start	end	text
19220	21900	No, sorry, the speaker can't be moved.
23200	25700	Sorry about that.
27960	29800	Yeah, we have audio.
29840	30620	Cool.
30980	35200	Okay, so, my name is Dean Pierce, this is Brandon Edwards.
35200	37800	We're undergraduates at Portland State University.
37900	42660	And we're going to be talking about...
43200	44020	Alright.
45280	46600	My associate here...
46600	49160	Yeah, you got that?
49360	50840	Yeah, I can hear myself.
51540	53360	Everyone can hear me alright?
54260	56400	Okay, how about now?
56800	57720	Hear me alright?
58480	59420	Alright.
60380	63360	We're here to talk on basically MAC...
63360	65940	Well, Authenticated Wireless Networks of all sorts.
66800	69940	As he introduced ourselves, we're students at Portland State.
73080	77140	Okay, basically what we're calling an authenticated network
77140	82400	is a network that you need to log in with a username and password.
82400	86640	So, such like at a lot of universities now and stuff like that.
86640	89200	Some people call it Captive Portal.
89920	93280	Yeah, there's many different implementations of it.
93280	95480	Like, there's open source ones like NoCat and whatever.
95480	99140	And there's also a lot of other different companies that are coming out now
99140	102860	that are implementing these Captive Portal systems.
103380	107220	And they all essentially work in the same manner.
108420	111940	Okay, so the one we're going to focus on for partially legal
111940	114320	and partially just reference use is NoCat.
114320	115760	I don't know if any of you are familiar with it.
115760	119200	Basically, NoCat is an open source or at least free
119980	121960	Captive Portal style authenticated network
121960	124920	commonly used for wireless networks in cafes and universities.
125400	127700	It's used in schools, restaurants, community networks.
127700	128960	It's used all over the place.
129040	132200	And that's what we are going to focus our talk on for the tool.
134300	136980	All right, let's go ahead and go into how this actually works.
136980	139460	So, we need to analyze how authentication works
139460	141200	to realize how we're going to bypass it.
142640	145040	If you look at the login process,
145040	148000	what a user will have to do on one of these authenticated wireless networks,
148000	149680	they'll obviously DHCP for an IP
149680	153120	because they won't have predestined information about the network.
153460	157100	They'll submit HTTP requests off and over SSL
157100	159640	to a login page to log in.
159880	163920	And during authentication, if a username and password is accepted,
163920	167960	their MAC and IP address are then added to an allow list
167960	170220	on the firewall to forward traffic out to the internet.
170220	171940	This is all pretty common stuff.
173360	175700	It basically just forwards it through the gateway.
179000	182880	So, to look at how that has to be bypassed,
182880	186320	you just have to analyze what the authentication is looking at.
186320	188860	And basically, for methods of bypassing to work,
188860	191260	it'll have to be on a non-switched or wireless network,
191260	193040	which is what you guys are here for.
193120	197080	And there has to be a currently or an about to authenticate user.
197080	200120	So, someone who is either sending user information,
200120	202340	already has sent user information, has been authenticated,
202340	205180	and is routing through the gateway to get access to the internet.
206460	209900	Basically, there's three basic steps to bypass this authentication.
209900	212780	You identify the MAC address of a target user, the IP address,
212780	216720	and you set your route once you've spoofed as those MAC and IP.
217420	220460	And to the gateway, or to the authentication system,
220460	222560	it looks as if you've already authenticated.
223380	225880	It's not new, but it can become a little trickier
225880	228460	than it seems to gather this information, which we'll go into.
232040	235600	So, essentially, the program that we wrote,
237520	239920	what it does is it creates a database,
239920	242120	and it gathers information on the current network,
242120	244220	and it just watches the data flowing by.
244220	246280	And it's kind of interesting because it's all completely silent,
246280	247300	if you want it to be,
247300	250840	where you don't actually have to send out any data on your network card
250840	253740	to be able to gather enough information to spoof yourself onto the network.
