In all seriousness, we're going to introduce Aardvark and Dark Matter, who, if you haven't
seen the pictures all weekend, have been wandering around having lots of fun. And they're going to
talk to you about Wiggle, like you mean it. Everybody good? Yeah. Can you still hear me back
there? Everybody good? I can hear me, so that's all that matters. So yeah, I'm Aardvark, that's
Dark Matter. I'm not going to let you talk into my chest, sorry. But yeah, what we're going to
talk about is, yeah, war driving. It's like, but they have these cool things now that we didn't
have a long time ago. So war driving, everybody knows what this is. Everybody did it. Who did it
back in the day? Who still does it? I do. In fact, I'm doing it right now as we, well, standing.
Yeah. So war driving.
War driving. War driving. Why, the original purpose is just find open networks so we can be
anonymous, find cool stuff. The reason why I got into it, I'm in mobile forensics, so geolocation.
A lot of locations on phones, map those up with positions. That's why I started using Wiggle.
What's out there? I kept doing it because I started finding really cool stuff out there, like
weird shit. Because you've heard of internet of whatever that thing is, things. Tracking people,
finding things. And it did actually get fun after a while, I know. When you have a hobby that's
like, you know, you're doing it, you're doing it, you're doing it, you're doing it, you're
making cakes or playing football or, I don't know, whatever. People are like, cool, that's
awesome. Why do you scan Wi-Fi? Why do you do that? That's really creepy. Yes, I know. But
that's how it is. Okay, Wiggle, born, the wireless geographic login engine. This is the
actual crew, the actual Wiggle crew here. 7th September. I think they should have waited until
it was all nines, but whatever. And it's basically there to map 802.11 networks and for, you
know, whatever your reasons are. Also cell towers. You've got cell towers on there as well.
Which is nice. Wiggle itself, I don't know. Anybody already on Wiggle or use it or have an
account? Cool. Okay, so you can upload data anonymously, but you need an account to do
queries and search and stuff like that. So a lot of stuff you can do for free. Sign up, though,
is pretty simple. Email, username, password. That's it. You don't need to put, like, a credit
card. What's that? Yeah, it is hard. You can make one up, you know, dork at dork.net,
whatever, you know. But it's all good. But no, you know, mother's last name or anything
like that. And some features you can use for free, like you can do mapping of nets. This is
Chicago Airport, and so you can map and do some simple filtering and things and limit them by
geographical areas, stuff like that. Any of these searches, though, if we want to do a major
search, we can search by SSID, BSSID, OUIs, and that kind of stuff. You do get, make sure you
correct me if I'm wrong, it's 10 queries a day if you're a non-contributing member. But if you
need more stuff, you just contact Wiggle.
If you've got a project, they will work with you on getting you more data, especially if you're
doing it for non-commercial purposes. I have 1,200,000 searches per day. I'm just kidding. I
made that up. I wish. Yeah. Okay. And you can bound them geographically. Here's a search of
DEF CON, 94 networks after July 2017 that have DEF CON in the title. They're, like, all in this
room, too. The wild cards are the percentage sign and the underscore. So they're SQL wild cards.
So pretty good.
And then there's also what's called a detail search. So if you have a MAC address, a BSSID, you
can see all the observations of that particular network. And that gets really useful if you want
to track if something's moved, where it's been seen, what countries it's been in, et cetera, et
cetera. And you can also see I did obfuscate one of the name changes because it was pretty
obvious, like Bob Stevenson's network. So I covered that one up. Okay. So why do I war drive?
The first, back in the beginning when it was WRT54Gs, it was just a little bit of a little bit of a
test to find Wi-Fi, get on, remember Wares? Do we still have Wares? I don't know. But get free
stuff, talk to people anonymously, that kind of stuff. When I got into mobile forensics, it was
geolocation. And that's where I kind of hung out for about five, six years. Just, you know, show
off at parties. Not really. Not those, I don't go to cool parties like that. Stage three, this
started about a year ago. And I just started seeing all the weird stuff out there. Cars,
controllers, government, exactly. Bluetooth pregnancy tests. Who would have thought it? And I
started looking at it. Anyway, not kidding, actually. Yeah, it is a thing. Next, I started
looking at analysis of what I was seeing, mapping it, categorizing it. So I wanted to know not just
what the vendor was, but actually what that was. Look at the OUI and go, oh, that's a GM car,
that's a Ford, that's a government, insert government agency here, sort of thing. And so where
I am right now is kind of one of these. These are a couple of tech streams from a friend and my
wife. So I take it seriously now. It is a little bit more complicated than I thought it would be.
It is getting a little bit weird, but that's okay. You know, I've thought, should I wiggle a
little bit more? Should I eat? Nah, it's all good. That actually was from a day I had somebody on
the monthly stats that was right ahead of me. So I did 50,913 with the help of my drone, I mean
my wife, in a different state. And so, yeah. And then I waited until about 1150 at night to
upload it. So to make sure nobody, it was like sniping an eBay auction, but yeah. It's really
weird. I know. I understand this. Okay.
In 2001, what did you need? A lot of stuff. You needed to have a laptop, a computer. We didn't
have all the cool stuff now. Wireless cards were very limited. Amplifiers, GPS's, software, time.
