Something's Not Quite Right...

Ok, so I've blogged about my fake attwifi hotspot using DD-WRT.  I've blogged about setting up a laptop in between that hotspot and the Internet for packet sniffing with Wireshark.  And I've mentioned doing other more interesting things like setting up the Upside-Down-Ternet.  I decided to put my money where my mouth is and build it out myself, potentially for demonstration purposes at our next security awareness presentation at the company I work for.  How many people in an audience of about 50 do you think I can get to auto-connect to my access point, just by virtue of them having their devices in their pockets?  We're about to find out in a couple of weeks.

After reading the main page for the Upside-Down-Ternet, I realized it was slightly more complicated than just running a script.  Turns out I needed to setup a squid proxy, a web server (likely apache), and some image manipulation tools on my laptop in order to automatically intercept Internet requests for linked images coming from my "victims", pull down those images myself for flipping, and rewrite the links to point to the flipped images on my own web server before delivering the web page to the client.  There is a pretty decent write-up about how to do this in a step-by-step fashion, but there are couple of differences/mistakes in certain sections:

• Setting up the proxy - Good
• Setting up the webserver - Instead of:
• sudo chown www-data:www-data /var/www/images
• it should be:
• sudo chown proxy:proxy /var/www/images
• Otherwise you'll end up with all sorts of permissions errors when squid tries to start manipulating and writing image files.
• Image Script - Good
• Networking Setup - Unnecessary, we're going to be taking care of this through our DD-WRT configuration
• Cleaning Up - Unnecessary, you won't be running it for very long. *ahem*

Also, instead of doing all that sudo-ing, I prefer to just "sudo su" once to get a root shell, but maybe that's just me. Anyway, once you've got that all set up, you can go ahead and test it out locally on the laptop first. Open up Firefox and navigate to Edit --> Preferences --> Advanced --> Network --> Settings... --> Manual proxy configuration. Enter 127.0.0.1 Port 3128 for the HTTP Proxy, and check the box to "Use this proxy server for all protocols."

Click OK to accept everything, then try going to your favorite sites to see the effects! Here's a couple of screenshots showing the updated sites that the original creator used:

If you can't get it to connect properly, or it just seems to be hanging, try kicking the services like so:

• service squid restart
• service apache2 restart

and that should work. Now, remember that whole proof-of-concept from the last blog entry? Well, once the router is setup to get Internet access through the laptop, you need to configure it so that anybody that connects to the router, goes through your new proxy. How do we do that? You'll need to use another device to manage the router for this, or you can temporarily connect the wireless interface of your laptop to the router instead of your real Internet connection to create a bit of a circular mess. :) Just remember to disconnect from attwifi and back to your true Internet connection on the laptop before calling it a day. In my case I used my iPad connected to attwifi to perform these steps.

• In the DD-WRT interface, navigate to Services --> Hotspot --> HTTP Redirect.
• Click the radio button to Enable this functionality, then for the HTTP Destination IP, enter in the IP address of the router's assigned gateway, which is also the IP adddress of the laptop's Ethernet interface. You can find that out easily by doing "ifconfig" on the laptop and looking for the IP address assigned to the "eth0" interface.
• For the HTTP Destination Port, enter 3128.
• For the HTTP Source Network, enter the CIDR address without the /24 or whatever your subnet mask might be.
• Click Save and then Apply Settings at the bottom of the page and wait for the router to come back up.

At this point, everything should be good to go! Try it out from any mobile device connected to your router, and voila:

Mogrify has a TON of image manipulation options, so play around and see which one you like the most. In the meantime, I think at this point you probably all want me to come up with a new line of topics to blog about already. Don't worry, have a bunch in draft, coming soon.

Cheers.

