802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ......

41
802.11 Massive Monitoring Andrés Blanco - Andrés Gazzoli

Transcript of 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ......

Page 1: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

802.11 Massive Monitoring Andrés Blanco - Andrés Gazzoli

Page 2: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

Outline

• Introduction

• Approaches

• The USB Dilemma

• Distributed System

• WiWo

• Questions

Page 3: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

Introduction [ Who is this talk for? ]

Page 4: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

Introduction [ Who is this talk for? ]

Page 5: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

Introduction [ Who is this talk for? ]

Page 6: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

Introduction [ Who is this talk for? ]

Page 7: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

Introduction [ Who is this talk for? ]

Page 8: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

Introduction [ goals ]

• Monitor

• Channel hopping traffic (such as WiFi-Direct)

• Access Points with auto channel selection

• Multiple Access Points on different channels

• Stations

• Inject frames on multiple channels

Page 9: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

Approaches [ first approach ]

Page 10: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

Approaches [ second approach ]

Page 11: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

Approaches [ wireshark ]

Page 12: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

Wireless Interface

DHCP

DNS

HTTP

Probe Request

Wireless Interface

DHCP

DNS

HTTP

Probe Request

Approaches [ station profiler ]

… Profiler

Page 13: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

Demo [ second approach ]

Wireless Network Traffic could be display during the demo. Please disable Wi-Fi if you don’t want to be part of it.

Page 14: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

The USB Dilemma [ scalability ]

Page 15: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

The USB Dilemma [ scalability ]

Page 16: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

The USB Dilemma [ bus saturation ]

Page 17: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

Wireless Interface

USB Bus

Filter

Kernel User Space

The USB Dilemma [ bus saturation ]

Firmware

Page 18: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

The USB Dilemma [ bus saturation ]

Page 19: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

The USB Dilemma [ bus saturation ]

Page 20: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

The USB Dilemma [ non-removable devices ]

Bluetooth Webcam

Page 21: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

The USB Dilemma [ non-removable devices ]

Page 22: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

The USB Dilemma [ available buses ]

USB Port 1

Page 23: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

The USB Dilemma [ available buses ]

USB Port 2

Page 24: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

The USB Dilemma [ available buses ]

USB Port 3

Page 25: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

The USB Dilemma [ power issues ]

Page 26: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

USB Bus

Filter

Kernel User Space

The USB Dilemma [ the option? ]

Wireless Interface

Firmware

Page 27: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

Worker Ethernet

Filter

Manager

Distributed System [ scalability ]

Page 28: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

Distributed System [ scalability ]

Page 29: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

Distributed System [ scalability ]

Page 30: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

WiWo is a distributed 802.11 monitoring and injecting system that is designed to be simple and

scalable, in which all workers (nodes) can be managed by a Python framework.

WiWo [ introduction ]

Page 31: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

WiWo [ workers ]

CPU Atheros AR7240@400MHz

RAM 32MiB

Flash 4MiB

Network 1 x 100MBit

TP-Link TL-MR3020

Page 32: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

WiWo [ workers ]

CPU Atheros AR9344 @ 560 MHz

RAM 128MiB

Flash 8MiB

Network 4 x 1000MBit

TP-Link TL-WDR3600

Page 33: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

WiWo [ workers ]

CPU Atheros AR7240 @ 400MHz

RAM 32MiB

Flash 4MiB

Network 1 x 100MBit

TP-Link TL-MR3040

Page 34: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

WiWo [ features ]

Manager

Lookup for workers

Get worker wireless interface information

Set worker wireless interface channel

Start monitoring on a workers wireless interface

Inject frame on a wireless interface of a worker

Page 35: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

WiWo [ manager architecture overview ]

Manager Manager Service

Data Frame Handler

Management Frame Handler

Page 36: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

WiWo [ ethernet ]

• Plug n’ Play

• Silence on the wire

• Avoid overhead to keep fragmentation low

Page 37: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

WiWo [ usage ideas ]

• IDS/IPS

• Traffic analysis

• Device Tracking

• Protocol analysis

Page 38: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

WiWo [ hardware PoC ]

Page 39: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

WiWo [ demo ]

Wireless Network Traffic could be display during the demo. Please disable Wi-Fi if you don’t want to be part of it.

