1
00:00:19,220 --> 00:00:21,900
No, sorry, the speaker can't be moved.

2
00:00:23,200 --> 00:00:25,700
Sorry about that.

3
00:00:27,960 --> 00:00:29,800
Yeah, we have audio.

4
00:00:29,840 --> 00:00:30,620
Cool.

5
00:00:30,980 --> 00:00:35,200
Okay, so, my name is Dean Pierce, this is Brandon Edwards.

6
00:00:35,200 --> 00:00:37,800
We're undergraduates at Portland State University.

7
00:00:37,900 --> 00:00:42,660
And we're going to be talking about...

8
00:00:43,200 --> 00:00:44,020
Alright.

9
00:00:45,280 --> 00:00:46,600
My associate here...

10
00:00:46,600 --> 00:00:49,160
Yeah, you got that?

11
00:00:49,360 --> 00:00:50,840
Yeah, I can hear myself.

12
00:00:51,540 --> 00:00:53,360
Everyone can hear me alright?

13
00:00:54,260 --> 00:00:56,400
Okay, how about now?

14
00:00:56,800 --> 00:00:57,720
Hear me alright?

15
00:00:58,480 --> 00:00:59,420
Alright.

16
00:01:00,380 --> 00:01:03,360
We're here to talk on basically MAC...

17
00:01:03,360 --> 00:01:05,940
Well, Authenticated Wireless Networks of all sorts.

18
00:01:06,800 --> 00:01:09,940
As he introduced ourselves, we're students at Portland State.

19
00:01:13,080 --> 00:01:22,400
Okay, basically what we're calling an authenticated network is a network that you need to log in with a username and password.

20
00:01:22,400 --> 00:01:26,640
So, such like at a lot of universities now and stuff like that.

21
00:01:26,640 --> 00:01:29,200
Some people call it Captive Portal.

22
00:01:29,920 --> 00:01:33,280
Yeah, there's many different implementations of it.

23
00:01:33,280 --> 00:01:35,480
Like, there's open source ones like NoCat and whatever.

24
00:01:35,480 --> 00:01:42,860
And there's also a lot of other different companies that are coming out now that are implementing these Captive Portal systems.

25
00:01:43,380 --> 00:01:47,220
And they all essentially work in the same manner.

26
00:01:48,420 --> 00:01:54,320
Okay, so the one we're going to focus on for partially legal and partially just reference use is NoCat.

27
00:01:54,320 --> 00:01:55,760
I don't know if any of you are familiar with it.

28
00:01:55,760 --> 00:02:04,920
Basically, NoCat is an open source or at least free Captive Portal style authenticated network commonly used for wireless networks in cafes and universities.

29
00:02:05,400 --> 00:02:07,700
It's used in schools, restaurants, community networks.

30
00:02:07,700 --> 00:02:08,960
It's used all over the place.

31
00:02:09,040 --> 00:02:12,200
And that's what we are going to focus our talk on for the tool.

32
00:02:14,300 --> 00:02:16,980
All right, let's go ahead and go into how this actually works.

33
00:02:16,980 --> 00:02:21,200
So, we need to analyze how authentication works to realize how we're going to bypass it.

34
00:02:22,640 --> 00:02:33,120
If you look at the login process, what a user will have to do on one of these authenticated wireless networks, they'll obviously DHCP for an IP because they won't have predestined information about the network.

35
00:02:33,460 --> 00:02:39,640
They'll submit HTTP requests off and over SSL to a login page to log in.

36
00:02:39,880 --> 00:02:50,220
And during authentication, if a username and password is accepted, their MAC and IP address are then added to an allow list on the firewall to forward traffic out to the internet.

37
00:02:50,220 --> 00:02:51,940
This is all pretty common stuff.

38
00:02:53,360 --> 00:02:55,700
It basically just forwards it through the gateway.

39
00:02:59,000 --> 00:03:06,320
So, to look at how that has to be bypassed, you just have to analyze what the authentication is looking at.

40
00:03:06,320 --> 00:03:13,040
And basically, for methods of bypassing to work, it'll have to be on a non-switched or wireless network, which is what you guys are here for.

41
00:03:13,120 --> 00:03:17,080
And there has to be a currently or an about to authenticate user.

42
00:03:17,080 --> 00:03:25,180
So, someone who is either sending user information, already has sent user information, has been authenticated, and is routing through the gateway to get access to the internet.

43
00:03:26,460 --> 00:03:29,900
Basically, there's three basic steps to bypass this authentication.

44
00:03:29,900 --> 00:03:36,720
You identify the MAC address of a target user, the IP address, and you set your route once you've spoofed as those MAC and IP.