Proof-of-Concept Evil Hotspot

So I recently built-out a new computer for the family common area, allowing me to repurpose that laptop for other nefarious tasks.  Ok, not really nefarious, i just wanted to have a decent test bed for trying out some of the latest versions of various flavors of Linux operating systems.  So the first one I'm trying is the newest Ubuntu, version 11.04.  One of the interesting capabilities that's been built into this OS for a couple of years now is Internet Connection Sharing whereby I can actually plug a device into the Ethernet port on my laptop and allow that device to piggy-back off of my laptop's existing Internet connection.  So of course I had to play around with it to see what I could do...

Enabling this functionality is actually extremely easy to do, and is well documented here.  Couple of screenshots to get the point across:

This functionality is extremely convenient in that it even pushes out a DHCP address to the connecting device.  So that's all well and good, but what can we DO with it?

Well, in my first blog post, I talked about how easy it was to spoof a legitimate hot spot's SSID, attwifi in my example, and some of the risks associated with connecting to those.  In my second post, I talked about Wireshark, and how easy it was to sniff traffic passing across the network to which you're connected.  Put 'em together and what have you got?  A method by which you can capture and view network traffic from mobile devices automatically connecting to you, trying to get Internet access.

Here's the setup: Internet connection --> Ubuntu laptop-Ethernet port --> WAN port-Asus WL-330GE Router-"Evil" attwifi network.

After you've configured Ubuntu to share out its Internet connection via the Ethernet port, and either rebooted or restarted the networking, your choice, you should find that the Internet-facing interface has reconnected back up, and the Ethernet interface will be ready to have a private address assigned to it, as per RFC 1918, once you plug in the router.  In my case, it was a 10.x.x.x address.

Now, plug in the wireless router's WAN port to the laptop's Ethernet port, and power up the router.  If it's configured to grab an IP address automatically via DHCP, it should also now have an IP address in the same subnet as the Ethernet interface of the laptop.  The wireless side of the router will now be broadcasting the new "evil" SSID, attwifi in my case.

Connect a "victim" device to the attwifi network, and you should find that you can get Internet access routed through the router --> laptop --> real Internet connection.  Now, run Wireshark on the Ubuntu laptop to capture clear-text traffic like http web traffic, smtp email traffic, telnet or ftp traffic, etc. sourced from your unwitting "victim" device.

One of the gotchas of running Wireshark on Ubuntu is that it will likely complain that there are no network interfaces to start capturing from.  This is because Wireshark needs root access to place those network interfaces into what's called "promiscuous mode," listening to all network traffic, not just that which is only intended for the system itself.  You can either "su" to root, or just "sudo wireshark" in order to get the necessary privileges to get Wireshark the access that it needs, and start capturing on the Ethernet interface of the laptop.  Done deal.

You also have the ability to do things like create a replica of a legitimate hot spot's captive portal to put up once someone connects to your "evil" one.  Then, you can capture a victim's hot spot credentials as well, in addition to their traffic once they've connected to you instead.  How easy is it?  Walk into a Starbucks, connect to their AT&T WiFi network, open up a browser, and when you get to their captive portal, from the File menu, just Save/Save Page As to pull down a copy of the site with all images and source code for your enjoyment.  Modify it to your liking, run it on your own webserver on the laptop, and you can even point to various Hotspot Services from the DD-WRT router firmware.

You can also have some more fun by creating a proxy on your laptop and causing some browsing mayhem doing something like serving up the Upside-Down-Ternet.  Watching the extremely confused looks on your victims' faces might actually be even more fun than just capturing their traffic and logon credentials, etc. :)

So the moral of the story hasn't changed, but let me summarize:

• Disable mobile device wireless when not in use.
• Be absolutely certain of what wireless networks you're connecting to and their legitimacy.
• Use encrypted protocols whenever possible.
• Don't do anything of a sensitive nature, like online banking or file transfers, when out and about using free, likely unsecured, wireless hotspots.

