[00:19.220 --> 00:21.900]  No, sorry, the speaker can't be moved.
[00:23.200 --> 00:25.700]  Sorry about that.
[00:27.960 --> 00:29.800]  Yeah, we have audio.
[00:29.840 --> 00:30.620]  Cool.
[00:30.980 --> 00:35.200]  Okay, so, my name is Dean Pierce, this is Brandon Edwards.
[00:35.200 --> 00:37.800]  We're undergraduates at Portland State University.
[00:37.900 --> 00:42.660]  And we're going to be talking about...
[00:43.200 --> 00:44.020]  Alright.
[00:45.280 --> 00:46.600]  My associate here...
[00:46.600 --> 00:49.160]  Yeah, you got that?
[00:49.360 --> 00:50.840]  Yeah, I can hear myself.
[00:51.540 --> 00:53.360]  Everyone can hear me alright?
[00:54.260 --> 00:56.400]  Okay, how about now?
[00:56.800 --> 00:57.720]  Hear me alright?
[00:58.480 --> 00:59.420]  Alright.
[01:00.380 --> 01:03.360]  We're here to talk on basically MAC...
[01:03.360 --> 01:05.940]  Well, Authenticated Wireless Networks of all sorts.
[01:06.800 --> 01:09.940]  As he introduced ourselves, we're students at Portland State.
[01:13.080 --> 01:17.140]  Okay, basically what we're calling an authenticated network
[01:17.140 --> 01:22.400]  is a network that you need to log in with a username and password.
[01:22.400 --> 01:26.640]  So, such like at a lot of universities now and stuff like that.
[01:26.640 --> 01:29.200]  Some people call it Captive Portal.
[01:29.920 --> 01:33.280]  Yeah, there's many different implementations of it.
[01:33.280 --> 01:35.480]  Like, there's open source ones like NoCat and whatever.
[01:35.480 --> 01:39.140]  And there's also a lot of other different companies that are coming out now
[01:39.140 --> 01:42.860]  that are implementing these Captive Portal systems.
[01:43.380 --> 01:47.220]  And they all essentially work in the same manner.
[01:48.420 --> 01:51.940]  Okay, so the one we're going to focus on for partially legal
[01:51.940 --> 01:54.320]  and partially just reference use is NoCat.
[01:54.320 --> 01:55.760]  I don't know if any of you are familiar with it.
[01:55.760 --> 01:59.200]  Basically, NoCat is an open source or at least free
[01:59.980 --> 02:01.960]  Captive Portal style authenticated network
[02:01.960 --> 02:04.920]  commonly used for wireless networks in cafes and universities.
[02:05.400 --> 02:07.700]  It's used in schools, restaurants, community networks.
[02:07.700 --> 02:08.960]  It's used all over the place.
[02:09.040 --> 02:12.200]  And that's what we are going to focus our talk on for the tool.
[02:14.300 --> 02:16.980]  All right, let's go ahead and go into how this actually works.
[02:16.980 --> 02:19.460]  So, we need to analyze how authentication works
[02:19.460 --> 02:21.200]  to realize how we're going to bypass it.
[02:22.640 --> 02:25.040]  If you look at the login process,
[02:25.040 --> 02:28.000]  what a user will have to do on one of these authenticated wireless networks,
[02:28.000 --> 02:29.680]  they'll obviously DHCP for an IP
[02:29.680 --> 02:33.120]  because they won't have predestined information about the network.
[02:33.460 --> 02:37.100]  They'll submit HTTP requests off and over SSL
[02:37.100 --> 02:39.640]  to a login page to log in.
[02:39.880 --> 02:43.920]  And during authentication, if a username and password is accepted,
[02:43.920 --> 02:47.960]  their MAC and IP address are then added to an allow list
[02:47.960 --> 02:50.220]  on the firewall to forward traffic out to the internet.
[02:50.220 --> 02:51.940]  This is all pretty common stuff.
[02:53.360 --> 02:55.700]  It basically just forwards it through the gateway.
[02:59.000 --> 03:02.880]  So, to look at how that has to be bypassed,
[03:02.880 --> 03:06.320]  you just have to analyze what the authentication is looking at.
