alright let's go ahead and get started
night so thanks for coming to the talk
topics course it tracking and monitoring
Wi-Fi devices without being connected to
them my name is cable magical I look
here in milwaukee wisconsin my public
hacker handle is met him my private
hacker handle we cannot know i don't
know if any of you are bed and my
website twitter twitter handle there i'm
also a ham radio person so my call sign
is whoo hat which has ended cool vanity
all times are free by the way now which
is cool you wanna stay processing the
payments was more expensive than the
merriment and my day job i worked for
fire eye on the man inside doing instant
response software which is really fun um
over the last few years i've been pretty
interested in Internet of Things kind of
stuff actually before I even knew duck
was what it was called I made my own
little wireless security home monitoring
system with a raspberry pi and breaking
open a remote control for a wireless
outlet a couple years I'm also
interested in security side I last year
I did like a little wild trip to app and
a couple years ago I that kind of a deep
dive into like wave processing mainly
from the audio processing standpoint and
it's been really interesting though
because you know you're looking at stuff
like Fourier transforms and being able
to look at waves and analyze them and
you can do an amazing number of things
by looking at waves so sure that with
audio analysis but a lot of what we're
going to talking about today kinda you
know kind of comes back
two waves are still involved with
wireless security so i've also been
really into a software-defined radio
over the last few years um you know I
got a little hack RF first thing I did
was try to do a replay attack on my jeep
and it worked which kind of scared me um
most cars you have to do more but so
I've kind of gotten into some simple
stuff but software-defined radio and
they got a little more complicated and
you know I thought went into things like
modulating digital signals from scratch
you think your map um so can i and i
just given a binary number modulated
pinned it out over the wireless SDR n
control thanks and turns out the antral
guests so the things like controlling
virus outlets by generating the code
from your mouth and sending that out um
you see me in that coffee shop I can see
like a ton of antenna my teenage um but
kind of acting up format like a lot of
stuff I've done over the last year and
mostly wireless security and I really
like it so much fun um it feels like
magic if you'll kind of like one of the
closest thing is Magic that I seen so
there's this invisible energy all around
that that permeates us sand is a radio
waves right and if you know what you're
doing it you can listen to this
invisible energy it can tell you things
that maybe you shouldn't even know and
if you write magical incantations and
computers you can make things happen in
a physical world um it reminds me of you
nice to play diablo 2 lord of
Destruction it's so addictive and you
know it was the lens of mine um you know
like a sorceress or whatever and
leveling up my character and gain new
skill points and it still kind of like
that like it's just like a lot of fun I
can learn new skills and see
like magic and so I hope for this talk
to you today it will be tied up for you
may be gaining a new skill points or
maybe leveling up a skill that you
already have and maybe even gaining a
new web editor tool um and so wireless
security it's becoming more and more
powerful as time goes on so you know
doing like a quick scan of like the
Milwaukee wireless frequencies that are
registered things like SCADA systems
that control the sewer systems come up
which is interesting you know and you
have some free month is right there you
can see um like in general iot Internet
of Things stuff is like it's like plus
5,000 to all of your wireless hacking
abilities because more and more things
are becoming a dependent on wireless
communication um obviously you got
things like your next home security
system but come and give your
refrigerator but you know things like
cars are becoming more what dependent on
wireless security and obviously you know
tons of things are you I mean Wi-Fi cell
phone GPS obviously list goes on and so
today what we're going to be talking
about is specifically raw 802 11
monitoring and just give you my
motivation in why I started looking into
this so a couple months ago so you know
I have a number of my security home
security devices I have some wireless
security cameras I have my ring that I
can activate like I have a full security
system where it might say you know turn
turn if you know how many alarms sirens
and strobe lights will go off any light
will come on it's like them and but not
because there's been this explosion in
the vendors and devices in IOT stuff not
everything and talk to each other very
well um so you know some of my security
cameras couldn't talk to my security
system and I mean today I wanted to get
my security camera sees motion and
cimmyt activated I wanted all the alarms
to come on and so I started thinking
about well how can I do that i mean i
can try to like tap into the API calls
but they're encrypted I could try to
