1 00:00:00,000 --> 00:00:04,900 Day two of the speaker workshops and of course they're here at ultimately here at DEVCON and 2 00:00:04,900 --> 00:00:10,520 let me tell you I think first and foremost on a very personal note we were just talking about it 3 00:00:10,520 --> 00:00:15,120 this is a lot of people here you know joining us so early on a Saturday morning because I'm pretty 4 00:00:15,120 --> 00:00:20,140 sure a lot of you folks here I think a lot of people may have had a few late and I hadn't had 5 00:00:20,140 --> 00:00:24,640 a late night did anyone go to concert last night anyone go to concert I heard it was really good 6 00:00:24,640 --> 00:00:31,500 also blast from the past you know from that 2000s as well who here this is your first DEVCON 7 00:00:32,260 --> 00:00:38,780 it's just yeah wow it never cease to amaze me it never cease to amaze me the number of people who 8 00:00:38,780 --> 00:00:44,400 who attend DEVCON for the first time here and looking at the room is usually like at least a 9 00:00:44,400 --> 00:00:51,180 good 50 60 60 70 percent is like first time here on a personal note my first DEVCON was in 2000 10 00:00:51,180 --> 00:00:54,540 and 2006 or DEVCON 14. 11 00:00:54,640 --> 00:01:07,540 and you know right then I had knew nothing and I absolutely knew absolutely nothing and you know 12 00:01:07,540 --> 00:01:12,080 what I learned from that first DEVCON was it really really makes a big difference when you 13 00:01:12,080 --> 00:01:17,420 work with other people collaborate to learn this much just try to eat up and learn from the 14 00:01:17,420 --> 00:01:23,720 experience I know it's very hard to do now I know it's very hard to do now because I've heard I saw 15 00:01:23,720 --> 00:01:24,620 on the social media page that there was a lot of people who were really interested in the DEVCON 16 00:01:24,620 --> 00:01:31,160 pictures that is an absolute like uh I don't even know what the right word is uh zoo uh getting into 17 00:01:31,160 --> 00:01:38,120 the getting into the tracks and I know it's hard harder to do here at the main DEVCON but uh you 18 00:01:38,120 --> 00:01:44,420 know you definitely have spent your day wisely already uh here at the packet hacking village 19 00:01:44,420 --> 00:01:49,140 because it's a little more intimate and plus by although it's a little far out it's definitely 20 00:01:49,140 --> 00:01:54,400 a lot intimate if you uh don't believe this this is what a DEVCON track was like 10 years ago 21 00:01:54,620 --> 00:01:59,500 it was nice and small and intimate now it's like a stadium I mean that's the biggest difference 22 00:02:00,140 --> 00:02:03,800 and uh he this is the reason why I still come to DEVCON it's the packet 23 00:02:03,800 --> 00:02:06,620 hacking village and I'm not sure some of you heard that I said 24 00:02:08,020 --> 00:02:14,180 um the reason why I still come to DEVCON is because my first experience you know at DEVCON 25 00:02:14,180 --> 00:02:18,820 was working it was was uh what they call the table of doom the wall of sheep and working 26 00:02:18,820 --> 00:02:24,540 with the people at the wall of sheep when I had my first DEVCON gave me the networking and security foundation 27 00:02:24,620 --> 00:02:25,880 I never got out of school. 28 00:02:26,040 --> 00:02:29,180 I never got any of that out of four years of college. 29 00:02:29,500 --> 00:02:33,100 And a lot of people still don't even get that stuff out of four years of college, 30 00:02:33,140 --> 00:02:36,020 and that's why I'm still here working for the Packet Hacking Village. 31 00:02:36,340 --> 00:02:43,500 The only big difference now between the Packet Hacking Village then in 2006 versus as it is now, 32 00:02:43,720 --> 00:02:48,460 I mean, it was just a username and password posted on paper plates in 2006. 33 00:02:49,340 --> 00:02:52,140 Now what we have here, we have the speaker workshops. 34 00:02:52,140 --> 00:02:55,480 We have the wall of sheep. 35 00:02:56,050 --> 00:02:59,360 We also have a bunch of learning opportunities as well. 36 00:02:59,640 --> 00:03:06,480 If you are new to network and packet analysis, there is Packet Detective all the way in Neapolitan 1. 37 00:03:06,540 --> 00:03:10,600 It's like to my left. 38 00:03:12,020 --> 00:03:16,040 There is, if you're really, really hungry for this stuff 39 00:03:16,040 --> 00:03:19,700 and you think you're really good at dissecting networks and PCAPs, 40 00:03:19,760 --> 00:03:21,980 there is Capture the Packet, 41 00:03:21,980 --> 00:03:23,560 which is traditionally a Black Badge event. 42 00:03:24,120 --> 00:03:26,220 We also have the Wi-Fi Sheep Hunt. 43 00:03:26,980 --> 00:03:28,380 We have Honey Pots. 44 00:03:28,620 --> 00:03:31,940 And we also have Sheep City, which has returned. 45 00:03:32,440 --> 00:03:35,420 And Sheep City, what it is, is just a bunch of... 46 00:03:36,020 --> 00:03:39,200 You might have seen a little train track that is out there. 47 00:03:39,240 --> 00:03:40,500 You may see a little train track. 48 00:03:40,840 --> 00:03:45,760 And there's a big bottle of booze that has an IoT thing to it. 49 00:03:45,920 --> 00:03:51,180 There's a whole bunch of routers that were donated by 360.cn that were from China. 50 00:03:53,740 --> 00:03:57,540 And if, as far as I know, if you can break into them, I think you can take one home. 51 00:03:58,920 --> 00:04:00,940 We don't know how any of that stuff works. 52 00:04:01,160 --> 00:04:04,760 We had trouble trying to get the manual because no one can read Mandarin here. 53 00:04:05,020 --> 00:04:07,280 I think some people, we finally figured it out. 54 00:04:07,440 --> 00:04:09,460 I don't know. It's all on display there. 55 00:04:09,780 --> 00:04:11,820 But, you know, knock yourself out. 56 00:04:11,940 --> 00:04:13,820 Just knock yourself out over there. 57 00:04:14,560 --> 00:04:21,500 With that said, actually, with that said, just mentioning about 360.cn, 58 00:04:21,980 --> 00:04:26,580 I want to take a brief opportunity to also say, you know, 59 00:04:26,600 --> 00:04:29,780 if you take a look around the village, if you take a look around even here, 60 00:04:30,420 --> 00:04:33,920 like, you know, the decor for this room and for this village, 61 00:04:34,160 --> 00:04:36,080 none of this stuff comes cheap at all. 62 00:04:36,400 --> 00:04:40,200 And we are very grateful for the number of sponsors that we have 63 00:04:41,180 --> 00:04:44,840 that have made, you know, this year's Packet Hacking Village possible, 64 00:04:45,000 --> 00:04:48,580 you know, with all the free swag and all that for the attendees. 65 00:04:49,360 --> 00:04:51,820 So the Wall of Sheep title sponsor is Splunk. 66 00:04:51,980 --> 00:04:56,260 Packet Detective sponsor, Fidelis. 67 00:04:56,960 --> 00:04:59,700 Capture the Packet title sponsor, Packet Slid. 68 00:05:00,040 --> 00:05:02,560 Capture the Packet Platinum sponsor, Talos. 69 00:05:02,720 --> 00:05:05,160 Sheep City title sponsor, Dark Matter. 70 00:05:05,920 --> 00:05:08,440 Sheep City sponsor, 360.cn. 71 00:05:08,920 --> 00:05:13,640 And the Honeypot title sponsor, 802 Secure. 72 00:05:14,060 --> 00:05:16,440 And so those are our sponsors. 73 00:05:16,480 --> 00:05:17,100 We thank them. 74 00:05:17,320 --> 00:05:21,780 But more importantly, most importantly, we want to thank you for spending the morning here. 75 00:05:22,320 --> 00:05:28,320 In a few minutes at 1010, what we're going to do is we're going to introduce two, 76 00:05:28,920 --> 00:05:31,480 to kick off this morning's speaker workshop, 77 00:05:32,040 --> 00:05:35,720 we could, two old friends and two DEFCON veterans, 78 00:05:38,820 --> 00:05:44,280 Vivek, Tomas, and they'll talk about making your own 802.11ac monitoring gadget. 79 00:05:44,680 --> 00:05:49,260 And you won't be disappointed, believe me, because they've come quite a bit. 80 00:05:49,340 --> 00:05:50,900 This isn't your first time. 81 00:05:50,900 --> 00:05:51,960 And we always welcome you. 82 00:05:51,980 --> 00:05:52,500 We always welcome you back. 83 00:05:54,880 --> 00:05:57,040 In a few minutes, I'll just give you the intro. 84 00:05:59,520 --> 00:06:03,840 But does anyone have any, oh, one keynote, one note here. 85 00:06:04,020 --> 00:06:11,300 If you have any questions, thoughts for any of the talks, the mic is right there. 86 00:06:11,440 --> 00:06:16,520 You know, at the, you know, when it's time for question and answer, please feel free to use the mic here. 87 00:06:16,780 --> 00:06:19,200 Oh, also, very important. 88 00:06:19,440 --> 00:06:21,960 We ask, we get, we have a lot of people who ask questions. 89 00:06:21,960 --> 00:06:29,460 They ask us each and every, almost like each and every talk, each and every talk, you know, 90 00:06:29,500 --> 00:06:32,500 what will the talk, will these talks be made publicly available? 91 00:06:32,920 --> 00:06:33,860 The answer is yes. 92 00:06:34,860 --> 00:06:36,520 And this is how it works. 93 00:06:36,920 --> 00:06:41,200 We have a video, we have a video and AV recorder guy over there. 94 00:06:41,300 --> 00:06:46,820 Thank you so much, by the way, for all the, everything that you've done for us, for so far at DEFCON. 