WEBVTT 00:19.220 --> 00:21.900 No, sorry, the speaker can't be moved. 00:23.200 --> 00:25.700 Sorry about that. 00:27.960 --> 00:29.800 Yeah, we have audio. 00:29.840 --> 00:30.620 Cool. 00:30.980 --> 00:35.200 Okay, so, my name is Dean Pierce, this is Brandon Edwards. 00:35.200 --> 00:37.800 We're undergraduates at Portland State University. 00:37.900 --> 00:42.660 And we're going to be talking about... 00:43.200 --> 00:44.020 Alright. 00:45.280 --> 00:46.600 My associate here... 00:46.600 --> 00:49.160 Yeah, you got that? 00:49.360 --> 00:50.840 Yeah, I can hear myself. 00:51.540 --> 00:53.360 Everyone can hear me alright? 00:54.260 --> 00:56.400 Okay, how about now? 00:56.800 --> 00:57.720 Hear me alright? 00:58.480 --> 00:59.420 Alright. 01:00.380 --> 01:03.360 We're here to talk on basically MAC... 01:03.360 --> 01:05.940 Well, Authenticated Wireless Networks of all sorts. 01:06.800 --> 01:09.940 As he introduced ourselves, we're students at Portland State. 01:13.080 --> 01:22.400 Okay, basically what we're calling an authenticated network is a network that you need to log in with a username and password. 01:22.400 --> 01:26.640 So, such like at a lot of universities now and stuff like that. 01:26.640 --> 01:29.200 Some people call it Captive Portal. 01:29.920 --> 01:33.280 Yeah, there's many different implementations of it. 01:33.280 --> 01:35.480 Like, there's open source ones like NoCat and whatever. 01:35.480 --> 01:42.860 And there's also a lot of other different companies that are coming out now that are implementing these Captive Portal systems. 01:43.380 --> 01:47.220 And they all essentially work in the same manner. 01:48.420 --> 01:54.320 Okay, so the one we're going to focus on for partially legal and partially just reference use is NoCat. 01:54.320 --> 01:55.760 I don't know if any of you are familiar with it. 01:55.760 --> 02:04.920 Basically, NoCat is an open source or at least free Captive Portal style authenticated network commonly used for wireless networks in cafes and universities. 02:05.400 --> 02:07.700 It's used in schools, restaurants, community networks. 02:07.700 --> 02:08.960 It's used all over the place. 02:09.040 --> 02:12.200 And that's what we are going to focus our talk on for the tool. 02:14.300 --> 02:16.980 All right, let's go ahead and go into how this actually works. 02:16.980 --> 02:21.200 So, we need to analyze how authentication works to realize how we're going to bypass it. 02:22.640 --> 02:33.120 If you look at the login process, what a user will have to do on one of these authenticated wireless networks, they'll obviously DHCP for an IP because they won't have predestined information about the network. 02:33.460 --> 02:39.640 They'll submit HTTP requests off and over SSL to a login page to log in. 02:39.880 --> 02:50.220 And during authentication, if a username and password is accepted, their MAC and IP address are then added to an allow list on the firewall to forward traffic out to the internet. 02:50.220 --> 02:51.940 This is all pretty common stuff. 02:53.360 --> 02:55.700 It basically just forwards it through the gateway. 02:59.000 --> 03:06.320 So, to look at how that has to be bypassed, you just have to analyze what the authentication is looking at. 03:06.320 --> 03:13.040 And basically, for methods of bypassing to work, it'll have to be on a non-switched or wireless network, which is what you guys are here for. 03:13.120 --> 03:17.080 And there has to be a currently or an about to authenticate user. 03:17.080 --> 03:25.180 So, someone who is either sending user information, already has sent user information, has been authenticated, and is routing through the gateway to get access to the internet. 03:26.460 --> 03:29.900 Basically, there's three basic steps to bypass this authentication. 03:29.900 --> 03:36.720 You identify the MAC address of a target user, the IP address, and you set your route once you've spoofed as those MAC and IP. 03:37.420 --> 03:42.560 And to the gateway, or to the authentication system, it looks as if you've already authenticated. 