[03:06.320 --> 03:08.860]  And basically, for methods of bypassing to work,
[03:08.860 --> 03:11.260]  it'll have to be on a non-switched or wireless network,
[03:11.260 --> 03:13.040]  which is what you guys are here for.
[03:13.120 --> 03:17.080]  And there has to be a currently or an about to authenticate user.
[03:17.080 --> 03:20.120]  So, someone who is either sending user information,
[03:20.120 --> 03:22.340]  already has sent user information, has been authenticated,
[03:22.340 --> 03:25.180]  and is routing through the gateway to get access to the internet.
[03:26.460 --> 03:29.900]  Basically, there's three basic steps to bypass this authentication.
[03:29.900 --> 03:32.780]  You identify the MAC address of a target user, the IP address,
[03:32.780 --> 03:36.720]  and you set your route once you've spoofed as those MAC and IP.
[03:37.420 --> 03:40.460]  And to the gateway, or to the authentication system,
[03:40.460 --> 03:42.560]  it looks as if you've already authenticated.
[03:43.380 --> 03:45.880]  It's not new, but it can become a little trickier
[03:45.880 --> 03:48.460]  than it seems to gather this information, which we'll go into.
[03:52.040 --> 03:55.600]  So, essentially, the program that we wrote,
[03:57.520 --> 03:59.920]  what it does is it creates a database,
[03:59.920 --> 04:02.120]  and it gathers information on the current network,
[04:02.120 --> 04:04.220]  and it just watches the data flowing by.
[04:04.220 --> 04:06.280]  And it's kind of interesting because it's all completely silent,
[04:06.280 --> 04:07.300]  if you want it to be,
[04:07.300 --> 04:10.840]  where you don't actually have to send out any data on your network card
[04:10.840 --> 04:13.740]  to be able to gather enough information to spoof yourself onto the network.
[04:14.180 --> 04:17.760]  And essentially, it just gathers the IP address and the MAC address
[04:17.760 --> 04:22.040]  of anyone that's using the internet, or whatever.
[04:22.040 --> 04:25.340]  And when the program starts out, it spawns three threads
[04:25.340 --> 04:29.260]  that search for TCP, UDP, and ARP packets,
[04:29.260 --> 04:31.440]  and then it dissects them as they come in,
[04:31.440 --> 04:34.900]  and then adds the information to the database as it comes by.
[04:35.280 --> 04:38.440]  So, once you've gathered enough targets,
[04:38.440 --> 04:41.180]  or you've gathered enough information to spoof yourself onto the network,
[04:41.180 --> 04:46.580]  you can use a spoof command that lets you spoof the identity of whatever user.
[04:46.580 --> 04:50.240]  And, yeah, if the target was authenticated,
[04:51.100 --> 04:52.720]  then you'll also be authenticated,
[04:52.720 --> 04:56.620]  so you can bypass, just like your unauthenticated user.
[04:58.740 --> 05:03.280]  So there's some very basic commands for the pickup line program,
[05:03.280 --> 05:04.640]  which is what we named it.
[05:05.000 --> 05:08.020]  And when you start out the... it's a command line program,
[05:08.020 --> 05:09.980]  so when you start it out, it gives you a user prompt,
[05:09.980 --> 05:11.680]  and then you type start,
[05:11.680 --> 05:14.000]  and then it spawns off the three threads that are sniffing,
[05:14.000 --> 05:16.780]  and then you'll start seeing information coming in,
[05:16.780 --> 05:18.960]  it'll just print it off as it goes,
[05:18.960 --> 05:22.540]  and then once you've started to gather some information,
[05:22.540 --> 05:26.360]  you can type list to see all the targets that are available,
[05:26.360 --> 05:30.660]  and then once you think you have a target that you want to use,
[05:30.660 --> 05:33.680]  you use the spoof command to pick a target,
[05:33.680 --> 05:35.840]  and then you just copy all of their information,
[05:35.840 --> 05:38.140]  and, like, you know, the IP address and the MAC address,
[05:38.140 --> 05:41.240]  and you go through the gateway, and then you're on the network.
