1 00:00:00,000 --> 00:00:08,880 In all seriousness, we're going to introduce Aardvark and Dark Matter, who, if you haven't 2 00:00:08,880 --> 00:00:13,600 seen the pictures all weekend, have been wandering around having lots of fun. And they're going to 3 00:00:13,600 --> 00:00:25,980 talk to you about Wiggle, like you mean it. Everybody good? Yeah. Can you still hear me back 4 00:00:25,980 --> 00:00:32,260 there? Everybody good? I can hear me, so that's all that matters. So yeah, I'm Aardvark, that's 5 00:00:32,260 --> 00:00:37,540 Dark Matter. I'm not going to let you talk into my chest, sorry. But yeah, what we're going to 6 00:00:37,540 --> 00:00:42,620 talk about is, yeah, war driving. It's like, but they have these cool things now that we didn't 7 00:00:42,620 --> 00:00:47,220 have a long time ago. So war driving, everybody knows what this is. Everybody did it. Who did it 8 00:00:47,220 --> 00:00:53,840 back in the day? Who still does it? I do. In fact, I'm doing it right now as we, well, standing. 9 00:00:54,140 --> 00:00:55,960 Yeah. So war driving. 10 00:00:55,960 --> 00:00:59,580 War driving. War driving. Why, the original purpose is just find open networks so we can be 11 00:00:59,580 --> 00:01:04,020 anonymous, find cool stuff. The reason why I got into it, I'm in mobile forensics, so geolocation. 12 00:01:04,360 --> 00:01:08,760 A lot of locations on phones, map those up with positions. That's why I started using Wiggle. 13 00:01:10,220 --> 00:01:14,260 What's out there? I kept doing it because I started finding really cool stuff out there, like 14 00:01:14,260 --> 00:01:19,700 weird shit. Because you've heard of internet of whatever that thing is, things. Tracking people, 15 00:01:19,960 --> 00:01:25,620 finding things. And it did actually get fun after a while, I know. When you have a hobby that's 16 00:01:25,620 --> 00:01:25,940 like, you know, you're doing it, you're doing it, you're doing it, you're doing it, you're 17 00:01:25,940 --> 00:01:31,000 making cakes or playing football or, I don't know, whatever. People are like, cool, that's 18 00:01:31,000 --> 00:01:37,040 awesome. Why do you scan Wi-Fi? Why do you do that? That's really creepy. Yes, I know. But 19 00:01:37,040 --> 00:01:41,320 that's how it is. Okay, Wiggle, born, the wireless geographic login engine. This is the 20 00:01:41,320 --> 00:01:46,900 actual crew, the actual Wiggle crew here. 7th September. I think they should have waited until 21 00:01:46,900 --> 00:01:52,340 it was all nines, but whatever. And it's basically there to map 802.11 networks and for, you 22 00:01:52,340 --> 00:01:55,640 know, whatever your reasons are. Also cell towers. You've got cell towers on there as well. 23 00:01:56,500 --> 00:02:01,440 Which is nice. Wiggle itself, I don't know. Anybody already on Wiggle or use it or have an 24 00:02:01,440 --> 00:02:07,320 account? Cool. Okay, so you can upload data anonymously, but you need an account to do 25 00:02:07,320 --> 00:02:11,760 queries and search and stuff like that. So a lot of stuff you can do for free. Sign up, though, 26 00:02:11,780 --> 00:02:16,020 is pretty simple. Email, username, password. That's it. You don't need to put, like, a credit 27 00:02:16,020 --> 00:02:21,240 card. What's that? Yeah, it is hard. You can make one up, you know, dork at dork.net, 28 00:02:21,280 --> 00:02:25,540 whatever, you know. But it's all good. But no, you know, mother's last name or anything 29 00:02:25,540 --> 00:02:32,140 like that. And some features you can use for free, like you can do mapping of nets. This is 30 00:02:32,140 --> 00:02:36,840 Chicago Airport, and so you can map and do some simple filtering and things and limit them by 31 00:02:36,840 --> 00:02:41,680 geographical areas, stuff like that. Any of these searches, though, if we want to do a major 32 00:02:41,680 --> 00:02:49,100 search, we can search by SSID, BSSID, OUIs, and that kind of stuff. You do get, make sure you 33 00:02:49,100 --> 00:02:53,560 correct me if I'm wrong, it's 10 queries a day if you're a non-contributing member. But if you 34 00:02:53,560 --> 00:02:55,440 need more stuff, you just contact Wiggle. 35 00:02:55,540 --> 00:02:59,640 If you've got a project, they will work with you on getting you more data, especially if you're 36 00:02:59,640 --> 00:03:05,460 doing it for non-commercial purposes. I have 1,200,000 searches per day. I'm just kidding. I 37 00:03:05,460 --> 00:03:10,720 made that up. I wish. Yeah. Okay. And you can bound them geographically. Here's a search of 38 00:03:10,720 --> 00:03:18,080 DEF CON, 94 networks after July 2017 that have DEF CON in the title. They're, like, all in this 39 00:03:18,080 --> 00:03:23,340 room, too. The wild cards are the percentage sign and the underscore. So they're SQL wild cards. 40 00:03:23,480 --> 00:03:24,280 So pretty good. 41 00:03:25,660 --> 00:03:30,160 And then there's also what's called a detail search. So if you have a MAC address, a BSSID, you 42 00:03:30,160 --> 00:03:34,620 can see all the observations of that particular network. And that gets really useful if you want 43 00:03:34,620 --> 00:03:39,380 to track if something's moved, where it's been seen, what countries it's been in, et cetera, et 44 00:03:39,380 --> 00:03:44,360 cetera. And you can also see I did obfuscate one of the name changes because it was pretty 45 00:03:44,360 --> 00:03:51,160 obvious, like Bob Stevenson's network. So I covered that one up. Okay. So why do I war drive? 46 00:03:51,260 --> 00:03:55,520 The first, back in the beginning when it was WRT54Gs, it was just a little bit of a little bit of a 47 00:03:55,520 --> 00:04:01,000 test to find Wi-Fi, get on, remember Wares? Do we still have Wares? I don't know. But get free 48 00:04:01,000 --> 00:04:05,240 stuff, talk to people anonymously, that kind of stuff. When I got into mobile forensics, it was 49 00:04:05,240 --> 00:04:09,200 geolocation. And that's where I kind of hung out for about five, six years. Just, you know, show 50 00:04:09,200 --> 00:04:13,700 off at parties. Not really. Not those, I don't go to cool parties like that. Stage three, this 51 00:04:13,700 --> 00:04:17,680 started about a year ago. And I just started seeing all the weird stuff out there. Cars, 52 00:04:20,000 --> 00:04:25,500 controllers, government, exactly. Bluetooth pregnancy tests. Who would have thought it? And I 53 00:04:25,520 --> 00:04:30,640 started looking at it. Anyway, not kidding, actually. Yeah, it is a thing. Next, I started 54 00:04:30,640 --> 00:04:35,100 looking at analysis of what I was seeing, mapping it, categorizing it. So I wanted to know not just 55 00:04:35,100 --> 00:04:39,180 what the vendor was, but actually what that was. Look at the OUI and go, oh, that's a GM car, 56 00:04:39,320 --> 00:04:46,700 that's a Ford, that's a government, insert government agency here, sort of thing. And so where 57 00:04:46,700 --> 00:04:50,940 I am right now is kind of one of these. These are a couple of tech streams from a friend and my 58 00:04:50,940 --> 00:04:55,500 wife. So I take it seriously now. It is a little bit more complicated than I thought it would be. 59 00:04:55,520 --> 00:04:59,240 It is getting a little bit weird, but that's okay. You know, I've thought, should I wiggle a 60 00:04:59,240 --> 00:05:04,420 little bit more? Should I eat? Nah, it's all good. That actually was from a day I had somebody on 61 00:05:04,420 --> 00:05:10,680 the monthly stats that was right ahead of me. So I did 50,913 with the help of my drone, I mean 62 00:05:10,680 --> 00:05:17,600 my wife, in a different state. And so, yeah. And then I waited until about 1150 at night to 63 00:05:17,600 --> 00:05:23,140 upload it. So to make sure nobody, it was like sniping an eBay auction, but yeah. It's really 64 00:05:23,140 --> 00:05:24,960 weird. I know. I understand this. Okay. 65 00:05:25,540 --> 00:05:30,280 In 2001, what did you need? A lot of stuff. You needed to have a laptop, a computer. We didn't 66 00:05:30,280 --> 00:05:36,080 have all the cool stuff now. Wireless cards were very limited. Amplifiers, GPS's, software, time. 67 00:05:36,420 --> 00:05:40,640 You had to be able to put up with strange looks from people. Today you need a phone. And I 68 00:05:40,640 --> 00:05:46,800 travel a ton. So for me, phone is the thing. And I usually, TSA agent said to me, he says, when 69 00:05:46,800 --> 00:05:52,800 somebody has four or five phones, I think that's kind of weird. You have 125 phones. So I 70 00:05:52,800 --> 00:05:55,440 figured you know what you're doing. And he actually says this to me. He's like, you don't, 71 00:05:55,440 --> 00:06:03,100 you don't try to sneak in with 125 phones. I believe they call that satiation. Yeah. And 72 00:06:03,100 --> 00:06:08,660 honestly, I hear these stories about the TSA and how bad they are. You guys are doing it wrong. Like 73 00:06:08,660 --> 00:06:15,680 I carry weird stuff onto the airport. Nothing illegal though. Anybody a Yorkie in here? They're 74 00:06:15,680 --> 00:06:19,980 delicious chocolate bars. But anyway, they're very good. Okay. Equipment. These days we have all 75 00:06:19,980 --> 00:06:24,940 sorts of stuff we could use. I mean, you know, you've got pies, you've got Wi-Fi, whatever the 76 00:06:24,940 --> 00:06:30,800 hell this is. Beagle bones, Arctic boards, all sorts of bananas, orange pies, minnow boards, all 77 00:06:30,800 --> 00:06:36,200 sorts of crazy stuff that we have that we can use. You can, there's all sorts of possibilities. You 78 00:06:36,200 --> 00:06:41,080 can put, you can drink beer while you kismet. You can use a phone with a little guy in your back 79 00:06:41,080 --> 00:06:50,220 window. And you can even put kismet on other devices possibly. Oh yeah. It's anything you can 80 00:06:50,220 --> 00:06:54,220 get Linux on basically. You can, you can run it on. So it's good to go. You may have to compile it, 81 00:06:54,260 --> 00:06:54,560 but whatever. 