[00:00.000 --> 00:00.960]  All right.
[00:00.960 --> 00:01.560]  Hey, everybody.
[00:01.560 --> 00:02.920]  My name is Eric Escobar.
[00:02.920 --> 00:05.940]  Thank you for looking at my corporate slides that allow me to come to DEF CON.
[00:05.940 --> 00:07.060]  I really appreciate it.
[00:07.060 --> 00:10.000]  This is what allows me to come here and have fun with all of you.
[00:10.560 --> 00:17.160]  So I'm going to talk about a subject that might be like, you know, kindergarten level to a lot of you, but to a lot of my clients, it's not.
[00:17.180 --> 00:24.200]  And so I feel the need to do a talk and kind of walk through a lot of the different aspects of what I do on a day-to-day basis.
[00:24.660 --> 00:32.040]  So this talk is going to be about evading or if you are a rogue access point, how to evade detection from a WIPS or a WID system.
[00:32.040 --> 00:33.480]  And we'll talk about all of that.
[00:34.380 --> 00:38.040]  So you are probably watching this wondering, who is this nerd?
[00:38.040 --> 00:39.100]  A lot of you know me.
[00:39.100 --> 00:42.220]  Thank you for coming to my talk, because no one else is going to be at my talk.
[00:42.300 --> 00:43.480]  Thank you for the alcohol.
[00:44.660 --> 00:49.400]  So I did not start out as a hacker, so the imposter syndrome is super real.
[00:49.440 --> 00:52.120]  I went to school to be a professional civil engineer.
[00:52.280 --> 00:58.420]  And I know that this probably doesn't fit with the talk, but I started coming to the Wireless Village not knowing anything at all.
[00:59.020 --> 01:01.280]  And then years later, here I am, you know, talking about this.
[01:01.280 --> 01:02.660]  I do it professionally now.
[01:02.660 --> 01:15.000]  And I say all of that because I've met a lot of first-time DEF CON attendees, and I just want to tell everybody out there, just do one thing, meet a bunch of people, because this is how you're going to get a career and a job in this field, or just make a bunch of friends,
[01:15.000 --> 01:15.720]  which I have.
[01:15.720 --> 01:18.880]  Some of my best friends I've made just by hacking and breaking into stuff.
[01:18.880 --> 01:29.500]  So I say that all to say, get involved in something, do something, because I used to just play the CTF, now I'm a Village member, and this got me a job in pen testing, so I highly recommend it.
[01:29.500 --> 01:33.600]  It's a ton of fun, and I can't believe they pay me to do some of the stuff that I do.
[01:35.600 --> 01:38.360]  So I come at this from wireless security, right?
[01:38.360 --> 01:42.080]  So I like to do wireless penetration testing, that's the thing that I do.
[01:42.080 --> 01:54.480]  However, we don't get that much wireless pen testing because a lot of our clients say, hey, we just need an external penetration test on our corporate firewalls, or hey, we just need an internal penetration test, or hey, we have a custom web app, can you take a look at that?
[01:54.480 --> 01:58.600]  And those are the top three that all of our clients say, hey, we want to check this, this, this, and this.
[01:58.660 --> 02:02.880]  And then I ask them, well, are you interested at all in a wireless test?
[02:02.980 --> 02:06.060]  And they're like, what could you even really do with our wireless?
[02:06.540 --> 02:12.820]  We have certs on everything, or we have a really strong wireless password, what's the worst that could happen?
[02:13.120 --> 02:23.200]  And that's where the fun begins, because for me, the whole wireless security aspect is a decade behind where external and internal penetration testing stuff comes from.
[02:23.200 --> 02:29.520]  Uh, in this picture, if anybody's interested, this is one of these 3D printed, like, raspberry pies that we throw in our pockets.
[02:29.520 --> 02:42.540]  So, we built this originally for the, uh, capture the flag for finding foxes, because foxes, uh, if anybody's chasing foxes, they are well aware of what wireless antennas look like, and that spooks foxes.
[02:42.540 --> 02:49.760]  Um, and so if you're trying to catch them, putting something like that in your pocket with like a 10,000 milliamp hour battery is a really good way to not be detected.
[02:51.060 --> 02:58.620]  Uh, and one of the other things, meeting a lot of first kind Defcon attendees, they ask, oh my gosh, like this hardware is thousands of dollars, how can I even compete?
[02:58.620 --> 03:00.360]  How could I even hope to do anything?
[03:00.460 --> 03:05.260]  Uh, and really, like, when I got started, it was like less than $100 worth of gear off of Amazon.
[03:05.300 --> 03:08.720]  Um, and you don't have to have, uh, anything fancy to do it.
[03:08.720 --> 03:12.740]  And when you're doing wireless testing, you don't need any internal access to do anything.
