All righty. I hate reading bios, so I'm not going to.
This is Alex. He's a good friend of the village for a couple of years now because he makes cool toys.
Those of you that have been in the village for more than a few seconds have probably noticed one of his cool toys in the back where he's been posted up.
And he's going to talk about what that device is and why it's cool.
So, this is Alex with large-scale wireless monitoring using Kismet packet sniffer on a multi-radio array.
And if you don't want one of these, you're probably in the wrong place.
So, thank you, Alex. Please.
Okay. Hi.
Hi.
So, hello, everyone.
First of all, I wanted to thank this cool bunch of village people for, like, giving me this opportunity to speak.
It's my first time at DEF CON.
I mean, presenting.
So, be gentle with me and, you know, you'll see how it goes.
This is my presentation flow.
Nothing really important.
A few words about me.
So, I spent about, like, 25 years in the high-tech industry.
Turned to the security field about, like, six years ago to find out that actually all 25 years I did security as a matter.
Sorry?
Let me.
Is it better now?
Okay.
So, I spent about 25 years in the high-tech industry, like, big names like Cisco, Alcatel, Ericsson, whatever.
Okay.
So, 25 years ago, I moved to security domain and found out that whatever I did for 25 years was actually a security field, right?
Don't pay attention to all this alphabet soup, you know, underneath.
I have to maintain my security profile to, you know, to work for a living.
I do own a small company.
I do own a small company.
I do own a consulting company in Ottawa, Canada.
Our main revenue stream is professional services, mostly in the security assessment and authorization field,
which gives us enough money to reinvest into the all kind of cool R&D activities.
So, our goal or our vision.
For our R&D domain is create appliances to support open source software.
I know, like, it's kind of like old stuff.
You probably, most of you know about this.
It's just like small recap.
This is 2.4 gigahertz frequency band and Wi-Fi.
We do have total of the 14 channels.
Not all of them are visible for you, like, due to.
You can see the regulatory domain, which is maintained by the firmware and the, uh, high level applications.
When it comes to the 5 gigahertz domains, things are becoming a little bit more complex, right?
It's more channels, uh, it's provisioning for like, wider WIS channel, like, 40, 80 and up to 160 mHz.
Recently.
So, you kinda get a picture how many channels there are.
uh one should to cover uh when we do perform sniffing and monitoring. Um the basic concept
of the wireless monitoring is like it's RF monitor mode which is uh which does allow a
wireless network interface controller to monitor all traffic received from the wireless
network. Now uh the difference is between like you know which is most which is less
relevant in the wireless domain is that RF one allows packets to be captured without uh your
network controller to be associated with any access point or like uh ad hoc network entity. Um
so RF one is the uh it's a feature that allows you to uh to monitor all traffic received from the
that is implemented in the hardware. So when we talk about hardware we and support of RF one
model or not is kinda like by fold is end its end hardware capability as well as the driver
capability to to turn it on. So uh very select subsets of chipsets do support uh RF one. If you go to
guys like Aircrack NG or Kismet Wireless you'll see the list of the supported cards or
supported wireless appliances in a USB or PCI Express domain and you'll see which ones are
supported right. Sometimes they do refer to the card itself, sometimes they do refer to the
chipset that this card employs. A small word about the antenna arrangement. So the
as you can understand antenna is very important thing when we monitor. Like think about it
like you have like hi-fi audio system, the top some notion you do connect it to the you know
lousy loudspeakers. Result is obvious right. So good antenna good good antenna arrangement is
critical for the successful monitoring. Um the antenna arrangement is critical for the
the quality or like characteristics of antennas are basically you can um describe in the
three domains like power gain, directive for gain and polarization. So power gain is basically
it's a ratio um it's a ratio between power produced uh by uh antenna from the remote power
source uh and the power gain. So the power gain is basically it's a ratio between the power
gain of theyang to the length of the antenna and the power gain of the antenna. Now in the
uh and hypothetically loose antenna right, which is measured by uh DBI which stands for the
that's the bell's isotropic and uh decibel is logarithmic unit when you do compare to uh to values DBA
which basically refers to the ability of the antenna
to receive signal from one direction
and basically gently reject signals
that are coming from those other directions.
We'll come to this later on.
Polarization is a way that antenna emits signal
into the air, so we do recognize two kinds of polarization,
polarization, vertical and horizontal,
and basically, rule of thumb, polarization is,
it's the same plane as main antenna elements are at.