[05:41.240 --> 05:43.760]  And then the exit command will exit the program.
[05:45.500 --> 05:48.220]  Okay, so it's...
[05:48.220 --> 05:51.300]  basically, there aren't really many alternatives
[05:51.300 --> 05:55.460]  to the authenticated wireless networks that are in place,
[05:55.460 --> 05:59.360]  and I say that because, as Dean believes,
[05:59.360 --> 06:01.340]  if you're in any sort of wireless network,
[06:01.340 --> 06:03.080]  you're shouting across a room,
[06:03.080 --> 06:05.820]  and any way you try to cover that, it's just not going to work.
[06:05.820 --> 06:07.700]  So if you say, I'm someone,
[06:07.700 --> 06:10.160]  and someone else says, I'm that same someone,
[06:10.160 --> 06:12.920]  it's going to work. They're going to be recognized.
[06:13.140 --> 06:15.740]  Wireless is just inherently insecure for that reason.
[06:16.440 --> 06:18.800]  Hotspots are considered to be a gamble for that.
[06:19.000 --> 06:21.100]  I'm quoting that from a security professional
[06:21.100 --> 06:24.820]  who works with wireless networks in the corporate field,
[06:24.820 --> 06:28.120]  and he's gone to implement similar methods,
[06:28.120 --> 06:30.140]  and he's examined other things, and there's...
[06:30.140 --> 06:32.000]  I mean, professionals will say it, hackers will say it,
[06:32.000 --> 06:33.940]  there's really not much that can be done to secure these,
[06:33.940 --> 06:36.300]  so some might say, well, what if you add encryption,
[06:36.300 --> 06:37.800]  but that takes out the stupid end user
[06:37.800 --> 06:40.180]  who wants to go to Starbucks, plug in his laptop,
[06:40.180 --> 06:41.360]  and just start using.
[06:42.640 --> 06:44.840]  There's variations of these authenticated networks.
[06:45.040 --> 06:47.760]  This tool will work on all of them, or most of them.
[06:47.860 --> 06:50.140]  There's agreement of use policy authentication.
[06:50.140 --> 06:52.140]  Basically, those are free networks you can go to,
[06:52.140 --> 06:54.620]  say, yes, I agree, I will not hack through the network
[06:54.620 --> 06:57.500]  with this access, and they'll let you get on.
[06:57.820 --> 06:59.520]  And so, I mean, this tool will bypass you
[06:59.520 --> 07:01.460]  having to agree to that if you really want.
[07:01.460 --> 07:04.300]  There are ones that use user path authentication,
[07:04.300 --> 07:06.740]  which is the main method we've been describing,
[07:06.740 --> 07:09.420]  and the tool will observe the traffic,
[07:09.420 --> 07:12.880]  steal the information, figure out the route, and set it.
[07:13.420 --> 07:15.200]  And there's variations of that, though.
[07:15.200 --> 07:16.620]  Certain networks will use just MAC,
[07:16.620 --> 07:18.800]  certain ones will use MAC and IP.
[07:19.040 --> 07:20.380]  And it becomes interesting because
[07:20.980 --> 07:23.220]  if you go to, say, a, you know,
[07:24.440 --> 07:26.000]  college network that has this,
[07:26.000 --> 07:27.600]  you can have the security,
[07:27.600 --> 07:29.360]  they did not design it with security in mind,
[07:29.360 --> 07:31.500]  and this is demonstrated because if they only authenticate
[07:31.500 --> 07:33.200]  based off of the MAC address,
[07:33.200 --> 07:36.300]  that means several computers could spoof as one MAC
[07:36.300 --> 07:38.460]  and each computer have a separate IP address
[07:38.460 --> 07:39.800]  and they all use the network.
[07:39.800 --> 07:41.940]  It's as if nobody seems to even notice
[07:41.940 --> 07:45.240]  that their access point's being completely abused.
[07:45.760 --> 07:48.680]  So it's, you know, there's multiple ways of doing it
[07:48.680 --> 07:49.580]  and there are alternatives,
[07:49.580 --> 07:51.860]  but wireless is just inherently broken.
[07:52.900 --> 07:53.780]  Okay.