82 00:06:55,760 --> 00:07:00,180 Software. So my choice has been the war driving app because it's purpose built to use with 83 00:07:00,180 --> 00:07:06,580 wiggle. It's easy to use. But we've got kismet ostensibly is running on this thing. Kismet 84 00:07:06,580 --> 00:07:11,440 insider. There's a bunch of other softwares, but these are the biggest ones. I think right now 80 85 00:07:11,440 --> 00:07:17,980 plus percent are using the wiggle Wi-Fi app. The app is nice because like I said, it's, it's GPS is 86 00:07:17,980 --> 00:07:22,700 purpose built. It stores all your fires locally. So all of your observations are in a SQL DB, a 87 00:07:22,700 --> 00:07:24,920 SQLite DB. And then you've got CLI. And then you've got, you've got, you've got, you've got a 88 00:07:24,940 --> 00:07:30,000 CSVs. Every time you upload, it creates a CSV of what you just uploaded. So easy to pull. If you, 89 00:07:30,000 --> 00:07:34,480 if you ever use ADB or MTP, you could just pull those files. They're always in the same location. 90 00:07:34,500 --> 00:07:38,480 And so you could just pull them out and use them. And also I use blue Hydra along with it, 91 00:07:38,520 --> 00:07:43,180 which doesn't have its own GPS. So I just use the, yeah, hell hide. Wait, it's supposed to. Yeah. 92 00:07:43,380 --> 00:07:49,700 Yeah. Anyway. But it doesn't have a GPS feed. So I just use wiggles locations and I marry them up 93 00:07:49,700 --> 00:07:54,620 with a Python script. So I'm lazy. So good deal. The SQLite DB, 94 00:07:54,940 --> 00:07:59,680 all of them, you can pull this down to your account at any given time. It's really easy to use. 95 00:07:59,720 --> 00:08:03,580 There's only two tables. You have networks, which lists all the nets by BSS ID, and then all those 96 00:08:03,580 --> 00:08:09,940 locations. So simple queries, SQLite queries work just fine. And you can pull all the data 97 00:08:09,940 --> 00:08:13,460 and they look basically, I know you probably can't see this now that I like tiny screen, 98 00:08:13,600 --> 00:08:20,320 but easy to read Unix times, last times, best longitudes, et cetera. The CSV files, 99 00:08:20,460 --> 00:08:24,620 these are kept right in the SD card. They have all the observations of all 100 00:08:24,620 --> 00:08:27,980 nets. So if you see the same net three, four times, it'll be listed three, four times with 101 00:08:27,980 --> 00:08:32,580 different lats and longs. Like I said, I use that as kind of a master timeline to apply to other 102 00:08:32,580 --> 00:08:41,280 things. They're GNU zipped. And I think that's the proper command to unzip it. To tar ABCDX. 103 00:08:41,400 --> 00:08:47,040 Just kidding. It's X, V, Z, F file name. Yeah. Anyway. Anybody ever type in a tar command 104 00:08:47,040 --> 00:08:54,520 correctly the first time? Nope. Oops. Nope. Wait. Yeah. Yeah. Sure. Yeah. They're, they're 105 00:08:54,620 --> 00:09:00,020 like I said, when I go out and I war drive a particular area real quick, then I upload that's 106 00:09:00,020 --> 00:09:04,080 that file just has that one run, which is kind of nice to have. And so if you've got, if you got 107 00:09:04,080 --> 00:09:08,400 ADB, which you should all have, it's just an ADB pull command and you can pull that entire folder 108 00:09:08,960 --> 00:09:13,840 or you can use MTP to pull it, but it's a little easier with ADB. So there's a look at the CSV 109 00:09:13,840 --> 00:09:18,840 files. You've got the type of encryption, the SSIDs, the, the, the RISI values, the lats and 110 00:09:18,840 --> 00:09:23,660 longs, altitudes, stuff like that. What's that? Yeah. 111 00:09:24,620 --> 00:09:29,400 Oh my gosh. They're every, I love Xfinity. Yeah. Xfinity's amazing. Their new routers have 112 00:09:29,400 --> 00:09:35,460 like eight to 10 unique Macs on them. So when you hit an Xfinity neighborhood, oh yeah, your 113 00:09:35,460 --> 00:09:40,900 numbers go like an apartment complex with Xfinity. It's awesome. So, uh, you want to talk 114 00:09:40,900 --> 00:09:47,040 now? Yeah. Yeah. Here you go. All right. Thank you. All right. So, um, Kismet has traditionally 115 00:09:47,040 --> 00:09:52,480 been the, uh, war driver software of choice, right? Everybody using Kismet. It's frigging dope. 116 00:09:52,480 --> 00:09:59,780 So classic Kismet, or if you go on GitHub or on Kismet's website, the stable, uh, Kismet has, 117 00:09:59,820 --> 00:10:05,340 um, basically everything built in and it has GPS support, right? So you just get yourself a nice 118 00:10:05,340 --> 00:10:10,160 little dongle like this, dump it in, and you're good to go. And so the advantages of that is 119 00:10:10,160 --> 00:10:14,320 you can just get your laptop and go start collecting things. And it also stores in a format 120 00:10:14,320 --> 00:10:20,080 that is easily up, uh, uploadable to the Wiggle website. They support it out of the gate. So 121 00:10:20,080 --> 00:10:22,460 super simple. And it's also super easy to use. So, uh, the, uh, the, uh, the, uh, the, uh, the, uh, 122 00:10:22,460 --> 00:10:25,640 it's really, uh, it's super easy to, uh, install with pseudo app to get, install Kismet, and 123 00:10:25,640 --> 00:10:31,160 you're on and good to go. So and, one other thing. It's also it's compatible with basically 124 00:10:31,160 --> 00:10:34,740 every wireless card. And you don't even have to have anything special really. You could, 125 00:10:34,780 --> 00:10:40,400 like, the Intel in my, uh, HP Elitebook works the, uh, with Intel chip set because, uh, 126 00:10:40,540 --> 00:10:43,960 all you're looking for is SSID. You're not doing any injection, you're not doing anything, 127 00:10:44,260 --> 00:10:48,000 uh, you don't even need true monitor mode to try to pick up clients. You just start looking 128 00:10:48,000 --> 00:10:52,440 at SSIDs. So basically everything works. So now this guy, qui- sitneed and then this dog did, you 129 00:10:52,440 --> 00:10:56,640 running actually the bleeding edge version of Kismet which the 130 00:10:56,640 --> 00:11:00,400 air bud guy is also running on his setup back there. And with 131 00:11:00,400 --> 00:11:03,560 that one of the features that we got in that is remote capture 132 00:11:03,560 --> 00:11:07,560 nodes so each of these devices looks like an individual radio 133 00:11:07,560 --> 00:11:10,120 as if it were plugged in with like USB or something. So I 134 00:11:10,120 --> 00:11:13,480 actually have 50 radios in this device here. The disadvantage of 135 00:11:13,480 --> 00:11:16,160 running bleeding edge is it doesn't have GPS support. It 136 00:11:16,160 --> 00:11:19,580 hasn't, Dragorn hasn't gotten to that yet. So he's working on 137 00:11:19,580 --> 00:11:22,840 it, it'll come out soon I'm sure. But it's web based, he's 138 00:11:22,840 --> 00:11:27,140 added a ton of functionality so it exports EKJSON and then um 139 00:11:27,600 --> 00:11:31,340 uh basically I just wrote a custom script which we're gonna 140 00:11:31,340 --> 00:11:34,880 put on our GitHub uh that allows you to take GPS from your 141 00:11:34,880 --> 00:11:38,920 receiver and then marry it to your Kismet PCAP file. So that 142 00:11:38,920 --> 00:11:42,360 way you can still stumble with the bleeding edge until it gets 143 00:11:42,360 --> 00:11:47,740 official support. So um just real quick I want to talk about 144 00:11:47,740 --> 00:11:49,340 Kismet stable just run through some of the 145 00:11:49,340 --> 00:11:49,560 configs here. So I'm going to run through some of the 146 00:11:49,580 --> 00:11:51,720 config stuff. I'm sure this is stuff that you guys have done a 147 00:11:51,720 --> 00:11:54,740 hundred times but I just want to make sure that uh I point out 148 00:11:54,740 --> 00:11:59,240 some of the key components of the Kismet conf. Uh basically 149 00:11:59,240 --> 00:12:01,920 there's the hopping velocity that's how quickly you're 150 00:12:01,920 --> 00:12:04,860 changing channels. When you have a situation like this uh you 151 00:12:04,860 --> 00:12:07,300 don't need to change channels at all cause you're covering 50 at 152 00:12:07,300 --> 00:12:10,140 once. Uh but typically when you just got your laptop you got 1 153 00:12:10,140 --> 00:12:13,520 or 2 radios. You'll want like 5 maybe 10 channels a second. It 154 00:12:13,520 --> 00:12:15,440 depends on how fast you're going. If you're doing like 20, 155 00:12:15,460 --> 00:12:18,340 30 miles an hour that should be plenty. You may want to go a 156 00:12:18,340 --> 00:12:19,560 little bit faster than that if you're doing something like 157 00:12:19,560 --> 00:12:23,000 you're going faster on the road but then you know you might 158 00:12:23,000 --> 00:12:26,800 miss some of the coverage. So uh I typically use 5 that's the 159 00:12:26,800 --> 00:12:29,780 default setting it seems to work out pretty good. Um another 160 00:12:29,780 --> 00:12:32,760 thing too is there's an option in there to do uh preferred 161 00:12:32,760 --> 00:12:35,980 channels and that's just going to limit the radios you pick up 162 00:12:35,980 --> 00:12:38,700 because if you're doing war driving uh you don't want to have 163 00:12:38,700 --> 00:12:40,780 any preferred channels you just want to make sure it's jumping 164 00:12:40,780 --> 00:12:43,420 on all of them equally so that way you can get a chance to pick 165 00:12:43,420 --> 00:12:45,700 up any of the radios that you'll see. Because guess what 166 00:12:45,700 --> 00:12:49,320 uh some lady down the street she loves using channel 2 she doesn't 167 00:12:49,320 --> 00:12:52,380 know why it's set to automatic mode the router just does it all 168 00:12:52,380 --> 00:12:57,380 by itself. So it's crazy. Um and then the GPS settings that's just 169 00:12:57,380 --> 00:13:00,020 right in the comp file. You can actually