254180	257760	And essentially, it just gathers the IP address and the MAC address
257760	262040	of anyone that's using the internet, or whatever.
262040	265340	And when the program starts out, it spawns three threads
265340	269260	that search for TCP, UDP, and ARP packets,
269260	271440	and then it dissects them as they come in,
271440	274900	and then adds the information to the database as it comes by.
275280	278440	So, once you've gathered enough targets,
278440	281180	or you've gathered enough information to spoof yourself onto the network,
281180	286580	you can use a spoof command that lets you spoof the identity of whatever user.
286580	290240	And, yeah, if the target was authenticated,
291100	292720	then you'll also be authenticated,
292720	296620	so you can bypass, just like your unauthenticated user.
298740	303280	So there's some very basic commands for the pickup line program,
303280	304640	which is what we named it.
305000	308020	And when you start out the... it's a command line program,
308020	309980	so when you start it out, it gives you a user prompt,
309980	311680	and then you type start,
311680	314000	and then it spawns off the three threads that are sniffing,
314000	316780	and then you'll start seeing information coming in,
316780	318960	it'll just print it off as it goes,
318960	322540	and then once you've started to gather some information,
322540	326360	you can type list to see all the targets that are available,
326360	330660	and then once you think you have a target that you want to use,
330660	333680	you use the spoof command to pick a target,
333680	335840	and then you just copy all of their information,
335840	338140	and, like, you know, the IP address and the MAC address,
338140	341240	and you go through the gateway, and then you're on the network.
341240	343760	And then the exit command will exit the program.
345500	348220	Okay, so it's...
348220	351300	basically, there aren't really many alternatives
351300	355460	to the authenticated wireless networks that are in place,
355460	359360	and I say that because, as Dean believes,
359360	361340	if you're in any sort of wireless network,
361340	363080	you're shouting across a room,
363080	365820	and any way you try to cover that, it's just not going to work.
365820	367700	So if you say, I'm someone,
367700	370160	and someone else says, I'm that same someone,
370160	372920	it's going to work. They're going to be recognized.
373140	375740	Wireless is just inherently insecure for that reason.
376440	378800	Hotspots are considered to be a gamble for that.
379000	381100	I'm quoting that from a security professional
381100	384820	who works with wireless networks in the corporate field,
384820	388120	and he's gone to implement similar methods,
388120	390140	and he's examined other things, and there's...
390140	392000	I mean, professionals will say it, hackers will say it,
392000	393940	there's really not much that can be done to secure these,
393940	396300	so some might say, well, what if you add encryption,
396300	397800	but that takes out the stupid end user
397800	400180	who wants to go to Starbucks, plug in his laptop,
400180	401360	and just start using.
402640	404840	There's variations of these authenticated networks.
405040	407760	This tool will work on all of them, or most of them.
407860	410140	There's agreement of use policy authentication.
410140	412140	Basically, those are free networks you can go to,
412140	414620	say, yes, I agree, I will not hack through the network
414620	417500	with this access, and they'll let you get on.
417820	419520	And so, I mean, this tool will bypass you
419520	421460	having to agree to that if you really want.
421460	424300	There are ones that use user path authentication,
424300	426740	which is the main method we've been describing,
426740	429420	and the tool will observe the traffic,
429420	432880	steal the information, figure out the route, and set it.
433420	435200	And there's variations of that, though.
435200	436620	Certain networks will use just MAC,
436620	438800	certain ones will use MAC and IP.
439040	440380	And it becomes interesting because
440980	443220	if you go to, say, a, you know,
444440	446000	college network that has this,
446000	447600	you can have the security,
447600	449360	they did not design it with security in mind,
449360	451500	and this is demonstrated because if they only authenticate
451500	453200	based off of the MAC address,
453200	456300	that means several computers could spoof as one MAC
456300	458460	and each computer have a separate IP address
458460	459800	and they all use the network.
