that a 1GHz ARM CPU in your phone isn't nearly as "fast" as a 1GHz x86 CPU, and that a dual core processor also doesn't actually mean it's twice as fast, right?
2. Re:Awww yeah aircrack-ng port to Android! by Anonymous Coward · 2012-09-18 08:16 · Score: 0
  
  Well that laptap can't run google earth, but my phone can :/ I'd say the processing power is on par at least. Sorry I didn't run cpuMark on both first to give you the exacting crunching numbers on both items. My bad :P Since Android is basically a smoothed over version of Linux anyway, a port of aircrack-ng and other related programs should be a snap. Which would be my point in the previous post, the actual processing power of any computing device isn't really an issue since the lightweight ***-ng programs are blazing fast even in brute force mode on highly outdated hardware.
3. Re:Awww yeah aircrack-ng port to Android! by MrDoh! · 2012-09-18 09:54 · Score: 1
  
  You realise that these phones can send emails/ftp/ssh the dump back to your real machine(s) with high end gpus, and wait for the password to appear. right? I
  
  --
  Waiting for an amusing sig.