use GPSD if you're 170 00:13:00,020 --> 00:13:02,420 brave and want to have all that stuff but I just like to run 171 00:13:02,420 --> 00:13:06,680 raw because Kismet has built in parsing of the um NMEA frame uh 172 00:13:06,680 --> 00:13:10,580 packet and so I just use the raw device it works brilliant um 173 00:13:10,580 --> 00:13:14,120 haven't had any issues with that. Uh and there's the command for 174 00:13:14,120 --> 00:13:17,180 that. Uh another thing too is if you're out war driving um 175 00:13:17,180 --> 00:13:19,300 there is some uh uh kind of a feature that you can use to 176 00:13:19,320 --> 00:13:21,440 capture the data. So if you're in a gray area of like wiretap 177 00:13:21,440 --> 00:13:24,800 laws um and I think Google had some issues with that. So 178 00:13:24,800 --> 00:13:28,300 basically uh be polite like hide the data frame so it doesn't 179 00:13:28,300 --> 00:13:31,600 even capture. So uh if you're doing that you don't run the 180 00:13:31,600 --> 00:13:34,520 risk of getting in trouble with networks you don't own. So I 181 00:13:34,520 --> 00:13:38,080 would encourage you to do that. Um and then finally there's just 182 00:13:38,080 --> 00:13:41,860 a couple of uh commands to get started on that. We got Kismet 183 00:13:41,860 --> 00:13:45,260 server at the bottom uh and if you want to it will automatically 184 00:13:45,260 --> 00:13:47,760 launch your capture source. If you don't have it in monitor mode 185 00:13:47,760 --> 00:13:49,000 it'll do it for you. So. 186 00:13:49,320 --> 00:13:52,740 Um just super easy like I said Kismet's a great tool to get 187 00:13:52,740 --> 00:13:57,240 started with. So uh to in all fairness um I have used Insider 188 00:13:57,240 --> 00:14:00,440 and I've used Kismet on my Mac and I want to talk about those 189 00:14:00,440 --> 00:14:02,700 tools just a little bit. Uh they're gonna get you the same 190 00:14:02,700 --> 00:14:05,420 functionality uh you're gonna be able to stumble you're gonna 191 00:14:05,420 --> 00:14:08,580 be able to get your GPS on. Um and I thought it was pretty 192 00:14:08,580 --> 00:14:11,080 funny I went to the Insider website. I remember when I first 193 00:14:11,080 --> 00:14:14,620 started using Insider it was like really low key just super 194 00:14:14,620 --> 00:14:18,200 put together or not put together very well and now it's like they 195 00:14:18,200 --> 00:14:19,300 got they got corporate people. So I was like I'm gonna use this 196 00:14:19,320 --> 00:14:22,200 this is from their website. So they got this dude in sales and 197 00:14:22,200 --> 00:14:24,860 corporate. So yeah go Insider must be getting that corporate 198 00:14:24,860 --> 00:14:29,660 money. Um anyways uh by the way go support Kismet on Patreon 199 00:14:30,140 --> 00:14:33,140 like cause let's make this thing rock. Um I really want to 200 00:14:33,140 --> 00:14:38,740 get Dragorn uh developing on this stuff full time. Um and 201 00:14:38,740 --> 00:14:40,700 then this is back to you. Software support my brother. 202 00:14:40,880 --> 00:14:43,820 Okay support software. Uh for various look as uh 203 00:14:43,820 --> 00:14:47,980 occasionally um I want to possibly uh gather maybe a uh 204 00:14:48,420 --> 00:14:51,460 photographic evidence of my war drive. Nexar's a really great 205 00:14:51,460 --> 00:14:55,160 dash cam. It keeps a track uh it apart from the video it keeps a 206 00:14:55,160 --> 00:14:58,740 a track of that trip that you do. So you can go back and refer to 207 00:14:58,740 --> 00:15:02,860 it if you run into a particular um item uh that you can marry up 208 00:15:02,860 --> 00:15:05,500 with an access point later. You've got video of it already. 209 00:15:05,840 --> 00:15:09,060 Um MyTracks is just a simple app that just draws a line where 210 00:15:09,060 --> 00:15:11,540 you've been. So it tracks exactly where you've been. Maybe 211 00:15:11,540 --> 00:15:13,840 that'd be a great feature for the Wiggle app in the future. But 212 00:15:13,840 --> 00:15:16,660 uh but it's pretty cool and I just run that on the side on one 213 00:15:16,660 --> 00:15:17,960 phone. It works really good. So I'm going to show you guys a 214 00:15:17,980 --> 00:15:21,580 fake GPS location. I don't fake GPS locations. If I go in a 215 00:15:21,580 --> 00:15:25,380 building and I don't get GPS I just use fake GPS to set it to 216 00:15:25,380 --> 00:15:28,500 that building so that I can I can do it inside. I don't ever 217 00:15:28,500 --> 00:15:31,400 fake the GPS right? Sorry cause that ruins the data. It 218 00:15:31,400 --> 00:15:34,520 breaks it. Okay and with the new version of the app one thing 219 00:15:34,520 --> 00:15:37,040 I used to have to use is I would have to check online on the 220 00:15:37,040 --> 00:15:39,660 map to see what areas had already been covered. But now 221 00:15:39,660 --> 00:15:41,880 that's actually showing it right in the app which is kind of 222 00:15:41,880 --> 00:15:44,460 handy. So you see uh it's already it's already uh pulling 223 00:15:44,460 --> 00:15:47,160 that up. I couldn't get enough internet to actually pull up the 224 00:15:47,160 --> 00:15:47,720 whole map there. 225 00:15:47,980 --> 00:15:50,900 And there's another uh another nice feature in the settings 226 00:15:50,900 --> 00:15:54,060 which is new. Um you can have it just show your networks that 227 00:15:54,060 --> 00:15:57,000 you've seen. Everybody's. And then you can set a date range. 228 00:15:57,180 --> 00:16:00,200 So you could have an area that was it was war driven back in 229 00:16:00,200 --> 00:16:03,220 2007 yet you need to go hit that area cause there's going 230 00:16:03,220 --> 00:16:06,720 to be all new stuff there. So it can show you uh the new stuff 231 00:16:06,720 --> 00:16:09,840 that that's available. Okay using phones. Pros. Everybody's 232 00:16:09,840 --> 00:16:12,240 got them. They don't look weird. They're small. They're cheap. 233 00:16:12,280 --> 00:16:15,380 This is why I use them cause I I travel so much. Um the app 234 00:16:15,380 --> 00:16:17,640 built it it's built to work with Wiggle. It works. 235 00:16:17,980 --> 00:16:20,640 Mozilla Emma uh Mozilla location services has their 236 00:16:20,640 --> 00:16:23,700 stumbler as well which is a good one. And you can use multiple 237 00:16:23,700 --> 00:16:26,560 scans uh phones to scan more effectively. I'll talk about 238 00:16:26,560 --> 00:16:28,920 that in a bit. And then range. And there's a little bit of 239 00:16:28,920 --> 00:16:31,640 debate. Do you use Yagy's directional antennas for war 240 00:16:31,640 --> 00:16:34,440 driving? Well yeah if you want to map a network that's a half 241 00:16:34,440 --> 00:16:37,820 mile away to your position sure. If you're looking for nets maybe 242 00:16:37,820 --> 00:16:42,180 but for tracking close stuff phones work really well. Cons. 243 00:16:42,320 --> 00:16:44,700 You don't usually get monitor mode. There are some phones that 244 00:16:44,700 --> 00:16:47,640 support OTG. You can put in an external card and you can use 245 00:16:47,640 --> 00:16:47,880 that. 246 00:16:47,980 --> 00:16:52,220 Uh uh TSA does look at you weird when you have dozens of 247 00:16:52,220 --> 00:16:54,860 phones. And iPhones don't work. They don't let you scan WiFi 248 00:16:54,860 --> 00:16:57,900 unless you got a jailbroken iPhone. And then range. Okay. 249 00:16:57,980 --> 00:17:00,840 This is also a con because you don't get very great range with 250 00:17:00,840 --> 00:17:04,000 phones. But it's usually good enough. Other equipment. Uh the 251 00:17:04,000 --> 00:17:06,640 pros. They're kind of obvious. Powerful. You got monitor mode. 252 00:17:06,780 --> 00:17:09,240 Large screens. You got a bunch of other stuff. You can look at 253 00:17:09,240 --> 00:17:11,340 porn while you're while you're war driving. All that kind of 254 00:17:11,340 --> 00:17:14,500 stuff. Cool stuff. You can put in multiple WiFi cards if 255 00:17:14,500 --> 00:17:17,780 you're retarded. But um no. Um and there's a lot of 256 00:17:17,780 --> 00:17:20,920 form factors. So you can go with say a Raspberry Pi with a 257 00:17:20,920 --> 00:17:25,080 seven inch screen or a Raspberry Pi with no screen or some God 258 00:17:25,080 --> 00:17:29,900 awful thing. Um whatever. Um it does get expensive. Uh you got 259 00:17:29,900 --> 00:17:33,080 monitor mode. It's hard sometimes. Some cards just don't 260 00:17:33,080 --> 00:17:37,200 work right. Set up and wiring can be a hassle. I I love having 261 00:17:37,200 --> 00:17:39,840 this because it's a good prop for all this stuff. Uh you need 262 00:17:39,840 --> 00:17:42,800 an external GTS uh GPS all that stuff. It's a little bit harder 263 00:17:42,800 --> 00:17:45,620 to look incognito with that. Hey what are you doing? You 264 00:17:45,620 --> 00:17:47,260 know with this. Nothing. Right? 265 00:17:48,440 --> 00:17:52,400 Mounting equipment. Um I can't stress how uh enough how 266 00:17:52,400 --> 00:17:54,620 important it is to put the phones up in the windows. Up 267 00:17:54,620 --> 00:17:57,540 high. Okay? Um I started doing that. I bought these little 268 00:17:57,540 --> 00:18:01,700 scosh magnetic mounts. So my now I get in. I put my little 269 00:18:01,700 --> 00:18:04,620 blue hydro Raspberry Pi in the center console. Put phone number 270 00:18:04,620 --> 00:18:06,840 one. Phone number two. Phone number three. Back in the back 271 00:18:06,840 --> 00:18:09,660 window. Phone number four. And then my actual phone to drive 272 00:18:09,660 --> 00:18:14,300 with. Um they but they've got nice mounts that you can use. 273 00:18:14,360 --> 00:18:16,620 Uh lots of different mounts. So you can mount multiple. You can 274 00:18:16,620 --> 00:18:16,820 get. 275 00:18:17,260 --> 00:18:20,400 You can get laptop mounts. They get pretty pricey. Uh dark 276 00:18:20,400 --> 00:18:23,040 matter convinced his lift driver. He actually put his 277 00:18:23,040 --> 00:18:26,420 account on there. Yeah uh next time you take a lift ask them 278 00:18:26,420 --> 00:18:29,380 if they'll install wiggle. Totally worth it. That's it 279 00:18:29,380 --> 00:18:31,600 right there. I got him. And then put your account in there 280 00:18:31,600 --> 00:18:35,060 so you get points obviously. Cause screw that anonymous guy. 281 00:18:35,280 --> 00:18:37,820 Cause I don't know who it is but they are winning and I'm 282 00:18:37,820 --> 00:18:43,540 tired of it. Yeah. Right. Yeah. So good. Good deals. Um okay 283 00:18:43,540 --> 00:18:45,840 other things. You can make up some stuff. Yeah he's like 284 00:18:45,840 --> 00:18:47,240 you've got an extra tripod. You can put your phone in there. 