95 00:06:47,260 --> 00:06:51,400 So, all the talks for the speaker, speaker, speaker workshops, 96 00:06:51,400 --> 00:06:52,680 I have a video recorded. 97 00:06:53,100 --> 00:06:57,060 The videos for all of our talks, for each and every one of our talks, 98 00:06:57,120 --> 00:07:00,880 will be made available at the same time as the DEFCON video. 99 00:07:01,140 --> 00:07:02,780 That usually takes two to three months. 100 00:07:03,860 --> 00:07:09,080 However, even better than that, what about the notes and PDF slides? 101 00:07:10,660 --> 00:07:17,320 Slides for all, almost all, if not all, of our speaker workshops, 102 00:07:17,680 --> 00:07:21,220 unless it's like into serious intellectual property and corporate matters, 103 00:07:21,220 --> 00:07:27,060 they will be made available within the next two weeks on the Wall of Sheep website, wallofsheep.com. 104 00:07:28,300 --> 00:07:33,060 So, talks, all of our talks, this talk, will be not only video recorded, 105 00:07:33,200 --> 00:07:37,000 but your slides will be, slides will also be made publicly on the Wall of Sheep website. 106 00:07:37,700 --> 00:07:38,220 Okay? 107 00:07:39,300 --> 00:07:44,300 So, yeah, all the content is there for free for the taking for future use and future reference. 108 00:07:45,140 --> 00:07:50,280 One last keynote, one last note before I make the introduction to Vivek and to Tomas. 109 00:07:51,940 --> 00:07:58,080 I want to give, start the morning off also to give each and every one of our public service announcements. 110 00:07:58,460 --> 00:08:04,060 This is something that I've made over every so often, is a public service announcement, 111 00:08:04,140 --> 00:08:11,220 which is a serious problem that is affecting cyber security and tech community, 112 00:08:11,380 --> 00:08:12,600 and that is sexual harassment. 113 00:08:12,980 --> 00:08:20,120 I mean, just, this is absolutely not tolerated here at Packet Hacking Village and with us. 114 00:08:21,220 --> 00:08:22,020 It's a no-no. 115 00:08:22,260 --> 00:08:23,780 I mean, don't do anything dumb. 116 00:08:25,080 --> 00:08:26,320 Don't do anything stupid. 117 00:08:26,880 --> 00:08:31,220 Don't give cyber, don't give this community and tech more black eyes. 118 00:08:31,600 --> 00:08:34,980 Because this is a, this is a matter that has affected us, 119 00:08:35,040 --> 00:08:40,260 because we had a few volunteers who were victims at the end of last year's DEF CON. 120 00:08:41,740 --> 00:08:45,680 This matter is really, really affecting the community. 121 00:08:46,040 --> 00:08:47,880 I just want to make everyone aware of it. 122 00:08:47,980 --> 00:08:50,420 You know, it's absolutely not tolerated. 123 00:08:50,420 --> 00:08:52,120 Absolutely not tolerated. 124 00:08:52,220 --> 00:08:54,480 Definitely also take a look at the Code of Conduct. 125 00:08:54,640 --> 00:08:55,400 Don't do it. 126 00:08:55,480 --> 00:08:56,320 Don't go there. 127 00:08:56,560 --> 00:08:57,600 Don't do anything dumb. 128 00:08:58,820 --> 00:09:05,480 So, now, with that said, I've rambled enough for ten, for almost ten minutes, you know. 129 00:09:05,600 --> 00:09:12,160 So we might as well just kick it off, day two of the speaker workshops at the Packet Hacking Village. 130 00:09:12,440 --> 00:09:18,500 And I said earlier, you know, we're going to start this speaker workshop with a bang, 131 00:09:18,500 --> 00:09:24,800 because we have two old friends and two DEF CON veterans with us today. 132 00:09:25,100 --> 00:09:30,040 I think, how many of you here use, either go to, how many people go to security tubes? 133 00:09:30,120 --> 00:09:30,820 Anyone go to security? 134 00:09:31,020 --> 00:09:32,780 Okay, you have an audience. 135 00:09:33,500 --> 00:09:34,260 Aircrack NG? 136 00:09:34,700 --> 00:09:35,560 Aircrack NG? 137 00:09:35,700 --> 00:09:36,000 Okay. 138 00:09:36,520 --> 00:09:39,420 And these two need no introduction. 139 00:09:39,420 --> 00:09:41,940 We've got security tube and Aircrack NG. 140 00:09:43,340 --> 00:09:45,540 Vivek, Tomas, it's all yours. 141 00:09:45,860 --> 00:09:46,620 Ladies and gentlemen. 142 00:09:52,580 --> 00:09:54,180 Thank you so much for the introduction. 143 00:09:54,600 --> 00:09:58,060 It's always a pleasure and an honor to be invited to the Packet Hacking Village. 144 00:09:59,200 --> 00:10:01,560 And thank you all for coming early in the morning. 145 00:10:01,820 --> 00:10:04,740 You know, we were always worried, 10, 10, you know, nobody shows up. 146 00:10:04,940 --> 00:10:06,080 But thank you so much. 147 00:10:06,880 --> 00:10:13,800 So we are going to be talking about making your own 802.11ac monitoring hacker gadget. 148 00:10:14,640 --> 00:10:15,800 My name is Vivek. 149 00:10:15,800 --> 00:10:18,180 And I have Tomas along with me. 150 00:10:18,600 --> 00:10:20,920 I'm just going to run through our introductions real quick. 151 00:10:21,660 --> 00:10:24,520 I've been hacking for the last 15, 16 years. 152 00:10:25,160 --> 00:10:27,140 Started my career as a low-level engineer. 153 00:10:27,580 --> 00:10:29,560 Spoke first in DC 15. 154 00:10:29,820 --> 00:10:31,140 So it's been 10 years for me. 155 00:10:32,000 --> 00:10:33,020 Broke web cloaking. 156 00:10:33,360 --> 00:10:35,160 Discovered a couple of attacks, the cafe latte. 157 00:10:35,820 --> 00:10:37,180 Won a couple of competitions. 158 00:10:38,060 --> 00:10:40,700 Tomas and I speak and train at multiple conferences. 159 00:10:41,560 --> 00:10:45,240 We've been running the Wi-Fi training at Black Hat for the past five years. 160 00:10:45,800 --> 00:10:49,240 I also run SecurityTube and Pentester Academy. 161 00:10:53,420 --> 00:10:55,680 So you probably already know me. 162 00:10:55,800 --> 00:11:02,000 Well, those of you who have used AircrackNG or any of the GUI tools like FernWifi, Jerix, 163 00:11:02,100 --> 00:11:05,040 and all those ones that are using underneath AircrackNG. 164 00:11:06,000 --> 00:11:15,040 I also created a long time ago the offensive security course, Waifu, which has been renamed to Virus Attacks. 165 00:11:15,040 --> 00:11:18,200 And I speak and train at multiple conventions. 166 00:11:19,960 --> 00:11:26,340 I'm now self-employed, so I do InfoSec trainings, Linux consulting, and software development. 167 00:11:30,400 --> 00:11:31,900 This was supposed to be back. 168 00:11:32,000 --> 00:11:33,120 I authored a couple of books. 169 00:11:33,980 --> 00:11:36,200 I think while playing with the keyboard it probably... 170 00:11:36,200 --> 00:11:36,660 Okay. 171 00:11:37,700 --> 00:11:38,700 The agenda. 172 00:11:38,980 --> 00:11:41,400 So we have a lot of exciting things today. 173 00:11:41,400 --> 00:11:45,580 We are going to be looking at 802.11 basics. 174 00:11:45,980 --> 00:11:50,580 Understand the current challenges at trying to monitor 11ac. 175 00:11:51,580 --> 00:11:55,380 Look at different commodity hardware we could use to get started. 176 00:11:55,800 --> 00:12:00,960 And then see how we can create our own custom OpenWrt solution. 177 00:12:01,480 --> 00:12:10,140 So we could pretty much run tools like Aerodump, Aircrack, Host, even Python on some of these commodity hardware routers. 178 00:12:10,140 --> 00:12:13,440 And create your monitoring attack defense platform. 179 00:12:15,740 --> 00:12:25,300 After we cover that, Thomas will show you how to go ahead, capture the packets, analyze them using a little tool he's created called WifiBeat. 180 00:12:26,780 --> 00:12:27,340 Okay. 181 00:12:27,840 --> 00:12:33,120 So let's step back if you remember the last 10 golden years of Wifi monitoring. 182 00:12:33,860 --> 00:12:36,480 Right, when we had just A, B, and G networks. 183 00:12:37,420 --> 00:12:40,120 Typically a single input, single output system. 184 00:12:40,880 --> 00:12:41,880 Extremely easy, right? 185 00:12:42,020 --> 00:12:44,600 We had our alpha cards, the directional antennas. 186 00:12:45,260 --> 00:12:48,320 Set the card on the same channel as the access point. 187 00:12:48,440 --> 00:12:49,260 Start monitoring. 188 00:12:49,520 --> 00:12:50,820 You get to see all the packets. 189 00:12:51,420 --> 00:12:53,400 Right? It was wonderful. It was paradise. 190 00:12:56,060 --> 00:13:02,540 And then N and 11ac came along and started making matters bad for us. 191 00:13:03,560 --> 00:13:06,460 So what is so complicated about N and 11ac? 192 00:13:06,460 --> 00:13:09,940 What is it about N and 11ac that requires us to create a custom solution? 193 00:13:10,440 --> 00:13:19,680 And why using a USB based adapter, which we are all used to, does not scale or work properly as we move along 11ac speeds. 194 00:13:20,460 --> 00:13:25,040 So the very first feature with N and 11ac have is channel bonding. 195 00:13:25,800 --> 00:13:32,940 Now putting it simply, with A, B, and G what we really had was 20 megahertz channels. Right? 196 00:13:32,940 --> 00:13:39,020 N and 11ac said, hey, why not combine both of these channels to adjacent ones. 197 00:13:39,320 --> 00:13:41,300 There are other variations as well. 198 00:13:41,440 --> 00:13:43,880 And create a 40 megahertz channel. 