[03:12.980 --> 03:23.800]  And what's, what's also nice about it too is that, like, I can be sitting in a car, I can play some malicious device near a building, I don't have to get on a camera, I can stay out of sight, I can sit on a park bench.
[03:23.800 --> 03:32.940]  There was one time that I sat across the street from a bank that I was testing, uh, from a park bench, just, and I just looked like a, you know, casual run of the mill person just sitting there on a laptop.
[03:33.280 --> 03:41.320]  Uh, and it's one of those things that, that doing wireless basically allows you the ability to stay out of sight out of my, my slides are freaking out, sorry, hold on, give me a second.
[03:41.580 --> 03:43.500]  Uh, it gives you the ability to stay out of sight.
[03:43.500 --> 03:50.440]  And that's also why I like it too, because when you're doing some physical engagements or some, you know, red team-y like things, uh, you don't want to be seen.
[03:50.440 --> 03:52.220]  You don't want somebody to remember your face.
[03:52.240 --> 04:00.160]  COVID's actually made it a lot easier because all of our physical engagements, we now get to wear masks and can change out masks, which really helps a lot because nobody's going to remember this face, right?
[04:00.220 --> 04:03.020]  Uh, if anything, they'll remember my stature more than anything.
[04:03.740 --> 04:05.720]  Um, so basically what, what do I do with that, right?
[04:05.720 --> 04:07.620]  What do I do with this little device that's in my pocket?
[04:07.760 --> 04:15.800]  And everybody, when they hear like, oh, rogue access point, they're probably thinking, you know, a disc, they're thinking it's something that's placed, but it could just be something that's chilling in my pocket.
[04:15.980 --> 04:30.140]  And so I just basically SSH into that, uh, Raspberry Pi on my phone and I can just walk around like any other schmuck wearing flip-flop sitting in your hotel lobby or sitting in your cafeteria, um, you know, seeing if I can capture a handshake, seeing if I can capture,
[04:30.140 --> 04:34.520]  uh, credentials if I'm using, you know, something with, uh, uh, enterprise on it.
[04:35.000 --> 04:40.360]  And so again, this is all for the purpose of staying anonymous, staying out of sight, not getting caught, right?
[04:40.360 --> 04:55.360]  Uh, and also it's fun too, if you have a hotspot in your pocket, I'll routinely have somebody that is sitting at home in the comfort of their home with multiple screens and just the ability to be comfortable that can just watch all of this traffic from the inside of my pocket through a hotspot through open VPN.
[04:55.360 --> 04:57.020]  So I don't even need to be looking at my phone.
[04:57.020 --> 05:00.600]  They can just be in a, in an AirPod saying, Hey Eric, you should go back to that area.
[05:00.600 --> 05:03.380]  You should go circle back over here because there's a lot of clients over there.
[05:03.380 --> 05:08.860]  Um, so all of this stuff is to stay out of sight, out of mind so that you're not picked up and you don't look suspicious.
[05:09.500 --> 05:15.240]  Uh, so this is, we had a client that had an, uh, site that was several, several thousand acres.
[05:15.240 --> 05:25.880]  So we built out a bunch of like, like if, if you've ever talked to me, if you know me or talk to me after this, I love building random pieces of hardware or random, like, like hidden objects that hide and stuff.
[05:25.880 --> 05:29.000]  If any of you know what geocaching is, I'm super into geocaching.
[05:29.000 --> 05:31.620]  It's like hidden treasure hunts scattered across the world.
[05:31.620 --> 05:36.340]  Um, so building devices to hide other things is like one of the things that I absolutely love to do.
[05:36.340 --> 05:44.840]  So we built this backpack and actually we had to put the antennas on the outside of the backpack for the picture because otherwise it just looks like a normal backpack as we're walking through this several thousand acre site.
[05:45.040 --> 05:47.520]  Um, and so this is just one of them that we built.
[05:47.520 --> 05:48.480]  Uh, and this is a couple of years ago.
[05:48.480 --> 05:56.220]  So we have, we have a lot more radios now, more spread out, but, um, just to give you an idea, a rogue access point isn't like, uh, you know, a specific thing.
[05:56.220 --> 06:01.720]  It's, you'll know it when you see it or more importantly, you know, you'll, you'll see from your logs if you're looking at them.
[06:02.500 --> 06:04.580]  Uh, so again, here's just another picture of it.
[06:04.660 --> 06:08.720]  Um, and it, and it's nothing, it's nothing super simple or sorry, it's nothing super complicated.
[06:08.740 --> 06:11.020]  Literally just raspberry pies hooked up to some batteries.
[06:11.020 --> 06:12.420]  Again, we have better batteries now.
[06:12.420 --> 06:15.680]  Uh, we don't use raspberry pies now, but you can still use it.