285 00:18:47,240 --> 00:18:51,140 Uh the problem with the Yagi though um is that yeah it does 286 00:18:51,140 --> 00:18:53,980 pull in distant networks and then maps them to your position 287 00:18:53,980 --> 00:18:57,600 which is a problem. Um any words on that? Yeah I mean. 288 00:18:58,140 --> 00:19:04,340 We we I mean. Yes. Here you go. Basically you know what are you 289 00:19:04,340 --> 00:19:07,120 trying to accomplish? Like if you're trying to do like the the 290 00:19:07,120 --> 00:19:10,560 true mission of wiggle uh then you don't want to be using huge 291 00:19:10,560 --> 00:19:13,660 crazy receptive dishes off of your vehicle because then it's 292 00:19:13,660 --> 00:19:17,220 going to basically make the uh database tainted. We're going to 293 00:19:17,240 --> 00:19:19,360 you're going to pick something up that's ten streets over. 294 00:19:19,480 --> 00:19:21,540 Somebody's going to be like ooh I found this and it's like it 295 00:19:21,540 --> 00:19:23,560 doesn't really matter cause you're still going to be off. So 296 00:19:23,560 --> 00:19:25,560 but then again it's like if you're trying to find the 297 00:19:25,560 --> 00:19:27,620 networks. If you're trying to just get stuff and maybe you 298 00:19:27,620 --> 00:19:31,060 just have a quick run. Like alright whatever. So I would 299 00:19:31,060 --> 00:19:34,120 argue that hey try to use smaller antennas so that way we 300 00:19:34,120 --> 00:19:36,920 can get better precision and so it makes the data more 301 00:19:36,920 --> 00:19:41,640 interesting. So. You're off the floor. Oh yeah it's still me. 302 00:19:41,780 --> 00:19:45,520 Okay um. There's Bluetooth. Yeah yeah yeah we'll get to that. 303 00:19:45,720 --> 00:19:47,200 He he he he he he he he he he he he he he he he he he he he he he 304 00:19:47,200 --> 00:19:49,500 he he he he he he he he he he he. Alright so um basically, uh 305 00:19:50,420 --> 00:19:55,480 sometimes uh it's fun to wiggle with uh with a cactus. Basically 306 00:19:55,480 --> 00:19:58,340 what I did is uh this project real quick I'll just give a 307 00:19:58,340 --> 00:20:01,560 quick run down. It's 25 uh tetras it was sponsored by Hack 308 00:20:01,560 --> 00:20:06,040 Five. Um I went uh I was in DC at shmoo con and I ran into 309 00:20:06,040 --> 00:20:08,260 Darren Kitchen and I was like you know what would be awesome is 310 00:20:08,260 --> 00:20:10,800 if we built something that we could listen on all the channels 311 00:20:10,800 --> 00:20:13,740 at the same time and he's like what would you need? and I'm 312 00:20:13,740 --> 00:20:17,180 like um I don't know maybe like uh 20 or 30 or 40 40 something 313 00:20:17,200 --> 00:20:24,960 30, like, radios. Two weeks later, 40 Tetras showed up at my house. Like, holy crap. So, 314 00:20:25,020 --> 00:20:30,420 and then it's like, crap, now I have to actually build this. So, uh, basically I've got an 315 00:20:30,420 --> 00:20:37,080 Intel Nook, it's got 16 gigs of RAM, 250 gig hard, solid, uh, NVME drive, um, and then, uh, 316 00:20:37,100 --> 00:20:42,500 two Cisco switches, 500 watt power supply, we got a battery that's about 30 amp hours, it 317 00:20:42,500 --> 00:20:47,920 pulls about 200 watts of power. Yes, it gets hot. Yes, it weighs about 45 pounds. Uh, it's not 318 00:20:47,920 --> 00:20:52,500 the most practical thing, but you're gonna catch everything. So, and I went over to, to 319 00:20:52,500 --> 00:20:59,000 Black Hat and kind of, uh, party crashed their Nock and in seven hours I got 40 gigs. So, that 320 00:20:59,000 --> 00:21:06,520 was pretty dope. So, anyways, just, uh, yeah. Be creative with what you can do because it will 321 00:21:06,520 --> 00:21:11,260 definitely help out what you're trying to do. Alright, back to you. Okay, questions. 322 00:21:11,420 --> 00:21:12,300 Where do you go wiggling? 323 00:21:12,500 --> 00:21:19,220 Um, when I cover an area, when I wiggle an area, it stays wiggled, right? Um, that's what we want 324 00:21:19,220 --> 00:21:24,320 to do. So, how do you find places? Um, there's good places, apartment complexes, especially low 325 00:21:24,320 --> 00:21:28,420 end ones. There's, they're packed in a little tighter, especially if they have Xfinity or Cox 326 00:21:28,420 --> 00:21:33,020 Cable or something, there's a lot of those. Uh, high univer, universities have high turnover, so 327 00:21:33,020 --> 00:21:38,760 every six months you can go hit it again. Um, town homes, condos, um, I really hate speed bumps, 328 00:21:38,980 --> 00:21:42,200 really hate them. Cul-de-sacs, right? Okay. 329 00:21:42,500 --> 00:21:47,440 But high density neighborhoods, the new, I don't know, those Euro style. Hey, I'm looking at you 330 00:21:47,440 --> 00:21:51,200 guys back there. Well, I know, Australian and New Zealand, but whatever, same thing. Um, okay. 331 00:21:51,580 --> 00:21:55,260 Straight streets are awesome, right? Through these straight streets, as long as they're not, like, 332 00:21:55,340 --> 00:22:00,620 one way streets. Large, some large businesses, some have nothing and some have lots of stuff. Uh, 333 00:22:00,640 --> 00:22:04,440 and then high density areas downtown. So, this has been covered, but it hasn't been covered with 334 00:22:04,440 --> 00:22:10,800 five phones yet at the same time. Um, so, lots of different places. Um, you can use the WiggleNet 335 00:22:10,800 --> 00:22:15,280 mapping function. So, these would be horrible areas, because I just covered them. It's, uh, west 336 00:22:15,280 --> 00:22:20,820 side of Chicago. Um, and these are really great areas. They're mouthwateringly great. Like, look, 337 00:22:20,900 --> 00:22:25,640 apartment complexes, packed in houses. This guy right here, he just got sick and went home. 338 00:22:25,780 --> 00:22:30,340 Actually, I had, actually, I had to pee. So, I was like, man, I really gotta go. That was about 339 00:22:30,340 --> 00:22:36,560 seven hours into a nine hour set. So, I, I really had to go. So, um, and then sometimes when you 340 00:22:36,560 --> 00:22:40,360 look at the map, you think, oh, wow, that's really covered pretty thick. But then, if you zoom in, 341 00:22:40,800 --> 00:22:44,440 you notice they haven't even touched the neighborhoods. Uh, so, it's just major streets. So, from 342 00:22:44,440 --> 00:22:47,560 a distance, it looks like, oh, man, that doesn't look good at all. But you look, you go in, there's 343 00:22:47,560 --> 00:22:52,860 all sorts of crazy good stuff in there. Um, here is, uh, Salt Lake City, kind of, uh, Salt Lake 344 00:22:52,860 --> 00:22:57,580 City, uh, what's the other one? Las Vegas. Summerlin. So, um, and you zoom in, and you see 345 00:22:57,580 --> 00:23:01,440 there's all sorts of crazy tight stuff in there you could go. In fact, you've got two schools you 346 00:23:01,440 --> 00:23:07,100 could go stalk. But, um, it's all good. Um, uh, note where if there's one-way streets and streets 347 00:23:07,100 --> 00:23:10,620 with medians, you don't want to get out and want to do a left and have to turn and go back around 348 00:23:10,800 --> 00:23:14,840 the way you came. Uh, when you're doing apartment complexes, it does make a difference. Go the 349 00:23:14,840 --> 00:23:18,760 direction that puts you closest to the buildings, because you, uh, 10 feet closer makes a huge 350 00:23:18,760 --> 00:23:23,360 difference sometimes. Uh, deploy foot mobiles. I don't know how many times I go on a date with my 351 00:23:23,360 --> 00:23:28,760 wife. We hit a huge apartment complex with an internal courtyard. I drop her off here. Go 352 00:23:28,760 --> 00:23:32,640 around. Yeah, put, yeah. Yeah. Oh, no, she walks through like this. She doesn't care. It's just 353 00:23:32,640 --> 00:23:36,640 college. She'll walk through. I pick her up on the other side. She's got another 500, because 354 00:23:36,640 --> 00:23:40,780 it's a, it's, right? Okay. Optimum speed, probably, I've found, is about 25 to 30 miles per 355 00:23:40,800 --> 00:23:46,160 hour, 35 maybe. Um, it depends. I even put it in kilometers per hour. I think those are 356 00:23:46,160 --> 00:23:51,260 correct. Um, and people think it's expensive, but Galaxy S4s are cheap, and they work really 357 00:23:51,260 --> 00:23:56,200 well. I've got like four of them. Um, the only better one is the Note 3 that I love. Uh, just 358 00:23:56,200 --> 00:24:00,100 research. And then if you don't want to take time when you're going home, just pick a couple of 359 00:24:00,100 --> 00:24:05,020 side streets on your way home. Every day hit a different area. It's really easy. Um, no big deal. 360 00:24:05,220 --> 00:24:09,680 Um, other things. Consider why you're war driving. Like Dark Matter was saying, are you just 361 00:24:09,680 --> 00:24:10,700 looking for free Wi-Fi? 362 00:24:10,700 --> 00:24:14,880 Hit the businesses. There's lots of coffee shops with free Wi-Fi. Are you looking for things to 363 00:24:14,880 --> 00:24:20,320 exploit? That might be businesses. It might be houses. It might be other things. Uh, are you 364 00:24:20,320 --> 00:24:23,280 looking for geolocation and mapping? You're going to get everything. You want to get 365 00:24:23,280 --> 00:24:29,280 everything. Are you looking to track humans? Um, for reasons, um, that you might do. Uh, 366 00:24:30,380 --> 00:24:36,260 okay. I went to Park City, and we did pub crawl a bit. Uh, Park City, Utah. Have you ever 367 00:24:36,260 --> 00:24:40,560 been there? It's pretty, it's pretty awesome. Um, I, I got like 11,000 networks. Uh, I 368 00:24:40,560 --> 00:24:46,260 didn't even know. I forgot to upload them for two days, but, uh, it was, it was good. Um, uh, but 369 00:24:46,260 --> 00:24:50,360 I believe that all access points, they don't have to earn the right to be scanned. They, they, 370 00:24:50,400 --> 00:24:55,120 they deserve it. They deserve to be mapped. They deserve to be cataloged. They don't have to do 371 00:24:55,120 --> 00:25:01,120 anything good or, or, or earn this. Okay. Um, okay. A little bit of diversion into MAC addresses. 