03:43.380 --> 03:48.460 It's not new, but it can become a little trickier than it seems to gather this information, which we'll go into. 03:52.040 --> 04:04.220 So, essentially, the program that we wrote, what it does is it creates a database, and it gathers information on the current network, and it just watches the data flowing by. 04:04.220 --> 04:13.740 And it's kind of interesting because it's all completely silent, if you want it to be, where you don't actually have to send out any data on your network card to be able to gather enough information to spoof yourself onto the network. 04:14.180 --> 04:22.040 And essentially, it just gathers the IP address and the MAC address of anyone that's using the internet, or whatever. 04:22.040 --> 04:34.900 And when the program starts out, it spawns three threads that search for TCP, UDP, and ARP packets, and then it dissects them as they come in, and then adds the information to the database as it comes by. 04:35.280 --> 04:46.580 So, once you've gathered enough targets, or you've gathered enough information to spoof yourself onto the network, you can use a spoof command that lets you spoof the identity of whatever user. 04:46.580 --> 04:56.620 And, yeah, if the target was authenticated, then you'll also be authenticated, so you can bypass, just like your unauthenticated user. 04:58.740 --> 05:04.640 So there's some very basic commands for the pickup line program, which is what we named it. 05:05.000 --> 05:18.960 And when you start out the... it's a command line program, so when you start it out, it gives you a user prompt, and then you type start, and then it spawns off the three threads that are sniffing, and then you'll start seeing information coming in, it'll just print it off as it goes, 05:18.960 --> 05:35.840 and then once you've started to gather some information, you can type list to see all the targets that are available, and then once you think you have a target that you want to use, you use the spoof command to pick a target, and then you just copy all of their information, 05:35.840 --> 05:41.240 and , like, you know, the IP address and the MAC address, and you go through the gateway, and then you're on the network. 05:41.240 --> 05:43.760 And then the exit command will exit the program. 05:45.500 --> 05:48.220 Okay, so it's... 05:48.220 --> 06:04.560 basically, there aren't really many alternatives to the authenticated wireless networks that are in place, and I say that because, as Dean believes, if you're in any sort of wireless network, you're shouting across a room, and any way you try to cover that, 06:04.560 --> 06:05.820 it's just not going to work. 06:05.820 --> 06:11.220 So if you say, I'm someone, and someone else says, I'm that same someone, it's going to work. 06:11.220 --> 06:12.920 They're going to be recognized. 06:13.140 --> 06:15.740 Wireless is just inherently insecure for that reason. 06:16.440 --> 06:18.800 Hotspots are considered to be a gamble for that. 06:19.000 --> 06:30.140 I'm quoting that from a security professional who works with wireless networks in the corporate field, and he's gone to implement similar methods, and he's examined other things, and there's... 06:30.140 --> 06:40.180 I mean, professionals will say it, hackers will say it, there's really not much that can be done to secure these, so some might say, well, what if you add encryption, but that takes out the stupid end user who wants to go to Starbucks, plug in his laptop, 06:40.180 --> 06:41.360 and just start using. 06:42.640 --> 06:44.840 There's variations of these authenticated networks. 06:45.040 --> 06:47.760 This tool will work on all of them, or most of them. 06:47.860 --> 06:50.140 There's agreement of use policy authentication. 06:50.140 --> 06:57.500 Basically, those are free networks you can go to, say, yes, I agree, I will not hack through the network with this access, and they'll let you get on. 06:57.820 --> 07:01.460 And so, I mean, this tool will bypass you having to agree to that if you really want. 07:01.460 --> 07:12.880 There are ones that use user path authentication, which is the main method we've been describing, and the tool will observe the traffic, steal the information, figure out the route, and set it. 07:13.420 --> 07:15.200 And there's variations of that, though. 