root the camera but like that's a lot of
work so I love a really simple solution
which is to just do raw 802 mm and
monitoring and ultimately these cameras
are you know upload videos cloud and so
to do that they have to send the video
to the club and obviously as soon as
they are triggered they want to help
with the video as fast as possible
because if someone's broken in your
house they could destroy the camera so
basically you know I think is ok if I if
I seem a certain amount of data coming
from the security cameras mac address in
some window time ago I'm going to say
that the video upload trigger the alarm
and it worked wonderfully actually um so
I just do a couple demos here so the
first one let me go ahead and open this
up and this is a security camera in I
think somebody's not it has needs a
visitor chair
oh um so yeah how that works really well
um and so that was really interesting
you know just by looking at the number
of light coming from the mac address of
the security camera I couldn't detect
whether it was dead in with uploading
video I had another so if I was like
sweet that was Al and I was awesome and
one interesting thing about this won't
get into the details in a second um but
I didn't have to be connected to my
Wi-Fi see that because i'm actually at
the raw 80 2011 data level um and you
know it hit me like it's interesting
because i could potentially see motion
detection in neighbors houses if they
have security cameras and actually when
I was looking at this um the security
camera that i had um I actually you know
when I was testing and I I armed it and
then tried it and then I was testing it
when it was not armed when it was in
home mode and it was still uploading the
video when it's all motion so that was
kind of a surprise um and this was the
canary camera nut in their settings you
can actually disable that which leads to
give you that control but it was cool it
was like I found this saying this
feature accidentally um but you know
looking at this looking at not having to
be connected to a Wi-Fi device and being
able to track traffic from mac addresses
um I found you know I thought thinking
about it there's other interesting
things you could do such as track people
um you know like if I wanted to track
when my wife got home luck it would be
great if I was in an office and I could
track with my bosses in the office but
um I were component anyway here's a
quick little demo of tracking a cell
phone i'm using tracker jacker and so
this was i'm going to do this
I'll just uh mute this so so basically
almost talk to us so I was I have my
cell phone and I had my cell phone in
airplane mode alright had white high off
feather and so you can see i would i
have my do you guys pull it up there
okay and we're back on um so anyway um
yes if you really funny someone's trying
to hack the wireless right now
congratulations so anyway my phone was
in at Wi-Fi off you know you can see
drove ice your bikes and it was
gathering in the 10-second window and
watch as soon as I turn on the Wi-Fi the
same press the button I look really
serious and there you are so it detected
almost almost instant which is pretty
cool um so um and you know based a just
had a 1 by threshold set up so it might
be any data from this MAC address
consider it detective um okay so let's
get out how this actually works and how
you can do it if you want so like a
primer and a refresher on how Wi-Fi
works from the radio perspective um so
you know it's ultimately all just radio
so a wireless adapter is cool it's just
a radio that certain operates at certain
frequencies and you have various
channels which are really just define
frequencies that everyone agreed upon
there may be some other minor things
that I mean idea
endo you have multiple access points
nearby hopefully the running for
channels and then it won't collide
there's various you know the channels
again we have certain frequency
definitions for two point four and five
gigahertz which are the two main ones on
the 2.4 gigahertz often the channels
overlap thankfully on a 5 gigahertz lee
jones as much oh and then so you know
it's just radio and ultimately it
modulates digital data over those radio
waves a bit beyond open this talk but
it's really cool stuff ok so monitoring
first promiscuous mode um can I see a
show of hands of like who's done some
kind of like Wi-Fi hack can reuse
promiscuous mode ok good number of
people and how many have done monitor
mode all right fuel us and hopefully all
the people could have that monitor mode
of the difference but just to explore
the difference between monitor modem
promiscuous locust and personally I got
into this I didn't quite understand it
so promiscuous mode ultimately you're
connected to a certain access point and
SSID and you know typically your Wi-Fi
too by the way normally works um it says
ok if I see a packet that's address to
my mac address then process it otherwise
this card and promiscuous mode based it
just says I don't care who is the dress
to I want it um and so you can get all
the packets on a given SSID but
something to keep in mind when you can
end when you connect to a wireless
network you're actually getting a