[06:15.680 --> 06:16.900]  Again, they're super cheap.
[06:16.900 --> 06:22.800]  I guess raspberry, raspberry pies probably aren't super cheap now, but there are plenty of other boards on the market that you can use for something like this.
[06:23.460 --> 06:31.580]  Um, and so when I talk to a lot of our clients, they always ask, like, well, you know, typically they all have this finding that is, oh, hey, you never detected our rogue access points.
[06:31.640 --> 06:39.080]  Uh, and, and so the idea that I try and get across to them before even we do the penetration test is, hey, this is why rogue access points are dangerous.
[06:39.160 --> 06:41.200]  Um, you know, I can gain access to your network.
[06:41.200 --> 06:42.520]  I can gain access to credentials.
[06:42.520 --> 06:50.620]  I can have your users and your clients connect to my devices, my malicious devices, and then give me a wealth of information that they completely don't intend to.
[06:50.620 --> 06:52.060]  And it might just happen automatically.
[06:52.540 --> 06:58.120]  Um, and so really like the technical definition of it is it's basically any access point that you don't control.
[06:58.120 --> 07:08.760]  And so when you talk to a system administrator or network administrator that, you know, has all of these wireless access points, they might just have any network that's not their network going through their logs or, you know, that's popping up an alert.
[07:08.780 --> 07:21.840]  But you don't necessarily, like if you're somebody who's running like, like say you're just your typical home network, you really don't care if some, if your neighbor is standing up an access point that they're using for their house, but you would really care if somebody copied the same wireless network name,
[07:21.840 --> 07:26.540]  the same SSID as the network that you're running to potentially do something nefarious.
[07:26.540 --> 07:33.940]  And so those are things of, of looking at that spectrum of like what is technically a rogue access point versus what is a rogue access point that you actually care about.
[07:34.300 --> 07:42.280]  Um, and so we're going to obviously focus on the dangerous rogue access points because nobody cares if there's a printer out there that says, you know, HP setup or ATT Wi-Fi, right?
[07:42.280 --> 07:43.660]  Like what could go wrong with that?
[07:44.260 --> 07:47.160]  Um, so one of the tools that I use is Wi-Fi Fisher.
[07:47.160 --> 07:50.760]  Uh, if the developer of Wi -Fi Fisher is out there, uh, how's it going?
[07:50.760 --> 07:51.060]  Thank you.
[07:51.060 --> 07:51.880]  I appreciate the tool.
[07:51.880 --> 07:53.300]  I'll buy you a this.
[07:53.300 --> 07:59.720]  Um, but this tool basically just, uh, is a great way to, to gain, um, uh, typically PSK credentials.
[07:59.720 --> 08:01.140]  And so I'll show that in the next slide.
[08:01.140 --> 08:03.240]  This is just a sample window of what that looks like.
[08:03.240 --> 08:06.160]  Basically I stand up a rogue access point of like a known open network.
[08:06.160 --> 08:14.280]  So that might be like Starbucks Wi-Fi, ATT Wi-Fi, Xfinity, uh, T-Mobile, Wingman, just any of these common open Wi-Fi's that are out there, right?
[08:14.400 --> 08:19.520]  And devices, if they're not connected to Wi-Fi, they'll say, Hey, I've connected to that before.
[08:19.620 --> 08:20.840]  I'll connect to it again.
[08:20.840 --> 08:23.640]  And when they do so, uh, their traffic goes through me.
[08:23.640 --> 08:24.720]  I control that network.
[08:24.720 --> 08:33.040]  So then I can, you know, SSL strip their traffic, potentially see something in clear text, or I can just forward them to my own captive portal page that makes them type in some information.
[08:33.460 --> 08:38.760]  Uh, and when they type it into my webpage, since I control the webpage, I can see everything in clear text.
[08:39.040 --> 08:52.520]  Um, one of the really cool modules about this tool, Wi-Fi Fisher, is that it has the ability to look at the user agent of the device that you're using and make a captive portal page, uh, that like mimics what it would look like if you were offline or a captive portal.
[08:52.580 --> 08:55.840]  So if you look at the screenshot right here, this is their captive portal page.
[08:55.840 --> 09:04.560]  If you were to log in from a Windows 10 computer, what's interesting about that is that, oh, you know, if you've ever used Windows 10, you're probably used to this as far as like, Oh, I just need to type in my password right there.
[09:04.620 --> 09:07.220]  But this is all on the actual webpage itself.
[09:07.220 --> 09:11.540]  It's not actually on, uh, you know, it's not like popped up on your network manager.
[09:11.540 --> 09:13.020]  That would be on your Windows 10 device.
[09:13.380 --> 09:15.580]  And you know, how many users are going to fall for this?