372 00:25:01,260 --> 00:25:04,400 As I've started scanning a lot of weird stuff, everybody knows what a MAC address is, right? An 373 00:25:04,400 --> 00:25:10,080 OUI, BSSIDs, all that stuff. But what I've found is that, uh, a lot of access points will modify the 374 00:25:10,080 --> 00:25:14,180 first byte of a MAC address, and then it won't show up as that brand. And that's a very common 375 00:25:14,180 --> 00:25:19,860 thing to do. Um, you can look these up. MAC vendors has a good little API. It's super easy to 376 00:25:19,860 --> 00:25:25,860 use. Um, and it pulls all its data from the official OUI, uh, text file from the IEEE. Um, so 377 00:25:25,860 --> 00:25:31,060 it, all it is, you could use curl, you could use, uh, requests in Python directly, but URL lib2 378 00:25:31,060 --> 00:25:37,140 does it, uh, very well. Um, it's very simple. Okay. The OUI is the first three bytes. Remember 379 00:25:37,140 --> 00:25:40,060 though, the OUI, just because it says a particular vendor, that's not going to change anything. 380 00:25:40,080 --> 00:25:44,740 That's who made that Wi-Fi chip, or that board, or that module. It may be something else. GM 381 00:25:44,740 --> 00:25:49,300 cars, for example, use Mitsumi electric cards. So if you see a Mitsumi, that's them. Ford uses 382 00:25:49,300 --> 00:25:54,240 Ford. So it comes up as Ford. Um, Texas Instruments is in all sorts of things, uh, for 383 00:25:54,240 --> 00:26:00,460 Bluetooth and other stuff. Um, some of them pick random MACs. Bluetooth LE stuff does random 384 00:26:00,460 --> 00:26:04,500 MACs. Uh, iPhones, their access points are random. So look at the name. We're going to have to 385 00:26:04,500 --> 00:26:08,540 look at the SSID in some of those to identify it. And then sometimes the first byte and the last 386 00:26:08,540 --> 00:26:12,660 bytes get changed. Here's an example. This is from a Netgear router. So you see you've got 387 00:26:12,660 --> 00:26:17,280 Stargate 5 and Stargate 2. This is all fictionalized, by the way. Don't go looking these up, 388 00:26:17,300 --> 00:26:21,500 because you won't find them. Uh, but then notice the last one, your mom's shop, uh, actually 389 00:26:21,500 --> 00:26:25,800 changes the first byte to A2 and then increments the last byte as well. If you look up the first 390 00:26:25,800 --> 00:26:29,920 one, it shows up as Netgear. If you look up the second one with the A2, you get no vendor. But if 391 00:26:29,920 --> 00:26:34,740 you just focus on the second and third byte, or the middle four bytes, you should be okay. Um, 392 00:26:35,100 --> 00:26:38,520 other ones. This is an Xfinity. It's a new router. Uh, it's a new router. Uh, it's a new 393 00:26:38,540 --> 00:26:42,840 router. Um, so you've got nine MAC addresses on one router, which is pretty sweet. I haven't, 394 00:26:42,860 --> 00:26:47,120 does anybody know what they're doing with the hidden ones? Like a mesh thing? Secret data 395 00:26:47,120 --> 00:26:53,060 code? Something. I'll, yeah, okay. I, I have, I had some new neighbors move in about a month 396 00:26:53,060 --> 00:26:57,720 ago, and you know how I knew? Seven new MAC addresses. I was like, hey, honey, the neighbors 397 00:26:57,720 --> 00:27:02,420 moved in. Okay, right. So that's how they show up. So you got a couple of open publics. You got 398 00:27:02,420 --> 00:27:06,440 the regular ones. If you had guest networks, they would be on a couple. And notice the, if you 399 00:27:06,440 --> 00:27:08,520 could see it, hopefully, the last ones are all 6A. Uh, so, uh, so, uh, uh, uh, uh, uh, uh, uh, uh, uh, uh, 400 00:27:08,520 --> 00:27:13,680 6B. Looks like the 5 gigahertz are 6B. But again, if you look up this one that starts in 06, 401 00:27:13,800 --> 00:27:18,860 you'll find nothing on the first one you get. You get ARIS. Uh, this is, um, uh, a view from 402 00:27:18,860 --> 00:27:25,000 Wiggle. Uh, the top three OUIs, the second one doesn't show up as anything unless you change it 403 00:27:25,000 --> 00:27:28,920 thusly, and it's Google. Those are actually things like Chromecast, Google TVs, and a bunch 404 00:27:28,920 --> 00:27:33,920 of other crap like that. So they, they shift off by two. They change it by a, a value of two, 405 00:27:34,040 --> 00:27:38,500 and, uh, we're not fooled. Okay, interesting stuff that I've started doing. I've started 406 00:27:38,500 --> 00:27:43,540 finding, anybody ever heard of Cradle Point? It's basically commercial MiFis. It's high-powered 407 00:27:43,540 --> 00:27:48,180 4G to Wi-Fi bridges, 3G Wi-Fi bridges. They're used in remote monitoring, irrigation, solar 408 00:27:48,180 --> 00:27:56,260 installations, power, uh, insert, insert organization here, vehicles, buses, shuttles, signs, 409 00:27:56,580 --> 00:28:00,580 anything remote. Uh, they're everywhere, and they're super interesting. Because whenever I 410 00:28:00,580 --> 00:28:04,720 see zero, these are the ones I've memorized. So it's like 0033, it's 3044. I was like, oh, 411 00:28:04,740 --> 00:28:08,340 what is that? And I immediately want to see what it is. Novotel Wireless. 412 00:28:08,500 --> 00:28:15,080 Makes all the Verizon MiFis. The 55, 10, 6, 6, 20, 77, whatever the hell. Um, those three OUIs 413 00:28:15,080 --> 00:28:19,420 are GM automobiles. The last, I think it's three model years, they're putting access points in 414 00:28:19,420 --> 00:28:24,460 them, and by experience, don't know how I got that, about 95% of the people have them on. And 415 00:28:24,460 --> 00:28:29,780 so now we don't care about clients, so we can track their vehicle directly. Yeah, yeah, it's 416 00:28:29,780 --> 00:28:34,100 there. It's always there. Then you got a couple from Google. Ericsson access points on Comcast. 417 00:28:34,340 --> 00:28:36,080 Those I would like to filter out. 418 00:28:37,720 --> 00:28:38,360 I'm pointing. 419 00:28:38,500 --> 00:28:45,060 Because they're everywhere. And then I got Cosico, that's Cisco, and then Ford. Those are the, like, 420 00:28:45,120 --> 00:28:49,240 the sync system in the Ford cars. Those are interesting stuff. Now, one, there's a company out 421 00:28:49,240 --> 00:28:53,940 of Orem, Utah that makes these LVT stations. It's live view tech. And they have permanent ones, 422 00:28:54,060 --> 00:28:57,340 and they have these ones that they can move around to, like, construction sites to do video 423 00:28:57,340 --> 00:29:03,040 surveillance. And they're everywhere. Um, and so I did it. I could map those. I could pull those 424 00:29:03,040 --> 00:29:08,020 out. And so you see a lot of Utah, Colorado, Wyoming, and then a smattering of other stuff. Uh, 425 00:29:08,020 --> 00:29:11,840 but those are pretty interesting. There, if there's an LVT station, that might be something you might 426 00:29:11,840 --> 00:29:19,460 want to investigate. Um, other cradle point stuff. This is Las Vegas. And the cradle point stuff I 427 00:29:19,460 --> 00:29:25,200 matched here. You got up in that American Coach, Mustang 1 and 2. This isn't Reno, right? Um, 428 00:29:25,900 --> 00:29:29,720 anyway, you got a bunch of stuff. So there's, this stuff's everywhere. You see a couple of YesCo signs 429 00:29:29,720 --> 00:29:38,000 in there. Uh, those electric signs. Okay. Other things. These GM vehicles. Uh, the first OUI, F0AB54, is the number one 430 00:29:38,020 --> 00:29:42,780 on Wiggle. Number three is the next one. And the third one, I think, is newer ones. They're a little bit 431 00:29:42,780 --> 00:29:49,320 farther down. But this was just stopped at a, a stop sign yesterday. I had a ZTE phone, a Ubiquiti. 432 00:29:49,440 --> 00:29:55,380 Those are everywhere. And then four, Wi-Fi hotspot. The default is Wi-Fi hotspot, four digits. And 433 00:29:55,380 --> 00:30:01,800 then you see things like this. I've seen these ones like that. I've seen politicians put their title 434 00:30:01,800 --> 00:30:07,680 on their hotspot of their vehicle. Like, hey, thanks, dude. Yeah. Awesome politician guy. 435 00:30:08,160 --> 00:30:38,000 Speaker of the house so and so. Yeah. Anyway. Um, you can do photographic correlations with this. This guy had his name on his license plate and on his access point. It's not too difficult to marry that up with the vehicle. When Johnson Suburban, that's also been fictionalized, pulls up next to me, I'm like, oh, okay, now I know who they are. I take a picture. But I just did that with photo grid while driving with one hand. Um, sadly, I'm not kidding. But, um, it's so good. Okay. Then, other things you could do. For example, here's Jim. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He 436 00:30:38,000 --> 00:30:45,800 drives a car. He drives a car. He drives a car. 437 00:30:45,800 --> 00:31:15,420 He drives a car. He drives a car. 438 00:31:15,420 --> 00:31:41,860 He drives a car. He drives a car. 439 00:31:45,400 --> 00:32:03,200 He drives a car. He drives a car. He drives a car. He drives a car. 440 00:32:28,560 --> 00:32:30,620 He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. 