You had to be able to put up with strange looks from people. Today you need a phone. And I
travel a ton. So for me, phone is the thing. And I usually, TSA agent said to me, he says, when
somebody has four or five phones, I think that's kind of weird. You have 125 phones. So I
figured you know what you're doing. And he actually says this to me. He's like, you don't,
you don't try to sneak in with 125 phones. I believe they call that satiation. Yeah. And
honestly, I hear these stories about the TSA and how bad they are. You guys are doing it wrong. Like
I carry weird stuff onto the airport. Nothing illegal though. Anybody a Yorkie in here? They're
delicious chocolate bars. But anyway, they're very good. Okay. Equipment. These days we have all
sorts of stuff we could use. I mean, you know, you've got pies, you've got Wi-Fi, whatever the
hell this is. Beagle bones, Arctic boards, all sorts of bananas, orange pies, minnow boards, all
sorts of crazy stuff that we have that we can use. You can, there's all sorts of possibilities. You
can put, you can drink beer while you kismet. You can use a phone with a little guy in your back
window. And you can even put kismet on other devices possibly. Oh yeah. It's anything you can
get Linux on basically. You can, you can run it on. So it's good to go. You may have to compile it,
but whatever.
Software. So my choice has been the war driving app because it's purpose built to use with
wiggle. It's easy to use. But we've got kismet ostensibly is running on this thing. Kismet
insider. There's a bunch of other softwares, but these are the biggest ones. I think right now 80
plus percent are using the wiggle Wi-Fi app. The app is nice because like I said, it's, it's GPS is
purpose built. It stores all your fires locally. So all of your observations are in a SQL DB, a
SQLite DB. And then you've got CLI. And then you've got, you've got, you've got, you've got a
CSVs. Every time you upload, it creates a CSV of what you just uploaded. So easy to pull. If you,
if you ever use ADB or MTP, you could just pull those files. They're always in the same location.
And so you could just pull them out and use them. And also I use blue Hydra along with it,
which doesn't have its own GPS. So I just use the, yeah, hell hide. Wait, it's supposed to. Yeah.
Yeah. Anyway. But it doesn't have a GPS feed. So I just use wiggles locations and I marry them up
with a Python script. So I'm lazy. So good deal. The SQLite DB,
all of them, you can pull this down to your account at any given time. It's really easy to use.
There's only two tables. You have networks, which lists all the nets by BSS ID, and then all those
locations. So simple queries, SQLite queries work just fine. And you can pull all the data
and they look basically, I know you probably can't see this now that I like tiny screen,
but easy to read Unix times, last times, best longitudes, et cetera. The CSV files,
these are kept right in the SD card. They have all the observations of all
nets. So if you see the same net three, four times, it'll be listed three, four times with
different lats and longs. Like I said, I use that as kind of a master timeline to apply to other
things. They're GNU zipped. And I think that's the proper command to unzip it. To tar ABCDX.
Just kidding. It's X, V, Z, F file name. Yeah. Anyway. Anybody ever type in a tar command
correctly the first time? Nope. Oops. Nope. Wait. Yeah. Yeah. Sure. Yeah. They're, they're
like I said, when I go out and I war drive a particular area real quick, then I upload that's
that file just has that one run, which is kind of nice to have. And so if you've got, if you got
ADB, which you should all have, it's just an ADB pull command and you can pull that entire folder
or you can use MTP to pull it, but it's a little easier with ADB. So there's a look at the CSV
files. You've got the type of encryption, the SSIDs, the, the, the RISI values, the lats and
longs, altitudes, stuff like that. What's that? Yeah.
Oh my gosh. They're every, I love Xfinity. Yeah. Xfinity's amazing. Their new routers have
like eight to 10 unique Macs on them. So when you hit an Xfinity neighborhood, oh yeah, your
numbers go like an apartment complex with Xfinity. It's awesome. So, uh, you want to talk
now? Yeah. Yeah. Here you go. All right. Thank you. All right. So, um, Kismet has traditionally
been the, uh, war driver software of choice, right? Everybody using Kismet. It's frigging dope.
So classic Kismet, or if you go on GitHub or on Kismet's website, the stable, uh, Kismet has,
um, basically everything built in and it has GPS support, right? So you just get yourself a nice
little dongle like this, dump it in, and you're good to go. And so the advantages of that is
you can just get your laptop and go start collecting things. And it also stores in a format
that is easily up, uh, uploadable to the Wiggle website. They support it out of the gate. So
super simple. And it's also super easy to use. So, uh, the, uh, the, uh, the, uh, the, uh, the, uh,
it's really, uh, it's super easy to, uh, install with pseudo app to get, install Kismet, and
you're on and good to go. So and, one other thing. It's also it's compatible with basically
every wireless card. And you don't even have to have anything special really. You could,
like, the Intel in my, uh, HP Elitebook works the, uh, with Intel chip set because, uh,
all you're looking for is SSID. You're not doing any injection, you're not doing anything,
uh, you don't even need true monitor mode to try to pick up clients. You just start looking
at SSIDs. So basically everything works. So now this guy, qui- sitneed and then this dog did, you
running actually the bleeding edge version of Kismet which the
air bud guy is also running on his setup back there. And with
that one of the features that we got in that is remote capture
nodes so each of these devices looks like an individual radio
as if it were plugged in with like USB or something. So I
actually have 50 radios in this device here. The disadvantage of
running bleeding edge is it doesn't have GPS support. It
hasn't, Dragorn hasn't gotten to that yet. So he's working on
it, it'll come out soon I'm sure. But it's web based, he's
added a ton of functionality so it exports EKJSON and then um
uh basically I just wrote a custom script which we're gonna
put on our GitHub uh that allows you to take GPS from your
receiver and then marry it to your Kismet PCAP file. So that
way you can still stumble with the bleeding edge until it gets
official support. So um just real quick I want to talk about
Kismet stable just run through some of the
configs here. So I'm going to run through some of the
config stuff. I'm sure this is stuff that you guys have done a
hundred times but I just want to make sure that uh I point out
some of the key components of the Kismet conf. Uh basically