[09:15.840 --> 09:16.920]  Probably not a lot.
[09:17.040 --> 09:18.200]  I just need one though.
[09:18.200 --> 09:20.180]  I just need one user to fall for it.
[09:20.180 --> 09:26.720]  And then I have a clear text PSK cred that I can then use to then access, you know, that network, uh, unencumbered.
[09:26.720 --> 09:37.680]  And so that's a lot of these things is that, you know, when I, when I talk about this stuff to people at the booth, they're like, Oh my gosh, but you know, nobody would ever do this or, uh, you know, this is so easy.
[09:37.680 --> 09:38.940]  I can't believe people fall for it.
[09:38.940 --> 09:43.480]  But at the end of the day, uh, not everybody is a supercomputer user, like everybody in this village.
[09:43.480 --> 09:47.700]  And that's who this talk is geared to just knowing what risks are out there, what to look for.
[09:47.700 --> 09:52.640]  And if you're a network administrator, you know, this is some, some of the, you know, attacks that we use to breach these networks.
[09:52.820 --> 09:56.460]  And again, this page is just generated by wifi Fisher, right?
[09:56.460 --> 09:59.380]  So if you submit your credential, I now have a clear text PSK.
[09:59.380 --> 10:00.420]  I don't even need to crack it.
[10:00.420 --> 10:01.580]  I don't need to do anything.
[10:01.680 --> 10:09.520]  Um, you know, I don't have to spin up all of our 3090 GPU rigs to try and, you know, try for a hundred years to crack a 15 character PSK.
[10:10.840 --> 10:13.040]  Uh, the other fun thing, I don't know where that slide went.
[10:13.100 --> 10:21.580]  So, uh, the other, so say you're not in a PSK network, say you're not in an open network, there's a bunch of super fun things that you can do as far as enterprise networks go.
[10:21.900 --> 10:31.780]  Uh, so obviously the gold standard of a, of an enterprise network is something that has, you know, uh, a custom profile set up with certificates so that the user doesn't type in their password or whatever that may be.
[10:31.960 --> 10:35.900]  Um, but there's a lot of old devices out there that still have to connect to these enterprise networks.
[10:36.080 --> 10:43.660]  Um, so when you use tools like e-pammer, uh, sycophant right there, just for you right there, stand up, say, hey, wave your hand.
[10:43.660 --> 10:45.560]  Um, or e-pammer with hostile portal.
[10:45.560 --> 10:50.000]  A lot of these tools, if your users connect to it, again, we control that network.
[10:50.000 --> 10:53.300]  So we can relay credentials, uh, you know, we can potentially downgrade it.
[10:53.300 --> 10:57.120]  So if somebody's GTC downgraded, I potentially get clear text credentials out of that.
[10:57.160 --> 11:04.700]  Or if it's e-pammer with hostile portal and responder running in the background, that's just, now it's turned into an internal penetration test, right?
[11:04.700 --> 11:09.900]  Um, and so all of these things gain us access to, you know, user credential, user information.
[11:10.220 --> 11:12.640]  And when you think about it, you're like, okay, great, Eric, so what?
[11:12.640 --> 11:16.740]  You get some user credentials, uh, they still require certificates to connect to that network.
[11:16.920 --> 11:20.040]  But at the end of the day, let's be real, you have user credentials.
[11:20.040 --> 11:22.600]  How many companies have a perfect MFA setup?
[11:22.620 --> 11:27.500]  How many companies have a setup that is, you know, looking for these types of attacks?
[11:27.500 --> 11:40.260]  When you have user credentials, the, the, the bar from going from no access to like, oh, I could be domain admin in a couple of days, uh, or potentially the day that you got that credential are pretty darn high.
[11:40.260 --> 11:43.060]  And that's something that your clients really, really, really want to know about.
[11:43.060 --> 11:48.180]  Or if you're defending a network, that's something that you also want to know about if that user credential is compromised.
[11:48.460 --> 11:50.840]  And so one of the ways that, let me see, where is that?
[11:51.960 --> 12:03.380]  So, one of the ways that I've used that, you know, on a network that has certificates where I wouldn't be able to connect to it even with valid credentials is by hopping on a, a network, um, a company's guest Wi-Fi network.
[12:03.380 --> 12:08.660]  And that guest Wi-Fi network has the same egress, the same external IP address as their corporate network does.
[12:08.660 --> 12:10.060]  Now the segmentation is good.
[12:10.060 --> 12:17.920]  I can't go from their guest Wi-Fi into their corporate network, but what I can do is I can go from their guest Wi-Fi from their guest network to the public internet.
[12:17.920 --> 12:18.920]  That's what it's designed for.