459800	461940	It's as if nobody seems to even notice
461940	465240	that their access point's being completely abused.
465760	468680	So it's, you know, there's multiple ways of doing it
468680	469580	and there are alternatives,
469580	471860	but wireless is just inherently broken.
472900	473780	Okay.
473780	476760	This is a basic demonstration,
477000	479520	a couple screenshots of program in action.
479700	482840	Essentially, you execute the pickup line binary
484100	486240	and you get, you know, the prompt
486240	487840	and it says the version number.
487840	490600	The current version number is 0.4.5
491360	494440	and it just assumes that you want ETH1.
494440	495920	You can use the interface command to change
495920	497440	which interface you want to use.
497440	500220	And you can type help if you want a list of commands, whatever.
501240	503000	And then you say start
503000	505180	and it gives a thing that says starting the sniffer
505180	508500	and then it just starts gathering data on the network.
508500	510100	Right here, the first thing it got
510100	511800	was the gateway MAC address.
511800	514200	And you probably got that from seeing
514800	516640	multiple TCP sessions from different people
516640	518380	and you can...
518380	519880	If there's a common MAC address
519880	523640	in, you know, user source MAC addresses,
523640	525360	then you can pretty much verify
525360	526740	that that's going to be the gateway.
526900	529260	And then it starts adding some targets.
530000	531820	And these are people that are just, you know,
531820	534440	logged onto the network, checking email or whatever.
534740	537900	And then after a while, it gathers the gateway IP
538420	541200	which can be used to, you know,
541200	542320	you need to route through.
543460	546040	And then once you've gathered some information,
546040	546920	you use the list command
546920	548660	and when you do list, it looks like this.
548660	550440	It says 1, 2, 3, and it has the IP addresses
550860	552400	that you can select from.
554560	555780	And then what you just do
555780	556780	is you use the spoof command
556780	558360	and then it asks you what target you want.
558460	560360	And then you say target number 3.
560620	563460	And then, you know, 1-3-1-2-5-2-2-5-5-1-7-8
563460	565100	which is an IP address
565100	566820	on the wireless network
566820	568340	at Portland State University.
569380	569820	And...
574900	576400	It's not actually a window.
576400	578380	It's just a screenshot, unfortunately.
578380	578980	Yeah.
579960	581980	We couldn't get a demo, I'm sorry.
582240	584920	Yeah. Sorry about that.
585880	586320	And...
586820	587820	Yeah, so then
588240	590280	once you say spoof and it brings down the interface
590760	591900	spoofs the MAC address
591900	593900	then it brings up the interface to
594440	595780	a certain IP address and then
597340	598120	we've found out
598120	599920	recently that, you know, there's a lot of different
601440	602200	captive portals
602200	603480	that'll use different netmasks
603480	606300	and so a lot of times it doesn't automatically detect it
606300	608820	but in this case it does.
609100	609740	And it can
609740	611920	it'll also grab netmasks out of
611920	613980	DNS requests, it'll notice those.
614220	615920	But you haven't
615920	616740	gathered the
618060	619920	netmask at this point, so it'll just guess it
619920	621940	anyway. And then it'll set the route
621940	624640	through the 1-3-1-2-5-2-200.10
624640	625580	which is the
627300	628580	local router on the wireless
628580	630360	network there. And
630360	632360	that's essentially it. And then you're online
632360	634920	you can, I don't know, browse Google or do whatever.
635020	637020	So, yeah, the attack
637020	638660	can seem trivial if you're
638660	641160	doing it. And it can easily be done
641160	642720	by hand, but there are things that
642720	644660	do make it a little trickier, like determining the route
645420	646680	particularly if you want to make
646680	648960	it a silent attack without actually DHCP-ing
648960	650740	to that server, therefore not giving
650740	653120	out any of your personal information like your MAC address.