Page 40: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

Future Work

• IP support

• Build more OpenWRT firmware’s

• Code more examples

• Interaction with other tools

Page 41: 802.11 Massive Monitoring - Paper Conf/Defcon/2015/DEFCON … · managed by a Python framework ... DEF CON 23 Presentation ... Subject: DEF CON 23 Presentation Keywords: DEF CON Conference,

Questions?

https://github.com/CoreSecurity/wiwo

https://twitter.com/6e726d

[email protected] [email protected]

https://twitter.com/rcpota


Starting the Avalanche - DEF CON CON 25/DEF CON 25 presentations/DEF… · Starting the Avalanche: Application DoS ... DEFCON, Speeches, Hacking, Hackers, Hacker Conference, Computer

Starting the Avalanche - DEF CON CON 25/DEF CON 25 presentations/DEF… · Starting the Avalanche: Application DoS ... DEFCON, Speeches, Hacking, Hackers, Hacker Conference, Computer

DEF CON 24 Hacking Conference CON 24/DEF CON 24 workshops/DEFCON-24...Embrace other people’s genius ... Start next topic at top of the hour ... info@hackingdojo.com HackingDojo.com

DEF CON 24 Hacking Conference CON 24/DEF CON 24 workshops/DEFCON-24...Embrace other people’s genius ... Start next topic at top of the hour ... [email protected] HackingDojo.com

Unboxing Android: Everything you ... - DEF CON Media … CON 25/DEF CON 25 presentations/DEFCON...For each /proc/ check that /proc//cmdline does not contain gdb, gdbserver,

Unboxing Android: Everything you ... - DEF CON Media … CON 25/DEF CON 25 presentations/DEFCON...For each /proc/ check that /proc//cmdline does not contain gdb, gdbserver,

DEF CON 25 Hacker Conference - DefCon Media Server CON 25/DEF CON 25 presentations/DEF… · functionality = self.checklist["Functionality"] ... Manually add ancillary data (pentest/other

DEF CON 25 Hacker Conference - DefCon Media Server CON 25/DEF CON 25 presentations/DEF… · functionality = self.checklist["Functionality"] ... Manually add ancillary data (pentest/other

Glitches cause stitches! - DEF CON CON 25/DEF CON 25 presentations/DEFCON...Breaking BitcoinHardwareWallets Glitches cause stitches! Josh Datko Chris Quartier Kirill Belyayev Updated:

Glitches cause stitches! - DEF CON CON 25/DEF CON 25 presentations/DEFCON...Breaking BitcoinHardwareWallets Glitches cause stitches! Josh Datko Chris Quartier Kirill Belyayev Updated:

Quantum Computers vs. Computers Security - DEF CON CON 23/DEF CON 23... · Quantum Computers vs. Computers Security @veorq — . ... Security Research, DEFCON 23, DC-23, DC23, Lockpicking,

Quantum Computers vs. Computers Security - DEF CON CON 23/DEF CON 23... · Quantum Computers vs. Computers Security @veorq — . ... Security Research, DEFCON 23, DC-23, DC23, Lockpicking,

Spread Spectrum Satcom Hacking - DEF CON CON 23/DEF CON 23 presentations/DEFCON...Motivation • Satellite hacking talks never deliver • RF world largely neglected by hacker community

Spread Spectrum Satcom Hacking - DEF CON CON 23/DEF CON 23 presentations/DEFCON...Motivation • Satellite hacking talks never deliver • RF world largely neglected by hacker community

DEF CON 23 Presentation Conf/Defcon/2015/DEFCON-23... · I Hunt Penetration Testers: More Weaknesses in Tools and Procedures Wesley McGrew, Ph.D. wesley@mcgrewsecurity.com Page !1

DEF CON 23 Presentation Conf/Defcon/2015/DEFCON-23... · I Hunt Penetration Testers: More Weaknesses in Tools and Procedures Wesley McGrew, Ph.D. [email protected] Page !1

Breaking the back end! - DEF CON CON 27/DEF CON 27 presentations/DEFCON-27-Gregory-Pickett...Epic Fail! Found Someone to Make Blank Tickets Copied Shit Ton of Objects in “Issued”

Breaking the back end! - DEF CON CON 27/DEF CON 27 presentations/DEFCON-27-Gregory-Pickett...Epic Fail! Found Someone to Make Blank Tickets Copied Shit Ton of Objects in “Issued”

Advanced Blind SQL Injection - DEF CON CON 24/DEF CON 24 workshops/DEFCON-24... · Advanced Blind SQL Injection David Caissy. 24 About the instructor David Caissy • Web App Penetration