45
00:03:37,420 --> 00:03:42,560
And to the gateway, or to the authentication system, it looks as if you've already authenticated.

46
00:03:43,380 --> 00:03:48,460
It's not new, but it can become a little trickier than it seems to gather this information, which we'll go into.

47
00:03:52,040 --> 00:04:04,220
So, essentially, the program that we wrote, what it does is it creates a database, and it gathers information on the current network, and it just watches the data flowing by.

48
00:04:04,220 --> 00:04:13,740
And it's kind of interesting because it's all completely silent, if you want it to be, where you don't actually have to send out any data on your network card to be able to gather enough information to spoof yourself onto the network.

49
00:04:14,180 --> 00:04:22,040
And essentially, it just gathers the IP address and the MAC address of anyone that's using the internet, or whatever.

50
00:04:22,040 --> 00:04:34,900
And when the program starts out, it spawns three threads that search for TCP, UDP, and ARP packets, and then it dissects them as they come in, and then adds the information to the database as it comes by.

51
00:04:35,280 --> 00:04:46,580
So, once you've gathered enough targets, or you've gathered enough information to spoof yourself onto the network, you can use a spoof command that lets you spoof the identity of whatever user.

52
00:04:46,580 --> 00:04:56,620
And, yeah, if the target was authenticated, then you'll also be authenticated, so you can bypass, just like your unauthenticated user.

53
00:04:58,740 --> 00:05:04,640
So there's some very basic commands for the pickup line program, which is what we named it.

54
00:05:05,000 --> 00:05:18,960
And when you start out the... it's a command line program, so when you start it out, it gives you a user prompt, and then you type start, and then it spawns off the three threads that are sniffing, and then you'll start seeing information coming in, it'll just print it off as it goes,

55
00:05:18,960 --> 00:05:35,840
and then once you've started to gather some information, you can type list to see all the targets that are available, and then once you think you have a target that you want to use, you use the spoof command to pick a target, and then you just copy all of their information,

56
00:05:35,840 --> 00:05:41,240
and , like, you know, the IP address and the MAC address, and you go through the gateway, and then you're on the network.

57
00:05:41,240 --> 00:05:43,760
And then the exit command will exit the program.

58
00:05:45,500 --> 00:05:48,220
Okay, so it's...

59
00:05:48,220 --> 00:06:04,560
basically, there aren't really many alternatives to the authenticated wireless networks that are in place, and I say that because, as Dean believes, if you're in any sort of wireless network, you're shouting across a room, and any way you try to cover that,

60
00:06:04,560 --> 00:06:05,820
it's just not going to work.

61
00:06:05,820 --> 00:06:11,220
So if you say, I'm someone, and someone else says, I'm that same someone, it's going to work.

62
00:06:11,220 --> 00:06:12,920
They're going to be recognized.

63
00:06:13,140 --> 00:06:15,740
Wireless is just inherently insecure for that reason.

64
00:06:16,440 --> 00:06:18,800
Hotspots are considered to be a gamble for that.

65
00:06:19,000 --> 00:06:30,140
I'm quoting that from a security professional who works with wireless networks in the corporate field, and he's gone to implement similar methods, and he's examined other things, and there's...

66
00:06:30,140 --> 00:06:40,180
I mean, professionals will say it, hackers will say it, there's really not much that can be done to secure these, so some might say, well, what if you add encryption, but that takes out the stupid end user who wants to go to Starbucks, plug in his laptop,

67
00:06:40,180 --> 00:06:41,360
and just start using.

68
00:06:42,640 --> 00:06:44,840
There's variations of these authenticated networks.

69
00:06:45,040 --> 00:06:47,760
This tool will work on all of them, or most of them.

70
00:06:47,860 --> 00:06:50,140
There's agreement of use policy authentication.

71
00:06:50,140 --> 00:06:57,500
Basically, those are free networks you can go to, say, yes, I agree, I will not hack through the network with this access, and they'll let you get on.

72
00:06:57,820 --> 00:07:01,460
And so, I mean, this tool will bypass you having to agree to that if you really want.

73
00:07:01,460 --> 00:07:12,880
There are ones that use user path authentication, which is the main method we've been describing, and the tool will observe the traffic, steal the information, figure out the route, and set it.

74
00:07:13,420 --> 00:07:15,200
And there's variations of that, though.

75
00:07:15,200 --> 00:07:18,800
Certain networks will use just MAC, certain ones will use MAC and IP.

76
00:07:19,040 --> 00:07:33,200
And it becomes interesting because if you go to, say, a, you know, college network that has this, you can have the security, they did not design it with security in mind, and this is demonstrated because if they only authenticate based off of the MAC address,

77
00:07:33,200 --> 00:07:39,800
that means several computers could spoof as one MAC and each computer have a separate IP address and they all use the network.

