{"id":99600,"date":"2014-03-31T14:01:03","date_gmt":"2014-03-31T12:01:03","guid":{"rendered":"http:\/\/mybroadband.co.za\/news\/?p=99600"},"modified":"2014-03-31T14:17:08","modified_gmt":"2014-03-31T12:17:08","slug":"wi-fi-hacking-quadcopter-from-sa-security-firm","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/99600-wi-fi-hacking-quadcopter-from-sa-security-firm.html","title":{"rendered":"Wi-Fi hacking quadcopter from SA security firm"},"content":{"rendered":"

Wi-Fi, as it is implemented in smartphones and other mobile devices today, has a number of security vulnerabilities that could make it easy to track, and even intercept data from a device.<\/p>\n

To raise awareness about these problems, SensePost, an information security firm headquartered in South Africa, built Snoopy.<\/p>\n

Snoopy developer Glenn Wilkinson describes it as a \u201cdistributed tracking, profiling, and data interception framework\u201d. Currently it shows what kind of mischief is possible with Wi-Fi, but Wilkinson said that since Snoopy is modular it could easily be extended to Bluetooth, RFID, and NFC.<\/p>\n

Wilkinson, a Zimbabwean working out of SensePost\u2019s London offices as lead security analyst, has been working on the technology with his colleagues since 2012, when he and Daniel Cuthbert gave a talk at 44con<\/a> about the privacy implications of the vulnerabilities in Wi-Fi.<\/p>\n

How your smartphone blabs about where you\u2019ve been<\/h3>\n

To understand what Snoopy does, SensePost\u2019s chief technology officer Dominic White said one must first have an idea of how Wi-Fi works.<\/p>\n

White explained that there are two \u201cmanagement frames\u201d Snoopy is interested in: beacons, and probes.<\/p>\n

Access points (APs) \u2013 the networking equipment to which your smartphone, tablet, or laptop wirelessly connects \u2013 send out messages called beacons on a certain interval.<\/p>\n

These beacons identify the wireless network and also help Wi-Fi connected devices avoid \u201ccollisions\u201d which occur if they send data at the same time.<\/p>\n

(For a great overview on Wi-Fi beacons, White recommended the following article: 802.11 Beacons revealed<\/a>)<\/p>\n

APs also send out probe responses, a message sent in reply to a probe request sent by a device.<\/p>\n

Together, beacons and probe responses let \u201cwardrivers\u201d (or companies like Google and Skyhook, for that matter) identify wireless networks and upload the identifying information and location of the access point to a database.<\/p>\n

Identifying information may consist of the basic service set identification (BSSID), or MAC address of the access point, as well as the extended SSID (ESSID, or just \u201cSSID\u201d for short).<\/p>\n

An example of a freely available database that contains such information is Wigle.net, which is what Wilkinson used in his demonstration of Snoopy.<\/p>\n

The other \u201cmanagement\u201d message in Wi-Fi Snoopy relies on is the probe request, which is the message devices send out to join a Wi-Fi network.<\/p>\n

These probe requests contain the ESSID of the wireless access point the device is trying to join.<\/p>\n

Where things get interesting, White explained, is that most devices actively scan for Wi-Fi networks by sending out probe requests on a regular interval for networks they have previously joined, or have been instructed to \u201cremember\u201d.<\/p>\n

By simply listening for and recording these probe requests, anyone can build up a list of Wi-Fi devices in the areas and which networks they connected to.<\/p>\n

At first this may not seem so scary, until you realise what the networks you have joined in the past may reveal about you.<\/p>\n

\"Snoopy<\/a>

Snoopy Maltego showing locations of access points<\/p><\/div>\n

Don\u2019t manually turn off your Wi-Fi? You probably should<\/h3>\n

To demonstrate what can be done with Snoopy, Wilkinson wrote a number of \u201ctransforms\u201d for Maltego, a tool developed by another South African company, Paterva.<\/p>\n

Wilkinson explained that Maltego lets you visualise data and the relationships between the various entities you might be analysing.<\/p>\n

He showed that you can select multiple Snoopy sensors (called \u201cdrones\u201d), then simply right click to activate a transform and bring up a list of Wi-Fi devices in the vicinity of those sensors.<\/p>\n

From there you can get the networks all those devices have been probing for.<\/p>\n

Another transform uses the public Wi-Fi access point database Wigle.net to geolocate the access points.<\/p>\n

If your access point at home or work has a unique name and a \u201cwardriver\u201d had uploaded its details to Wigle.net, then it could very well be used to pin-point exactly where the user of a particular device works or lives.<\/p>\n

This data can also be used to analyse whether devices (and perhaps people) were in the same place at one time or another.<\/p>\n

Another Maltego transform lets you easily perform this analysis by right clicking on a location and looking up all the devices your sensors have seen that have been at that place.<\/p>\n

\"Snoopy<\/a>

Snoopy Maltego showing website info that can be intercepted<\/p><\/div>\n

From Wi-Fi tracking to hacking<\/h3>\n

While some may not be too concerned about the privacy implications of the vulnerabilities in Wi-Fi, the potential to exploit them for data interception (\u201chacking\u201d) purposes should worry everyone that uses the technology.<\/p>\n

Armed with the knowledge of which Wi-Fi networks you are probing for, a hacker can pretend to be that Wi-Fi network and trick you into connecting to them.<\/p>\n

White said that these attacks are called \u201ckarma\u201d-type attacks and are also nothing new \u2013\u00a0dating back to at least 2005.<\/p>\n

Wilkinson demonstrated that with Maltego, Snoopy can see which services a device is logged into and hijack your session, or exploit vulnerabilities such as SSL degradation to execute man-in-the-middle attacks.<\/p>\n

In simple terms, a hacker could get access to everything from your Facebook to sensitive data you\u2019re sending out over the Wi-Fi network.<\/p>\n

If your browser is not up-to-date it is even possible to gain access to your PayPal account, Wilkinson said.<\/p>\n

White said that modern browsers and websites that use HTTP Strict Transport Security (HSTS) are protected from this kind of attack.\u00a0Most of Google\u2019s authenticated sites are protected in this way, White said.<\/p>\n

As an example of the contrary, Wilkinson said that companies like Facebook have to stop sending their authentication cookies out over unencrypted channels.<\/p>\n

Drone-mounted Wi-Fi sensor<\/h3>\n