there's the hopping velocity that's how quickly you're
changing channels. When you have a situation like this uh you
don't need to change channels at all cause you're covering 50 at
once. Uh but typically when you just got your laptop you got 1
or 2 radios. You'll want like 5 maybe 10 channels a second. It
depends on how fast you're going. If you're doing like 20,
30 miles an hour that should be plenty. You may want to go a
little bit faster than that if you're doing something like
you're going faster on the road but then you know you might
miss some of the coverage. So uh I typically use 5 that's the
default setting it seems to work out pretty good. Um another
thing too is there's an option in there to do uh preferred
channels and that's just going to limit the radios you pick up
because if you're doing war driving uh you don't want to have
any preferred channels you just want to make sure it's jumping
on all of them equally so that way you can get a chance to pick
up any of the radios that you'll see. Because guess what
uh some lady down the street she loves using channel 2 she doesn't
know why it's set to automatic mode the router just does it all
by itself. So it's crazy. Um and then the GPS settings that's just
right in the comp file. You can actually use GPSD if you're
brave and want to have all that stuff but I just like to run
raw because Kismet has built in parsing of the um NMEA frame uh
packet and so I just use the raw device it works brilliant um
haven't had any issues with that. Uh and there's the command for
that. Uh another thing too is if you're out war driving um
there is some uh uh kind of a feature that you can use to
capture the data. So if you're in a gray area of like wiretap
laws um and I think Google had some issues with that. So
basically uh be polite like hide the data frame so it doesn't
even capture. So uh if you're doing that you don't run the
risk of getting in trouble with networks you don't own. So I
would encourage you to do that. Um and then finally there's just
a couple of uh commands to get started on that. We got Kismet
server at the bottom uh and if you want to it will automatically
launch your capture source. If you don't have it in monitor mode
it'll do it for you. So.
Um just super easy like I said Kismet's a great tool to get
started with. So uh to in all fairness um I have used Insider
and I've used Kismet on my Mac and I want to talk about those
tools just a little bit. Uh they're gonna get you the same
functionality uh you're gonna be able to stumble you're gonna
be able to get your GPS on. Um and I thought it was pretty
funny I went to the Insider website. I remember when I first
started using Insider it was like really low key just super
put together or not put together very well and now it's like they
got they got corporate people. So I was like I'm gonna use this
this is from their website. So they got this dude in sales and
corporate. So yeah go Insider must be getting that corporate
money. Um anyways uh by the way go support Kismet on Patreon
like cause let's make this thing rock. Um I really want to
get Dragorn uh developing on this stuff full time. Um and
then this is back to you. Software support my brother.
Okay support software. Uh for various look as uh
occasionally um I want to possibly uh gather maybe a uh
photographic evidence of my war drive. Nexar's a really great
dash cam. It keeps a track uh it apart from the video it keeps a
a track of that trip that you do. So you can go back and refer to
it if you run into a particular um item uh that you can marry up
with an access point later. You've got video of it already.
Um MyTracks is just a simple app that just draws a line where
you've been. So it tracks exactly where you've been. Maybe
that'd be a great feature for the Wiggle app in the future. But
uh but it's pretty cool and I just run that on the side on one
phone. It works really good. So I'm going to show you guys a
fake GPS location. I don't fake GPS locations. If I go in a
building and I don't get GPS I just use fake GPS to set it to
that building so that I can I can do it inside. I don't ever
fake the GPS right? Sorry cause that ruins the data. It
breaks it. Okay and with the new version of the app one thing
I used to have to use is I would have to check online on the
map to see what areas had already been covered. But now
that's actually showing it right in the app which is kind of
handy. So you see uh it's already it's already uh pulling
that up. I couldn't get enough internet to actually pull up the
whole map there.
And there's another uh another nice feature in the settings
which is new. Um you can have it just show your networks that
you've seen. Everybody's. And then you can set a date range.
So you could have an area that was it was war driven back in
2007 yet you need to go hit that area cause there's going
to be all new stuff there. So it can show you uh the new stuff
that that's available. Okay using phones. Pros. Everybody's
got them. They don't look weird. They're small. They're cheap.
This is why I use them cause I I travel so much. Um the app
built it it's built to work with Wiggle. It works.
Mozilla Emma uh Mozilla location services has their
stumbler as well which is a good one. And you can use multiple
scans uh phones to scan more effectively. I'll talk about
that in a bit. And then range. And there's a little bit of
debate. Do you use Yagy's directional antennas for war
driving? Well yeah if you want to map a network that's a half
mile away to your position sure. If you're looking for nets maybe
but for tracking close stuff phones work really well. Cons.
You don't usually get monitor mode. There are some phones that
support OTG. You can put in an external card and you can use
that.
Uh uh TSA does look at you weird when you have dozens of
phones. And iPhones don't work. They don't let you scan WiFi
unless you got a jailbroken iPhone. And then range. Okay.
This is also a con because you don't get very great range with
phones. But it's usually good enough. Other equipment. Uh the
pros. They're kind of obvious. Powerful. You got monitor mode.
Large screens. You got a bunch of other stuff. You can look at
porn while you're while you're war driving. All that kind of
stuff. Cool stuff. You can put in multiple WiFi cards if
you're retarded. But um no. Um and there's a lot of
form factors. So you can go with say a Raspberry Pi with a
seven inch screen or a Raspberry Pi with no screen or some God
awful thing. Um whatever. Um it does get expensive. Uh you got
monitor mode. It's hard sometimes. Some cards just don't
work right. Set up and wiring can be a hassle. I I love having
this because it's a good prop for all this stuff. Uh you need
an external GTS uh GPS all that stuff. It's a little bit harder
to look incognito with that. Hey what are you doing? You
know with this. Nothing. Right?