199 00:13:44,720 --> 00:13:51,180 From our perspective, if you want to monitor a network using 40 megahertz, using channel bonding. 200 00:13:51,560 --> 00:13:55,880 You need to ensure that your card supports channel bonding as well. 201 00:13:56,620 --> 00:14:02,540 A very common question which I get from pen testers in the field is, hey, you know, I am monitoring this network. 202 00:14:02,540 --> 00:14:03,160 I see nothing. 203 00:14:03,800 --> 00:14:12,740 Well that is because either you have a 20 megahertz only card or you have a card which can operate on 40 but you set it on 20. 204 00:14:13,880 --> 00:14:16,480 One of the most common mistakes I have seen people do. 205 00:14:16,880 --> 00:14:25,520 So channel bonding requires you to have compatible hardware and to make sure that you set the channel appropriately. 206 00:14:27,620 --> 00:14:30,280 Then we have 5 gigahertz channels. Right? 207 00:14:30,280 --> 00:14:31,760 A bunch of channels. 208 00:14:32,620 --> 00:14:35,800 Some of them of course you can use 36 to 48. 209 00:14:36,140 --> 00:14:38,060 And then you have DFS channels. 210 00:14:39,020 --> 00:14:41,660 Which are dynamic frequency selection channels. 211 00:14:42,360 --> 00:14:46,960 So on these channels there could be radar or other communication happening. 212 00:14:47,500 --> 00:14:52,920 And what access points are required to do is sense those channels. 213 00:14:53,040 --> 00:14:59,360 And if they see that there is any form of radar or any other communication then to back off and not use them. 214 00:15:00,280 --> 00:15:02,320 Now this is great. 215 00:15:02,540 --> 00:15:06,480 Unfortunately the bad guys if you are monitoring a network don't play by the rules. 216 00:15:07,240 --> 00:15:16,880 So I have even seen a lot of million dollar 11ac monitoring products actually back off from channels where there is radar communication happening. 217 00:15:17,440 --> 00:15:27,680 But attackers can very easily create back door APs, rogue APs on these channels even though there is probably something happening there. Right? 218 00:15:27,680 --> 00:15:37,580 So our monitoring solution also requires that we sense and monitor all channels regardless of other transmissions. 219 00:15:38,080 --> 00:15:42,580 Which might, depending on the jurisdiction you are in, mean you need permission. 220 00:15:45,040 --> 00:15:56,820 So from an attacker or a defender's perspective we need to make sure that the regulatory domains which we are setting on the monitoring platform is coherent with what we want to do. 221 00:15:56,820 --> 00:15:57,060 Right? 222 00:15:57,140 --> 00:16:00,060 Again, one of the most common mistakes I have seen people do. 223 00:16:00,260 --> 00:16:06,340 They start monitoring, don't see any traffic from some channels, they just assume nothing is happening there. 224 00:16:06,780 --> 00:16:10,240 In all probability your card is probably not even going on those channels. 225 00:16:11,400 --> 00:16:17,180 Okay, if that wasn't enough, NNAC has MIMO. Right? Multiple input, multiple output. 226 00:16:18,020 --> 00:16:25,400 Very simply put, this is really multiple transmission and receiving antennas, all of them sending out the signal. 227 00:16:25,400 --> 00:16:37,980 The DSP on the receiver side is going to pick up these signals from these different receiving antennas and combine them intelligently so you have a much more powerful, stable signal. 228 00:16:40,500 --> 00:16:44,900 Now with NNAC, they actually brought in an additional complexity. 229 00:16:46,080 --> 00:16:53,200 So the ideal case is if you want high reliability, you would want to transmit the same signal. 230 00:16:53,200 --> 00:16:56,500 Let's say from both the antennas. Right? 231 00:16:56,840 --> 00:17:01,780 Now in NNAC, you have what are called spatial streams. 232 00:17:02,930 --> 00:17:08,260 So this is really trying to go ahead and get higher throughput at the cost of reliability. 233 00:17:09,100 --> 00:17:20,960 So what they do is we have a high bit rate signal and they split that signal up and every antenna is actually going to transmit part of that signal. 234 00:17:20,960 --> 00:17:25,700 So now each antenna is really sending a part of that data stream. 235 00:17:26,120 --> 00:17:31,780 On the receiver side, they have a lot of DSP going on which can intelligently combine that together. 236 00:17:32,400 --> 00:17:40,720 So essentially, now we have multiple spatial streams which send data independently of each other. 237 00:17:42,820 --> 00:17:46,900 In the case of N, we can have four streams. That is the maximum. 238 00:17:47,400 --> 00:17:50,620 I've seen most commercial equipment go up to three streams. 239 00:17:50,620 --> 00:17:52,380 But you can do four streams. 240 00:17:52,920 --> 00:17:58,840 With AC, we can go all the way up to eight streams, which is quite a lot. 241 00:17:59,720 --> 00:18:08,620 Just to give you an example, all your phones, or rather most of your phones, which even are 11ac compatible, are probably single stream. 242 00:18:10,020 --> 00:18:12,740 Most of your laptops probably are two stream. 243 00:18:13,410 --> 00:18:19,060 The last I checked, only the MacBook Pro was three stream. Right? 244 00:18:19,060 --> 00:18:20,420 So keep that in mind. 245 00:18:20,680 --> 00:18:28,420 From our perspective, if you're monitoring a network which is four stream or eight stream and you do not have compatible hardware, 246 00:18:28,960 --> 00:18:33,080 you're probably not going to see most of the data being sent. Right? 247 00:18:33,240 --> 00:18:34,640 Again, very, very important. 248 00:18:35,420 --> 00:18:41,060 So pen testers buy equipment. Again, I've seen that teaching Wi-Fi security now for ten years. 249 00:18:41,440 --> 00:18:44,540 They go to the field, start monitoring, don't see anything. 250 00:18:45,500 --> 00:18:48,280 And then you realize they have a single stream adapter. 251 00:18:48,280 --> 00:18:51,820 While the network is operating completely in four streams. 252 00:18:52,880 --> 00:18:56,200 So this is important. Keep this in mind. 253 00:18:56,280 --> 00:19:03,160 You have to purchase equipment which is compatible with the number of streams of the network you're trying to monitor. 254 00:19:04,920 --> 00:19:06,480 Okay, if that wasn't enough. 255 00:19:07,260 --> 00:19:11,300 They also came out with CU and MU-MIMO. 256 00:19:11,380 --> 00:19:12,640 So what is this all about? 257 00:19:13,680 --> 00:19:17,920 CU-MIMO is really 11n and AC wave one. 258 00:19:18,600 --> 00:19:22,560 Now we talked about the fact that we have multiple streams. Right? 259 00:19:22,580 --> 00:19:25,580 Four streams, eight streams. That's what these APs can do. 260 00:19:25,880 --> 00:19:31,620 But the clients themselves unfortunately can be one, two stream in general. 261 00:19:32,600 --> 00:19:41,540 So with CU-MIMO or single user MIMO, the access point time division multiplexes between these devices. 262 00:19:42,100 --> 00:19:47,760 So let's say we have a laptop which is four stream and two mobile phones which are single stream. 263 00:19:47,920 --> 00:19:51,200 The access point is going to multiplex between them. 264 00:19:51,280 --> 00:19:53,900 So it talks four stream to the four stream laptop. 265 00:19:54,120 --> 00:19:57,680 It talks, you know, single stream to the single stream mobile phones. 266 00:19:58,800 --> 00:20:01,880 As you can clearly see, that is not optimal. Right? 267 00:20:01,920 --> 00:20:10,020 It's more like a hub model where when an AP is talking to a device, it's essentially just occupying the channel with just that device. 268 00:20:10,580 --> 00:20:16,500 So with MU-MIMO, which is really bleeding edge, 11 AC wave two. 269 00:20:16,500 --> 00:20:22,300 What they try to do is actually simultaneously talk to multiple devices. 270 00:20:24,360 --> 00:20:31,220 So in that figure which we have, let's say the laptop has two streams and we have two mobile phones, single stream each. 271 00:20:31,500 --> 00:20:39,320 The access point can simultaneously talk to the two stream laptop and the two single stream mobile phones. Right? 272 00:20:39,420 --> 00:20:43,520 There are some limitations. There are some cases of how grouping and all of that happens. 273 00:20:43,520 --> 00:20:45,500 But this is the overall view. 274 00:20:48,100 --> 00:20:54,420 Another example, a four stream AP on the left can talk to four single stream clients. 275 00:20:54,780 --> 00:21:02,040 Or the same four stream AP can talk to two single stream clients and one two stream client. Okay? 276 00:21:04,900 --> 00:21:06,800 Okay. More challenges. 277 00:21:07,580 --> 00:21:12,500 And as you can clearly see how vastly ABG versus NNAC differs. 278 00:21:12,500 --> 00:21:15,040 Especially as we move towards wave two. 279 00:21:15,800 --> 00:21:20,300 So additionally, what we have with AC is also beam forming. 280 00:21:20,740 --> 00:21:22,060 So what is beam forming? 281 00:21:23,480 --> 00:21:31,380 Now, previously in the good old days, we used to have an access point, typically omnidirectional, sending out power in all directions. Right? 