For example, if you do take vertical antenna, right,
so it's vertical polarization.
Horizontal, horizontal, it's very simple, right?
You know, I did deal with the very knowledgeable RF
antenna engineer who could explain me all this stuff
using fingers on one hand, it's kind of really simple,
without diving into the glory details.
Shortly, overview of antennas that people use
for the monitoring, so everybody knows, like,
rubber duck or deep hole antenna.
Yagi antenna, it's more kind of narrow band antenna.
Log periodic, Vivaldi, patch and panel.
So what's cool about these two antennas in particular,
log periodic and Vivaldi, is extremely wide frequency range coverage.
Another quality, I died, one, two, three.
What's great about these ones, it's a lot of blinkers,
I personally like their, I quite like their range,
It's a little bit of distance.
If you have, you know, a table-to-table wall,
it's the same, you have to go into each room,
and there's a little bit of distance.
So you have 6,000, 6,000, 6,000.
So you really set up.
keep them together. So what's really cool about this log periodic and Vivaldi antennas is
that they can be implemented using simple printed circuit board, right? So it's very easy
to manufacture. If you go Google you'll find multiple designs and multiple applications. What
frequency range coverage. That's kind of small overview like what each antenna uh stands for.
Um so rubber duck as you see like all these guys are using is uh is omnidirectional and
propagating radio frequency energy like 360 degrees in a in a horizontal plane and basically
you can find like do it yourself kits uh on the on the web if you take like piece of wire make it
like half or quarter wavelength so the desirable band may you see it's probably the best thing
that you can get. Uh a log periodic antenna it's multi element directional. So it's approximately
30 degrees horizontal and 30 degrees vertical. But uh in terms of gain so rubber ducks
you'll find somewhere between like 3 dBi up till 7 dBi for like 2.4 and 5.8 and 5.8 gigahertz
bands. A log periodic uh you'll you may gain in a small form factor up till 16. Right? So it's
even though being directional somewhat gain is incomparable. Another thing is that with the
rubber duck antennas when you do buy dual band rubber duck antennas you you have to remember
that it's always a compromise. Right? So it's kinda performance okay-ish on a 2.4 and okay-ish
on the 5.8 but not on the both of them. Right? So if a if you compare quality and gain of
rubber duck antennas that are uh uh mono band it's much higher gain. Right? Um and so on.
Vivaldi, patch, Yagi antenna, panel antenna. So all of them do have certain you know area of
application. Um we started to play internally with the Vivaldi and log periodic antennas and
we do gain extremely good results. Right? Um this is kinda for fun. You know what I when I did
uh you know studies this all this horizontal vertical sync. Right? I found out this uh block
by the senior uh Apple RF engineer. Which I can kind of found funny uh by the same token
obvious. Right? And I tested this thing at home with my kids like MacBooks and believe it or
not I hit it just like amazing results. Right? I see gain boom right on the spot. The whole
thing is that in the in the you know MacBook where do you think antenna is? Right? It's kinda
it's metal aluminum shell. Right? Where do they put antenna? Well the antenna is in the middle of the
wall. They put the antenna in this small plastic area on the hinge. Right? So the only way they
can do it like just they put it like you know horizontally. Right? So here you go. You have
your horizontal polarization. Now if you will just move your outer antenna one of them you know
horizontally you will see significant gain in crease. A significant um significant uh um
power level increase. So you can see the uh the uh the uh the uh the uh the uh the uh the uh the uh
difference you can see between the two. And this is what they can do with the USB port EMeniz
but you can't see through. This is web monitor device kind of stupid but it works fine. You know
like I just test to it home. It just works just fine. Er yeah. Sorry? Is that omni or
getting directory. This, this is omni. Right? But again you know where's the uh main uh element
is. Which plane here you know there. One of its,
choices right? You can always start with the uh purposefully built appliances like wifi uh
pineapple which you can buy here at the Wenders area. Uh many people use uh USB based
dongles right? For for example these guys over there they heavily utilize USB based
dongles as I noticed. Um the problem with USB uh dongles is that they're mostly made um in
Asia. It's kind of like mass production thing right? And antenna wise unless it's external
antenna it's internal built in PCB or ceramic chip antenna with very low quality right? So don't
expect to you know to see a lot from this uh cheap USB adapters. Even though they might be
compatible with the other phone no one says that it's wrong but uh drivers are an issue as
well. Uh whatever sources that we have that are coming from overseas uh well they need
heavily fixing. Uh they need heavy fixing and uh they're not as polished as the you know uh as
for example PCI Express. Uh in a PCI Express you have much more offerings uh in terms of
like quality products right? Um the the the the the the the the the the the the the the the the
quality of your device. Uh we do have a readily available few kinds of PCI Express radio cards
so the first two on the top is PCI PCI Express mini which is basically uh your your PCI your PCI
Express single lane interface minus twelve volts power rail. To be like to simplify things right?