Mounting equipment. Um I can't stress how uh enough how
important it is to put the phones up in the windows. Up
high. Okay? Um I started doing that. I bought these little
scosh magnetic mounts. So my now I get in. I put my little
blue hydro Raspberry Pi in the center console. Put phone number
one. Phone number two. Phone number three. Back in the back
window. Phone number four. And then my actual phone to drive
with. Um they but they've got nice mounts that you can use.
Uh lots of different mounts. So you can mount multiple. You can
get.
You can get laptop mounts. They get pretty pricey. Uh dark
matter convinced his lift driver. He actually put his
account on there. Yeah uh next time you take a lift ask them
if they'll install wiggle. Totally worth it. That's it
right there. I got him. And then put your account in there
so you get points obviously. Cause screw that anonymous guy.
Cause I don't know who it is but they are winning and I'm
tired of it. Yeah. Right. Yeah. So good. Good deals. Um okay
other things. You can make up some stuff. Yeah he's like
you've got an extra tripod. You can put your phone in there.
Uh the problem with the Yagi though um is that yeah it does
pull in distant networks and then maps them to your position
which is a problem. Um any words on that? Yeah I mean.
We we I mean. Yes. Here you go. Basically you know what are you
trying to accomplish? Like if you're trying to do like the the
true mission of wiggle uh then you don't want to be using huge
crazy receptive dishes off of your vehicle because then it's
going to basically make the uh database tainted. We're going to
you're going to pick something up that's ten streets over.
Somebody's going to be like ooh I found this and it's like it
doesn't really matter cause you're still going to be off. So
but then again it's like if you're trying to find the
networks. If you're trying to just get stuff and maybe you
just have a quick run. Like alright whatever. So I would
argue that hey try to use smaller antennas so that way we
can get better precision and so it makes the data more
interesting. So. You're off the floor. Oh yeah it's still me.
Okay um. There's Bluetooth. Yeah yeah yeah we'll get to that.
He he he he he he he he he he he he he he he he he he he he he he
he he he he he he he he he he he. Alright so um basically, uh
sometimes uh it's fun to wiggle with uh with a cactus. Basically
what I did is uh this project real quick I'll just give a
quick run down. It's 25 uh tetras it was sponsored by Hack
Five. Um I went uh I was in DC at shmoo con and I ran into
Darren Kitchen and I was like you know what would be awesome is
if we built something that we could listen on all the channels
at the same time and he's like what would you need? and I'm
like um I don't know maybe like uh 20 or 30 or 40 40 something
30, like, radios. Two weeks later, 40 Tetras showed up at my house. Like, holy crap. So,
and then it's like, crap, now I have to actually build this. So, uh, basically I've got an
Intel Nook, it's got 16 gigs of RAM, 250 gig hard, solid, uh, NVME drive, um, and then, uh,
two Cisco switches, 500 watt power supply, we got a battery that's about 30 amp hours, it
pulls about 200 watts of power. Yes, it gets hot. Yes, it weighs about 45 pounds. Uh, it's not
the most practical thing, but you're gonna catch everything. So, and I went over to, to
Black Hat and kind of, uh, party crashed their Nock and in seven hours I got 40 gigs. So, that
was pretty dope. So, anyways, just, uh, yeah. Be creative with what you can do because it will
definitely help out what you're trying to do. Alright, back to you. Okay, questions.
Where do you go wiggling?
Um, when I cover an area, when I wiggle an area, it stays wiggled, right? Um, that's what we want
to do. So, how do you find places? Um, there's good places, apartment complexes, especially low
end ones. There's, they're packed in a little tighter, especially if they have Xfinity or Cox
Cable or something, there's a lot of those. Uh, high univer, universities have high turnover, so
every six months you can go hit it again. Um, town homes, condos, um, I really hate speed bumps,
really hate them. Cul-de-sacs, right? Okay.
But high density neighborhoods, the new, I don't know, those Euro style. Hey, I'm looking at you
guys back there. Well, I know, Australian and New Zealand, but whatever, same thing. Um, okay.
Straight streets are awesome, right? Through these straight streets, as long as they're not, like,
one way streets. Large, some large businesses, some have nothing and some have lots of stuff. Uh,
and then high density areas downtown. So, this has been covered, but it hasn't been covered with
five phones yet at the same time. Um, so, lots of different places. Um, you can use the WiggleNet
mapping function. So, these would be horrible areas, because I just covered them. It's, uh, west
side of Chicago. Um, and these are really great areas. They're mouthwateringly great. Like, look,
apartment complexes, packed in houses. This guy right here, he just got sick and went home.