654120	655320	And keys with that
655320	657140	is that, you know, this tool will watch
657140	659160	traffic go by and determine not just a target
659160	661100	for you, but a route as well, which is
661540	663000	beneficial. That entire
663000	665260	demonstration that was shown didn't send out a
665260	667280	single packet the whole time it was there. It doesn't even need an
667280	669120	IP address. So
670080	671300	yeah, all you need to do is bring up
671300	673220	the interface and it'll, you know, sniff
673220	676300	and get all the information it needs.
676300	677380	And right
677380	679180	now, okay, the required library is
679680	680920	libpcap, so that, you know,
680920	683380	it can sniff and then pthreads for the threading.
684160	685200	And then,
685200	686520	yeah, we...
686520	689000	if anybody wants to, like, port it to OS10
689000	690960	or, like, to Windows or anything like that, we'd be
690960	692980	glad to help out and we would love for you
692980	694400	to help out. And
694820	696760	right now it's written for Linux. It'll work in
696760	698960	most Linux environments. It'll probably work
698960	701520	in a lot of BSD environments or whatever.
701960	702980	And there's
702980	704880	our contact email addresses.
705540	707260	piercede at pdx.edu
708080	709400	and... okay.
709400	712140	And then Brandon at datatactic.com.
712800	713400	And
713400	715980	if you want to download the latest version of the program,
715980	717420	it's at that URL
717420	719760	there that some of you might be able to see.
719900	720380	It's at
720380	723700	web.pdx.edu. Yeah, there.
725180	725780	piercede
725780	727080	slash cs.pickup
727080	728760	at html.
728800	731200	Those are... okay.
731300	732820	Is there any questions or any
734180	735620	thing interesting?
735620	736340	Yeah.
739180	739920	Do you know
739920	741920	what the authentication methods are for that
741920	743260	or how deep that gets?
757200	758600	If it's a user...
762960	763400	If
763400	765180	it does authentication by adding a MAC
765180	767140	to the IP tables allow list to
767140	769320	route traffic, then yes, this will work on it.
769320	770720	I mean, basically any implementation
770720	773040	that doesn't do... I mean, any
773040	774880	public implementation of such authentication
774880	776380	will be broken simply because
777540	779040	wireless... unless you use encryption,
779040	780080	it's gonna be...
780080	780540	Mm-hmm.
783600	784320	They broadcast...
784320	786260	The information happens when they stream...
786260	787980	When they go to any website, the information
787980	790120	is already... is shot out in the
790120	792080	air because it's wireless. So if you can intercept
792080	794140	it, you can figure out that they've been authenticated
794140	796080	and what their route is for, you know,
798720	799080	using...
799080	799960	What was that?
801640	802220	Right.
802220	804340	Right. It's the user that you target, really.
804660	806080	Yeah, we have also a question...
807420	808140	Anyone?
808140	809260	Yeah, question?
814800	816520	You would think that
816520	817960	and on our testing that hasn't
817960	820020	happened in actual switch networks
820020	822060	with Windows, Windows will pop up and say
822060	824000	yeah, there's another person using this IP
824000	826000	address. But due to TCP using
826000	828040	individual sequence numbers for each connection,
828040	829920	we never get any collisions with that and for some reason
829920	832000	over wireless networks, Windows never seems to notice
832000	833700	or Linux or BSD never notice that
834160	835980	they don't even get kicked off. They just
835980	838560	share the connection with you. They pay for it, you use it.
838560	839160	Mm-hmm.
840880	842340	Ah, it figures out the route
842340	844280	by watching the packets. I mean, he can tell you more
844280	846300	of the logic behind that, but it watches the packet
846300	848240	go through and at the head of every packet
848240	850500	there's the MAC address of the gateway.
850520	852320	We snag that gateway and then we ARP
852320	854820	resolve the gateway to the IP to set our route.
854820	855960	Yeah, there's a lot of
856780	858300	information in the ARP packets
858300	860480	to travel around to, so it's pretty useful.