Slashdot Mirror
Anonymizing Wi-Fi Device Project Unexpectedly Halted
An anonymous reader notes that a project to develop an anonymizing Wi-Fi device has been canceled under mysterious circumstances. The device, called Proxyham, was unveiled a couple weeks ago by Rhino Security Labs. They said it would use low-frequency radio channels to connect a computer to public Wi-Fi hotspots up to 2.5 miles away, thus obscuring a user's actual location. But a few days ago the company announced it would be halting development and canceling a talk about it at Def Con, which would have been followed with a release of schematics and source code. They apologized, but appear to be unable to say anything further.
"In fact, all [the speaker] can say is that the talk is canceled, the ProxyHam source code and documentation will never be made public, and the ProxyHam units developed for Las Vegas have been destroyed. The banner at the top of the Rhino Security website promoting ProxyHam has gone away too. It's almost as if someone were trying to pretend the tool never existed." The CSO article speculates that a government agency killed the project and issued a gag order about it. A post at Hackaday calls this idea absurd and discusses the hardware needed to build a Proxyham. They say using it would be "a violation of the Computer Fraud & Abuse Act, and using encryption over radio violates FCC regulations. That’s illegal, it will get you a few federal charges — but so will blowing up a mailbox with some firecrackers." They add, "What you’re seeing is just the annual network security circus and it’s nothing but a show."
"In fact, all [the speaker] can say is that the talk is canceled, the ProxyHam source code and documentation will never be made public, and the ProxyHam units developed for Las Vegas have been destroyed. The banner at the top of the Rhino Security website promoting ProxyHam has gone away too. It's almost as if someone were trying to pretend the tool never existed." The CSO article speculates that a government agency killed the project and issued a gag order about it. A post at Hackaday calls this idea absurd and discusses the hardware needed to build a Proxyham. They say using it would be "a violation of the Computer Fraud & Abuse Act, and using encryption over radio violates FCC regulations. That’s illegal, it will get you a few federal charges — but so will blowing up a mailbox with some firecrackers." They add, "What you’re seeing is just the annual network security circus and it’s nothing but a show."
It is a violation of the Computer Fraud & Abuse Act, and using encryption over radio violates FCC regulations.
I think they mean that encryption on licensed Ham bands is illegal, since encryption over radio is perfectly legal (otherwise both Bluetooth and Wifi would be illegal).
Sure you can.
Wonder if they bothered to get a Grand Jury to rubberstamp it....
"I do not agree with what you say, but I will defend to the death your right to say it"
Gag orders and national security letters have no place in the Land of the Free.
This should be too obvious to even be worth saying.
Or maybe 100% vaporware without a feasible implementation in sight? Was a working prototype ever presented? Was a sound technical concept ever presented?
The technology isn't fundamentally impossible - it isn't breaking any laws of physics or demanding amazing breakthroughs. The only really difficult part is making it sufficiently small. Distance like that needs a large antenna.
...and they didn't want to go to jail for a useless gimmick? That, or a squad of Ham operators had a horse head delivered to the developers; you know, to hint at consequences for abusing their bands.
I'm guessing the ~450Mhz PMR / FRS bands due to the availability of cheap commodity hardware (with the same nominal range) that will cover the various international allocations, and the fact that these radios are generally pretty easy to interface in (i.e. setup parrot repeaters etc) Failing that the VHF ham bands as others had said.
Either way it was never going to be a goer, even if they chose to disregard the permitted spectrum use, there was never going to be the bandwidth to float this kind of thing, especially when your sharing it with every other station within several miles (propagation can be a bitch). I doubt there has been some massive cover-up, more likely some software guys setup a radio modem with 2 handhelds and got carried away, before crashing head-first back into reality.
Almost certainly this is due to it using Ham frequencies and some other crap, and nothing to do with OH NOES TEH NSA.
It's trivially easy to build a signal boosting reflector out of some aluminum foil and construction paper, or use one of the 8139417234 different cantenna plans on dem innernetz.
Last crap (read: expensive) hotel I was in offered internet access at $15 per device per day and free service in the lobby. Bought a Nanostation with the hopes that next time it might extend service from whatever room I end up in into the lobby. But if it doesn't, my plan was to use my phone to buy access, clone the mac to the Nanostation, set it up in station mode, and connect the Nanostation to an OpenWRT access point configured to put all traffic through a VPN before sending it out the WAN port to the Nanostation. Thus avoiding the issue of the more intelligent operators looking for access point "leakage" and letting me connect more than one device. If the hotel actively tries to shut down ANY access points that aren't theirs, I'd turn off the radio and use the LAN ports.
Since the FCC has declared that Wifi blocking is illegal, why not just use your phone as a hotspot and then you don't need to carry around a network closet's worth of wifi equipment with you? Worst case, get a USB cellular modem and plug it straight into your laptop.
Yeah, I guess that makes me a scumbag too. I figure at $15+ a day for almost no service, I'm in good company. :P
Replace the network cable with two Nanostations bridging the connection and you've got this same item (the locoM9 does 900 Mhz, if that's what is wanted). I'm not really sure it's all that genius, to be honest.