cryptography key and that way you can
actually read all of the packets to an
extent at the data access layer you can
read the package and if you're outside
the network you don't have that
encryption event at cryptography key um
so you can only look at traffic from the
network that you or attached to
a promiscuous mode now in monitor mode
that's different in monitor mode you
don't connect to any Wi-Fi access point
instead you're just getting the wrong
you're driving the raw radio data out of
the air now something to keep in mind
about this is again and it said it's
encrypted so anytime you're using any
kind of you know um SSID if you connect
to it it encrypts the data and people
out time to network can't read it unless
they have getting stuff but anyway a
mantra mode we're just getting the
encrypted data along with the meta data
so how is that useful to us um when I
need to monitor mode all the time does
it's encrypted um so here's the stuff
that you know I thought oh that you kind
of get out of monitor mode raw 802 10 11
captures you can implicitly at the time
a packet with sense of course just it
some time that you receive it you can
get the mac address that it was from the
mac address that it's to the bssid which
is the access points not the dress
basically the SSID and sometimes the
essid but not getting into that and you
can also get the encrypted data I which
probably won't be useful to you unless
you can decrypt it um and you also
because it's a radio your wireless card
actually can see the signal string of
any given message that receives so
implicitly and potentially to do some
level of physical proximity from that um
you know what can you do with as well as
I pointed out you know you can monitor
security cameras and see when they see
motion potentially you can you can have
movements of people you can also
determine you know which which Wi-Fi art
which Wi-Fi devices are associated with
any given access point because you can
see they're talking to each other and
sending data packets and there's
actually another night admission you get
there's like management packages control
tactics and data back so you can
actually see it's just sending data and
I should also point out that this
tracking of people's movements um it was
one of the things that came out so did
but the government is actually using
this track people and it's very very
simple to do you know keep in mind
sitting out any package you're on
connecting anything you're simply
constantly monitoring radio waves over
with you know head you they get um you
can also if you go into if you actually
send data in raulito 2011 you can do
other things like to do all the tasks
and we're not going to get into that in
this one so anyway how do you how do you
do these raw 80 shoot 11 capture it and
monitor mode so i want to show you this
from the linux perspective using Holly
um and just I want to show you the wrong
commands so you know it's our nominees I
thing to see what's your wireless
devices and you know let's say wlan0
we're trying to use you can use the ilu
deff command to get its physical
interface ID you can then run IW this
man here to add a basically to add a
monitor device on that for that physical
device to leave yolan and up the new one
and then you have a wireless device
beacons and monitor mode on you can they
if you do i fire and take again you'll
see or monitor device and then something
to be aware of is again it's a radio
it's just a radio and radios can't
actually receive at every frequency
simultaneously and that's why there's
channels and when you're in raw mode
it's actually a responsibility to set a
channel to set the frequency of the
radio which is really cool I think you
can lie set it to the designees channels
although theoretically drive your driver
but anyway so you said it's to the
channel you can do IWC that it is indeed
the channel that I said and from there
you can catch your raw frames basically
using any key tap program so it can be
TCP dump it can be wider shark I like to
use JP myself that it's a python library
and it's two commands like you know
importance can be stuff and then just
uses unit normal sense and you get the
raw data frames just like that you can
then analyze them grab out things like
mac address that it's from events too
and that's basically how you do it um
now I'm kind of in this kind of part of
this talk but I actually developed a
little tool to help with this call
tracker gender which you see it up
anyway I told time for gender and it's a
Python program that's based on JP umm it
only runs on linux for now um to install
it it hit the tip install its Python 30
me um and it makes less you do a lot of
the things that I wanted to do which are
these tracking and you know tracking
things as well as some functionality to
map what it surrounds me you know what
what what what radio what devices are
sending radio waves that I can see and
how are they associated you know what
what devices are on what s IDs so we can
do all of that with a malfunction ality
you can see an example command that like
that I used to track a mac address like
this was 40 on the security camera
directly um also um some running it
looks like is um I am tracking all of