78
00:07:39,800 --> 00:07:45,240
It's as if nobody seems to even notice that their access point's being completely abused.

79
00:07:45,760 --> 00:07:51,860
So it's, you know, there's multiple ways of doing it and there are alternatives, but wireless is just inherently broken.

80
00:07:52,900 --> 00:07:53,780
Okay.

81
00:07:53,780 --> 00:07:59,520
This is a basic demonstration, a couple screenshots of program in action.

82
00:07:59,700 --> 00:08:07,840
Essentially, you execute the pickup line binary and you get, you know, the prompt and it says the version number.

83
00:08:07,840 --> 00:08:14,440
The current version number is 0.4.5 and it just assumes that you want ETH1.

84
00:08:14,440 --> 00:08:17,440
You can use the interface command to change which interface you want to use.

85
00:08:17,440 --> 00:08:20,220
And you can type help if you want a list of commands, whatever.

86
00:08:21,240 --> 00:08:28,500
And then you say start and it gives a thing that says starting the sniffer and then it just starts gathering data on the network.

87
00:08:28,500 --> 00:08:31,800
Right here, the first thing it got was the gateway MAC address.

88
00:08:31,800 --> 00:08:38,380
And you probably got that from seeing multiple TCP sessions from different people and you can...

89
00:08:38,380 --> 00:08:46,740
If there's a common MAC address in, you know, user source MAC addresses, then you can pretty much verify that that's going to be the gateway.

90
00:08:46,900 --> 00:08:49,260
And then it starts adding some targets.

91
00:08:50,000 --> 00:08:54,440
And these are people that are just, you know, logged onto the network, checking email or whatever.

92
00:08:54,740 --> 00:09:02,320
And then after a while, it gathers the gateway IP which can be used to, you know, you need to route through.

93
00:09:03,460 --> 00:09:08,660
And then once you've gathered some information, you use the list command and when you do list, it looks like this.

94
00:09:08,660 --> 00:09:12,400
It says 1, 2, 3, and it has the IP addresses that you can select from.

95
00:09:14,560 --> 00:09:18,360
And then what you just do is you use the spoof command and then it asks you what target you want.

96
00:09:18,460 --> 00:09:20,360
And then you say target number 3.

97
00:09:20,620 --> 00:09:28,340
And then, you know, 1-3-1-2-5-2-2-5-5-1-7-8 which is an IP address on the wireless network at Portland State University.

98
00:09:29,380 --> 00:09:29,820
And...

99
00:09:34,900 --> 00:09:36,400
It's not actually a window.

100
00:09:36,400 --> 00:09:38,380
It's just a screenshot, unfortunately.

101
00:09:38,380 --> 00:09:38,980
Yeah.

102
00:09:39,960 --> 00:09:41,980
We couldn't get a demo, I'm sorry.

103
00:09:42,240 --> 00:09:42,760
Yeah.

104
00:09:43,480 --> 00:09:44,920
Sorry about that.

105
00:09:45,880 --> 00:09:46,320
And...

106
00:09:46,820 --> 00:10:08,820
Yeah, so then once you say spoof and it brings down the interface spoofs the MAC address then it brings up the interface to a certain IP address and then we've found out recently that, you know, there's a lot of different captive portals that'll use different netmasks and so a lot of times it doesn't automatically detect it but in this case it does.

107
00:10:09,100 --> 00:10:13,980
And it can it'll also grab netmasks out of DNS requests, it'll notice those.

108
00:10:14,220 --> 00:10:20,260
But you haven't gathered the netmask at this point, so it'll just guess it anyway.

109
00:10:20,260 --> 00:10:29,560
And then it'll set the route through the 1-3-1-2-5-2-200.10 which is the local router on the wireless network there.

110
00:10:30,080 --> 00:10:31,480
And that's essentially it.

111
00:10:31,480 --> 00:10:34,920
And then you're online you can, I don't know, browse Google or do whatever.

112
00:10:35,020 --> 00:10:39,080
So, yeah, the attack can seem trivial if you're doing it.

113
00:10:39,080 --> 00:10:53,120
And it can easily be done by hand, but there are things that do make it a little trickier, like determining the route particularly if you want to make it a silent attack without actually DHCP-ing to that server, therefore not giving out any of your personal information like your MAC address.

114
00:10:54,120 --> 00:11:02,300
And keys with that is that, you know, this tool will watch traffic go by and determine not just a target for you, but a route as well, which is beneficial.