Doing all of that just to get "free" wifi doesn't make you a scumbag, it makes you a geek.
So it was probably the gubbmint. Thanks, Obama.
1-watt, IIRC
As a longtime ARRL license holder I was following this project closely and I have to say...what whoever did and whatever they did to do it pretty much accomplished the equivalent of the Streisand Effect on steroids traveling at the speed of light (radio). 'Disappearing' this project virtually guarantees that almost a quarter-million DIY techies that build things like this from what they find in their garage plus a pound of solder just because they are bored and want to 'chew the carpet' about it on the next local repeater Net will do so, and because you can't shut us the hell up even people who don't want to know or care about this will hear about it 16 times. And there will be huge amounts of coax and silicone tape sacrificed to this end.
Accessing an open WiFi connection using a repeater would not violate the CFAA -- the connection is open and your device would log on to it. You'd be using it the way it was intended. Of course, The DOJ claims that simply violating terms of service can make you a federal felon, but that's wrong. Read Prof. Orin Kerr's work for more on this
On the other hand, the FCC allows anyone to use the 900MHz band but tightly regulates what can be done there (for example, no "retransmission of .. signals emanating from ... radio station other than an amateur radio station", which likely does make this idea illegal. See 47 CFR Part 97.
Orwell's "memory hole" at work?
Patent litigation: A doctrine of Mutually Assured Destruction... in which everyone seems willing to push the button
So we'll pretend there is a coverup of some sort to "get of jail for free" :)
I think 900mhz is better for longer distances and diffusing around obstacles, with the gain usually 14dbi+ 900 can easily tune resonant reflections of 2.4 in the clear...maybe even 4.9-5.0 (I think that's allocated to something or other, too), but yeah, to tx you'd need a call sign...but as this claimed to anonymize traffic txing wouldn't tip your identity, only your location, and you'd have to be bleeding over the spectral masks of nearby bands and making a huge dick of yourself before there would be any reason that someone might call the radio cops on your ass.
I forgot about the ERP limit, that would make it hard to legally do all of what I went on about above w/o a call sign.
Sure, but to keep it legal one would need to be very careful.
Such a device would need to be Part 15 compliant, which puts a real damper on the output power, but allows encryption (I believe). Also Part 15 is secondary to EVERYBODY else on the spectrum. Running more than the Part 15 allowed field strengths and encrypting would be illegal.... Part 15 is pretty much do what you want to do, just keep the field strengths low enough that nobody will likely hear you more than 100 yards or so away, and if you interfere with somebody, YOU get to shut down.
Being illegal and getting caught are totally different things though.... The FCC is pretty understaffed in the spectrum monitoring area so unless somebody complains the chances of having a legal problem is slim (but not none). However, if they catch you, the fines can be $5K/day for each offense, so I'd not recommend flaunting the law in this case..
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Or maybe 100% vaporware without a feasible implementation in sight? Was a working prototype ever presented? Was a sound technical concept ever presented?
Totally possible, just totally illegal to operate and would have a high possibility of being caught. They would certainly need to use licensed spectrum for what they are describing, and such spectrum is currently packed solid with users. The data rates possible are pretty slow, unless you take up a huge amount of spectrum space, which would raise the noise floor, up the necessary power and make yourself a problem for the licensed users. Licensed users would surely locate you, then turn you in to the FCC in droves, who would show up to verify the interference and start sending you nasty letters about the rules you are breaking and the cost of the fines. They might even knock on your door and inspect the equipment if you are dumb enough to let them in. They cannot do much but fine you, but the DOJ can force the collection of the fines though court action, fines which run upwards to $5K/day per violation..
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
It's pretty trivial to make a Yagi from a Pringles can to point at an open AP. Change your MAC id and connect to a TOR node.
Mission accomplished
09 F9 11 02 9D 74 E3 5B - D8 41 56 C5 63 56 88 C0 45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
You can get over 20 miles from a pringles can and a standard wifi router, so I'm thinking the design/engineering isn't holding up the project.
Thanks to the first amendment.
On the radio spectrum, unless the license you are using allows encryption, it is illegal. You see, the FCC has some pretty clear rules about this kind of thing, and it has NOTHING to do with the First amendment, according to the courts anyway..
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
I couldn't see how this would be legal. Operating a transmitter at 900mhz requires a license. You don't simply start transmitting without either using air ways that are open to usage ( Ham operator - still requires a license to operate) or that you own the frequencies. As 900mhz is mainly cellular I didn't believe that the article was real.
Actually, the FCC does issue blanket authorizations to operate on may frequencies though Part 15 (pretty much every frequency is fair game, with a few exceptions). Part 15 requires some pretty low maximum field strengths though and has some criteria for all electronic/electric devices that emit RF however it is the field strength limits that make this device impossible to be a part 15 device, which means you are going to have to go with one of the licensed services.
CB and FRS are out because encryption is not allowed there, nor is data. Ham bands might work but you would need to get a license (not hard, really) and encryption would be a big no no. Other licensed services would be expensive and generally would require a fixed operating point which make being stealthy impossible...