[07:53.780 --> 07:56.760]  This is a basic demonstration,
[07:57.000 --> 07:59.520]  a couple screenshots of program in action.
[07:59.700 --> 08:02.840]  Essentially, you execute the pickup line binary
[08:04.100 --> 08:06.240]  and you get, you know, the prompt
[08:06.240 --> 08:07.840]  and it says the version number.
[08:07.840 --> 08:10.600]  The current version number is 0.4.5
[08:11.360 --> 08:14.440]  and it just assumes that you want ETH1.
[08:14.440 --> 08:15.920]  You can use the interface command to change
[08:15.920 --> 08:17.440]  which interface you want to use.
[08:17.440 --> 08:20.220]  And you can type help if you want a list of commands, whatever.
[08:21.240 --> 08:23.000]  And then you say start
[08:23.000 --> 08:25.180]  and it gives a thing that says starting the sniffer
[08:25.180 --> 08:28.500]  and then it just starts gathering data on the network.
[08:28.500 --> 08:30.100]  Right here, the first thing it got
[08:30.100 --> 08:31.800]  was the gateway MAC address.
[08:31.800 --> 08:34.200]  And you probably got that from seeing
[08:34.800 --> 08:36.640]  multiple TCP sessions from different people
[08:36.640 --> 08:38.380]  and you can...
[08:38.380 --> 08:39.880]  If there's a common MAC address
[08:39.880 --> 08:43.640]  in, you know, user source MAC addresses,
[08:43.640 --> 08:45.360]  then you can pretty much verify
[08:45.360 --> 08:46.740]  that that's going to be the gateway.
[08:46.900 --> 08:49.260]  And then it starts adding some targets.
[08:50.000 --> 08:51.820]  And these are people that are just, you know,
[08:51.820 --> 08:54.440]  logged onto the network, checking email or whatever.
[08:54.740 --> 08:57.900]  And then after a while, it gathers the gateway IP
[08:58.420 --> 09:01.200]  which can be used to, you know,
[09:01.200 --> 09:02.320]  you need to route through.
[09:03.460 --> 09:06.040]  And then once you've gathered some information,
[09:06.040 --> 09:06.920]  you use the list command
[09:06.920 --> 09:08.660]  and when you do list, it looks like this.
[09:08.660 --> 09:10.440]  It says 1, 2, 3, and it has the IP addresses
[09:10.860 --> 09:12.400]  that you can select from.
[09:14.560 --> 09:15.780]  And then what you just do
[09:15.780 --> 09:16.780]  is you use the spoof command
[09:16.780 --> 09:18.360]  and then it asks you what target you want.
[09:18.460 --> 09:20.360]  And then you say target number 3.
[09:20.620 --> 09:23.460]  And then, you know, 1-3-1-2-5-2-2-5-5-1-7-8
[09:23.460 --> 09:25.100]  which is an IP address
[09:25.100 --> 09:26.820]  on the wireless network
[09:26.820 --> 09:28.340]  at Portland State University.
[09:29.380 --> 09:29.820]  And...
[09:34.900 --> 09:36.400]  It's not actually a window.
[09:36.400 --> 09:38.380]  It's just a screenshot, unfortunately.
[09:38.380 --> 09:38.980]  Yeah.
[09:39.960 --> 09:41.980]  We couldn't get a demo, I'm sorry.
[09:42.240 --> 09:44.920]  Yeah. Sorry about that.
[09:45.880 --> 09:46.320]  And...
[09:46.820 --> 09:47.820]  Yeah, so then
[09:48.240 --> 09:50.280]  once you say spoof and it brings down the interface
[09:50.760 --> 09:51.900]  spoofs the MAC address
[09:51.900 --> 09:53.900]  then it brings up the interface to
[09:54.440 --> 09:55.780]  a certain IP address and then
[09:57.340 --> 09:58.120]  we've found out
[09:58.120 --> 09:59.920]  recently that, you know, there's a lot of different
[10:01.440 --> 10:02.200]  captive portals
[10:02.200 --> 10:03.480]  that'll use different netmasks
[10:03.480 --> 10:06.300]  and so a lot of times it doesn't automatically detect it
[10:06.300 --> 10:08.820]  but in this case it does.