115
00:11:02,300 --> 00:11:06,440
That entire demonstration that was shown didn't send out a single packet the whole time it was there.

116
00:11:06,440 --> 00:11:08,040
It doesn't even need an IP address.

117
00:11:08,340 --> 00:11:15,180
So yeah , all you need to do is bring up the interface and it'll, you know, sniff and get all the information it needs.

118
00:11:15,900 --> 00:11:23,380
And right now , okay, the required library is libpcap , so that, you know, it can sniff and then pthreads for the threading.

119
00:11:24,160 --> 00:11:26,520
And then, yeah, we...

120
00:11:26,520 --> 00:11:34,020
if anybody wants to, like, port it to OS10 or, like, to Windows or anything like that, we'd be glad to help out and we would love for you to help out.

121
00:11:34,160 --> 00:11:36,140
And right now it's written for Linux.

122
00:11:36,140 --> 00:11:38,340
It'll work in most Linux environments.

123
00:11:38,340 --> 00:11:41,520
It'll probably work in a lot of BSD environments or whatever.

124
00:11:41,960 --> 00:11:44,880
And there's our contact email addresses.

125
00:11:45,540 --> 00:11:49,400
piercede at pdx.edu and... okay.

126
00:11:49,400 --> 00:11:52,140
And then Brandon at datatactic.com.

127
00:11:52,800 --> 00:11:59,760
And if you want to download the latest version of the program, it's at that URL there that some of you might be able to see.

128
00:11:59,900 --> 00:12:02,780
It's at web.pdx.edu.

129
00:12:02,780 --> 00:12:03,700
Yeah, there.

130
00:12:05,180 --> 00:12:08,760
piercede slash cs.pickup at html.

131
00:12:08,800 --> 00:12:11,200
Those are... okay.

132
00:12:11,300 --> 00:12:15,620
Is there any questions or any thing interesting?

133
00:12:15,620 --> 00:12:16,340
Yeah.

134
00:12:19,180 --> 00:12:23,260
Do you know what the authentication methods are for that or how deep that gets?

135
00:12:37,200 --> 00:12:38,600
If it's a user...

136
00:12:42,960 --> 00:12:49,320
If it does authentication by adding a MAC to the IP tables allow list to route traffic, then yes, this will work on it.

137
00:12:49,320 --> 00:13:00,080
I mean, basically any implementation that doesn't do... I mean, any public implementation of such authentication will be broken simply because wireless... unless you use encryption, it's gonna be...

138
00:13:00,080 --> 00:13:00,540
Mm-hmm.

139
00:13:03,600 --> 00:13:04,320
They broadcast...

140
00:13:04,320 --> 00:13:06,260
The information happens when they stream...

141
00:13:06,260 --> 00:13:11,240
When they go to any website, the information is already... is shot out in the air because it's wireless.

142
00:13:11,240 --> 00:13:19,080
So if you can intercept it, you can figure out that they've been authenticated and what their route is for, you know, using...

143
00:13:19,080 --> 00:13:19,960
What was that?

144
00:13:21,640 --> 00:13:22,220
Right.

145
00:13:22,220 --> 00:13:22,500
Right.

146
00:13:22,500 --> 00:13:24,340
It's the user that you target, really.

147
00:13:24,660 --> 00:13:26,080
Yeah, we have also a question...

148
00:13:27,420 --> 00:13:28,140
Anyone?

149
00:13:28,140 --> 00:13:29,260
Yeah, question?

150
00:13:34,800 --> 00:13:44,740
You would think that and on our testing that hasn't happened in actual switch networks with Windows, Windows will pop up and say yeah, there's another person using this IP address.

151
00:13:44,740 --> 00:13:55,660
But due to TCP using individual sequence numbers for each connection, we never get any collisions with that and for some reason over wireless networks, Windows never seems to notice or Linux or BSD never notice that they don't even get kicked off.

152
00:13:55,660 --> 00:13:57,120
They just share the connection with you.

153
00:13:57,120 --> 00:13:58,560
They pay for it, you use it.

154
00:13:58,560 --> 00:13:59,160
Mm -hmm.

155
00:14:00,880 --> 00:14:03,540
Ah, it figures out the route by watching the packets.

156
00:14:03,540 --> 00:14:10,500
I mean, he can tell you more of the logic behind that, but it watches the packet go through and at the head of every packet there's the MAC address of the gateway.

157
00:14:10,520 --> 00:14:14,820
We snag that gateway and then we ARP resolve the gateway to the IP to set our route.

158
00:14:14,820 --> 00:14:20,480
Yeah, there's a lot of information in the ARP packets to travel around to, so it's pretty useful.