Uh they do come as a full length and as a single line you can open the whole box and you can opening
the half length. Depends on the chipset, depends on the
manufacturer. Um when we talk about the powerful cards like for
example the ones that are that are produced by company by name
Microtech or like powerful A to A11 AC cards which are produced
by for example company like Compex. They do they do equip
them with the heat sinks because uh they do have heat
dissipation uh issue so you have to drive heat off of uh of the
card. Uh newly uh like relatively new standard is M2
which uh which basically is going to replace uh wireless
cards on each and every laptop that you will see coming
forward. Uh form factor is almost twice smaller than the
normal PCI Express Mini. Um uh the uh quality cards are from
Intel. It's 80 to 60, 70 to 60. Uh but again if you do have PCI
Express Mini slot in your system you'll have to go and buy of
eBay or from Amazon adapters that uh will uh convert uh M2 uh
pin out form factor to PCI Express Mini.
Um now talking about PCI PCI Express Mini. Um uh historically
the most friendly uh chipsets uh uh ever produced uh were from
company by name Atiros. This is where I don't know if you've
heard or not like driver family like ATH 9K, ATH 10K and so on
so forth. So these are probably the best chipsets in in uh PCI
160 industry. So majority of them if not all of them are Pc ah uh
PcXS based. So if you wanted to go and excel in a monitoring so which
have choice between weigh-in PCI Express I would say go to
monitoring. You can always Google them and take a look what they do. Uh we tried recently
uh where was that? We tried recently uh acrylic wifi. It's a small company in Spain and they
make amazing piece of software uh that is capable of producing so called heat maps. Unfortunately
it it's Windows based software so whoever hates Windows need to suck it up. Um our darling
and our like and we talk about this going forward our darling and our favorite scanner is
Kismet and I'll explain why in a few slides. Um now when we talk about wireless security
monitoring or wireless monitoring challenges right? So there are few aspects. First of all
we do have like legitimately two frequency bands. 2.4 and 5.8. Uh across these two bands
we do have multiple channels arrangements right? For example uh appliance that we are going
to present today uh cards are 802.11a BGN and across these two bands we do have multiple
channels. So basically the aggregated channel capability is 84. So each card is capable of
scanning 84 channels with different arrangements. Different frequencies, different channel
V's and so on and so forth. Now if you do uh monitor if you aim monitor 84 channels so
basically scanning goes like you tune to the channel, you sit there, you listen, whatever you
can capture from the air. When you're happy you move on to the next channel. Like if you will
hope like this 84 times you can understand that once when you will finish your loop and you'll go
back to the channel number one some time will elapse right? So chances are that you or you'll
miss something right? Uh or you will not capture whatever you need. Right? Um another uh
challenge is discovery versus tracking right? So uh I'm not going to go into too much detail here.
Cause under circumstances it depends on the task in hand. You might need not only to discover
wireless appliances uh in a proximity you also want to track them down right? Means that okay
how often they do appear, when you did see them first time, when you did see them last time, how
you know active you are and uh they are and so on and so forth. So this all of this uh creates a
uh challenge for fast and full monitoring. Uh this is a challenge uh for fast and full monitoring.
um now when we talk about monitoring like if I'll say you that okay now we have single
single radio card we have 84 channels to cover and we kind of hope from channel to channel
sitting on each channel for a certain period of time waiting for frames to arrive once we
are happy we move on what if you have like multiple cards what if what if we will have
ability to to talk simultaneously to multiple uh capturing devices or multiple resources right
so let's say you have two cards right you can always say okay now card number one will be
tasked to capture from channel H to channel B and card number two from channel C to channel D in
a sense what it gives you it gives you twice more presence on each given channel right and so
on so forth.