Actually, I had, actually, I had to pee. So, I was like, man, I really gotta go. That was about
seven hours into a nine hour set. So, I, I really had to go. So, um, and then sometimes when you
look at the map, you think, oh, wow, that's really covered pretty thick. But then, if you zoom in,
you notice they haven't even touched the neighborhoods. Uh, so, it's just major streets. So, from
a distance, it looks like, oh, man, that doesn't look good at all. But you look, you go in, there's
all sorts of crazy good stuff in there. Um, here is, uh, Salt Lake City, kind of, uh, Salt Lake
City, uh, what's the other one? Las Vegas. Summerlin. So, um, and you zoom in, and you see
there's all sorts of crazy tight stuff in there you could go. In fact, you've got two schools you
could go stalk. But, um, it's all good. Um, uh, note where if there's one-way streets and streets
with medians, you don't want to get out and want to do a left and have to turn and go back around
the way you came. Uh, when you're doing apartment complexes, it does make a difference. Go the
direction that puts you closest to the buildings, because you, uh, 10 feet closer makes a huge
difference sometimes. Uh, deploy foot mobiles. I don't know how many times I go on a date with my
wife. We hit a huge apartment complex with an internal courtyard. I drop her off here. Go
around. Yeah, put, yeah. Yeah. Oh, no, she walks through like this. She doesn't care. It's just
college. She'll walk through. I pick her up on the other side. She's got another 500, because
it's a, it's, right? Okay. Optimum speed, probably, I've found, is about 25 to 30 miles per
hour, 35 maybe. Um, it depends. I even put it in kilometers per hour. I think those are
correct. Um, and people think it's expensive, but Galaxy S4s are cheap, and they work really
well. I've got like four of them. Um, the only better one is the Note 3 that I love. Uh, just
research. And then if you don't want to take time when you're going home, just pick a couple of
side streets on your way home. Every day hit a different area. It's really easy. Um, no big deal.
Um, other things. Consider why you're war driving. Like Dark Matter was saying, are you just
looking for free Wi-Fi?
Hit the businesses. There's lots of coffee shops with free Wi-Fi. Are you looking for things to
exploit? That might be businesses. It might be houses. It might be other things. Uh, are you
looking for geolocation and mapping? You're going to get everything. You want to get
everything. Are you looking to track humans? Um, for reasons, um, that you might do. Uh,
okay. I went to Park City, and we did pub crawl a bit. Uh, Park City, Utah. Have you ever
been there? It's pretty, it's pretty awesome. Um, I, I got like 11,000 networks. Uh, I
didn't even know. I forgot to upload them for two days, but, uh, it was, it was good. Um, uh, but
I believe that all access points, they don't have to earn the right to be scanned. They, they,
they deserve it. They deserve to be mapped. They deserve to be cataloged. They don't have to do
anything good or, or, or earn this. Okay. Um, okay. A little bit of diversion into MAC addresses.
As I've started scanning a lot of weird stuff, everybody knows what a MAC address is, right? An
OUI, BSSIDs, all that stuff. But what I've found is that, uh, a lot of access points will modify the
first byte of a MAC address, and then it won't show up as that brand. And that's a very common
thing to do. Um, you can look these up. MAC vendors has a good little API. It's super easy to
use. Um, and it pulls all its data from the official OUI, uh, text file from the IEEE. Um, so
it, all it is, you could use curl, you could use, uh, requests in Python directly, but URL lib2
does it, uh, very well. Um, it's very simple. Okay. The OUI is the first three bytes. Remember
though, the OUI, just because it says a particular vendor, that's not going to change anything.
That's who made that Wi-Fi chip, or that board, or that module. It may be something else. GM
cars, for example, use Mitsumi electric cards. So if you see a Mitsumi, that's them. Ford uses
Ford. So it comes up as Ford. Um, Texas Instruments is in all sorts of things, uh, for
Bluetooth and other stuff. Um, some of them pick random MACs. Bluetooth LE stuff does random
MACs. Uh, iPhones, their access points are random. So look at the name. We're going to have to
look at the SSID in some of those to identify it. And then sometimes the first byte and the last
bytes get changed. Here's an example. This is from a Netgear router. So you see you've got
Stargate 5 and Stargate 2. This is all fictionalized, by the way. Don't go looking these up,
because you won't find them. Uh, but then notice the last one, your mom's shop, uh, actually
changes the first byte to A2 and then increments the last byte as well. If you look up the first
one, it shows up as Netgear. If you look up the second one with the A2, you get no vendor. But if
you just focus on the second and third byte, or the middle four bytes, you should be okay. Um,
other ones. This is an Xfinity. It's a new router. Uh, it's a new router. Uh, it's a new
router. Um, so you've got nine MAC addresses on one router, which is pretty sweet. I haven't,
does anybody know what they're doing with the hidden ones? Like a mesh thing? Secret data
code? Something. I'll, yeah, okay. I, I have, I had some new neighbors move in about a month
ago, and you know how I knew? Seven new MAC addresses. I was like, hey, honey, the neighbors
moved in. Okay, right. So that's how they show up. So you got a couple of open publics. You got
the regular ones. If you had guest networks, they would be on a couple. And notice the, if you
could see it, hopefully, the last ones are all 6A. Uh, so, uh, so, uh, uh, uh, uh, uh, uh, uh, uh, uh, uh,
6B. Looks like the 5 gigahertz are 6B. But again, if you look up this one that starts in 06,
you'll find nothing on the first one you get. You get ARIS. Uh, this is, um, uh, a view from
Wiggle. Uh, the top three OUIs, the second one doesn't show up as anything unless you change it
thusly, and it's Google. Those are actually things like Chromecast, Google TVs, and a bunch
of other crap like that. So they, they shift off by two. They change it by a, a value of two,
and, uh, we're not fooled. Okay, interesting stuff that I've started doing. I've started
finding, anybody ever heard of Cradle Point? It's basically commercial MiFis. It's high-powered
4G to Wi-Fi bridges, 3G Wi-Fi bridges. They're used in remote monitoring, irrigation, solar
installations, power, uh, insert, insert organization here, vehicles, buses, shuttles, signs,
anything remote. Uh, they're everywhere, and they're super interesting. Because whenever I
see zero, these are the ones I've memorized. So it's like 0033, it's 3044. I was like, oh,
what is that? And I immediately want to see what it is. Novotel Wireless.