[12:18.920 --> 12:26.660]  It's designed for when their clients come in from when, you know, people outside of their office come in that they can use that guest Wi-Fi and get out to the, you know, get out to the public internet.
[12:26.880 --> 12:37.840]  Well, in the infinite wisdom of a system administrator who is actually doing a good job and wants their, you know, their users to have a, a, you know, a good use case or not good use case, a, to have, you know, good usability.
[12:37.840 --> 12:47.960]  They said, you know what, look, if you're in the building, if you're authenticated on your laptop, uh, we're going to have the egress IP address be trusted as far as like Azure, Office 365, all that stuff goes.
[12:47.980 --> 12:50.220]  So, hey, you're in the building, you know, great.
[12:50.220 --> 12:50.980]  You're on our Wi-Fi.
[12:50.980 --> 12:53.600]  This, this egress, this public IP address is trusted.
[12:53.600 --> 12:59.460]  Well, if I hop on the guest Wi-Fi network with a valid set of credentials, now I have the same egress.
[12:59.460 --> 13:02.620]  I have that same, you know, I'm in that same zone.
[13:02.620 --> 13:08.540]  And so now I'm able to use those credentials to hop in to everything that's sensitive without ever being prompted for MFA.
[13:08.560 --> 13:15.360]  And that's a, it's a really weird edge case, but it's, I've used it more than once to be able to compromise clients.
[13:15.440 --> 13:24.560]  And, and these are the things that, you know, maybe not your run of the mill, you know, tester would do, maybe not, you know, somebody would think up off the top of their head, but this is just one edge case.
[13:24.560 --> 13:31.100]  There's so many edge cases out there that eventually you have to look at some of them and say, hey, what does our threat pro, what does our risk profile look like?
[13:31.240 --> 13:33.400]  Um, to where this is maybe something of concern.
[13:33.560 --> 13:41.300]  And really at the end of the day, this is all coming back to just get an alert if a rogue access point that matches your SSID pops up.
[13:42.720 --> 13:47.880]  Um, so let's talk about like the different, so I mentioned my, my talk is like WIDs and WIPs, right?
[13:47.880 --> 13:53.160]  I, I hate those terms because it's, it's, you know, they sound, I guess, more technical than I really think they are.
[13:53.160 --> 13:57.400]  But, uh, WIDs is intrusion detection and WIPs is intrusion prevention.
[13:57.520 --> 14:04.160]  So WIPs might do some act, something active to prevent, you know, their clients from connecting to a malicious, a rogue access point.
[14:04.160 --> 14:14.240]  But even just detection, if, if all of my clients got a notification on their phone , a notification in their email, if a rogue access point popped up, that would be incredible.
[14:14.240 --> 14:19.460]  Uh , almost none of our clients get those notifications as they go through the steps of our penetration tests.
[14:19.460 --> 14:22.480]  And I always tell them, hey, let me know when you see them.
[14:22.520 --> 14:25.380]  Uh, don't go back and look through the logs after the fact.
[14:25.380 --> 14:38.520]  You want to be able to get these notifications in real time because me telling you that I did a rogue access point attack or that, you know, that I did some rogue AP attack, that's not helpful because you're not going to be able to use that in the real world if you have to go back and look for it.
[14:38.580 --> 14:43.120]  Um, so again, the WIDs, WIPs, it's just, it's a way to detect if there's a rogue access point.
[14:44.840 --> 14:45.540]  Um, okay.
[14:45.540 --> 14:50.800]  So I'm going to go down kind of like my like matrix that I made up as far as like, and again, this is totally something I made up.
[14:50.800 --> 14:57.020]  If you have a better way to organize this, by all means, come talk to me after this because, uh, this is just how it makes sense in my brain.
[14:57.220 --> 15:00.900]  So when we start out an attack, um, what I typically do is I say, okay, you know what?
[15:00.900 --> 15:04.920]  I'm going to clone your Mac or I'm going to clone your, your, uh, Corp WiFi, right?
[15:04.920 --> 15:10.960]  So if your SSID, if your WiFi name is, you know, Corp WiFi, I'm going to say, hey, exact match Corp WiFi.
[15:11.020 --> 15:17.480]  And then I'm going to make the Mac address, you know, something super easy, uh, that you'd be able to scroll through the logs and be like, that doesn't look right.
[15:17.900 --> 15:19.840]  Um, and see if, hey, did they get a match?
[15:19.840 --> 15:20.620]  They get an alert.
[15:20.620 --> 15:21.820]  Then I'll keep going down.
[15:21.820 --> 15:27.280]  I'll keep basically say like, okay, I'm going to, uh, exact match for the SSID and then a random Mac address.
[15:27.360 --> 15:30.840]  Uh, and then maybe I'll do an exact match for their SSID.
[15:31.100 --> 15:32.440]  Um, so let's go to the next slide.