282 00:21:31,580 --> 00:21:39,880 So which means if the AP is communicating with a client here, an attacker is located in the other direction, he might still be able to pick it up. 283 00:21:40,500 --> 00:21:47,540 Unfortunately, what they decided to do, and this is unfortunate for us, good for, of course, the larger consumer market, 284 00:21:48,120 --> 00:21:56,800 is now they actually try to detect the direction in which the client or the device, either party is communicating with, 285 00:21:56,960 --> 00:22:00,080 and they try to channelize the energy in that direction. 286 00:22:01,020 --> 00:22:07,800 So this way, it is more directed, which means you get more range, and of course, this is an optimal solution. 287 00:22:08,380 --> 00:22:11,380 From our perspective, location matters. 288 00:22:12,380 --> 00:22:16,120 Right? You just can't get away now with just having, I mean, the physics is against you. 289 00:22:16,480 --> 00:22:24,140 Unless you are Neo from Matrix, you are probably going to have to have more sensors or an optimal location. 290 00:22:25,800 --> 00:22:35,420 Okay. So to summarize, NNAC actually bring about a lot of additional features, which is going to make monitoring more and more difficult. 291 00:22:35,880 --> 00:22:37,460 Couple of them, as I mentioned. 292 00:22:37,460 --> 00:22:43,720 Location, channel width, you know, we have 2040. With AC, that can be 80 and even 160. 293 00:22:44,800 --> 00:22:50,720 The 160 MHz equipment, I have not seen too many enterprises use, but the adoption is increasing. 294 00:22:51,260 --> 00:22:57,380 Probably a year, year and a half from now, you should see more and more 160 MHz 11AC networks. 295 00:22:58,280 --> 00:23:05,460 We are packing more bits per MHz, so the QAM, or the Quadrature Amplitude Modulation, that is increasing as well. 296 00:23:05,580 --> 00:23:07,440 All the way to 256 MHz. 297 00:23:07,440 --> 00:23:14,040 QAM for 11AC. Spatial streams increase, beamforming, MIMO, and all the stuff we talked about. 298 00:23:15,600 --> 00:23:22,660 Of course, with all of this new technology coming in, you have the monster APs invading, right? 299 00:23:23,140 --> 00:23:28,820 You may have seen a lot of these photographs with 6, 10, 12, you know, how many ever antennas. 300 00:23:29,680 --> 00:23:33,640 And with, of course, every antenna getting added, the price gets bumped as well. 301 00:23:36,060 --> 00:23:44,400 Some of these are pretty powerful platforms. And many of them are actually based off OpenWRT and other Linux platforms. 302 00:23:45,200 --> 00:23:53,200 The sad part, not all vendors acknowledge that publicly, but if you just try to log into the box and do a little bit of digging, 303 00:23:53,460 --> 00:24:01,900 you'll actually find almost 50% of these APs are just running Linux based on OpenWRT, DDWRT, or one of the other variants. 304 00:24:04,380 --> 00:24:08,380 Interestingly, when I bought the ASUS one for one of the trainings we were conducting, 305 00:24:08,740 --> 00:24:14,560 I even saw this little home assessment kind of banner ad. I don't know if you've seen it. 306 00:24:15,240 --> 00:24:19,980 So, now you can actually invite a wireless expert to your home. 307 00:24:21,200 --> 00:24:24,180 So he can lay everything out for you in an optimal way. 308 00:24:24,360 --> 00:24:28,560 And of course, then your neighbor in the next apartment decides to change his AP's locations. 309 00:24:29,580 --> 00:24:31,920 And then you have to call him all back again. 310 00:24:35,420 --> 00:24:43,680 Okay, this is just a diagram of how you could go ahead and use multiple radios and chain together more and more bandwidth. 311 00:24:45,200 --> 00:24:48,700 So, to summarize, these are the challenges we are looking at. 312 00:24:48,780 --> 00:24:54,380 Beamforming, challenge of course, location matters. Spatial stream count. 313 00:24:54,980 --> 00:25:03,440 We have to ensure that our capturing and monitoring platform has equal number of spatial streams as the network we are lying to monitor. 314 00:25:03,640 --> 00:25:08,780 High speed. Now, this is really where I'm going to disappoint many of you. 315 00:25:09,160 --> 00:25:16,860 Because as these networks are really fast, unfortunately you'll find that USB based solutions aren't going to work anymore. 316 00:25:17,280 --> 00:25:23,480 So I'm sorry if I had to break the bad news. But we really cannot use USB anymore. 317 00:25:23,880 --> 00:25:28,120 Unless all you're interested in is just macro statistics. Right? 318 00:25:28,180 --> 00:25:31,240 If you want to do deep packet inspection, look at what is happening. 319 00:25:31,840 --> 00:25:35,160 You know, at a much more micro level. Detect threats and all of that. 320 00:25:35,260 --> 00:25:41,340 Anomaly time correlation or spatial correlation. You do require a much more robust solution. 321 00:25:41,640 --> 00:25:42,720 Which is what we're going to talk about. 322 00:25:43,920 --> 00:25:47,440 Multiple channels. Channel bonding. Again, compatible hardware. 323 00:25:49,740 --> 00:25:53,840 Okay. So, as I mentioned, I'm going to go a bit fast. We have a lot to cover. 324 00:25:54,100 --> 00:25:56,740 I'll take call questions at the end and even outside. 325 00:25:57,960 --> 00:26:00,240 Okay. So, as I mentioned. 326 00:26:00,240 --> 00:26:05,120 The Wi-Fi adapters, especially the USB ones, aren't going to be very useful. 327 00:26:05,480 --> 00:26:08,500 So, what we want to do is AP based monitoring. 328 00:26:13,800 --> 00:26:18,840 Now, there are many commercial APs available which are based on open source. 329 00:26:20,340 --> 00:26:24,760 I've tested probably over a hundred. I'm not kidding you. Over a hundred. 330 00:26:25,440 --> 00:26:29,540 The ones which I've found really good, reasonably priced, 331 00:26:29,540 --> 00:26:32,320 is the Ubiquity range. I don't work for them. 332 00:26:33,940 --> 00:26:37,480 And I don't have a referral code anywhere there. So, just so you know. 333 00:26:38,980 --> 00:26:44,500 So, Ubiquity actually has a series of UniFi APs. Some of you might have already bought it. 334 00:26:45,160 --> 00:26:50,340 These are based out of OpenWrt. I don't see that acknowledged anywhere on their website. 335 00:26:50,560 --> 00:26:56,780 Or maybe my search skills are bad. But after digging a little deep, what I've found is it's just OpenWrt. 336 00:26:58,120 --> 00:27:06,340 So, what we are going to do is pick up one of these access points and see if we can do something with them. 337 00:27:06,460 --> 00:27:14,440 First with whatever manufacturer firmware is in it and then see how we can load our own customized firmware 338 00:27:14,440 --> 00:27:17,900 so we can port attack tools and all of that in it. Okay? 339 00:27:19,160 --> 00:27:26,760 So, the USC AC Pro. Now, these little access points are supposed to be either cloud based 340 00:27:26,760 --> 00:27:30,900 or to be controlled by a local embedded controller. 341 00:27:31,500 --> 00:27:36,380 Now, when you buy them, my recommendation if you want to use it for monitoring, 342 00:27:36,760 --> 00:27:39,160 do not connect and provision them. 343 00:27:40,900 --> 00:27:46,400 Rolling back all of the stuff the provisioning scripts do is a couple of hours of work. 344 00:27:47,500 --> 00:27:54,080 So, just buy them, take it out of the box, power it up and just wait for two to three minutes. 345 00:27:54,320 --> 00:27:55,660 What happens is, 346 00:27:55,660 --> 00:28:01,200 the AC Pro tries to get a DHCP address so it can connect to a cloud system. 347 00:28:02,100 --> 00:28:14,320 When it fails, the entire Unify series goes ahead and assumes a static IP address which is 192.168.1.20. 348 00:28:14,500 --> 00:28:19,460 Right? It's a predictable single IP which the entire range of APs take. 349 00:28:21,200 --> 00:28:23,820 The good news, SSH is enabled. 350 00:28:23,820 --> 00:28:27,620 Because SSH is what is used to provision these APs. 351 00:28:29,980 --> 00:28:32,340 Do we have to reverse engineer the firmware? 352 00:28:32,840 --> 00:28:37,620 You know, use an IDA, do something to get the default username and password? No. 353 00:28:39,820 --> 00:28:43,720 Someone posted that on the forums. The default username is UBNT. 354 00:28:44,460 --> 00:28:46,840 And the password is? UBNT. 355 00:28:50,640 --> 00:28:52,780 So, what I've done is, 356 00:28:52,780 --> 00:28:54,800 this is an access point which I've bought. 357 00:28:55,980 --> 00:28:59,180 Contains the manufacturer firmware. No modification made. 358 00:28:59,660 --> 00:29:01,660 I've just powered it up. It uses PoE. 359 00:29:02,480 --> 00:29:07,420 And now, I'm going to go ahead and log into the AP. 360 00:29:10,020 --> 00:29:12,780 So, it is going to be difficult to type with one hand. 361 00:29:13,440 --> 00:29:14,160 I'll try. 362 00:29:16,100 --> 00:29:22,760 Okay. So, the IP address as I mentioned was 192.168.1.20. 363 00:29:22,760 --> 00:29:26,220 And the passphrase or the password is UBNT. 364 00:29:26,760 --> 00:29:31,700 As soon as you log in, people who've worked with embedded systems or routers, 365 00:29:31,900 --> 00:29:34,360 that must be a familiar prompt, right? 