[10:09.100 --> 10:09.740]  And it can
[10:09.740 --> 10:11.920]  it'll also grab netmasks out of
[10:11.920 --> 10:13.980]  DNS requests, it'll notice those.
[10:14.220 --> 10:15.920]  But you haven't
[10:15.920 --> 10:16.740]  gathered the
[10:18.060 --> 10:19.920]  netmask at this point, so it'll just guess it
[10:19.920 --> 10:21.940]  anyway. And then it'll set the route
[10:21.940 --> 10:24.640]  through the 1-3-1-2-5-2-200.10
[10:24.640 --> 10:25.580]  which is the
[10:27.300 --> 10:28.580]  local router on the wireless
[10:28.580 --> 10:30.360]  network there. And
[10:30.360 --> 10:32.360]  that's essentially it. And then you're online
[10:32.360 --> 10:34.920]  you can, I don't know, browse Google or do whatever.
[10:35.020 --> 10:37.020]  So, yeah, the attack
[10:37.020 --> 10:38.660]  can seem trivial if you're
[10:38.660 --> 10:41.160]  doing it. And it can easily be done
[10:41.160 --> 10:42.720]  by hand, but there are things that
[10:42.720 --> 10:44.660]  do make it a little trickier, like determining the route
[10:45.420 --> 10:46.680]  particularly if you want to make
[10:46.680 --> 10:48.960]  it a silent attack without actually DHCP-ing
[10:48.960 --> 10:50.740]  to that server, therefore not giving
[10:50.740 --> 10:53.120]  out any of your personal information like your MAC address.
[10:54.120 --> 10:55.320]  And keys with that
[10:55.320 --> 10:57.140]  is that, you know, this tool will watch
[10:57.140 --> 10:59.160]  traffic go by and determine not just a target
[10:59.160 --> 11:01.100]  for you, but a route as well, which is
[11:01.540 --> 11:03.000]  beneficial. That entire
[11:03.000 --> 11:05.260]  demonstration that was shown didn't send out a
[11:05.260 --> 11:07.280]  single packet the whole time it was there. It doesn't even need an
[11:07.280 --> 11:09.120]  IP address. So
[11:10.080 --> 11:11.300]  yeah, all you need to do is bring up
[11:11.300 --> 11:13.220]  the interface and it'll, you know, sniff
[11:13.220 --> 11:16.300]  and get all the information it needs.
[11:16.300 --> 11:17.380]  And right
[11:17.380 --> 11:19.180]  now, okay, the required library is
[11:19.680 --> 11:20.920]  libpcap, so that, you know,
[11:20.920 --> 11:23.380]  it can sniff and then pthreads for the threading.
[11:24.160 --> 11:25.200]  And then,
[11:25.200 --> 11:26.520]  yeah, we...
[11:26.520 --> 11:29.000]  if anybody wants to, like, port it to OS10
[11:29.000 --> 11:30.960]  or, like, to Windows or anything like that, we'd be
[11:30.960 --> 11:32.980]  glad to help out and we would love for you
[11:32.980 --> 11:34.400]  to help out. And
[11:34.820 --> 11:36.760]  right now it's written for Linux. It'll work in
[11:36.760 --> 11:38.960]  most Linux environments. It'll probably work
[11:38.960 --> 11:41.520]  in a lot of BSD environments or whatever.
[11:41.960 --> 11:42.980]  And there's
[11:42.980 --> 11:44.880]  our contact email addresses.
[11:45.540 --> 11:47.260]  piercede at pdx.edu
[11:48.080 --> 11:49.400]  and... okay.
[11:49.400 --> 11:52.140]  And then Brandon at datatactic.com.
[11:52.800 --> 11:53.400]  And
[11:53.400 --> 11:55.980]  if you want to download the latest version of the program,
[11:55.980 --> 11:57.420]  it's at that URL
[11:57.420 --> 11:59.760]  there that some of you might be able to see.
[11:59.900 --> 12:00.380]  It's at
[12:00.380 --> 12:03.700]  web.pdx.edu. Yeah, there.