you right now if you have a wireless
device that is on I probably have your
mac address
as true and dispersing is actually a
very good way to voice but just show you
how what he also does amount looks like
you know maybe just list a bunch of BS
SIDS and then the SSID that so scenes
with them and the various MAC addresses
that are associated hit on a channel
channel basis so you know channel 44
channel 40 etc now if you'd like to if
you'd like me to leave your mac address
you can just give me your name and the
mac address I don't work from the other
um so anyway that that's kind of tracker
jacker it's um go again it's on um it's
on hi hi so that's like you could
install it and github code is publicly
available you could probably just google
for it um a couple notes on the
environment um so you notice I have a
pretty serious looking Wi-Fi adapter
here it's really ugly but the reason I
have this one is because it's a dual
band so I can capture it in both 2.4
gigahertz and fighting hurts most of the
channels most of the stuff I've done has
been in kali linux running on a PM and
it works best if you run with an
external adapter a lot of internal
adapter especially for using in the vm
you can't put them in monitor mode so
that's a big reason and plus you
actually get much farther week with an
external adapter all of them also as far
as wireless devices I've tested a few um
this is this is a nice point it's like
really keeping up their King bucks on
amazon um so this one looks over works
well i'll try to post keynotes someone
line outside 405 anti-trans website um
this is a good one um i tried another
one by the tp-link that didn't work very
well if it's newer drivers are out there
yet a lot of basically a lot of kiki
links at a lot especially a lot of
alphas were the Alpha brand or really
well I have so anyway if you take aways
Wi-Fi is just radio it's just a radio as
a physical layer and it's really
interesting when you think about that
and all the things you could potentially
do um it's trivial to track Wi-Fi
devices in monitor mode um and
surprisingly interesting information can
be obtained even though the packets are
encrypted looking looking just at the
the metadata of course I introduce new
tool tracker jacker it's very much alpha
stage by the way but I'm adding new
functionality hopefully we'll get mad
and support if it's possible sometime
soon um and how to not be trapped if
you're traveling and you don't want the
government or some other organization
track your movements it's probably best
to just turn off your Wi-Fi um some
devices actually I phones are very good
about this um and when they are not
attached to a particular at this point
they actually randomize the mac address
for you which helps to not be tracked
which is really great so you can use an
iphone or turn off your Wi-Fi um but
keep in mind this doesn't mitigate
distractibility completely because
ultimately when you when you attach to a
local network that you've been part of
um you have it actually uses your real
mac address um and you know that's
that's one thing is really interesting
to me about a lot of this wireless
security stuff compared to like binary
exploitation is that so you know if you
like if you do find a bug and binary um
that can be useful but it's ultimately
bug that can be patched
nyr the security a lot of the
vulnerabilities didn't find our are
systemic and they are not easily touched
you know I mean if you want to I mean
there's nothing there's almost nothing
no way to mitigate a lot of these attack
vectors so that's really interesting so
I thank you and I guess we have a few
minutes so if anyone has any questions
yes even if there's any wireless
adapters but purpose radar detector
detector style listening see if anyone's
in monitor mode um as far as I know when
you're a monitor mode you simply don't
give off an ERF so the entrance it's not
even physically possible for some kinds
of radio they radar detectors emit a
signal that you can listen to so if you
did if you there might be someone with
radio backscatter but you're getting
really esoteric is everyone okay so
another one any other questions up get
the album I think it was the same model
yeah I kind of different kids get in it
maybe is a few much more in version 2 it
would be lifted if you found any that
anymore said one of those chips yeah
yeah so that if you make the one a
little white one um basically the new
version has a chipset it's also dual
band which is why I bought it because
I'd like sweet you can do two point four
and five yrs it turn out to be obtained
I have any not working yet I just got a
two days hey hey hey they didn't change
the model number so it's not the same
model of it which is good okay any
others yes I'm basically uh I right into
the response software
I mean I very correlated unless we do
you want to go on here security camera
um it's just fun like I mean I don't
think I'm a control freak but it's
really close to being able to control
stuff myself with computers in physical
world it's like magic it's like its cool
the right stuff and approach in a
computer and runs on the computer and
make this world but it's cool when you
get outside of the computer so that's
that NZ