366 00:29:35,060 --> 00:29:37,960 Busy box. Is this visible at the back? 367 00:29:40,280 --> 00:29:43,120 Okay. Now, the first thing which I like to do, 368 00:29:43,140 --> 00:29:47,220 and I'm kind of running you through how I experiment with newer platforms which I look at, 369 00:29:47,380 --> 00:29:52,600 is just hit that twice and look at all the built-in utilities, 370 00:29:52,600 --> 00:29:53,020 all the utilities available. 371 00:29:53,780 --> 00:29:59,040 A lot of times, manufacturers may have, you know, most utilities you would require, 372 00:29:59,760 --> 00:30:03,060 which is the case for the Ubiquity series. 373 00:30:03,320 --> 00:30:04,520 So, if I were to just scroll up, 374 00:30:06,880 --> 00:30:09,500 I always love to see iwconfig 375 00:30:10,200 --> 00:30:13,260 because this allows me to quickly look at interfaces, you know, 376 00:30:13,260 --> 00:30:16,160 without having to go around in circles. 377 00:30:16,760 --> 00:30:21,560 And then, I actually find that there is a wlan-config, which is fantastic. 378 00:30:21,560 --> 00:30:22,660 Come to that. 379 00:30:23,800 --> 00:30:26,940 We have wpa-supplicant, host-apd, 380 00:30:30,240 --> 00:30:31,920 and a couple of other utilities. 381 00:30:32,700 --> 00:30:38,620 So, let's actually run iwconfig and look at what interfaces are available on this system. 382 00:30:39,400 --> 00:30:42,800 So, we have at 0 and at 1. 383 00:30:43,180 --> 00:30:47,540 And if you notice, at 0 is currently in master mode. 384 00:30:47,760 --> 00:30:51,220 So, when it says mode master, it just means it's an access point. 385 00:30:51,560 --> 00:30:51,820 Okay? 386 00:30:52,740 --> 00:30:55,820 We can see this is the 2.4 gigahertz radio. 387 00:30:56,060 --> 00:30:58,200 So, this actually has two radios in it. 388 00:30:58,540 --> 00:31:01,340 One for 2.4, the other for 5. Fantastic. 389 00:31:01,880 --> 00:31:03,980 So, we don't require two APs. 390 00:31:04,160 --> 00:31:09,080 We can just use one platform to monitor both the bands. 391 00:31:10,580 --> 00:31:11,920 Then, you have at 1. 392 00:31:12,860 --> 00:31:15,180 Interestingly, this seems to be managed mode. 393 00:31:15,940 --> 00:31:19,380 And at 1, of course, is the 5 gigahertz radio. Great. 394 00:31:21,800 --> 00:31:24,020 Unfortunately, can't do anything with these interfaces. 395 00:31:25,720 --> 00:31:29,880 So, what I'd like to do is destroy these interfaces 396 00:31:30,560 --> 00:31:35,040 and go ahead and create monitor mode interfaces in turn, which we can use. 397 00:31:35,320 --> 00:31:35,600 Right? 398 00:31:36,440 --> 00:31:41,340 Again, a lot of hit and trial, and what I've actually found is 399 00:31:41,340 --> 00:31:45,120 even though you should be able to destroy these interfaces directly, 400 00:31:45,500 --> 00:31:49,360 it's always a good idea to kind of bring them down before you destroy them. 401 00:31:49,360 --> 00:31:49,960 Okay? 402 00:31:50,920 --> 00:31:52,480 So, let me bring these down. 403 00:31:52,620 --> 00:31:53,480 I'm going to bring these down. 404 00:31:53,560 --> 00:31:54,800 At 0, down. 405 00:31:57,400 --> 00:31:59,080 And then at 1, down. 406 00:32:03,440 --> 00:32:10,160 Now, to destroy them, we are going to use the WLAN config utility. 407 00:32:10,620 --> 00:32:12,060 Again, let me reiterate. 408 00:32:12,320 --> 00:32:17,460 Every single utility right now is built in with the manufacturer firmware. 409 00:32:18,080 --> 00:32:18,240 Right? 410 00:32:18,240 --> 00:32:20,560 These are not my additions. 411 00:32:20,980 --> 00:32:22,640 We'll come to my additions later. 412 00:32:23,260 --> 00:32:30,120 So, the usage to destroy an interface is as simple as it can get. 413 00:32:30,660 --> 00:32:35,940 WLAN config at 0, destroy. 414 00:32:39,020 --> 00:32:43,800 And then WLAN config at 1, destroy. 415 00:32:45,220 --> 00:32:48,120 Now, if we look at the list of interfaces, 416 00:32:49,140 --> 00:32:52,560 we see that at 0 and at 1 have been destroyed. 417 00:32:52,960 --> 00:32:53,180 Right? 418 00:32:53,440 --> 00:32:55,920 Now, keep in mind, this is the running config. 419 00:32:56,200 --> 00:32:58,120 I haven't saved this in a persistent way, 420 00:32:58,240 --> 00:33:01,700 and I'll talk about that later when we look at our customizations. 421 00:33:02,060 --> 00:33:02,420 Right? 422 00:33:03,440 --> 00:33:06,040 So, now that we've destroyed both of these, 423 00:33:06,180 --> 00:33:10,500 we'd like to create monitor mode interfaces which we can use. 424 00:33:11,220 --> 00:33:13,800 Again, WLAN config comes to our rescue. 425 00:33:14,060 --> 00:33:16,120 I mean, unbelievably simple. 426 00:33:16,120 --> 00:33:18,500 All you have to do is WLAN config. 427 00:33:18,940 --> 00:33:21,620 Let's name the monitor mode interface. 428 00:33:21,840 --> 00:33:23,540 So, let's actually call this mon0, 429 00:33:23,740 --> 00:33:25,280 the first monitor mode interface. 430 00:33:25,720 --> 00:33:27,180 I'm going to say create. 431 00:33:27,500 --> 00:33:30,240 And again, all I'm doing is copying this command out. 432 00:33:33,300 --> 00:33:34,200 WLAN dev. 433 00:33:34,860 --> 00:33:38,200 Now, you want to create this virtual monitor mode interface 434 00:33:38,200 --> 00:33:40,480 on top of one of the cards. 435 00:33:40,720 --> 00:33:42,720 So, I'm going to be using WIFI 0. 436 00:33:42,860 --> 00:33:43,300 Right? 437 00:33:43,300 --> 00:33:43,980 The first card. 438 00:33:48,400 --> 00:33:50,540 And then, the WLAN mode. 439 00:33:52,200 --> 00:33:54,180 I am typing with one hand, so. 440 00:33:56,960 --> 00:34:00,000 And of course, the option is monitor. 441 00:34:03,640 --> 00:34:04,200 Okay. 442 00:34:04,400 --> 00:34:09,040 So, what this is going to do is create a new interface mon0 443 00:34:10,120 --> 00:34:12,940 as a virtual adapter on top of WIFI 0. 444 00:34:13,300 --> 00:34:15,100 And this will be a monitor mode interface. 445 00:34:15,360 --> 00:34:15,540 Right? 446 00:34:15,700 --> 00:34:18,060 So, I hit an enter. 447 00:34:18,360 --> 00:34:22,580 It goes ahead and echoes back mon0, 448 00:34:22,740 --> 00:34:23,960 which means everything went well. 449 00:34:25,120 --> 00:34:29,500 Similarly, I'm going to go ahead and create mon1 450 00:34:29,500 --> 00:34:31,120 on top of WIFI 1. 451 00:34:33,180 --> 00:34:33,740 Fantastic. 452 00:34:33,960 --> 00:34:36,360 Now, we have two monitor mode interfaces. 453 00:34:36,780 --> 00:34:37,920 Let's bring them up. 454 00:34:38,200 --> 00:34:41,440 So, if config mon0 up. 455 00:34:41,980 --> 00:34:43,740 And then, mon1 up. 456 00:34:46,320 --> 00:34:47,920 Let's type in iwconfig. 457 00:34:48,500 --> 00:34:49,560 And there we are. 458 00:34:49,840 --> 00:34:50,220 Right? 459 00:34:50,560 --> 00:34:53,140 So, what we've done so far, if I were to summarize, 460 00:34:53,280 --> 00:34:57,820 is we've removed the interfaces the manufacturer had by default. 461 00:34:58,320 --> 00:35:04,140 And we've created monitor mode interfaces on the box. 462 00:35:04,580 --> 00:35:07,060 So, now, let's actually set this to a channel. 463 00:35:07,160 --> 00:35:10,120 So, I'm going to go ahead and say iwconfig mon0. 464 00:35:11,240 --> 00:35:12,640 Channel 6. 465 00:35:15,760 --> 00:35:18,320 Now, we'd like to look at the packets. 466 00:35:20,260 --> 00:35:23,620 Good news, tcpdump is also in there. 467 00:35:28,000 --> 00:35:31,700 So, tcpdump-i mon0. 468 00:35:34,940 --> 00:35:36,360 And there you go. 469 00:35:36,360 --> 00:35:41,700 So, we are now monitoring 2.4 gigahertz, channel 6. 470 00:35:42,860 --> 00:35:43,720 Where's the clapping? 471 00:35:46,580 --> 00:35:47,760 Thank you. Thank you. 472 00:35:51,860 --> 00:35:55,360 I haven't slept the whole night because I had to kind of flash firmware. 473 00:35:55,560 --> 00:35:56,540 So, you guys have to keep me awake. 474 00:35:57,880 --> 00:36:01,280 We have a booth and just trying to flash firmware for it. 475 00:36:02,540 --> 00:36:05,020 Okay. So, this is good. This is great. 476 00:36:05,020 --> 00:36:07,100 Bad news, right? 477 00:36:07,160 --> 00:36:09,460 The device does not have storage capacity. 478 00:36:09,760 --> 00:36:13,840 It probably has around 10 megabit or something like that. 479 00:36:14,920 --> 00:36:19,000 Well, what they did is they've kind of removed some functionality here or there. 480 00:36:19,320 --> 00:36:21,840 But I'll show you how to find the disk size in just a bit. 481 00:36:22,200 --> 00:36:24,840 But we can't do anything on this device. 482 00:36:25,200 --> 00:36:30,520 Well, we can look at the packets using tcpdump and that's great from a research standpoint. 483 00:36:30,700 --> 00:36:32,400 But, you know, what more? 484 00:36:32,400 --> 00:36:41,740 So, what we can do is stream packets from this device using SSH back to a central server 485 00:36:42,380 --> 00:36:50,260 where we can analyze them as a pcap file or actually even just have Wireshark receive that stream and look at it live. 486 00:36:51,980 --> 00:36:53,760 So, let's do that. 487 00:36:57,160 --> 00:36:58,520 This is the command. 