I'm with you, the device may have been real, but it wasn't legal by FCC rules in the USA (or the rest of the industrialized world for that matter). Importing the devices would be a serous problem too... I'm guessing they realized that this wouldn't go well for them on a number of fronts...
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
1-watt, IIRC
Nope, 1-watt is generally way too much power for Part 15 limits, with a few exceptions you are going to be limited to 1/10th of a watt or less of drive power (not RF out, DC IN to the final amplifier). Actual transmit power is going to be somewhat less than the 0.1 Watt. Plus, there are field strength limits too, so you cannot just hook up a directional antenna (like a 26db Yagi) and stay under the field strength limits very easily.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
This would be fairly easy to produce. VHF radios are available cheap (Wouxen, Baofeng). Getting WIFI throughput would be all but impossible due to the necessity of using a much narrower than the 20 MHz channel WIFI uses at 2.4GHz.
Hams have been transmitting digital packets via radio over much father distances for over two decades. True it was only 1200 baud but I could see much higher speeds with much more modern DSP capabilities.
More than likely they cancelled this due to potential liability issues.
maybe they were just bullshitting anyways.
like, come on, if it dependent on a device that sat near the wifi AP, it was hardly anything magical-special-super-anonymizer device in the first place. all it then was, would have been an unlicensed sort-of-long distance radio data link - which would have a whole other market mind you.
if they were implying that you could connect to the wifi ap from 2.5 klicks without anything special device near the wifi ap, then they were bullshitting.
so probably they were bullshitting because their product if it functioned as would have been likely, would have had a totally different market than what they were pushing it to.
just that it worked on unlicensed spectrum wouldn't have made it illegal to produce for markets where such use would have been legal.
world was created 5 seconds before this post as it is.
Well they sparked the idea of such a device and gave an overall description on how it works, so I wonder how long it will take for somebody else to make a similar device :) I think government gag orders (or any other suppression methods [and I think this is government work] ) are useless in the long run.
What's so mysterious about it. They got a national security letter, can't talk about it and they will be hacked this or next week, the plans will be published by wikileaks or Anonymous and you will be able to order a completed product on Aliexpress for $29.95 in 3....2.....1...
Might they have been secretly compelled to provide the customer list to the FBI? At this point no doubt the spooks would consider anyone who wanted one as "suspicious". Remember when this was supposed to be a free country? The "home of the brave"? Those were the days, eh?
I am not saying that the project has no merit
What I am saying is that the project was doomed from the very beginning
The developers of the project may have good intentions unfortunately their approach was totally misguided
If I were the one who wants to do something like that I would just do it, first , making sure that the thing works as advertised, and only then, I show the thing to the world - with source code, and everything
Muchas Gracias, Señor Edward Snowden !
You've been so wrong about a lot of things lately, I really can't bring myself to believe a single word of that.
Part 15 reads almost the same for 900 MHz as for 2.4 GHz: You can use 1W if you are doing one of three things.
Thing 1 is to send a direct-sequenced spread spectrum signal (not in this case)
Thing 2 is to send a frequency-hopping spread spectrum signal, with a maximum dwell time of 400ms and a minimum of 50 channels in your spreading sequence (again, not the case here)
Thing 3 is to send a digital signal of at least 500 kHz RF bandwidth (which is likely to be the case here)
Additionally, there are bonuses for using good antennas (the FCC seems to want to encourage this). You do need to reduce your transmit power if you have a gainful antenna, but you only have to reduce power by 1dB for every 3dBi of antenna gain. For example, using a 3dBi antenna (for instance, a 5/8 wave) would double the strength of your transmitted signal, but would require you to turn down your transmitter power by 1 dB, making it roughly 800 mW rather than 1W. Put this together, and you get an effective radiated power (ERP) of ~ 1.6W.
In a more extreme case, imagine using a 24dBi directional antenna: You get a 2^8 boost in your signal from the antenna, and only have to cut your power by 8dB. Actual transmitter power ends up at 160mW, but the boost from the antenna gives you an ERP of ~40W.
www.wavefront-av.com
WRONG. The FCC Part 97 rules themselves explicitly forbid encryption for the purposes of obscuring the message.
(Spread spectrum techniques can be considered encryption, which is why SS is only allowed if you publish your spreading algorithm. Encryption for the purposes of "data whitening" is OK as long as the key you're using is published somewhere.)
retrorocket.o not found, launch anyway?
S/he is wrong, the radio being used is commercially available and runs on the ISM 900Mhz band. Other posts above have all the information about the radios (Ubiquiti M900) and how it works. There is nothing special about this device, with good antennas though, you likely could get 25 or so mile range.
https://en.wikipedia.org/wiki/...
http://www.wlanparts.com/ubiqu...
APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?
Thanks Minitrue, you always come through! Still waiting on the 10th edition of the Newspeak Dictionary. That would be doublegood!
Be More, Be Manly, The Manly Geek Ubergeek Extraordinaire Blogger: www.manlygeek.com/blog Podcaster: podcast.man
That's a large, directional antenna. You can't conceal it, and you can't casually drop it. It's also up in 2.4GHz band - where range is far too short. This device would have to run lower, which means a bigger antenna still.