441 00:32:30,620 --> 00:32:40,960 He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. 442 00:32:40,960 --> 00:32:44,840 phone and Apple watch. I'm thinking, okay, the iPhone's her personal one because she has an Apple watch. That's probably 443 00:32:44,840 --> 00:32:47,660 her work phone that she got at her employer. 444 00:32:49,400 --> 00:32:52,900 Which her phone is now asking for. And Susan's a smart 445 00:32:52,900 --> 00:32:56,880 girl. She's a rich girl. And she really loves to read, but she is a bit clumsy. 446 00:32:57,520 --> 00:33:00,820 Just a bit. 11 Kindles, seriously. She's dedicated 447 00:33:00,820 --> 00:33:03,960 to the Kindles. She loves to take them to read at the coffee shops. 448 00:33:04,560 --> 00:33:08,480 All of the good coffee shops. Which is a little strange because of this one. 449 00:33:09,440 --> 00:33:12,700 I'm not sure how many are familiar with the LDS 450 00:33:12,700 --> 00:33:16,700 church. No coffee. So I figured maybe the Audi is her work 451 00:33:16,700 --> 00:33:20,660 and coffee vehicle while the Denali is the one she drives 452 00:33:20,660 --> 00:33:24,720 to church every Sunday. So it's 453 00:33:24,720 --> 00:33:28,700 good stuff. And this was all in the space of about two minutes, approximately. 454 00:33:28,780 --> 00:33:32,820 Maybe. And then I also have the other ones. 455 00:33:33,060 --> 00:33:36,360 Susan's bathroom echo, her backyard, Susan's mother's house. 456 00:33:36,640 --> 00:33:37,580 No, I'm just kidding. 457 00:33:38,480 --> 00:33:42,880 I'm just kidding. Right. Okay. So things that you can see out there. 458 00:33:42,960 --> 00:33:46,340 These are just examples. We got OBD2 adapters, 459 00:33:47,040 --> 00:33:49,820 Audis, an Osmo gimbal, TVs, 460 00:33:51,160 --> 00:33:54,140 GPSs, SMA. If it starts with SMA, that's a solar controller. 461 00:33:54,500 --> 00:33:57,220 They have Bluetooth and Wi-Fi. Mercedes-Benz, 462 00:33:57,780 --> 00:34:01,460 P-Net, FedEx trucks, other trucks, etc. 463 00:34:02,620 --> 00:34:06,040 AutoNet. There's a couple of police vehicles up there. Okay. 464 00:34:06,140 --> 00:34:08,140 So there's a lot of tons of stuff. And like I said, 465 00:34:08,480 --> 00:34:10,940 this is why I started doing this more because I started seeing all this cool 466 00:34:10,940 --> 00:34:13,740 stuff that was out there. And I want to track that cool stuff, really. 467 00:34:13,860 --> 00:34:18,040 I mean, let's be honest. What time is it? Cool. All right. Okay. 468 00:34:18,040 --> 00:34:20,100 The Wiggle API. This is what I really wanted to talk to you. 469 00:34:20,140 --> 00:34:23,900 The biggest thing is it's not REST, which really annoys. No, I don't really care. 470 00:34:24,120 --> 00:34:27,760 But it's an RPC style. It's JSON. That's what it gives you back. 471 00:34:27,980 --> 00:34:32,340 I've heard that's really good, honestly. And before this, there was kind of 472 00:34:32,340 --> 00:34:38,320 some semi-official but not really supported stuff. And depending on how much you contribute and how much you 473 00:34:38,480 --> 00:34:42,440 beg, you can get more queries per day. And that will put an end to this. 474 00:34:43,340 --> 00:34:47,580 Who's done this before? Really cool Wi-Fis, etc., etc., right? 475 00:34:47,860 --> 00:34:52,480 But many monks have lost their employment in the procedure because they no longer. 476 00:34:55,220 --> 00:34:57,840 Yeah. The handwriting, yeah. Okay. 477 00:34:58,600 --> 00:35:02,980 Somebody asked about the Wiggle API key. It's with your account you get an API key. 478 00:35:03,100 --> 00:35:08,280 You get an API name and a token. All you got to do is log into your account. You go to tools API and 479 00:35:08,480 --> 00:35:12,700 go to your account. It will show you what you can get your API key name and token. 480 00:35:13,000 --> 00:35:18,180 And so it looks like this. And then those are what you're going to use to log into the account for API use. 481 00:35:18,460 --> 00:35:22,100 Okay. And as I said, if you want to ask for more, is that the right email right there? 482 00:35:22,180 --> 00:35:27,280 Wiggle admin. Yes, it is. Yes. Awesome. Not that they're with Wiggle or anything. 483 00:35:28,000 --> 00:35:32,060 Okay. So basic authorization. So if you want to use curl, you can do this. 484 00:35:32,360 --> 00:35:37,720 So you've got a curl capital X, a get. And these are, oh, by the way, it's not the user password. 485 00:35:37,720 --> 00:35:42,080 It's your API name and token. And then they have a base 64 encoded user pass. 486 00:35:42,260 --> 00:35:46,340 You stick in there in the header. And then you've got an application JSON. 487 00:35:46,540 --> 00:35:50,120 And then the query itself. The first one I'm showing is a geocode query. 488 00:35:50,440 --> 00:35:54,080 They're using the open street maps, the nom and natum. I'm not sure how you pronounce that. 489 00:35:54,300 --> 00:35:59,860 But what it'll do is it'll record, it'll return, among other things, a bounding box for a location. 490 00:36:00,140 --> 00:36:05,540 So if I want to wiggle or I want to do queries on Clark County, I just put in Clark County, Nevada. 491 00:36:05,780 --> 00:36:07,200 It spews back four. 492 00:36:07,720 --> 00:36:10,360 Two lats and two longs. It gives me a box of Clark County. 493 00:36:10,500 --> 00:36:13,680 That way I can feed it into further queries and get just stuff in that area. 494 00:36:13,860 --> 00:36:18,020 The second one shows a basic search. So that's a network search, net ID. 495 00:36:18,280 --> 00:36:21,960 For this one, you need either an SSID. You can use an OUI. 496 00:36:22,140 --> 00:36:23,820 Or you can use the full MAC address. 497 00:36:24,500 --> 00:36:28,920 And then on the last one is what's a detail search, like I showed before on this other search. 498 00:36:29,040 --> 00:36:32,880 That's where you give it a full MAC address. And it will give you all the observations. 499 00:36:33,300 --> 00:36:33,560 Okay. 500 00:36:35,920 --> 00:36:36,320 Okay. 501 00:36:36,320 --> 00:36:42,080 There is a library called Piggle. It actually works really good, installs with PIP, so not a problem. 502 00:36:42,480 --> 00:36:49,160 And on that one, in the site packages folder, you have the config.py, and there you just put your API name and token. 503 00:36:49,320 --> 00:36:54,280 So whenever you do searches, it automatically pulls it. You just import the config, and it works there. 504 00:36:54,400 --> 00:36:58,700 And this is the website for that. But you can just do PIP install Piggle, and it installs fine. 505 00:36:58,880 --> 00:37:00,720 Is it 2.7 or 3.0? 506 00:37:01,340 --> 00:37:02,540 I'm using 2.7. 507 00:37:02,680 --> 00:37:02,980 Okay. 508 00:37:03,180 --> 00:37:03,460 Yeah. 509 00:37:03,520 --> 00:37:04,900 I honestly don't... 510 00:37:04,900 --> 00:37:05,280 It's good for life. 511 00:37:05,660 --> 00:37:06,100 Yeah. 512 00:37:06,320 --> 00:37:07,100 I honestly... 513 00:37:07,100 --> 00:37:07,480 Yeah. 514 00:37:07,540 --> 00:37:08,300 I will never move. 515 00:37:08,600 --> 00:37:10,860 And I will fight anyone who claims otherwise. 516 00:37:11,160 --> 00:37:12,980 Now, I'm kind of stuck with Python, too. 517 00:37:13,100 --> 00:37:13,820 But, okay. 518 00:37:13,940 --> 00:37:15,640 So a basic search with Piggle. 519 00:37:15,700 --> 00:37:16,900 This is just a bare bone. 520 00:37:17,100 --> 00:37:18,240 So you import config. 521 00:37:18,540 --> 00:37:19,200 You import network. 522 00:37:19,420 --> 00:37:20,240 That gives you the searching. 523 00:37:20,480 --> 00:37:22,960 An SSID, pretty fly for a Wi-Fi. 524 00:37:23,060 --> 00:37:25,760 Pretty good one to use if you want to look incognito, by the way. 525 00:37:25,920 --> 00:37:27,940 And so we just do a network.search. 526 00:37:28,280 --> 00:37:29,420 Plug in your SSID. 527 00:37:29,820 --> 00:37:32,000 Tell it what offset you want to start. 528 00:37:32,100 --> 00:37:33,560 It pulls in increments of 100. 529 00:37:33,780 --> 00:37:35,980 So you want to start at 0, 100, 200, so forth. 530 00:37:35,980 --> 00:37:37,380 Lat ranges. 531 00:37:37,640 --> 00:37:39,640 Those are longs, I believe. 532 00:37:40,500 --> 00:37:40,900 Doubles. 533 00:37:40,980 --> 00:37:41,420 They're doubles. 534 00:37:41,560 --> 00:37:41,900 They're floats. 535 00:37:42,300 --> 00:37:44,180 And then I just loop through the results. 536 00:37:44,320 --> 00:37:46,280 I get back a JSON element. 537 00:37:47,360 --> 00:37:50,120 Piggle does not push back a JSON object. 538 00:37:50,300 --> 00:37:51,100 It gives you a dictionary. 539 00:37:51,360 --> 00:37:53,600 So you don't have to import JSON or anything like that. 540 00:37:53,700 --> 00:37:55,980 It gives it to you all ready to be used as a dictionary. 541 00:37:56,280 --> 00:37:58,640 And so I want to pull the SSID, the net ID. 542 00:37:58,900 --> 00:38:01,740 The trilaterated latitude and longitude. 543 00:38:01,800 --> 00:38:02,900 That's the averaged one. 544 00:38:03,160 --> 00:38:04,720 And then the last update type. 545 00:38:04,800 --> 00:38:05,440 So very simple. 546 00:38:05,540 --> 00:38:05,960 And I'm going to double check that. 547 00:38:05,960 --> 00:38:06,420 I'm going to demo these two. 548 00:38:06,580 --> 00:38:08,180 Now this one I did a little bit different. 549 00:38:08,280 --> 00:38:09,360 I did a detail. 550 00:38:09,620 --> 00:38:13,480 And I wanted to pull the details of both a GSM network and a Wi-Fi. 551 00:38:13,680 --> 00:38:15,060 So there we have the net ID. 552 00:38:15,340 --> 00:38:16,980 My BSSID. 553 00:38:17,400 --> 00:38:19,920 The operator is 310410. 554 00:38:20,000 --> 00:38:21,500 That's AT&T for the U.S. 555 00:38:21,500 --> 00:38:22,940 And then a LAC and a cell ID. 556 00:38:23,260 --> 00:38:24,660 And so then I just pull through. 