488 00:37:00,640 --> 00:37:02,340 Let's explain the command in a bit. 489 00:37:13,980 --> 00:37:18,840 Okay. So, what this command does and now I'm running this on my host machine, right? 490 00:37:18,900 --> 00:37:21,020 Which is connected to this box. 491 00:37:21,360 --> 00:37:27,060 Now, keep in mind that you could connect this to even your local network in your enterprise 492 00:37:27,060 --> 00:37:29,480 and still stream it to any server. 493 00:37:29,680 --> 00:37:35,980 This doesn't necessarily have to be connected physically to the collection, you know, station, right? 494 00:37:36,360 --> 00:37:40,360 So, all I'm doing is logging in using SSH. 495 00:37:41,300 --> 00:37:43,160 The user name is ubnt. 496 00:37:43,780 --> 00:37:46,060 The IP address is 1.20. 497 00:37:50,360 --> 00:37:51,980 Twenty more minutes? Okay. 498 00:37:52,360 --> 00:37:53,880 I'm just going to be a bit fast. 499 00:37:54,040 --> 00:37:55,140 You don't have too much time. 500 00:37:56,360 --> 00:38:04,000 And then I'm going to invoke tcpdump, give it mon0, tell it to snap the entire packet length 501 00:38:04,000 --> 00:38:11,080 and then write it to, you know, stdout which comes back over SSH and gets piped into Wireshark. 502 00:38:11,220 --> 00:38:12,860 K is start immediately. 503 00:38:13,260 --> 00:38:16,220 I is interface which is the input, right? 504 00:38:16,420 --> 00:38:22,780 So, once I go ahead and run this, Wireshark pops up assuming you have that stored locally. 505 00:38:23,400 --> 00:38:31,440 Now, the moment I log in, packets will get automatically streamed into Wireshark. 506 00:38:33,040 --> 00:38:33,780 Isn't that cool? 507 00:38:40,580 --> 00:38:48,180 And you can go ahead and write your own channel hopper, you know, simple bash script or, you know, something similar and that work as well. 508 00:38:48,400 --> 00:38:52,760 So, this is how you can go ahead, get the packets from the device to a remote device. 509 00:38:52,760 --> 00:38:53,600 This is a remote collection server. 510 00:38:54,120 --> 00:39:00,880 You could even just go ahead, redirect this into a file and then have multiple utilities read from it. 511 00:39:01,740 --> 00:39:02,180 Great. 512 00:39:02,500 --> 00:39:09,480 Now, this isn't enough, right? 513 00:39:09,640 --> 00:39:11,200 We want to run Thomas's tool. 514 00:39:11,440 --> 00:39:12,960 I mean, he's been a good friend for ten years. 515 00:39:13,060 --> 00:39:13,900 This is the least I could do. 516 00:39:15,700 --> 00:39:18,380 So, we want to run arrow dump ng on it. 517 00:39:18,460 --> 00:39:20,240 We want to run, you know, python on it. 518 00:39:20,320 --> 00:39:22,680 We want to run pretty much whatever we want. 519 00:39:22,680 --> 00:39:22,880 Right? 520 00:39:23,340 --> 00:39:26,340 So that we can convert this into a fully customized platform. 521 00:39:29,100 --> 00:39:30,440 So, there are a lot of steps. 522 00:39:30,620 --> 00:39:36,720 What I'm going to be doing is I've shot videos of every step which you guys can look at later of how to install the firmware. 523 00:39:37,180 --> 00:39:38,260 It's pretty straightforward. 524 00:39:38,780 --> 00:39:40,040 We don't have enough time. 525 00:39:40,300 --> 00:39:44,360 So, I'm just going to go through it in the slides and at the end, I'm going to give you a link which you can use. 526 00:39:45,420 --> 00:39:50,180 So, all we do is download a compatible open WRT. 527 00:39:50,180 --> 00:39:54,120 And basically write that onto the device. 528 00:39:54,320 --> 00:39:54,700 Okay? 529 00:39:54,720 --> 00:39:55,420 Using MTD. 530 00:39:56,740 --> 00:39:59,800 Once we do that, we can restart the device. 531 00:40:00,080 --> 00:40:00,980 Extremely straightforward. 532 00:40:01,200 --> 00:40:01,860 Nothing complex. 533 00:40:02,500 --> 00:40:03,500 Restart the device. 534 00:40:03,820 --> 00:40:06,540 You get a familiar open WRT prompt. 535 00:40:06,700 --> 00:40:15,240 If you haven't used it, open WRT is, you know, an embedded Linux used by a lot of commercial routers, both home as well as enterprise grade. 536 00:40:16,520 --> 00:40:17,420 Extremely flexible. 537 00:40:17,420 --> 00:40:19,760 Has a lot of package management and support. 538 00:40:20,040 --> 00:40:28,200 From a security perspective, Aircrack NG, MDK3, Skp, a lot of these tools are supported in the package manager itself. 539 00:40:28,440 --> 00:40:31,100 So, you don't have to do any of the cross-compiling exercise. 540 00:40:32,020 --> 00:40:36,040 The next thing, of course, which we notice is we only have around 10 megabit. 541 00:40:36,220 --> 00:40:46,380 So, we are going to use a technique called extroot which allows us to extend the root onto an external storage device which is a USB key. 542 00:40:46,380 --> 00:40:49,680 So, this is the modified one. 543 00:40:49,840 --> 00:40:52,100 And if you notice, I have a USB key connected to it. 544 00:40:52,300 --> 00:40:52,640 Right? 545 00:40:52,780 --> 00:40:57,820 It's a 16 gig one, though you can pretty much go as high as you'd like. 546 00:40:58,200 --> 00:41:04,740 So, you could have that external storage and dump everything in it or load the OS and other things from it. 547 00:41:04,840 --> 00:41:05,940 A lot of possibilities. 548 00:41:06,480 --> 00:41:06,780 Okay. 549 00:41:07,620 --> 00:41:09,920 We have to install the ATT 10K drivers. 550 00:41:10,400 --> 00:41:11,720 Again, everything is there. 551 00:41:11,780 --> 00:41:12,940 No cross-compiling required. 552 00:41:13,660 --> 00:41:15,400 Now, what I'm going to do is... 553 00:41:16,280 --> 00:41:20,360 I have gone ahead and put all of this on that device. 554 00:41:20,920 --> 00:41:24,060 And I'm going to now connect to that device and show you how it looks like. 555 00:41:24,160 --> 00:41:24,300 Right? 556 00:41:24,440 --> 00:41:29,040 The entire customization process is very simple. 557 00:41:29,240 --> 00:41:30,700 Just you have to follow the steps. 558 00:41:30,820 --> 00:41:32,080 I'm going to give you videos for that. 559 00:41:32,180 --> 00:41:32,760 Just a second. 560 00:41:46,380 --> 00:41:46,780 Okay. 561 00:41:46,900 --> 00:41:49,760 So, I am connecting to the custom AP now. 562 00:42:00,500 --> 00:42:00,900 Okay. 563 00:42:02,200 --> 00:42:04,320 The demo gods are with me so far. 564 00:42:06,600 --> 00:42:11,120 Let's see if a simple SSH works or if that is what is. 565 00:42:11,200 --> 00:42:11,320 Okay. 566 00:42:11,500 --> 00:42:12,520 Hopefully, this will work. 567 00:42:15,540 --> 00:42:21,880 So, the OpenWrt system, I am root on that unlike UBNT. 568 00:42:22,400 --> 00:42:26,520 I had to check what privileges UBNT was but I'm probably sure it's close to root. 569 00:42:26,680 --> 00:42:27,820 I didn't try installing anything. 570 00:42:28,840 --> 00:42:36,220 And the IP address of my customized device now running OpenWrt is 50.150. 571 00:42:36,620 --> 00:42:41,440 I'm going to SSH into it. 572 00:42:43,320 --> 00:42:44,440 And there you go. 573 00:42:45,380 --> 00:42:48,900 You have to change the welcome message. 574 00:42:49,060 --> 00:42:49,240 Right? 575 00:42:49,260 --> 00:42:49,640 Whymon. 576 00:42:52,560 --> 00:42:54,220 That's all the customization I did. 577 00:42:58,720 --> 00:43:05,320 So, with the manufacturer firmware, of course, we had to go through all the pains of creating the monitor mode interface and all of that. 578 00:43:06,140 --> 00:43:07,720 With the customized one. 579 00:43:16,760 --> 00:43:17,600 Okay. 580 00:43:17,720 --> 00:43:19,440 Looks like the USB key. 581 00:43:24,400 --> 00:43:25,280 It's not connected. 582 00:43:31,540 --> 00:43:33,420 Hard to happen. 583 00:43:34,800 --> 00:43:35,640 Okay. 584 00:43:41,740 --> 00:43:42,380 Okay. 585 00:43:43,040 --> 00:43:43,680 Okay. 586 00:43:59,320 --> 00:44:04,980 So, this does take roughly I think a minute or two to start. 587 00:44:05,100 --> 00:44:05,620 Okay. 588 00:44:05,620 --> 00:44:07,080 Just give me a second. 589 00:44:07,080 --> 00:44:31,060 Give me a second. 590 00:44:32,940 --> 00:44:35,520 Okay, I'm waiting for an IP address. 591 00:44:40,140 --> 00:44:41,780 I should have shortly. 592 00:44:43,920 --> 00:44:44,720 Okay. 593 00:44:46,800 --> 00:44:47,600 Okay. 594 00:45:07,280 --> 00:45:08,100 There we go. 595 00:45:08,240 --> 00:45:08,680 Okay. 596 00:45:08,940 --> 00:45:13,760 So now that I have the USB key connected with all my customizations, 597 00:45:14,540 --> 00:45:18,480 as soon as we log in, you see we see WLAN 0 and WLAN 1. 598 00:45:18,620 --> 00:45:19,020 Do you see that? 599 00:45:20,360 --> 00:45:23,280 So what I've done is I've changed the init scripts, 600 00:45:23,780 --> 00:45:27,040 and these automatically are set to monitor mode. 601 00:45:27,780 --> 00:45:29,480 So we don't have to do anything. 602 00:45:29,580 --> 00:45:30,420 It's just plug and play. 603 00:45:31,460 --> 00:45:33,460 I'm going to quickly just demo three tools. 604 00:45:33,580 --> 00:45:36,100 The videos have a lot more, and then I'm going to give it to Thomas. 605 00:45:37,080 --> 00:45:41,420 The first tool we all love, and we have the creator here with us, 606 00:45:42,520 --> 00:45:44,600 is, of course, AeroDumpNG. 607 00:45:49,000 --> 00:45:50,060 And there you go. 608 00:45:51,300 --> 00:45:51,780 Claps. 