Advanced Blind SQL Injection - DEF CON CON 24/DEF CON 24 workshops/DEFCON-24... · Advanced Blind SQL Injection David Caissy. 24 About the instructor David Caissy • Web App Penetration

Investigating PowerShell Attacks - DEF CON · Ryan Kazanciyan, Matt Hastings, Investigating PowerShell Attacks, DEFCON, DEF CON, Hacker, Security Conference, Presentations, Technology,

Investigating PowerShell Attacks - DEF CON · Ryan Kazanciyan, Matt Hastings, Investigating PowerShell Attacks, DEFCON, DEF CON, Hacker, Security Conference, Presentations, Technology,

Building a Security Operations Center - DEF CON · PDF fileBuilding a Security Operations Center Author: Josh Pyorre Keywords: Defcon, DEF CON, Hacker,Security Conference, Presentations,Technology,Phreaking,Lockpicking

Building a Security Operations Center - DEF CON · PDF fileBuilding a Security Operations Center Author: Josh Pyorre Keywords: Defcon, DEF CON, Hacker,Security Conference, Presentations,Technology,Phreaking,Lockpicking

DEF CON 24 Hacking Conference CON 24/DEF CON 24 presentations/DEFCON...The!proliferation!of!computer ... Overall,!minimal!research!has!been!conducted!regarding!the!impact!of!solid!state!drives!on!

DEF CON 24 Hacking Conference CON 24/DEF CON 24 presentations/DEFCON...The!proliferation!of!computer ... Overall,!minimal!research!has!been!conducted!regarding!the!impact!of!solid!state!drives!on!

.NET MALWARE THREAT: INTERNALS AND REVERSING … CON 27/DEF CON 27 presentations/DEFCON-27... · ALEXANDRE BORGES – MALWARE AND SECURITY RESEARCHER DEF CON USA 2019 5 9Motivationsto

.NET MALWARE THREAT: INTERNALS AND REVERSING … CON 27/DEF CON 27 presentations/DEFCON-27... · ALEXANDRE BORGES – MALWARE AND SECURITY RESEARCHER DEF CON USA 2019 5 9Motivationsto

Feds and 0Days - DEF CON CON 24/DEF CON 24 presentations/DEFCON...From Before Heartbleed to After FBI-Apple ... including the defensive agencies ... • “The default is to disclose

Feds and 0Days - DEF CON CON 24/DEF CON 24 presentations/DEFCON...From Before Heartbleed to After FBI-Apple ... including the defensive agencies ... • “The default is to disclose

BURPKIT Presented by - Paper Conf/Defcon/2015/DEFCON-23-Nadeem-Douba...• Building hacking tools • Prior work: • Sploitego (presented at DEF CON XX) • Canari (used by Fortune

BURPKIT Presented by - Paper Conf/Defcon/2015/DEFCON-23-Nadeem-Douba...• Building hacking tools • Prior work: • Sploitego (presented at DEF CON XX) • Canari (used by Fortune

Fundamentals of Leveraging PowerShell - DEF CON CON 25/DEF CON 25... · Fundamentals of Leveraging PowerShell -DEFCON Executing PowerShell •Windows PowerShell typically is not the

Fundamentals of Leveraging PowerShell - DEF CON CON 25/DEF CON 25... · Fundamentals of Leveraging PowerShell -DEFCON Executing PowerShell •Windows PowerShell typically is not the

DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27 presentations/DEFCON-27... · Sound Effects Exploring acoustic cyber-weapons Matt Wixey August 2019 All references cited

DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27 presentations/DEFCON-27... · Sound Effects Exploring acoustic cyber-weapons Matt Wixey August 2019 All references cited

DEFCON-22-Glenn-Wilkinson-Practical-Aerial-Hacking … · DEFCON 22 Presentation Materials ... Practical Aerial Hacking & Surveillance, DEFCON, DEF CON, Hacker, Security Conference,

DEFCON-22-Glenn-Wilkinson-Practical-Aerial-Hacking … · DEFCON 22 Presentation Materials ... Practical Aerial Hacking & Surveillance, DEFCON, DEF CON, Hacker, Security Conference,

Using GPS Spoofing to Control Time - DEF CON CON 25/DEF CON 25 presentations/DEFCON... · Using GPS Spoofing to Control Time Dave/Karit (@nzkarit) –ZX Security Defcon 2017

Using GPS Spoofing to Control Time - DEF CON CON 25/DEF CON 25 presentations/DEFCON... · Using GPS Spoofing to Control Time Dave/Karit (@nzkarit) –ZX Security Defcon 2017