557 00:38:24,880 --> 00:38:27,840 And I'll demo these in a second so you can see what they look like. 558 00:38:28,060 --> 00:38:29,080 But it just puts them out. 559 00:38:29,200 --> 00:38:31,280 I just did a simple example to show how those work. 560 00:38:31,420 --> 00:38:34,060 So I'm going to go ahead and do that real quick. 561 00:38:35,580 --> 00:38:35,940 So I'm going to go ahead and do that real quick. 562 00:38:38,540 --> 00:38:39,780 So the first one. 563 00:38:44,680 --> 00:38:45,300 Wiggle search. 564 00:38:45,800 --> 00:38:46,660 Just run that. 565 00:38:47,300 --> 00:38:47,840 Oh shoot. 566 00:38:47,880 --> 00:38:48,400 You're kidding me. 567 00:38:48,540 --> 00:38:49,480 I got no internets. 568 00:38:52,060 --> 00:38:53,140 My internets went away. 569 00:38:57,100 --> 00:38:57,460 Yeah, I don't think so. 570 00:38:57,460 --> 00:38:58,440 I'll just connect you to a random AP. 571 00:38:58,720 --> 00:38:59,080 Yeah. 572 00:38:59,120 --> 00:38:59,600 I don't think so. 573 00:38:59,740 --> 00:39:00,420 But hey, thanks. 574 00:39:02,220 --> 00:39:03,680 Let me see if I can do this. 575 00:39:03,800 --> 00:39:04,480 Give me one sec. 576 00:39:04,580 --> 00:39:05,140 I'll see if I can. 577 00:39:05,560 --> 00:39:05,920 I'll just connect you to a random AP. 578 00:39:05,920 --> 00:39:06,500 I'll just spawn it up. 579 00:39:10,660 --> 00:39:11,000 OK. 580 00:39:12,240 --> 00:39:12,740 We're fine. 581 00:39:12,860 --> 00:39:13,400 We're doing it live. 582 00:39:16,840 --> 00:39:18,520 Don't look at the name of my access point. 583 00:39:34,660 --> 00:39:35,000 No. 584 00:39:35,120 --> 00:39:35,820 It's still breaking. 585 00:39:35,920 --> 00:39:36,460 It's still pissed off. 586 00:39:36,540 --> 00:39:36,760 Yeah. 587 00:39:36,880 --> 00:39:37,860 It doesn't want to play. 588 00:39:38,020 --> 00:39:39,240 We might not be on the internets. 589 00:39:39,800 --> 00:39:40,120 Yeah. 590 00:39:40,180 --> 00:39:40,780 We might not be. 591 00:39:40,920 --> 00:39:41,240 OK. 592 00:39:41,340 --> 00:39:42,640 So I'm just going to roll with this. 593 00:39:42,700 --> 00:39:45,120 I'll just explain the script a little bit. 594 00:39:45,240 --> 00:39:47,120 The ones I'm doing later, I already have the data. 595 00:39:47,220 --> 00:39:47,760 So it's just fine. 596 00:39:47,900 --> 00:39:50,580 So what this does is the first one is going to pull a Wi-Fi record. 597 00:39:50,840 --> 00:39:52,880 Now what it does is it pulls a JSON object. 598 00:39:53,340 --> 00:39:56,180 And all of these are available in their online. 599 00:39:56,380 --> 00:39:58,200 They have an online demonstration piece. 600 00:39:58,340 --> 00:40:00,620 And you can look at every attribute and every method. 601 00:40:00,800 --> 00:40:01,760 You can do tests. 602 00:40:01,900 --> 00:40:04,920 And it shows you the JSON object, the curl command, all that stuff. 603 00:40:04,980 --> 00:40:05,440 It's really awesome. 604 00:40:06,120 --> 00:40:08,720 In fact, that was the first time I'd ever seen that swagger UI. 605 00:40:08,960 --> 00:40:09,720 But it's pretty cool. 606 00:40:09,920 --> 00:40:12,900 So if you have any questions, you just do the query on the site. 607 00:40:13,080 --> 00:40:15,920 It tells you all the stuff that you look for, all the options and everything. 608 00:40:16,160 --> 00:40:20,520 So I'm going to pull out the net ID, the SSIDs, the last updates, the try lat and the try long. 609 00:40:20,620 --> 00:40:24,080 So I'm pulling that one record, the main record for that access point. 610 00:40:24,340 --> 00:40:28,480 Then the next one, I'm going to loop through all the location data for all the observations. 611 00:40:28,780 --> 00:40:32,200 And then print out all the regular lats, longs, the type of encryption, et cetera. 612 00:40:32,440 --> 00:40:35,320 The next one, GSM, the format's slightly different. 613 00:40:35,320 --> 00:40:36,980 The record has an ID. 614 00:40:37,260 --> 00:40:38,000 You've still got results. 615 00:40:38,200 --> 00:40:43,180 But it's got an ID, last update, try lat, try long, and then the individual results down below. 616 00:40:43,600 --> 00:40:44,640 So pretty simple. 617 00:40:44,740 --> 00:40:48,140 Now, this stuff, we do have a GitHub where I put these examples on there. 618 00:40:48,220 --> 00:40:49,180 So you can use them. 619 00:40:49,220 --> 00:40:50,140 No big deal. 620 00:40:52,500 --> 00:40:53,580 So skip forward. 621 00:40:53,780 --> 00:40:56,020 OK, other useful APIs that I've used. 622 00:40:56,660 --> 00:40:57,800 GeoPy is really great. 623 00:40:58,240 --> 00:41:00,800 Do geocoding count against your queries? 624 00:41:01,240 --> 00:41:03,160 No, it's got its own problem for the day. 625 00:41:03,540 --> 00:41:04,280 Oh, does it? 626 00:41:04,380 --> 00:41:04,660 Yeah. 627 00:41:05,340 --> 00:41:10,240 So if you want to do nominate them, you can import geopy.geocoders. 628 00:41:10,340 --> 00:41:11,860 And that has nominate them into. 629 00:41:12,020 --> 00:41:13,320 You can get bounty boxes there. 630 00:41:13,460 --> 00:41:15,140 I've got that on that GitHub as well. 631 00:41:16,140 --> 00:41:18,940 Facebook-SDK, you can import that, install it with pip. 632 00:41:19,100 --> 00:41:22,200 I won't tell you why you would do that, but you might do that, right? 633 00:41:25,240 --> 00:41:25,660 Reasons. 634 00:41:25,800 --> 00:41:27,320 For reasons, right? 635 00:41:29,280 --> 00:41:31,280 Mexicans post a lot of porn, just saying. 636 00:41:31,800 --> 00:41:32,500 Where's Nicholas? 637 00:41:32,840 --> 00:41:33,260 Sorry. 638 00:41:33,260 --> 00:41:33,320 Sorry. 639 00:41:34,020 --> 00:41:34,660 Yeah, anyway. 640 00:41:34,960 --> 00:41:38,140 And TweePy is what you use with that for Python. 641 00:41:38,660 --> 00:41:39,440 Other things. 642 00:41:39,880 --> 00:41:42,960 OpenCellID has their entire database of cell towers you can download. 643 00:41:43,100 --> 00:41:43,640 It's a CSV. 644 00:41:43,880 --> 00:41:45,820 So you'll maybe want to filter it to your area. 645 00:41:45,960 --> 00:41:46,500 But then you can use that. 646 00:41:46,520 --> 00:41:47,400 Mozilla MLS. 647 00:41:48,000 --> 00:41:51,120 I'm not sure if they still are, but they were in cahoots with OpenCellID. 648 00:41:51,260 --> 00:41:51,880 So same stuff. 649 00:41:52,560 --> 00:41:54,360 MacVendors has OUI lookups. 650 00:41:55,040 --> 00:41:56,620 Google's geolocation and geocoding. 651 00:41:56,700 --> 00:41:59,680 You get 2,500 free searches a day without paying money. 652 00:41:59,840 --> 00:42:03,240 And then over that, it's like 50 cents per thousand or something crazy. 653 00:42:03,240 --> 00:42:07,020 Then all the Facebook, Twitter, Instagram APIs. 654 00:42:07,240 --> 00:42:07,980 There's tons of stuff. 655 00:42:08,160 --> 00:42:13,440 And you might want to use those for, again, reasons that are whatever you want to do. 656 00:42:13,860 --> 00:42:14,100 Okay. 657 00:42:14,100 --> 00:42:14,800 So what's that? 658 00:42:14,880 --> 00:42:15,680 Geolocation is yummy. 659 00:42:16,020 --> 00:42:16,420 Geolocation. 660 00:42:16,540 --> 00:42:17,140 I love geolocation. 661 00:42:17,340 --> 00:42:17,600 Seriously. 662 00:42:17,780 --> 00:42:19,900 I get excited when I see, like, hmm. 663 00:42:20,500 --> 00:42:20,900 Anyway. 664 00:42:21,020 --> 00:42:21,340 Okay. 665 00:42:21,520 --> 00:42:24,040 So what if you want to be incognito? 666 00:42:24,160 --> 00:42:26,080 Look like a GM car, first of all. 667 00:42:26,080 --> 00:42:26,480 That's good. 668 00:42:26,740 --> 00:42:27,940 GM cars drive around. 669 00:42:28,160 --> 00:42:30,260 So background a little bit. 670 00:42:30,380 --> 00:42:31,880 I work in mobile forensics. 671 00:42:31,920 --> 00:42:33,000 So I work with a lot of agencies. 672 00:42:33,040 --> 00:42:33,220 Okay. 673 00:42:33,240 --> 00:42:36,900 And sometimes I'm scanning things with them. 674 00:42:37,000 --> 00:42:41,640 And their cars have very obvious names, both Bluetooth and Wi-Fi. 675 00:42:41,880 --> 00:42:42,980 And I ask them why. 676 00:42:43,260 --> 00:42:46,380 And I'm saying, why don't you just call yourself Bob's iPhone or something. 677 00:42:46,440 --> 00:42:47,120 But have a list. 678 00:42:47,240 --> 00:42:48,720 You know, Bob's iPhone is this car and so forth. 679 00:42:49,020 --> 00:42:51,300 So this would look incognito. 680 00:42:51,340 --> 00:42:52,140 iPhone is good. 681 00:42:52,480 --> 00:42:52,880 Audis. 682 00:42:52,940 --> 00:42:53,860 Android APs. 683 00:42:54,100 --> 00:42:55,060 Here, Xfinity. 684 00:42:55,300 --> 00:42:56,020 In Mexico. 685 00:42:56,520 --> 00:42:56,920 Infinitum. 686 00:42:56,980 --> 00:42:57,780 In Central America. 687 00:42:58,240 --> 00:42:58,640 Turbonet. 688 00:42:58,700 --> 00:42:59,580 You've got all sorts of crazy stuff. 689 00:42:59,640 --> 00:43:00,240 Cable Wi-Fi. 690 00:43:00,320 --> 00:43:01,680 Pretty fly for a Wi-Fi. 691 00:43:01,680 --> 00:43:02,420 Tell my Wi-Fi. 692 00:43:02,480 --> 00:43:03,200 These are all great ones. 693 00:43:03,320 --> 00:43:03,600 They're everywhere. 694 00:43:04,660 --> 00:43:05,900 FBI surveillance fan. 695 00:43:06,040 --> 00:43:07,800 Did you see that FBI surveillance fan the other day? 696 00:43:08,220 --> 00:43:09,600 That somebody's selling, right? 697 00:43:09,720 --> 00:43:13,980 If I ever had an FBI surveillance fan, I would just call it FBI surveillance fan. 698 00:43:14,140 --> 00:43:15,380 Because holy shnikes. 699 00:43:18,760 --> 00:43:19,800 Nobody will notice. 700 00:43:20,040 --> 00:43:20,480 Okay. 701 00:43:20,840 --> 00:43:22,900 I have 47 in my neighborhood. 702 00:43:23,120 --> 00:43:23,280 Yeah. 703 00:43:23,340 --> 00:43:23,580 Yeah. 704 00:43:23,740 --> 00:43:24,420 Oh, yeah. 705 00:43:24,460 --> 00:43:24,820 They're everywhere. 706 00:43:24,960 --> 00:43:25,280 Right. 