609 00:45:53,780 --> 00:45:55,220 I'm going to remind you of it. 610 00:45:58,020 --> 00:45:59,880 So here is AeroDumpNG, 611 00:46:01,080 --> 00:46:04,200 and Thomas has a little plug there which says contact the author. 612 00:46:04,360 --> 00:46:06,280 This is his trick so that he gets fan mail. 613 00:46:10,820 --> 00:46:11,360 So, 614 00:46:13,920 --> 00:46:15,240 along with that, 615 00:46:18,200 --> 00:46:22,700 what I'm going to do is run another tool called Horse. 616 00:46:22,840 --> 00:46:26,400 Now this is actually, you know, quite an underappreciated tool in my opinion. 617 00:46:27,340 --> 00:46:32,200 Horse allows you to do scanning on 5 gigahertz 618 00:46:32,200 --> 00:46:34,840 and is aware of channel bonding and all of that. 619 00:46:36,220 --> 00:46:36,980 There you go. 620 00:46:37,080 --> 00:46:41,840 I use this actually to, you know, hop channels, do other interesting things. 621 00:46:41,960 --> 00:46:42,500 They have an API. 622 00:46:42,760 --> 00:46:45,340 I would highly recommend looking at this tool. 623 00:46:45,740 --> 00:46:50,720 Now, right now, if you notice at the bottom right, we are on channel 60. 624 00:46:50,920 --> 00:46:53,620 At the rate 80 means 80 megahertz, right? 625 00:46:54,500 --> 00:46:55,800 Right here at the bottom. 626 00:46:55,920 --> 00:46:56,820 Might not be too visible. 627 00:46:57,000 --> 00:46:58,920 C8-036 at 80. 628 00:46:59,040 --> 00:47:03,320 So channel 36, 80 megahertz. 629 00:47:05,140 --> 00:47:10,740 I can go ahead and tell it to scan by selecting S. 630 00:47:10,980 --> 00:47:15,200 And this now starts scanning all the channels. 631 00:47:15,480 --> 00:47:20,240 And you can even set it for HD 20, 40, 80, 160, whatever combinations you want. 632 00:47:20,420 --> 00:47:23,660 It has a config file which you can change and modify as well. 633 00:47:25,080 --> 00:47:27,720 The videos have more detailed information. 634 00:47:28,800 --> 00:47:31,880 The last thing I want to quickly show is... 635 00:47:33,180 --> 00:47:35,220 And by the way, you can run MDK3. 636 00:47:35,320 --> 00:47:37,940 You can run all your attack tools on this, right? 637 00:47:38,000 --> 00:47:40,660 Air replay, injection attacks, everything. 638 00:47:41,760 --> 00:47:44,960 The last thing I want to show is for people who love Python. 639 00:47:46,900 --> 00:47:47,860 Skp, right? 640 00:47:49,620 --> 00:47:51,280 So extremely simple code. 641 00:47:51,380 --> 00:47:56,160 It's just a POC just to show you that we can run Skp very easily. 642 00:47:56,360 --> 00:47:58,960 So this is like the simplest Skp code ever. 643 00:47:59,500 --> 00:48:01,740 All it does is monitors the interface. 644 00:48:01,880 --> 00:48:05,220 Takes a number of packets and just prints the summary. 645 00:48:06,580 --> 00:48:07,160 Okay. 646 00:48:32,320 --> 00:48:34,340 Now on the other side, there you go. 647 00:48:34,540 --> 00:48:35,980 So there it is. 648 00:48:36,640 --> 00:48:37,500 Skp running. 649 00:48:38,740 --> 00:48:39,620 People remember. 650 00:48:43,360 --> 00:48:47,340 And of course, you can pretty much port more sniffers and injectors if you want. 651 00:48:48,000 --> 00:48:50,440 So I'm going to give it to Thomas now. 652 00:48:50,520 --> 00:48:55,900 What he's going to show is how you can now take all of these packets and do deep analysis. 653 00:48:56,460 --> 00:48:57,480 You have 10? 654 00:49:29,400 --> 00:49:30,160 Great. 655 00:49:30,400 --> 00:49:31,700 So I created. 656 00:49:31,740 --> 00:49:31,860 Great. 657 00:49:31,860 --> 00:49:34,000 So I created recently another tool called Wi-Fi Beat. 658 00:49:34,340 --> 00:49:48,680 So you store all your packets parsed in Elasticsearch and you can search for them using Kibana or you can use other tools such as ElastAlert to create alerts and send you emails or using other channels. 659 00:49:49,500 --> 00:49:58,760 So I'm going to quickly go through, explain the different Elastic tools, what is Beat, Wi-Fi Beat itself, and the two libraries that I created along with it. 660 00:49:59,060 --> 00:50:01,820 And a quick demo and let you know where you can. 661 00:50:03,240 --> 00:50:05,120 So all the Elastic tools. 662 00:50:05,460 --> 00:50:10,520 So you have Elasticsearch, which is pretty much a NoSQL database and stores JSON documents. 663 00:50:11,480 --> 00:50:15,500 And you have Kibana that does visualization, so it connects to Elasticsearch to do that. 664 00:50:15,920 --> 00:50:23,960 You have Logstash that can connect also to Elasticsearch and stores all the logs from a bunch of different sources. 665 00:50:24,920 --> 00:50:26,740 And you also have Beats. 666 00:50:26,820 --> 00:50:28,480 And Beats are pretty much data shippers. 667 00:50:28,820 --> 00:50:31,840 And it can send data either to Logstash or to Elasticsearch. 668 00:50:31,840 --> 00:50:33,760 Or directly to Elasticsearch. 669 00:50:34,820 --> 00:50:36,240 So here are some of them. 670 00:50:36,300 --> 00:50:38,800 You have FileBeat that reads log files. 671 00:50:39,500 --> 00:50:42,600 Much lighter than Logstash if you only need to read log files. 672 00:50:43,220 --> 00:50:45,180 You have a MetricBeat that does metrics. 673 00:50:46,020 --> 00:50:49,480 WinLogBeat that does Windows logs because Windows had to do something different. 674 00:50:50,720 --> 00:50:52,240 HeatBeat that shows the uptime. 675 00:50:52,380 --> 00:50:56,000 And PacketBeat that does packet monitoring and parsing. 676 00:50:56,480 --> 00:50:59,360 You might think that PacketBeat is the one you're looking for. 677 00:50:59,620 --> 00:51:01,620 But no, it doesn't understand. 678 00:51:01,840 --> 00:51:07,120 PacketBeat is the radio tab, which is the header that comes with Wi-Fi packets, the metadata. 679 00:51:07,660 --> 00:51:09,460 So basically you have all the information. 680 00:51:09,720 --> 00:51:14,120 It says which channel is best captured on, the signal, and a bunch of other information. 681 00:51:14,880 --> 00:51:19,820 So that's the error that appears when you start a program. 682 00:51:20,540 --> 00:51:25,300 So I created Wi-FiBeat as well as two libraries that I needed for it. 683 00:51:25,840 --> 00:51:31,820 So Wi-FiBeat captures all the packets from one or multiple wireless interfaces. 684 00:51:31,840 --> 00:51:34,540 And stores them on Elasticsearch. 685 00:51:34,800 --> 00:51:36,600 So you can even read PCAP files. 686 00:51:38,400 --> 00:51:43,720 You have full packet decoding pretty much like Wireshark filters. 687 00:51:43,860 --> 00:51:48,260 So you can transpose pretty much your Wireshark display filter in Kibana. 688 00:51:48,380 --> 00:51:49,980 So you can search for the packets. 689 00:51:50,880 --> 00:51:53,100 You can also do decryption if you'd like. 690 00:51:53,280 --> 00:51:57,000 But in that case you have to provide the key in the configuration file. 691 00:51:57,140 --> 00:51:58,600 It doesn't do any cracking whatsoever. 692 00:51:58,880 --> 00:52:01,820 You have to use Aircracker and any other tool to do that. 693 00:52:03,760 --> 00:52:07,420 Another library that I created was simplejson-cpp. 694 00:52:07,560 --> 00:52:08,640 A C++ library. 695 00:52:09,240 --> 00:52:12,820 Let's just do a simple generation for JSON. 696 00:52:14,340 --> 00:52:15,540 Here's what it looks like. 697 00:52:15,760 --> 00:52:17,380 So you have some of the codes. 698 00:52:17,620 --> 00:52:19,060 You create an object here. 699 00:52:19,240 --> 00:52:20,340 That's the main document. 700 00:52:20,680 --> 00:52:21,600 You create values. 701 00:52:22,460 --> 00:52:26,160 And you simply add all those values to the main document. 702 00:52:26,640 --> 00:52:28,640 Here I create another object. 703 00:52:28,640 --> 00:52:32,040 And I create a key and value in that object. 704 00:52:32,180 --> 00:52:34,380 And I finally add that to the main one. 705 00:52:35,360 --> 00:52:39,440 For example, here is a vector, an array that we add to the main object. 706 00:52:39,620 --> 00:52:41,380 And then I export it to a string. 707 00:52:41,880 --> 00:52:45,020 So that's very easy, very simple to create a JSON. 708 00:52:46,720 --> 00:52:50,880 I used to use rapid JSON, but that one was very complicated. 709 00:52:51,100 --> 00:52:52,260 It's very nice, very fast. 710 00:52:53,100 --> 00:52:56,260 But the problem, it has some very weird memory allocations. 711 00:52:56,420 --> 00:52:58,260 And you had, for example, 712 00:52:58,800 --> 00:53:03,280 for this one you had to do like four lines of code. 713 00:53:03,400 --> 00:53:07,220 And considering the amount of code that is even in Warstrike decoding, 714 00:53:07,400 --> 00:53:11,780 27,000 lines, that was out of question. 715 00:53:11,900 --> 00:53:12,860 Not maintainable. 716 00:53:14,180 --> 00:53:17,560 The other library that I did was ElasticBeat. 717 00:53:18,220 --> 00:53:22,460 And that is, both of those libraries are header only. 718 00:53:22,620 --> 00:53:24,860 So you don't have to compile any code. 719 00:53:24,980 --> 00:53:28,060 So you just include it in your main project. 720 00:53:28,060 --> 00:53:29,760 And then it gets compiled with it. 721 00:53:30,300 --> 00:53:34,120 So for now, it uses rapid JSON for parsing JSON documents. 