More cards you will employ you know more you will be present on each particular channel more
you'll capture. Um you can distribute this workload to balance workload across multiple uh
sources. Uh you can switch between channels faster right because you will come back to them
faster right. Um and and uh another thing you can do is you can uh you can uh you can uh you can
do is you can do a little bit of Russive tracking to make sure your collectors don't have to
the part of the thing that's the most important thing is that with all this 20 MHz channel this 40
80 in the AC 80 plus 80 and 160 mhz you are physically kinda in the same frequency sport right
right? But you should tune your radio differently to capture data from different channels.
Um and we talked about balance and uh versus tracking monitoring. So here's appliance that
we created, right? So I uh idea behind was very simple, right? So we wanted to give to
community something that uh that uh can utilize multiple high quality PCI express mini and M2
radio cards to be easy to use, right? Uh we uh we did equip this appliance with standard uh
X86 uh Intel platform. As you can see it's sort of standard mini ITX low profile
motherboard. Such as developers will not spend time with ARM or MIPS or like whatever the CPUs
they have with patches with you know kernel and so on and so forth. So this appliance actually
runs whatever any PC will uh w- w- whatever any PC would, right? Um appliance has the
provisioning for uh 9 PCI express mini slots. So you can choose your commodity or you can
choose whatever compatible cards from from Amazon from Ebay from other sources,
right? Inst- installs them and just uh have yourself multi radio uh multi radio array. Uh
a choice for the antennas as the end connectors, so rather than SMA was the filter application
because we uh our first prototype was based on uh SMA uh so on'multi- um uh it was uh we made uh
SMA connectors and SMA antennas. Like after like 20, 25 times of like putting them on,
taking them out, we found out that thread on the connector was gone. Right? So it's no
point. And, and connectors are professional quality. You have much more professional
antenna offerings from the market. Um, and we found it like, you know, um, you know,
somewhat easier to use. Uh, again, so it's flexible because it allows you to install any
op. So our PCI Express slots in this device are fully populated with the USB 2.0. So if you
have like, you know, Bluetooth cards or something like that, or cards that are combo
cards, uh, Wi-Fi plus Bluetooth, they will work fine as well. Um, and, and we found that, um,
it actually works fine. And the, the, as they said uses any commercially available mini AC
Express. You have your card, x86 platform composite with anything that is available, with any
open source. Um, well it's kinda just just walk over through the main feature. This is how
a device looks like inside. And you see is here a nice RF cable? So these arecular cables and
signals, which do have very low signal loss. Um, as I said, it's, uh, our standard offering
is, uh, uh, quad-core Brasswell Intel Celeron, uh, 8 gig of RAM, 64 gig of solid state. Uh,
we can, uh, also, uh, populate it with up to two terabytes of the, of the retention
storage, 9 PCI Express mini slots, which can accommodate any PCI Express or M2 card. Um,
that's it, basically, what do we plan to do, what our plans to do next as the hardware goes,
right? We just, uh, finalized the, uh, development of the, uh, 12 card, uh, uh, memory card,
uh, carrier, which looks like this. It's the first prototype board. Uh, it looks like visually
as the, uh, standard PCI Express mini carrier board, but it's actually fine-tuned, uh, for the,
uh, wireless applications. And I'll explain in the, in the, in the second, on the next, uh,
slide, what do I mean by this. Uh, we do plan to, uh, it, it's in works, uh, mini PCI Express,
for a factor of what channel sub-gigahertz radio card, this coverage from 119 to 960
mi, mi hertz frequency range. And when I mean, when I'm saying what channel I mean what radio.
It's true quad radio card. Uh, we do plan to, um, to create a quad, uh, quad card mini PCI
Express, mini, uh, Bluetooth, so, and, um, uh, as I call it, anyway, uh, uh, a, a, uh, uh, uh, uh,
energy with uh which will be compatible with the uh new 5.0
standard. Uh and we also plan to uh create our own form factor
uh our own quad uh channel quad radio ABGN AC receiver. So all
these cards will be in a purely receive mode. No need transmit
no nothing but we'll do it as uh as we need. Uh also our plans
are to create 360 directional antenna array uh to try out to um
um track physical uh location of the wireless appliance in the
proximity. Oh this is how this card will work. This is the
look like. It has kind of two layers. So uh lower layer lower
layer will will have four PCI express mini slots and uh uh
another eight are going on the top. So when I said that it will
be fine tuned for the uh wireless application is uh is
the following. Um currently developing and soon to appear on
the market. Uh eight to two eleven AC wave two radio cards do
have excessive power budget requirements. So standard PCI
express mini slot can supply only up to 13 watts of the power.