[12:05.180 --> 12:05.780]  piercede
[12:05.780 --> 12:07.080]  slash cs.pickup
[12:07.080 --> 12:08.760]  at html.
[12:08.800 --> 12:11.200]  Those are... okay.
[12:11.300 --> 12:12.820]  Is there any questions or any
[12:14.180 --> 12:15.620]  thing interesting?
[12:15.620 --> 12:16.340]  Yeah.
[12:19.180 --> 12:19.920]  Do you know
[12:19.920 --> 12:21.920]  what the authentication methods are for that
[12:21.920 --> 12:23.260]  or how deep that gets?
[12:37.200 --> 12:38.600]  If it's a user...
[12:42.960 --> 12:43.400]  If
[12:43.400 --> 12:45.180]  it does authentication by adding a MAC
[12:45.180 --> 12:47.140]  to the IP tables allow list to
[12:47.140 --> 12:49.320]  route traffic, then yes, this will work on it.
[12:49.320 --> 12:50.720]  I mean, basically any implementation
[12:50.720 --> 12:53.040]  that doesn't do... I mean, any
[12:53.040 --> 12:54.880]  public implementation of such authentication
[12:54.880 --> 12:56.380]  will be broken simply because
[12:57.540 --> 12:59.040]  wireless... unless you use encryption,
[12:59.040 --> 13:00.080]  it's gonna be...
[13:00.080 --> 13:00.540]  Mm-hmm.
[13:03.600 --> 13:04.320]  They broadcast...
[13:04.320 --> 13:06.260]  The information happens when they stream...
[13:06.260 --> 13:07.980]  When they go to any website, the information
[13:07.980 --> 13:10.120]  is already... is shot out in the
[13:10.120 --> 13:12.080]  air because it's wireless. So if you can intercept
[13:12.080 --> 13:14.140]  it, you can figure out that they've been authenticated
[13:14.140 --> 13:16.080]  and what their route is for, you know,
[13:18.720 --> 13:19.080]  using...
[13:19.080 --> 13:19.960]  What was that?
[13:21.640 --> 13:22.220]  Right.
[13:22.220 --> 13:24.340]  Right. It's the user that you target, really.
[13:24.660 --> 13:26.080]  Yeah, we have also a question...
[13:27.420 --> 13:28.140]  Anyone?
[13:28.140 --> 13:29.260]  Yeah, question?
[13:34.800 --> 13:36.520]  You would think that
[13:36.520 --> 13:37.960]  and on our testing that hasn't
[13:37.960 --> 13:40.020]  happened in actual switch networks
[13:40.020 --> 13:42.060]  with Windows, Windows will pop up and say
[13:42.060 --> 13:44.000]  yeah, there's another person using this IP
[13:44.000 --> 13:46.000]  address. But due to TCP using
[13:46.000 --> 13:48.040]  individual sequence numbers for each connection,
[13:48.040 --> 13:49.920]  we never get any collisions with that and for some reason
[13:49.920 --> 13:52.000]  over wireless networks, Windows never seems to notice
[13:52.000 --> 13:53.700]  or Linux or BSD never notice that
[13:54.160 --> 13:55.980]  they don't even get kicked off. They just
[13:55.980 --> 13:58.560]  share the connection with you. They pay for it, you use it.
[13:58.560 --> 13:59.160]  Mm-hmm.
[14:00.880 --> 14:02.340]  Ah, it figures out the route
[14:02.340 --> 14:04.280]  by watching the packets. I mean, he can tell you more
[14:04.280 --> 14:06.300]  of the logic behind that, but it watches the packet
[14:06.300 --> 14:08.240]  go through and at the head of every packet
[14:08.240 --> 14:10.500]  there's the MAC address of the gateway.
[14:10.520 --> 14:12.320]  We snag that gateway and then we ARP
[14:12.320 --> 14:14.820]  resolve the gateway to the IP to set our route.
[14:14.820 --> 14:15.960]  Yeah, there's a lot of
[14:16.780 --> 14:18.300]  information in the ARP packets
[14:18.300 --> 14:20.480]  to travel around to, so it's pretty useful.