07:15.200 --> 07:18.800 Certain networks will use just MAC, certain ones will use MAC and IP. 07:19.040 --> 07:33.200 And it becomes interesting because if you go to, say, a, you know, college network that has this, you can have the security, they did not design it with security in mind, and this is demonstrated because if they only authenticate based off of the MAC address, 07:33.200 --> 07:39.800 that means several computers could spoof as one MAC and each computer have a separate IP address and they all use the network. 07:39.800 --> 07:45.240 It's as if nobody seems to even notice that their access point's being completely abused. 07:45.760 --> 07:51.860 So it's, you know, there's multiple ways of doing it and there are alternatives, but wireless is just inherently broken. 07:52.900 --> 07:53.780 Okay. 07:53.780 --> 07:59.520 This is a basic demonstration, a couple screenshots of program in action. 07:59.700 --> 08:07.840 Essentially, you execute the pickup line binary and you get, you know, the prompt and it says the version number. 08:07.840 --> 08:14.440 The current version number is 0.4.5 and it just assumes that you want ETH1. 08:14.440 --> 08:17.440 You can use the interface command to change which interface you want to use. 08:17.440 --> 08:20.220 And you can type help if you want a list of commands, whatever. 08:21.240 --> 08:28.500 And then you say start and it gives a thing that says starting the sniffer and then it just starts gathering data on the network. 08:28.500 --> 08:31.800 Right here, the first thing it got was the gateway MAC address. 08:31.800 --> 08:38.380 And you probably got that from seeing multiple TCP sessions from different people and you can... 08:38.380 --> 08:46.740 If there's a common MAC address in, you know, user source MAC addresses, then you can pretty much verify that that's going to be the gateway. 08:46.900 --> 08:49.260 And then it starts adding some targets. 08:50.000 --> 08:54.440 And these are people that are just, you know, logged onto the network, checking email or whatever. 08:54.740 --> 09:02.320 And then after a while, it gathers the gateway IP which can be used to, you know, you need to route through. 09:03.460 --> 09:08.660 And then once you've gathered some information, you use the list command and when you do list, it looks like this. 09:08.660 --> 09:12.400 It says 1, 2, 3, and it has the IP addresses that you can select from. 09:14.560 --> 09:18.360 And then what you just do is you use the spoof command and then it asks you what target you want. 09:18.460 --> 09:20.360 And then you say target number 3. 09:20.620 --> 09:28.340 And then, you know, 1-3-1-2-5-2-2-5-5-1-7-8 which is an IP address on the wireless network at Portland State University. 09:29.380 --> 09:29.820 And... 09:34.900 --> 09:36.400 It's not actually a window. 09:36.400 --> 09:38.380 It's just a screenshot, unfortunately. 09:38.380 --> 09:38.980 Yeah. 09:39.960 --> 09:41.980 We couldn't get a demo, I'm sorry. 09:42.240 --> 09:42.760 Yeah. 09:43.480 --> 09:44.920 Sorry about that. 09:45.880 --> 09:46.320 And... 09:46.820 --> 10:08.820 Yeah, so then once you say spoof and it brings down the interface spoofs the MAC address then it brings up the interface to a certain IP address and then we've found out recently that, you know, there's a lot of different captive portals that'll use different netmasks and so a lot of times it doesn't automatically detect it but in this case it does. 10:09.100 --> 10:13.980 And it can it'll also grab netmasks out of DNS requests, it'll notice those. 10:14.220 --> 10:20.260 But you haven't gathered the netmask at this point, so it'll just guess it anyway. 10:20.260 --> 10:29.560 And then it'll set the route through the 1-3-1-2-5-2-200.10 which is the local router on the wireless network there. 10:30.080 --> 10:31.480 And that's essentially it. 10:31.480 --> 10:34.920 And then you're online you can, I don't know, browse Google or do whatever. 10:35.020 --> 10:39.080 So, yeah, the attack can seem trivial if you're doing it. 10:39.080 --> 10:53.120 And it can easily be done by hand, but there are things that do make it a little trickier, like determining the route particularly if you want to make it a silent attack without actually DHCP-ing to that server, therefore not giving out any of your personal information like your MAC address. 