So new uh tripplin uh quad chain AC cards uh do have special
arrangement for five volts rail on addition to the standard 3.3 volt
on the PCI express slot. The reason for that they do uh uh uh they
need this voltage to uh power up the uh power amplifiers on the card.
Right? So which in a sense it it's beyond 13 watts. So if you have
chance to buy this card you'll not be able to use it in the standard PCI
express mini slot. So what vendors do uh there are certain pins on the PCI
express mini connectors that are unspecified by the standard. They're
actually vendors are free to use them as they see them fit. So in a particular uh big
vendor like Compex uh they just about to release uh quad chain AC cards where they
have five volt power rail on these pins. So we do accommodate this uh feature as well.
So another thing is that uh we do recognize this card as a maybe
stand alone gadget. So we have uh arrangement for the remote PCI express uh connectivity.
Um which will be done through the USB 3.0 cable. Now Kismet. So Kismet I mean I'm sure like
many people used it in the in the in the past. I just will go through uh this tool uh uh this tool.
very fast. It's network detector and packet sniffer for like 8 to 2 lead into wireless
LANs even though like uh maintainer uh wants to add and Bluetooth and sub gigahertz radio
uh functionality and so on so forth. Um it used by thousands of professionals as a baseline
for intrusion uh detection systems. Uh maintainer of uh through to a very high frequency uh
Kismet wireless claims having in excess of 50,000 downloads a month. So this is just to
give you an idea how big the community is. Uh Kismet probably one of the very few passive
scanners which means that it doesn't emit anything to the wireless environment. It doesn't
produce any beacon request frames. It's not detectable because it doesn't send anything out.
Um it uh has capability to detect both like access points, wireless clients and uh uh
corresponding associations. Uh is it is the most widely used and up to date open source
tool. Uh as we speak the changes are going to the git on a daily and on a daily basis. Uh
the hourly basis. Um so it also has capability to uh uh to get in uh GPS data in NMEA format.
Uh and has capability to create the uh wireless objects detected versus the geolocation versus
geolocation of the sniffer itself.
So this is demo that you will see over there near near the wall. So we do have our air bat
appliance which runs Kismet server. We do have client which is basically simple web browser.
It's kinda it's a screen shots from the latest uh git version of the Kismet. Probably not the
same Kismet as you saw like.
You know in the past now it's purely sort of like client server architecture where where the client or like visual GUI is it's your browser. Right? Um same functionality underneath tool was uh has a major improvement last uh four or five months uh with lots of optimizations. Um when I look at the
the counter how many devices do we see on the Kismet right now it was I think it was fourteen
thousand. This is how many devices we see around here right now. Um so if you will approach this desk I will show you all the screen kinda live. Um all the particular clients uh associated with the
the access points. This one is interesting because it shows you all the resources capable in
the color schema and then shows you dynamically how each resource hops from channel to
channel without overlapping. It's a plugin that shows you how many devices it sees right
now, how many packets a second Kismet takes in, how many channels are subject to scan, and
how many active sources are employed. All of us do this stuff, you know, we are passionate
about what we are doing. Like open source community, people are actually doing
something. You know, we are passionate about what we are doing. Like open source community,
people are actually doing something for a living, right? Whatever they do create, they
do create in their free time, you know, like taking time from family, from kids, from et
cetera. The maintainer and the author of Kismet is Dragan. He created this tool both in need
and the passion. He could have charged for it, but he pushed a reward because he doesn't
you choose not to, it takes a great amount of time and effort and skill to maintain Kismet
and enhance its features. He never charged the community for this. So what we are saying
is that we kind of strongly suggest the community to support the guy, right? I mean, any kind
of donations towards his project will be helpful. Whatever it will be, like $1, $5, $10, $100,
whatever. Corporate support is welcome as well. So me, like personally, I'm going to tweet
smoking today, and I'll dedicate my smoke money to this guy right now. So help us to improve
this tool, help us to make it perfect.
Um, you, if you go to the uh, Patreon website, you have all to the Kismet Wireless web, uh,
website, you will see the link, how to become a patron. So any support, uh, towards project
would be greatly appreciated. Um, this is my particulars, my data, you can always email,
me, call me. Uh, I'm in the eastern standard time, so make an adjustment, please. Um, that's
about it. So if anybody has any questions... So demo is over there. So whoever wants to see the
demo, it's near the wall, on the back. Thanks.
.