Makes all the Verizon MiFis. The 55, 10, 6, 6, 20, 77, whatever the hell. Um, those three OUIs
are GM automobiles. The last, I think it's three model years, they're putting access points in
them, and by experience, don't know how I got that, about 95% of the people have them on. And
so now we don't care about clients, so we can track their vehicle directly. Yeah, yeah, it's
there. It's always there. Then you got a couple from Google. Ericsson access points on Comcast.
Those I would like to filter out.
I'm pointing.
Because they're everywhere. And then I got Cosico, that's Cisco, and then Ford. Those are the, like,
the sync system in the Ford cars. Those are interesting stuff. Now, one, there's a company out
of Orem, Utah that makes these LVT stations. It's live view tech. And they have permanent ones,
and they have these ones that they can move around to, like, construction sites to do video
surveillance. And they're everywhere. Um, and so I did it. I could map those. I could pull those
out. And so you see a lot of Utah, Colorado, Wyoming, and then a smattering of other stuff. Uh,
but those are pretty interesting. There, if there's an LVT station, that might be something you might
want to investigate. Um, other cradle point stuff. This is Las Vegas. And the cradle point stuff I
matched here. You got up in that American Coach, Mustang 1 and 2. This isn't Reno, right? Um,
anyway, you got a bunch of stuff. So there's, this stuff's everywhere. You see a couple of YesCo signs
in there. Uh, those electric signs. Okay. Other things. These GM vehicles. Uh, the first OUI, F0AB54, is the number one
on Wiggle. Number three is the next one. And the third one, I think, is newer ones. They're a little bit
farther down. But this was just stopped at a, a stop sign yesterday. I had a ZTE phone, a Ubiquiti.
Those are everywhere. And then four, Wi-Fi hotspot. The default is Wi-Fi hotspot, four digits. And
then you see things like this. I've seen these ones like that. I've seen politicians put their title
on their hotspot of their vehicle. Like, hey, thanks, dude. Yeah. Awesome politician guy.
Speaker of the house so and so. Yeah. Anyway. Um, you can do photographic correlations with this. This guy had his name on his license plate and on his access point. It's not too difficult to marry that up with the vehicle. When Johnson Suburban, that's also been fictionalized, pulls up next to me, I'm like, oh, okay, now I know who they are. I take a picture. But I just did that with photo grid while driving with one hand. Um, sadly, I'm not kidding. But, um, it's so good. Okay. Then, other things you could do. For example, here's Jim. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He
drives a car. He drives a car. He drives a car.
He drives a car. He drives a car.
He drives a car. He drives a car.
He drives a car. He drives a car. He drives a car. He drives a car.
He drives a car. He drives a car. He drives a car. He drives a car. He drives a car. He drives a car.
He drives a car. He drives a car. He drives a car. He drives a car. He drives a car.
phone and Apple watch. I'm thinking, okay, the iPhone's her personal one because she has an Apple watch. That's probably
her work phone that she got at her employer.
Which her phone is now asking for. And Susan's a smart
girl. She's a rich girl. And she really loves to read, but she is a bit clumsy.
Just a bit. 11 Kindles, seriously. She's dedicated
to the Kindles. She loves to take them to read at the coffee shops.
All of the good coffee shops. Which is a little strange because of this one.
I'm not sure how many are familiar with the LDS
church. No coffee. So I figured maybe the Audi is her work
and coffee vehicle while the Denali is the one she drives
to church every Sunday. So it's
good stuff. And this was all in the space of about two minutes, approximately.
Maybe. And then I also have the other ones.
Susan's bathroom echo, her backyard, Susan's mother's house.
No, I'm just kidding.
I'm just kidding. Right. Okay. So things that you can see out there.
These are just examples. We got OBD2 adapters,
Audis, an Osmo gimbal, TVs,
GPSs, SMA. If it starts with SMA, that's a solar controller.
They have Bluetooth and Wi-Fi. Mercedes-Benz,
P-Net, FedEx trucks, other trucks, etc.
AutoNet. There's a couple of police vehicles up there. Okay.
So there's a lot of tons of stuff. And like I said,
this is why I started doing this more because I started seeing all this cool
stuff that was out there. And I want to track that cool stuff, really.
I mean, let's be honest. What time is it? Cool. All right. Okay.
The Wiggle API. This is what I really wanted to talk to you.
The biggest thing is it's not REST, which really annoys. No, I don't really care.
But it's an RPC style. It's JSON. That's what it gives you back.
I've heard that's really good, honestly. And before this, there was kind of
some semi-official but not really supported stuff. And depending on how much you contribute and how much you
beg, you can get more queries per day. And that will put an end to this.
Who's done this before? Really cool Wi-Fis, etc., etc., right?
But many monks have lost their employment in the procedure because they no longer.
Yeah. The handwriting, yeah. Okay.
Somebody asked about the Wiggle API key. It's with your account you get an API key.
You get an API name and a token. All you got to do is log into your account. You go to tools API and
go to your account. It will show you what you can get your API key name and token.
And so it looks like this. And then those are what you're going to use to log into the account for API use.
Okay. And as I said, if you want to ask for more, is that the right email right there?
Wiggle admin. Yes, it is. Yes. Awesome. Not that they're with Wiggle or anything.
Okay. So basic authorization. So if you want to use curl, you can do this.
So you've got a curl capital X, a get. And these are, oh, by the way, it's not the user password.
It's your API name and token. And then they have a base 64 encoded user pass.
You stick in there in the header. And then you've got an application JSON.
And then the query itself. The first one I'm showing is a geocode query.
They're using the open street maps, the nom and natum. I'm not sure how you pronounce that.