[15:32.440 --> 15:38.860]  So exact match and random, and everybody doesn't know a Mac address is basically just a hardware identifier of that access point.
[15:38.860 --> 15:39.120]  Right.
[15:39.120 --> 15:41.880]  And so say you have a room, say you're in DEF CON, right.
[15:41.880 --> 15:44.180]  And you have, uh, 10 access points.
[15:44.180 --> 15:50.140]  They'll all have a unique or should be unique, uh, Mac address hardware identifier that allows them to communicate to each other.
[15:50.140 --> 15:50.660]  Right.
[15:50.720 --> 16:00.060]  Um, and so why that matters is that's what, that is what a lot of these, you know, intrusion prevention detection systems use as a means to say, Hey, is this valid?
[16:00.060 --> 16:00.640]  Is this known?
[16:00.780 --> 16:08.960]  But anybody can see this information if you're looking for, if you're using, you know, any number of tools out there, uh, to just, to just see what access points are out there.
[16:09.300 --> 16:13.600]  Uh, so again, my, my easy mode is like, Hey, exact match of your wireless name.
[16:13.660 --> 16:18.360]  And just like a Mac address that is just completely bogus that you should just recognize is not real.
[16:18.740 --> 16:25.700]  Um, and then an exact match plus just, you know, some, maybe just a random Mac address that Mac changer will, will just, you know, make for you.
[16:26.360 --> 16:29.660]  Then it gets a step harder and the step harder is, you know what, same thing.
[16:29.660 --> 16:34.480]  I'm going to have an exact match of your wireless name, but maybe I'm going to make it similar.
[16:34.480 --> 16:43.820]  So if I see maybe you're running some Iraqi, if you're running some Aruba, if you're running some ubiquity, maybe I'll have, you know, all, all of the Mac address look the same except for the last couple of digits, right?
[16:43.820 --> 16:45.260]  The last couple of octets of that.
[16:45.360 --> 16:47.280]  Um, or maybe I want to get even harder.
[16:47.280 --> 16:54.440]  And what I'll do is I'll go look on, on wiggle and I'll say, Hey, say it's a bank that has two completely geographically separated sites.
[16:54.620 --> 17:01.220]  Um, maybe I'm going to go take a cloned Mac address from one site and I'm going to stand it up at the second side as my rogue access point.
[17:01.220 --> 17:08.080]  And if they have one unified controller there, well then all of a sudden they're going to say, Hey, totally valid Mac address, not going to learn on anything.
[17:08.300 --> 17:12.200]  Um, and so those are typically the ones that if they're going to get caught, they'll get caught there.
[17:13.420 --> 17:16.440]  Uh, but then one of the things that I'll do is I'll clone the Mac address.
[17:16.440 --> 17:18.300]  So say, say you have a large, like a Costco, right?
[17:18.300 --> 17:22.540]  Or, you know, some large big box store and they have, you know, a lot of access points.
[17:22.540 --> 17:28.400]  Say it were to go to one side, the North side of the building and take and, you know, see what, what Mac addresses are there.
[17:28.460 --> 17:39.600]  I can then take those and I can, you know, take a screenshot of them, go to the South side of the building and I can basically stand up a rogue access point using those Mac addresses.
[17:39.620 --> 17:43.740]  And there's not going to be a conflict because they're geographically separated from each other.
[17:43.740 --> 17:51.160]  But when the wireless controllers look at that, they're going to say, Hey, here's a new access point with a Mac address that we totally see as valid.
[17:51.160 --> 17:52.760]  This is a totally valid Mac address.
[17:52.760 --> 17:58.340]  And that's how you avoid any like weird race conditions or two, you know, Mac addresses or access points, um, in that spot.
[17:58.780 --> 18:04.200]  But that, that will evade most of the detection systems that are currently on the market.
[18:04.660 --> 18:10.820]  Um, and again, that's if, that's if your clients are even looking at logs, that's if you're a system administrator and you're even looking at the logs.
[18:12.700 --> 18:17.340]  Um, and so then, then I get into the more difficult mode and for the clients that actually are looking.
[18:17.360 --> 18:28.620]  Uh, and so if they have a knowledge of the geography of their site, um, or, or, you know, maybe it's one of these things that they're actively, you know, they have something running that is going to look at this and see power level indicators and hey,
[18:28.620 --> 18:29.940]  there's a spike over here.
[18:30.220 --> 18:35.440]  Um, one of the things then what we'll do is I won't even have an exact match of the SSID.
[18:35.440 --> 18:37.160]  So I won't have an exact match.
[18:37.160 --> 18:41.320]  So say you're running Corp WiFi, one of the things that I'll do on the next slide.
[18:41.320 --> 18:42.900]  So you look at the two strings right there.