Like those Allstate commercials say, "Be better protected from mayhem like me.  Dollar for dollar, nobody protects you from mayhem like [gobitech]." :)

attwifi Impersonation Experiment

I recently decided to conduct a little experiment in the name of science (or security, tech-geek curiosity, take your pick).  As many of you may already know, AT&T is behind many of the publicly available wifi hotspots located everywhere at places like Starbucks, McDonalds, etc.  For AT&T iPhone users, the first time that you connect to one of these hot spots, with an SSID of attwifi, your phone is then configured to automatically connect to these networks whenever they come in range so that you can get faster connectivity and avoid data usage charges on your 3G plans. Convenient, right?  Well, security and convenience have always butted heads together, causing headaches for all of those involved.  And that's where I come in.  I was wondering how many devices I could get to automatically connect to a wifi network that I was broadcasting from my backpack on my normal commuting route, which includes about a 3 mile drive, 25 minutes on the subway, and 3 blocks of walking...  roughly 45 minutes door-to-door.


I had previously purchased a portable wireless router, the Asus WL-330GE, and flashed a custom, linux-based firmware called DD-WRT onto it.  DD-WRT is a great alternative firmware for compatible routers as it enables features above and beyond those of the manufacturers' firmware, while providing rock solid stability.  I had another Asus router that was running for over 230 days with no issues until I accidentally, ahem, power cycled it.  Anyway, one of those features is to increase the power of the wifi radio, which came in handy for this experiment.  I gave the device an SSID of attwifi, turned off encryption, and enabled a pool of 50 IP addresses that could be given out automatically to any associated device that wanted one.  I hooked it up to a Griffin USB Reserve Power, and threw it into my backpack for the trip home from the office one day, slightly paranoid that the subway security personnel would come after me for carrying something with bright blue flashing LEDs onto the train.  The Griffin battery is able to provide a little under 2 hours of power to the router, perfect for my little project.  To give you an idea, the router itself is slightly smaller than a deck of cards.

I logged into the router from my own iPhone periodically during my commute to keep tabs on who, if anyone, was connecting.  And were there ever.  By the time I walked the four blocks from my office to the train station, the 50 IP addresses were already all spoken for!  Surprisingly, a majority of the devices that hooked into my router were blackberries, with iPhones coming in second, and Android devices and iPads trailing a distant 3rd and 4th.  For a second run of the experiment later on, I increased the number of available IP addresses to 253, and got 107 devices to connect to me over the course of the commute, one-way!


One of the other features of the DD-WRT firmware is the ability to see who is connected and their relative signal strengths as well.  Sitting on the train on the way home, I took a look at the list and at any point in time had half a dozen or so connected clients.  The amusing thing was, I was basically able to put a name to a face when iPhone users were connected.  The name of the client device is typically [name]'s-iPhone.  So when the signal strength says 98% for Marcia's-iPhone and there's only one woman in my immediate vicinity with an iPhone out, tapping away furiously, wondering why she can't get online, chances are, that's Marcia.

So what does this mean?  Well, from a security standpoint, it's no longer about making sure that your own devices/computers/etc. are fully patched, up-to-date, locked down, etc., to keep the bad guys out.  Now more than ever, with the emergence of mobile technologies, you need to be cognizant of the bad guys that you could potentially be connecting to either willingly or unknowingly.  At best, I could cause a denial-of-service attack, meaning these devices which all prefer wifi over 3G connectivity automatically, connect to my setup, which isn't connected to the Internet at all, and they get nowhere fast.  Marcia's case in point.  At worst, I could setup a system which would pass them through to the Internet just as they expected, but capturing everything that they do along the way beforehand, like passwords, credit card numbers, email and chat messages, etc.  EVERYTHING.  The same risks apply to things like free hotel wifi networks, Panera, Barnes & Noble, etc.


Moral of the story, make absolutely certain that the wireless networks that you're connecting to are the legitimate ones that you're expecting, and it's good practice to disable automatically connecting to wireless networks (unencrypted or otherwise) unless you absolutely need them.  This means turning off wifi functionality until you need it.  I'd be willing to bet that a good majority of my "victims" weren't even using their devices at the time, they were just auto-connecting from their holsters/purses/pockets and such.  As "Mad-Eye" Moody from Harry Potter always says, "Constant Vigilance!"