But what it'll do is it'll record, it'll return, among other things, a bounding box for a location.
So if I want to wiggle or I want to do queries on Clark County, I just put in Clark County, Nevada.
It spews back four.
Two lats and two longs. It gives me a box of Clark County.
That way I can feed it into further queries and get just stuff in that area.
The second one shows a basic search. So that's a network search, net ID.
For this one, you need either an SSID. You can use an OUI.
Or you can use the full MAC address.
And then on the last one is what's a detail search, like I showed before on this other search.
That's where you give it a full MAC address. And it will give you all the observations.
Okay.
Okay.
There is a library called Piggle. It actually works really good, installs with PIP, so not a problem.
And on that one, in the site packages folder, you have the config.py, and there you just put your API name and token.
So whenever you do searches, it automatically pulls it. You just import the config, and it works there.
And this is the website for that. But you can just do PIP install Piggle, and it installs fine.
Is it 2.7 or 3.0?
I'm using 2.7.
Okay.
Yeah.
I honestly don't...
It's good for life.
Yeah.
I honestly...
Yeah.
I will never move.
And I will fight anyone who claims otherwise.
Now, I'm kind of stuck with Python, too.
But, okay.
So a basic search with Piggle.
This is just a bare bone.
So you import config.
You import network.
That gives you the searching.
An SSID, pretty fly for a Wi-Fi.
Pretty good one to use if you want to look incognito, by the way.
And so we just do a network.search.
Plug in your SSID.
Tell it what offset you want to start.
It pulls in increments of 100.
So you want to start at 0, 100, 200, so forth.
Lat ranges.
Those are longs, I believe.
Doubles.
They're doubles.
They're floats.
And then I just loop through the results.
I get back a JSON element.
Piggle does not push back a JSON object.
It gives you a dictionary.
So you don't have to import JSON or anything like that.
It gives it to you all ready to be used as a dictionary.
And so I want to pull the SSID, the net ID.
The trilaterated latitude and longitude.
That's the averaged one.
And then the last update type.
So very simple.
And I'm going to double check that.
I'm going to demo these two.
Now this one I did a little bit different.
I did a detail.
And I wanted to pull the details of both a GSM network and a Wi-Fi.
So there we have the net ID.
My BSSID.
The operator is 310410.
That's AT&T for the U.S.
And then a LAC and a cell ID.
And so then I just pull through.
And I'll demo these in a second so you can see what they look like.
But it just puts them out.
I just did a simple example to show how those work.
So I'm going to go ahead and do that real quick.
So I'm going to go ahead and do that real quick.
So the first one.
Wiggle search.
Just run that.
Oh shoot.
You're kidding me.
I got no internets.
My internets went away.
Yeah, I don't think so.
I'll just connect you to a random AP.
Yeah.
I don't think so.
But hey, thanks.
Let me see if I can do this.
Give me one sec.
I'll see if I can.
I'll just connect you to a random AP.
I'll just spawn it up.
OK.
We're fine.
We're doing it live.
Don't look at the name of my access point.
No.
It's still breaking.
It's still pissed off.
Yeah.
It doesn't want to play.
We might not be on the internets.
Yeah.
We might not be.
OK.
So I'm just going to roll with this.
I'll just explain the script a little bit.
The ones I'm doing later, I already have the data.
So it's just fine.
So what this does is the first one is going to pull a Wi-Fi record.
Now what it does is it pulls a JSON object.
And all of these are available in their online.
They have an online demonstration piece.
And you can look at every attribute and every method.
You can do tests.
And it shows you the JSON object, the curl command, all that stuff.
It's really awesome.
In fact, that was the first time I'd ever seen that swagger UI.
But it's pretty cool.
So if you have any questions, you just do the query on the site.
It tells you all the stuff that you look for, all the options and everything.
So I'm going to pull out the net ID, the SSIDs, the last updates, the try lat and the try long.
So I'm pulling that one record, the main record for that access point.
Then the next one, I'm going to loop through all the location data for all the observations.
And then print out all the regular lats, longs, the type of encryption, et cetera.
The next one, GSM, the format's slightly different.
The record has an ID.
You've still got results.
But it's got an ID, last update, try lat, try long, and then the individual results down below.
So pretty simple.
Now, this stuff, we do have a GitHub where I put these examples on there.
So you can use them.
No big deal.
So skip forward.
OK, other useful APIs that I've used.
GeoPy is really great.
Do geocoding count against your queries?
No, it's got its own problem for the day.
Oh, does it?
Yeah.
So if you want to do nominate them, you can import geopy.geocoders.
And that has nominate them into.
You can get bounty boxes there.
I've got that on that GitHub as well.
Facebook-SDK, you can import that, install it with pip.
I won't tell you why you would do that, but you might do that, right?
Reasons.
For reasons, right?
Mexicans post a lot of porn, just saying.
Where's Nicholas?
Sorry.
Sorry.
Yeah, anyway.
And TweePy is what you use with that for Python.
Other things.
OpenCellID has their entire database of cell towers you can download.
It's a CSV.
So you'll maybe want to filter it to your area.
But then you can use that.
Mozilla MLS.
I'm not sure if they still are, but they were in cahoots with OpenCellID.
So same stuff.
MacVendors has OUI lookups.
Google's geolocation and geocoding.
You get 2,500 free searches a day without paying money.
And then over that, it's like 50 cents per thousand or something crazy.
Then all the Facebook, Twitter, Instagram APIs.
There's tons of stuff.
And you might want to use those for, again, reasons that are whatever you want to do.
Okay.
So what's that?
Geolocation is yummy.
Geolocation.
I love geolocation.
Seriously.