[18:42.900 --> 18:46.920]  One of them is Corp WiFi and the other one is Corp WiFi with like a space after it.
[18:46.940 --> 18:50.200]  Uh, and so now all of a sudden that's a brand new profile in that Windows machine.
[18:50.200 --> 18:54.060]  That's a brand new SSID as far as any other device is concerned.
[18:54.060 --> 19:06.800]  And so all the protections, certificates and all that stuff that are put in place to ignore an exact string match, now they go completely out the window because as far as, you know, any computer is concerned, that is a completely different wireless network that you're trying to connect to.
[19:07.060 --> 19:16.060]  Um, and, and typically if you're on your cell phone and you see Corp WiFi with a space at the end of it, you are never going to recognize that as being something that is different.
[19:16.060 --> 19:20.560]  You're just going to see two WiFi networks that, that look very similar when you connect on your phone.
[19:20.560 --> 19:28.440]  Um, and sometimes it all that whites or that, that space won't even show up as a character or anything depending on the type of phone, depending on the type of OS that you're using.
[19:28.540 --> 19:33.980]  And so in that case, now your end users who are just saying, man, that's a bummer that my WiFi isn't working right now.
[19:33.980 --> 19:37.200]  Let me just try and manually connect to this other WiFi that I see.
[19:37.200 --> 19:44.220]  Now your users are actively helping somebody like me, uh, to then, you know, pillage their company or access their company or gain access to their company.
[19:44.360 --> 19:47.880]  Um, and again, this, this may not be news to any of you here.
[19:47.980 --> 19:50.680]  It's news to a lot of my clients and a lot of the people that I talk to.
[19:50.680 --> 19:56.880]  And this is something that I just want to be able to point to and say, look, these are all, these are the steps that I go through in my brain.
[19:56.880 --> 19:59.800]  And maybe that's not organized in how any of you would think about this.
[19:59.940 --> 20:02.660]  Um, but trying to methodically go through all the different steps.
[20:02.880 --> 20:10.040]  And really at the end of the day, all I really want to do is have people ask themselves questions of, Hey, what do I do if, right?
[20:10.460 --> 20:22.380]  You know, so say you do have rogue access point detection enabled on whatever controller you're using, your wireless, you know, whatever wireless architecture network stuff you have set up, you know, what do you do if you detect a rogue access point?
[20:22.500 --> 20:23.100]  Like, okay, great.
[20:23.100 --> 20:24.620]  You have a notification set up.
[20:24.700 --> 20:31.380]  Do you have any idea of the geography you're set up or what access point potentially detected that and how you would go find it?
[20:31.380 --> 20:35.000]  If somebody did plug in something nefarious, like what does that look like?
[20:35.000 --> 20:39.180]  You know, have a plan in place to where if something pops up, what do you do about it?
[20:39.180 --> 20:39.780]  Where do you go?
[20:39.780 --> 20:40.660]  How can you find it?
[20:40.660 --> 20:42.720]  Is it an employee that just plugged in another one?
[20:42.720 --> 20:49.200]  Or maybe it's just a misconfigured access point that your controller doesn't recognize because it's not in the system properly.
[20:49.220 --> 20:50.680]  I've had that happen to before.
[20:51.680 --> 20:58.040]  You know, or, and then basically, do you have any of the alerting that's going to go to any of the people that are on call, right?
[20:58.040 --> 21:01.140]  Do, do any of your, so in this case, I consider them my clients, right?
[21:01.140 --> 21:06.160]  Because they're clients that come to us, but do your clients get any alerting at all as far as a rogue access point?
[21:06.280 --> 21:09.580]  Like my home gear is Ubiquity and Ubiquity sends you a push notification.
[21:09.880 --> 21:15.520]  If you enable it, that says, Hey, you know, there's an exact match of an SSID that we're not familiar with.
[21:15.520 --> 21:22.880]  That's something out there that just that little bit of knowing that somebody is starting the initial opening salvo to probe your network, that's huge.
[21:22.880 --> 21:25.620]  Just knowing that, Hey, something looks a little wonky here.
[21:25.620 --> 21:27.500]  Maybe I should go investigate this.
[21:28.740 --> 21:39.060]  You know, and then, and then even looking at how your clients, you know, how your access points are, you know, how your access points are configured, but then also how are the devices in your network configured?
[21:39.100 --> 21:42.980]  Maybe, maybe you have like a gold image of a windows laptop that everybody uses.
[21:42.980 --> 21:45.200]  And that one's configured really, really, really well.
[21:45.480 --> 21:47.040]  I don't live in that realm.
[21:47.040 --> 21:58.900]  I live in the realm of edge cases of like, yeah, you know what our POS system, it uses this older Android laptop that's vulnerable to GTC downgrade or sorry, Android tablet that's vulnerable GTC downgrade.