10:54.120 --> 11:02.300 And keys with that is that, you know, this tool will watch traffic go by and determine not just a target for you, but a route as well, which is beneficial. 11:02.300 --> 11:06.440 That entire demonstration that was shown didn't send out a single packet the whole time it was there. 11:06.440 --> 11:08.040 It doesn't even need an IP address. 11:08.340 --> 11:15.180 So yeah , all you need to do is bring up the interface and it'll, you know, sniff and get all the information it needs. 11:15.900 --> 11:23.380 And right now , okay, the required library is libpcap , so that, you know, it can sniff and then pthreads for the threading. 11:24.160 --> 11:26.520 And then, yeah, we... 11:26.520 --> 11:34.020 if anybody wants to, like, port it to OS10 or, like, to Windows or anything like that, we'd be glad to help out and we would love for you to help out. 11:34.160 --> 11:36.140 And right now it's written for Linux. 11:36.140 --> 11:38.340 It'll work in most Linux environments. 11:38.340 --> 11:41.520 It'll probably work in a lot of BSD environments or whatever. 11:41.960 --> 11:44.880 And there's our contact email addresses. 11:45.540 --> 11:49.400 piercede at pdx.edu and... okay. 11:49.400 --> 11:52.140 And then Brandon at datatactic.com. 11:52.800 --> 11:59.760 And if you want to download the latest version of the program, it's at that URL there that some of you might be able to see. 11:59.900 --> 12:02.780 It's at web.pdx.edu. 12:02.780 --> 12:03.700 Yeah, there. 12:05.180 --> 12:08.760 piercede slash cs.pickup at html. 12:08.800 --> 12:11.200 Those are... okay. 12:11.300 --> 12:15.620 Is there any questions or any thing interesting? 12:15.620 --> 12:16.340 Yeah. 12:19.180 --> 12:23.260 Do you know what the authentication methods are for that or how deep that gets? 12:37.200 --> 12:38.600 If it's a user... 12:42.960 --> 12:49.320 If it does authentication by adding a MAC to the IP tables allow list to route traffic, then yes, this will work on it. 12:49.320 --> 13:00.080 I mean, basically any implementation that doesn't do... I mean, any public implementation of such authentication will be broken simply because wireless... unless you use encryption, it's gonna be... 13:00.080 --> 13:00.540 Mm-hmm. 13:03.600 --> 13:04.320 They broadcast... 13:04.320 --> 13:06.260 The information happens when they stream... 13:06.260 --> 13:11.240 When they go to any website, the information is already... is shot out in the air because it's wireless. 13:11.240 --> 13:19.080 So if you can intercept it, you can figure out that they've been authenticated and what their route is for, you know, using... 13:19.080 --> 13:19.960 What was that? 13:21.640 --> 13:22.220 Right. 13:22.220 --> 13:22.500 Right. 13:22.500 --> 13:24.340 It's the user that you target, really. 13:24.660 --> 13:26.080 Yeah, we have also a question... 13:27.420 --> 13:28.140 Anyone? 13:28.140 --> 13:29.260 Yeah, question? 13:34.800 --> 13:44.740 You would think that and on our testing that hasn't happened in actual switch networks with Windows, Windows will pop up and say yeah, there's another person using this IP address. 13:44.740 --> 13:55.660 But due to TCP using individual sequence numbers for each connection, we never get any collisions with that and for some reason over wireless networks, Windows never seems to notice or Linux or BSD never notice that they don't even get kicked off. 13:55.660 --> 13:57.120 They just share the connection with you. 13:57.120 --> 13:58.560 They pay for it, you use it. 13:58.560 --> 13:59.160 Mm -hmm. 14:00.880 --> 14:03.540 Ah, it figures out the route by watching the packets. 14:03.540 --> 14:10.500 I mean, he can tell you more of the logic behind that, but it watches the packet go through and at the head of every packet there's the MAC address of the gateway. 14:10.520 --> 14:14.820 We snag that gateway and then we ARP resolve the gateway to the IP to set our route. 14:14.820 --> 14:20.480 Yeah, there's a lot of information in the ARP packets to travel around to, so it's pretty useful.