722 00:53:34,340 --> 00:53:39,560 And it inserts stuff using the bulk API from Elasticsearch. 723 00:53:40,740 --> 00:53:42,320 So this is what it looks like. 724 00:53:42,920 --> 00:53:45,320 So you connect to Elasticsearch here. 725 00:53:45,560 --> 00:53:49,040 So on our local host, we display the version. 726 00:53:50,020 --> 00:53:52,380 Here's another example where you can get indices. 727 00:53:53,140 --> 00:53:54,580 All tables, pretty much. 728 00:53:55,120 --> 00:53:57,180 You can check if an index exists. 729 00:53:57,180 --> 00:53:58,100 And then create it. 730 00:53:59,640 --> 00:54:02,880 And here's, for example, that bulk request that we do. 731 00:54:03,000 --> 00:54:06,100 So you send a bunch of documents to Elasticsearch to store them. 732 00:54:06,180 --> 00:54:08,100 So you don't do one by one. 733 00:54:08,920 --> 00:54:10,860 All of them are going to be sent in one query. 734 00:54:10,980 --> 00:54:14,340 You can do either index or delete. 735 00:54:14,760 --> 00:54:17,660 So the index is pretty much insert for those who have done 736 00:54:17,660 --> 00:54:18,780 a relation of databases. 737 00:54:19,620 --> 00:54:22,260 And finally, you can see if there are any errors. 738 00:54:22,440 --> 00:54:25,760 If there are any, so it will just display that into the error field. 739 00:54:25,760 --> 00:54:30,460 And if not, you get all your IDs back in case you want to process them. 740 00:54:31,520 --> 00:54:35,320 So to summarize, so the Wi-Fi bit is GPLv3. 741 00:54:35,760 --> 00:54:39,020 It parses and stores data in Elasticsearch. 742 00:54:39,160 --> 00:54:43,020 And you also have Kibana dashboards with it. 743 00:54:43,100 --> 00:54:44,440 And it's in C++. 744 00:54:45,460 --> 00:54:49,060 The two libraries that are created are in BSD license. 745 00:54:49,300 --> 00:54:50,820 So you do whatever you want with it. 746 00:54:50,880 --> 00:54:53,040 You can even include them in your commercial product. 747 00:54:53,180 --> 00:54:53,900 It doesn't matter. 748 00:54:55,760 --> 00:54:57,000 And they're both C++. 749 00:54:57,560 --> 00:55:00,040 So Elasticsearch bit communicates with Elasticsearch. 750 00:55:00,180 --> 00:55:02,140 And simple JSON generates JSON. 751 00:55:02,720 --> 00:55:05,760 So now let's switch quickly to the demo. 752 00:55:17,800 --> 00:55:21,680 Okay, so now you can see I have a search field. 753 00:55:21,780 --> 00:55:24,940 So in Kibana, you have three main... 754 00:55:26,220 --> 00:55:26,740 Items. 755 00:55:26,780 --> 00:55:30,800 So you have Discover where you see all your logs or documents. 756 00:55:31,780 --> 00:55:33,860 You have Visualize where you can create visualization. 757 00:55:34,240 --> 00:55:34,940 And you have Dashboard. 758 00:55:35,200 --> 00:55:41,900 So here's just a search for a specific time frame because I already have a ton of data for that. 759 00:55:42,300 --> 00:55:44,340 And here's one of the documents. 760 00:55:45,020 --> 00:55:52,360 So you can see here exactly all the data parsed in the database. 761 00:55:53,020 --> 00:55:54,880 So one thing about it is... 762 00:55:55,760 --> 00:55:59,620 Elasticsearch for Kibana displays everything flat. 763 00:55:59,860 --> 00:56:01,020 So you can see it here. 764 00:56:01,520 --> 00:56:05,900 So that WN underscore MGT dot A S E L. 765 00:56:06,040 --> 00:56:07,080 And you see a bunch of them. 766 00:56:07,280 --> 00:56:11,640 A S E L dot capable CSI if reserved IREX. 767 00:56:13,080 --> 00:56:17,660 And so all those things were in a single JSON document. 768 00:56:18,160 --> 00:56:20,600 And here you have a different item. 769 00:56:20,700 --> 00:56:23,560 So you can see that image here. 770 00:56:23,560 --> 00:56:29,760 So Elasticsearch in Kibana cannot handle arrays. 771 00:56:30,280 --> 00:56:32,840 So it just displays it like this. 772 00:56:33,140 --> 00:56:34,020 There's a workaround. 773 00:56:34,160 --> 00:56:38,400 There's a library for that for either Elasticsearch or Kibana. 774 00:56:38,600 --> 00:56:42,460 And I give the link to it in the project. 775 00:56:43,700 --> 00:56:48,780 So here's if you want to take a look at the JSON. 776 00:56:49,180 --> 00:56:50,860 That's what the document looks like. 777 00:56:51,160 --> 00:56:53,020 So the familiar fields. 778 00:56:53,980 --> 00:56:54,900 In the packet. 779 00:56:55,220 --> 00:56:57,120 So version, type, subtype. 780 00:56:57,140 --> 00:56:59,680 So the type of the frame and subtype of the frame. 781 00:57:00,660 --> 00:57:02,520 And if I look at Wireshark here. 782 00:57:03,280 --> 00:57:04,760 See if I can open that one. 783 00:57:05,940 --> 00:57:10,400 And I can actually take my filter all the way above here. 784 00:57:17,000 --> 00:57:19,000 I just have to modify it a little bit. 785 00:57:19,320 --> 00:57:19,800 Since... 786 00:57:20,700 --> 00:57:22,600 Change the column to equals. 787 00:57:24,800 --> 00:57:27,140 And so we have the exact same pack as well. 788 00:57:27,240 --> 00:57:28,020 Different capture. 789 00:57:29,140 --> 00:57:31,300 The same thing that are parsed. 790 00:57:31,980 --> 00:57:34,780 So the frame control field that we had. 791 00:57:35,560 --> 00:57:39,980 And you can see all the information in Elasticsearch here. 792 00:57:41,260 --> 00:57:42,320 So in the dashboard. 793 00:57:42,560 --> 00:57:44,840 For now I created a very simple dashboard. 794 00:57:45,480 --> 00:57:48,400 With a bit basic information about a network. 795 00:57:50,780 --> 00:57:52,100 So that way it looks like. 796 00:57:52,160 --> 00:57:53,520 You can see a different type of frames. 797 00:57:53,840 --> 00:57:54,760 The amount of frames. 798 00:57:55,540 --> 00:57:58,800 You can even calculate other searches that are added. 799 00:57:58,940 --> 00:58:00,420 So that you can get the amount of data. 800 00:58:00,700 --> 00:58:02,380 That is stored in a... 801 00:58:02,380 --> 00:58:05,020 That has been transmitted in the network. 802 00:58:14,500 --> 00:58:16,960 So that's what the tool looks like when you run it. 803 00:58:16,960 --> 00:58:18,060 You have the version. 804 00:58:18,460 --> 00:58:19,540 The configuration. 805 00:58:20,540 --> 00:58:23,360 You can change the configuration file. 806 00:58:23,460 --> 00:58:24,500 If you're doing some testing. 807 00:58:24,980 --> 00:58:26,740 You can make it go in the foreground. 808 00:58:27,040 --> 00:58:28,800 If you want to debug some stuff. 809 00:58:29,820 --> 00:58:30,300 And... 810 00:58:30,840 --> 00:58:32,680 All the logs go to syslog. 811 00:58:32,800 --> 00:58:33,400 So everything. 812 00:58:33,640 --> 00:58:35,540 All the actions are logged to syslog. 813 00:58:35,560 --> 00:58:37,080 In case you want to see it. 814 00:58:37,220 --> 00:58:38,680 And you're running a background. 815 00:58:38,860 --> 00:58:39,560 You have a pit file. 816 00:58:39,880 --> 00:58:42,640 Very useful when you're running as a service. 817 00:58:43,720 --> 00:58:44,280 So... 818 00:58:44,280 --> 00:58:46,080 We already went through all that. 819 00:58:46,980 --> 00:58:48,660 So a few last words. 820 00:58:49,060 --> 00:58:49,860 Elastic beat. 821 00:58:50,960 --> 00:58:53,060 So I'm going to add the beat protocol. 822 00:58:53,240 --> 00:58:54,100 In the future. 823 00:58:54,300 --> 00:58:56,100 Built in a rapid json. 824 00:58:56,260 --> 00:58:57,300 Or even get rid of it. 825 00:58:58,060 --> 00:59:00,060 And built in a library. 826 00:59:01,580 --> 00:59:02,900 For simple json. 827 00:59:03,380 --> 00:59:06,600 I'm going to do more json parsing. 828 00:59:06,600 --> 00:59:07,120 With it. 829 00:59:07,320 --> 00:59:08,680 And for wifi beat. 830 00:59:09,160 --> 00:59:10,880 I will do persistent queues. 831 00:59:11,320 --> 00:59:12,460 Support for NPK. 832 00:59:12,460 --> 00:59:14,320 So some windows adapters. 833 00:59:14,440 --> 00:59:15,760 Supports monitor mode. 834 00:59:15,900 --> 00:59:16,600 So you can use them. 835 00:59:18,140 --> 00:59:18,860 NPK supports. 836 00:59:20,480 --> 00:59:21,440 Channel width. 837 00:59:21,700 --> 00:59:23,100 So 5, 10 megahertz. 838 00:59:23,620 --> 00:59:25,780 Even HD and VHD channels. 839 00:59:25,960 --> 00:59:28,020 Which is already in the code. 840 00:59:28,260 --> 00:59:29,660 But not enabled yet. 841 00:59:30,780 --> 00:59:31,260 Pkpng. 842 00:59:31,840 --> 00:59:33,180 And a bunch of other things. 843 00:59:34,060 --> 00:59:36,440 So if you want to take a look at all the projects. 844 00:59:36,560 --> 00:59:37,360 They're all on github. 845 00:59:38,140 --> 00:59:40,120 Github.com slash wifibeat. 846 00:59:41,500 --> 00:59:42,380 The case is. 847 00:59:42,460 --> 00:59:42,720 Doesn't matter. 848 00:59:42,880 --> 00:59:44,400 So you can even put lower case. 849 00:59:44,520 --> 00:59:44,880 That's fine. 850 00:59:47,100 --> 00:59:49,700 Or you can just go to wifibeat.org. 851 00:59:49,820 --> 00:59:52,320 That contains the links to it. 852 00:59:52,460 --> 00:59:53,580 And just a brief description. 853 01:00:07,540 --> 01:00:09,140 Pretty good back to back. 854 01:00:09,140 --> 01:00:09,980 Uh. 855 01:00:10,340 --> 01:00:11,020 .