[21:58.900 --> 21:59.380]  Great.
[21:59.440 --> 22:02.280]  That's, you know, potentially clear text credentials for me.
[22:02.280 --> 22:02.540]  Right.
[22:02.540 --> 22:05.480]  So I have the easier job in all of this.
[22:05.480 --> 22:11.200]  If any of you are like system administrators or like wireless network administrators, you have the infinitely harder job.
[22:11.200 --> 22:13.520]  You have to keep users using your network.
[22:13.520 --> 22:14.960]  You have to keep it up and running.
[22:14.960 --> 22:16.380]  You have to keep it secure.
[22:16.500 --> 22:18.100]  And I don't envy that.
[22:18.100 --> 22:23.940]  For me, I just have to find one weird trick, one weird edge case where I'm able to get in.
[22:23.940 --> 22:30.240]  And so my hope with all of this is that I'm able to at least make you ask those questions and, and, you know, take it to your environment.
[22:30.240 --> 22:33.800]  You guys are experts on your environments if you're a, you know, sysadmin out there.
[22:33.800 --> 22:37.680]  And you can hopefully take those questions and just say, okay, you know, what do I do with this?
[22:37.680 --> 22:42.440]  What does that look like if, if somebody like me were able to, you know, stand up a rogue access point?
[22:44.020 --> 22:47.700]  And so again, other things to look for, check for excessive password spraying.
[22:47.840 --> 23:00.340]  I know, I know password spraying, everybody's used to like looking at like Office 365 or like, you know, looking at their E5, you know, Microsoft license and saying, oh yeah, you know, like this threat actor is scanning from one IP address or from a prox or something like that.
[23:00.480 --> 23:04.300]  But nobody ever checks their wireless controllers for password spraying.
[23:04.300 --> 23:05.720]  It's really, really slow.
[23:05.720 --> 23:06.440]  Don't get me wrong.
[23:06.440 --> 23:10.400]  It is incredibly slow to, to password spray from it, but it works.
[23:10.760 --> 23:13.560]  And if it says, you know, it's one of those things like, where's it coming from?
[23:13.560 --> 23:14.620]  Where's the auth coming from?
[23:14.700 --> 23:15.800]  Inside the building.
[23:15.800 --> 23:16.420]  Not really.
[23:16.420 --> 23:18.500]  It's coming from outside the building because it's wireless.
[23:18.820 --> 23:22.560]  So just one of those things, you know, get those alerts of rogue access points come up.
[23:22.720 --> 23:28.380]  Have a plan, you know, like I mentioned, have a plan to, to locate those rogue access points when and if you see them.
[23:29.000 --> 23:31.600]  Understand as far as MAC addresses that those are clear text.
[23:31.600 --> 23:32.920]  It doesn't matter what you're running on them.
[23:32.920 --> 23:36.800]  I've had a lot of clients that say, well, how do we encrypt our MAC addresses so that you can't see them?
[23:36.800 --> 23:39.320]  And it's like, well, uh, that's not how that works.
[23:39.320 --> 23:42.300]  Um, and just, just know that that information is out there.
[23:42.520 --> 23:57.360]  Um, log your data and look at, you know, so log your data first and foremost, but then look at that after you've logged it, logged it, get alerts, have somebody monitor it, know what your wireless, you know, environment looks like surrounding your building and notice if something changes,
[23:57.360 --> 24:04.480]  because that could be, uh, you know , again, the first move for somebody like me or somebody worse than me, who's not doing it, uh, to try and protect you.
[24:04.480 --> 24:07.260]  Somebody is trying to do something nefarious to you from going from there.
[24:07.260 --> 24:07.520]  Right.
[24:07.520 --> 24:09.580]  So anyways, that's all I got.
[24:09.580 --> 24:11.500]  If you have any questions, feel free to come talk to me.
[24:11.500 --> 24:12.840]  I'm behind there.
[24:12.840 --> 24:17.660]  Go play the wireless capture the flags and, uh, hopefully it wasn't a complete waste of time.
[24:17.660 --> 24:18.980]  Hey Wasabi, you have a question for me.
[24:18.980 --> 24:19.580]  What's up?
[24:21.800 --> 24:24.800]  Oh, see, like it depends on like the season.
[24:24.880 --> 24:28.380]  Um, like if it's like fall time, then it's more of like evermore.
[24:28.380 --> 24:32.320]  Whereas like if it's like, like New Year's Eve, then it's like 22.
[24:33.760 --> 24:35.300]  Is that the only question?
[24:35.900 --> 24:38.220]  You guys can ask me Taylor Swift questions too.
[24:39.680 --> 24:41.520]  Thank you for enduring this talk.