707 00:43:25,320 --> 00:43:29,100 So this was just a limit search of only 10,000 results. 708 00:43:29,440 --> 00:43:29,740 Okay. 709 00:43:31,740 --> 00:43:32,880 So there you go. 710 00:43:32,940 --> 00:43:34,520 That's with KMLs right there. 711 00:43:34,600 --> 00:43:35,040 That's good stuff. 712 00:43:35,280 --> 00:43:35,580 Okay. 713 00:43:35,600 --> 00:43:37,780 You know what else is huge besides FBI surveillance fans? 714 00:43:38,720 --> 00:43:39,300 What else? 715 00:43:39,320 --> 00:43:39,560 Anything? 716 00:43:40,700 --> 00:43:41,300 Your mom. 717 00:43:44,300 --> 00:43:45,400 Don't read this one. 718 00:43:45,440 --> 00:43:45,800 They're bad. 719 00:43:46,120 --> 00:43:47,380 This is your mom. 720 00:43:48,580 --> 00:43:49,260 Tu mama. 721 00:43:49,640 --> 00:43:50,780 Y tu mama tambien. 722 00:43:52,660 --> 00:43:53,800 It's basically, yeah. 723 00:43:54,100 --> 00:43:54,800 It's your baby. 724 00:43:55,040 --> 00:43:55,820 Your mom's baby. 725 00:43:55,940 --> 00:43:56,160 Yeah. 726 00:43:56,160 --> 00:43:56,760 Don't read these. 727 00:43:56,800 --> 00:43:57,300 These are bad. 728 00:43:57,560 --> 00:43:58,400 Some of them are terrible. 729 00:43:58,500 --> 00:43:59,360 Your mom has an Audi. 730 00:43:59,500 --> 00:43:59,720 That's bad. 731 00:43:59,740 --> 00:44:00,060 That's a good one. 732 00:44:00,980 --> 00:44:01,620 That one's good. 733 00:44:01,780 --> 00:44:02,100 Yeah. 734 00:44:02,140 --> 00:44:03,560 But that's a good one to masquerade as. 735 00:44:03,720 --> 00:44:04,540 Nobody's going to notice. 736 00:44:04,800 --> 00:44:05,160 Right? 737 00:44:05,740 --> 00:44:07,000 I have my phone, actually. 738 00:44:07,080 --> 00:44:08,400 My Bluetooth name is your mom's. 739 00:44:08,400 --> 00:44:10,340 Because when I pair with stuff, it's paired with your mom's. 740 00:44:10,660 --> 00:44:13,000 It never gets old. 741 00:44:13,180 --> 00:44:13,440 Seriously. 742 00:44:13,680 --> 00:44:14,320 It never gets old. 743 00:44:14,860 --> 00:44:15,220 Okay. 744 00:44:15,760 --> 00:44:21,940 So what we're doing, what we want to do in the future is we want to look at, like I said, 745 00:44:22,000 --> 00:44:26,040 not just get the vendor of a device, but actually figure out kind of what it is. 746 00:44:26,780 --> 00:44:29,040 So I've been starting to categorize. 747 00:44:29,040 --> 00:44:30,780 And I'll probably put this up on the GitHub soon. 748 00:44:31,700 --> 00:44:33,100 OUIs and then what they are. 749 00:44:34,040 --> 00:44:35,140 Cradle points are there. 750 00:44:35,320 --> 00:44:36,580 That was my first one I put on. 751 00:44:36,660 --> 00:44:37,800 Mitsumi Electric are the cars. 752 00:44:38,560 --> 00:44:39,360 Wistron New Web. 753 00:44:39,520 --> 00:44:41,960 They make direct TV receiver stuff. 754 00:44:42,320 --> 00:44:45,560 And they also are in Audis, BMWs, Volvos, et cetera. 755 00:44:45,720 --> 00:44:49,300 I've seen DVRs, you know, Comcast business class. 756 00:44:49,480 --> 00:44:49,600 What's that? 757 00:44:50,620 --> 00:44:50,860 What's that? 758 00:44:51,700 --> 00:44:53,660 The same group, they partner with Arcos. 759 00:44:53,800 --> 00:44:54,200 Oh, they could. 760 00:44:54,300 --> 00:44:54,460 Yeah. 761 00:44:54,520 --> 00:44:55,560 I haven't seen those, but yeah. 762 00:44:56,040 --> 00:44:59,020 And then, you know, Pegatron routers, et cetera, for Comcast business class. 763 00:44:59,040 --> 00:44:59,620 Internet. 764 00:45:00,020 --> 00:45:02,200 So I'm starting to do these digital signs. 765 00:45:02,500 --> 00:45:02,980 I love those. 766 00:45:03,100 --> 00:45:06,900 Every time I see an LED sign, there's a stop sign in my neighborhood that has Wi-Fi. 767 00:45:07,100 --> 00:45:10,140 It's like pretty cool, but it's awesome. 768 00:45:10,340 --> 00:45:10,700 Okay. 769 00:45:10,940 --> 00:45:12,100 So that's kind of what we're doing. 770 00:45:12,160 --> 00:45:14,480 So the summary, and then I'm going to try and demo that stuff again. 771 00:45:14,700 --> 00:45:17,200 There's a lot of wireless stuff out there, and it's really interesting. 772 00:45:18,560 --> 00:45:20,700 It could tell us a lot about people around us. 773 00:45:20,800 --> 00:45:23,740 And turn your wireless off most of the time. 774 00:45:23,820 --> 00:45:26,940 People go out of their houses, and they leave all their crap on. 775 00:45:27,100 --> 00:45:29,020 And make sure everybody leaves their stuff on. 776 00:45:29,040 --> 00:45:30,900 Turn yours off. 777 00:45:31,040 --> 00:45:31,260 Leave it on. 778 00:45:31,680 --> 00:45:32,700 Go get on Wiggle. 779 00:45:32,960 --> 00:45:33,700 Join the cause. 780 00:45:33,840 --> 00:45:35,560 If you want to, I'll give you my account information. 781 00:45:35,900 --> 00:45:36,600 You can put it in there. 782 00:45:37,140 --> 00:45:37,760 Or mine. 783 00:45:38,180 --> 00:45:38,820 Human drones. 784 00:45:39,140 --> 00:45:45,580 I have my wife, two federal agents, one cop, and two other friends. 785 00:45:45,660 --> 00:45:47,400 I have phones with my account info in them. 786 00:45:47,560 --> 00:45:49,760 So yeah, you're like, how does he get around so much? 787 00:45:49,800 --> 00:45:49,940 No. 788 00:45:50,860 --> 00:45:51,220 Right. 789 00:45:51,380 --> 00:45:53,340 Lyft drivers, wives, partners, federal agents, whatever. 790 00:45:54,380 --> 00:45:56,480 On Twitter, I'm at Arject. 791 00:45:56,520 --> 00:45:59,020 And he's at Dark Matter with fours, where the A's should be. 792 00:45:59,040 --> 00:46:00,780 And then you've got Wi-Fi Cactus. 793 00:46:00,920 --> 00:46:02,500 I threw that in there, because you know what. 794 00:46:03,660 --> 00:46:07,000 I will, if you follow my Twitter, I will post that GitHub. 795 00:46:07,320 --> 00:46:09,040 It just has these little snippets on it. 796 00:46:09,160 --> 00:46:12,720 And we're going to be posting more stuff on there as we go. 797 00:46:13,720 --> 00:46:16,140 So let's see if I can get this thing to work again. 798 00:46:21,700 --> 00:46:22,480 Okay, let's see. 799 00:46:23,180 --> 00:46:24,280 Give me one second. 800 00:46:24,340 --> 00:46:25,260 We'll see if we can do it. 801 00:46:25,840 --> 00:46:27,300 Well, I'll just show you some of those. 802 00:46:27,300 --> 00:46:28,900 I'll show you some examples. 803 00:46:29,500 --> 00:46:35,500 Okay, so one traveling Android access point. 804 00:46:36,120 --> 00:46:37,740 So one of them, my map. 805 00:46:37,780 --> 00:46:39,420 I do a regular network search. 806 00:46:40,100 --> 00:46:40,920 Oh, shoot. 807 00:46:40,980 --> 00:46:41,540 Still can't. 808 00:46:41,600 --> 00:46:43,520 Just go ahead and say yes. 809 00:46:44,320 --> 00:46:44,840 No. 810 00:46:45,780 --> 00:46:47,040 And I get some. 811 00:46:47,100 --> 00:46:48,520 Yeah, I know you can't talk through that. 812 00:46:48,620 --> 00:46:50,880 I get a few hits on this Android access point. 813 00:46:52,380 --> 00:46:56,620 But when I run an actual detailed search on all the OUIs 814 00:46:56,620 --> 00:46:58,780 that tie back to that access point. 815 00:46:59,320 --> 00:47:00,520 Yeah, yeah, yeah, I know, I know. 816 00:47:00,900 --> 00:47:02,560 I can actually see a lot more. 817 00:47:02,720 --> 00:47:03,520 Geez, go away. 818 00:47:04,320 --> 00:47:05,920 A lot more interesting information. 819 00:47:06,140 --> 00:47:10,120 Like when Aardvark drove to DEF CON, for example. 820 00:47:10,420 --> 00:47:11,620 When he went to Chicago. 821 00:47:11,900 --> 00:47:13,260 When he went to Columbus, Ohio. 822 00:47:13,840 --> 00:47:15,780 When he went to don't know why, Mexico. 823 00:47:16,620 --> 00:47:19,700 You could also see a few places the name changed. 824 00:47:20,060 --> 00:47:22,580 Right here in El Salvador it was called your mom's. 825 00:47:22,600 --> 00:47:24,340 In Guatemala it was called LDS access. 826 00:47:24,680 --> 00:47:24,840 You know. 827 00:47:24,840 --> 00:47:27,360 That is me, yes. 828 00:47:27,460 --> 00:47:27,960 That's me. 829 00:47:28,200 --> 00:47:28,660 Followed. 830 00:47:28,680 --> 00:47:32,180 And then in Panama it was FBI surveillance van because. 831 00:47:33,540 --> 00:47:35,120 FBI is clearly in Panama. 832 00:47:35,180 --> 00:47:35,860 Because reasons. 833 00:47:36,100 --> 00:47:36,360 Right? 834 00:47:36,480 --> 00:47:36,660 Okay. 835 00:47:36,820 --> 00:47:39,440 So just as a review on the API. 836 00:47:39,660 --> 00:47:40,440 Easy to get into. 837 00:47:40,560 --> 00:47:41,260 Easy to play with. 838 00:47:41,340 --> 00:47:42,800 Go play around with the little demo thing. 839 00:47:44,740 --> 00:47:47,480 And I'll be posting examples of how to do KML. 840 00:47:47,720 --> 00:47:48,400 Nominate them. 841 00:47:48,460 --> 00:47:49,960 How to pull in like Mac vendor stuff. 842 00:47:50,800 --> 00:47:54,820 And so I will Tweet that out if you follow at Arject and 843 00:47:54,820 --> 00:47:55,460 at dark matter. 844 00:47:55,960 --> 00:47:57,060 You can get that stuff. 845 00:47:57,860 --> 00:48:00,020 Also we have stickers up here. 846 00:48:00,160 --> 00:48:01,820 The wiggle guys are back there. 847 00:48:01,920 --> 00:48:02,840 They're in the lab coats. 848 00:48:03,000 --> 00:48:03,880 They have stickers. 849 00:48:04,020 --> 00:48:04,900 And do you still have shirts? 850 00:48:05,320 --> 00:48:06,460 We have T-shirts, yes. 851 00:48:06,560 --> 00:48:06,860 Okay. 852 00:48:06,880 --> 00:48:08,000 So go mob them. 853 00:48:08,200 --> 00:48:09,520 I also have stickers up here. 854 00:48:09,620 --> 00:48:10,460 So you can come get that. 855 00:48:10,880 --> 00:48:11,720 And that is all. 856 00:48:11,820 --> 00:48:12,800 Thank you for attending. 857 00:48:12,960 --> 00:48:13,540 Appreciate it. 858 00:48:14,260 --> 00:48:14,660 . 859 00:48:14,660 --> 00:48:14,920 . 860 00:48:14,920 --> 00:48:15,520 . 861 00:48:15,520 --> 00:48:15,540 . 862 00:48:15,540 --> 00:48:16,220 . 863 00:48:16,220 --> 00:48:16,460 . 864 00:48:16,460 --> 00:48:16,860 . 865 00:48:16,860 --> 00:48:17,380 .