I get excited when I see, like, hmm.
Anyway.
Okay.
So what if you want to be incognito?
Look like a GM car, first of all.
That's good.
GM cars drive around.
So background a little bit.
I work in mobile forensics.
So I work with a lot of agencies.
Okay.
And sometimes I'm scanning things with them.
And their cars have very obvious names, both Bluetooth and Wi-Fi.
And I ask them why.
And I'm saying, why don't you just call yourself Bob's iPhone or something.
But have a list.
You know, Bob's iPhone is this car and so forth.
So this would look incognito.
iPhone is good.
Audis.
Android APs.
Here, Xfinity.
In Mexico.
Infinitum.
In Central America.
Turbonet.
You've got all sorts of crazy stuff.
Cable Wi-Fi.
Pretty fly for a Wi-Fi.
Tell my Wi-Fi.
These are all great ones.
They're everywhere.
FBI surveillance fan.
Did you see that FBI surveillance fan the other day?
That somebody's selling, right?
If I ever had an FBI surveillance fan, I would just call it FBI surveillance fan.
Because holy shnikes.
Nobody will notice.
Okay.
I have 47 in my neighborhood.
Yeah.
Yeah.
Oh, yeah.
They're everywhere.
Right.
So this was just a limit search of only 10,000 results.
Okay.
So there you go.
That's with KMLs right there.
That's good stuff.
Okay.
You know what else is huge besides FBI surveillance fans?
What else?
Anything?
Your mom.
Don't read this one.
They're bad.
This is your mom.
Tu mama.
Y tu mama tambien.
It's basically, yeah.
It's your baby.
Your mom's baby.
Yeah.
Don't read these.
These are bad.
Some of them are terrible.
Your mom has an Audi.
That's bad.
That's a good one.
That one's good.
Yeah.
But that's a good one to masquerade as.
Nobody's going to notice.
Right?
I have my phone, actually.
My Bluetooth name is your mom's.
Because when I pair with stuff, it's paired with your mom's.
It never gets old.
Seriously.
It never gets old.
Okay.
So what we're doing, what we want to do in the future is we want to look at, like I said,
not just get the vendor of a device, but actually figure out kind of what it is.
So I've been starting to categorize.
And I'll probably put this up on the GitHub soon.
OUIs and then what they are.
Cradle points are there.
That was my first one I put on.
Mitsumi Electric are the cars.
Wistron New Web.
They make direct TV receiver stuff.
And they also are in Audis, BMWs, Volvos, et cetera.
I've seen DVRs, you know, Comcast business class.
What's that?
What's that?
The same group, they partner with Arcos.
Oh, they could.
Yeah.
I haven't seen those, but yeah.
And then, you know, Pegatron routers, et cetera, for Comcast business class.
Internet.
So I'm starting to do these digital signs.
I love those.
Every time I see an LED sign, there's a stop sign in my neighborhood that has Wi-Fi.
It's like pretty cool, but it's awesome.
Okay.
So that's kind of what we're doing.
So the summary, and then I'm going to try and demo that stuff again.
There's a lot of wireless stuff out there, and it's really interesting.
It could tell us a lot about people around us.
And turn your wireless off most of the time.
People go out of their houses, and they leave all their crap on.
And make sure everybody leaves their stuff on.
Turn yours off.
Leave it on.
Go get on Wiggle.
Join the cause.
If you want to, I'll give you my account information.
You can put it in there.
Or mine.
Human drones.
I have my wife, two federal agents, one cop, and two other friends.
I have phones with my account info in them.
So yeah, you're like, how does he get around so much?
No.
Right.
Lyft drivers, wives, partners, federal agents, whatever.
On Twitter, I'm at Arject.
And he's at Dark Matter with fours, where the A's should be.
And then you've got Wi-Fi Cactus.
I threw that in there, because you know what.
I will, if you follow my Twitter, I will post that GitHub.
It just has these little snippets on it.
And we're going to be posting more stuff on there as we go.
So let's see if I can get this thing to work again.
Okay, let's see.
Give me one second.
We'll see if we can do it.
Well, I'll just show you some of those.
I'll show you some examples.
Okay, so one traveling Android access point.
So one of them, my map.
I do a regular network search.
Oh, shoot.
Still can't.
Just go ahead and say yes.
No.
And I get some.
Yeah, I know you can't talk through that.
I get a few hits on this Android access point.
But when I run an actual detailed search on all the OUIs
that tie back to that access point.
Yeah, yeah, yeah, I know, I know.
I can actually see a lot more.
Geez, go away.
A lot more interesting information.
Like when Aardvark drove to DEF CON, for example.
When he went to Chicago.
When he went to Columbus, Ohio.
When he went to don't know why, Mexico.
You could also see a few places the name changed.
Right here in El Salvador it was called your mom's.
In Guatemala it was called LDS access.
You know.
That is me, yes.
That's me.
Followed.
And then in Panama it was FBI surveillance van because.
FBI is clearly in Panama.
Because reasons.
Right?
Okay.
So just as a review on the API.
Easy to get into.
Easy to play with.
Go play around with the little demo thing.
And I'll be posting examples of how to do KML.
Nominate them.
How to pull in like Mac vendor stuff.
And so I will Tweet that out if you follow at Arject and
at dark matter.
You can get that stuff.
Also we have stickers up here.
The wiggle guys are back there.
They're in the lab coats.
They have stickers.
And do you still have shirts?
We have T-shirts, yes.
Okay.
So go mob them.
I also have stickers up here.
So you can come get that.
And that is all.
Thank you for attending.
Appreciate it.
.
.
.
.
.
.
.
.