Observations On Evil Access Points

This is not a HOWTO. There are gazillions of those on the Interwebs, which is how I got started into this. BT5's intro in April really boosted the interest in wireless hacking, especially considering Vivek Ramachandran's Megaprimer on SecurityTube, which leveraged the fuck out of BT5.

This brings me to my first observation: it only works on BT5. Now, before you protest and tell me about your wonderful experience with Aircrack-ng on Ubuntu or Fedora, let me explain. I've done a lot of custom kernels in my time chasing new features in netfilter only to find that I broke something else that ran just fine with a stock distro kernel. Mea culpa.

The first thing I bumped up against was a kernel bug that sets the WiFi channel to 255 when you try to create an access point with airbase-ng. This doesn't happen with BT5's "2.6.38 #1 SMP Thu Mar 17 20:52:18 EDT 2011 i686 GNU/Linux" kernel, so stick with BT5.  I hope it doesn't break in BT5 R1.

Another curiosity: BT5's implementation of wicd can't see access points made with airbase-ng. This is what I get (entry at top is the evil access point):

I haven't found a work-around for that, but Windows 7 sees the AP just fine, as does NetworkManager in Linux Mint LXDE.

Which brings up another point: do not try to make an access point on any box that uses NetworkManager! Personally, I despise NetworkManager, and generally remove it whenever possible. I learned this from the Mint box, so stick with BT5.

The Mint box did surprise me as a client, though. Evidently ndiswrapper has come a long way from whenever the last time I used it was (2006? 2007?). There's even a gui, ndisgtk, for painless installation of drivers.

If you can find them. Case in point: the NetGear WG111v1 wireless USB NIC I've had since 2005. I knew I had them somewhere but I thought it would be quicker to hit NetGear's site to download them. Nope. No way am I going to register with a company I have no intention of ever doing business with again. But luckily I found the original drivers buried deep on a dusty old hard drive. I installed the drivers and the damned thing actually worked. I never got that damned thing to work on Linux before! It's not perfect and a lot of features just aren't there, but for basic functionality in a pinch you can't beat it.

Which brings up another observation: there's no ndiswrapper in BT5. You can download all the tools, but the kernel module isn't there (I had the exact same problem with JFS in BT4). You really wouldn't want it for making an AP, but if you're short a NIC, ndiswrapper would be nice to have around.  If they do add support for ndiswrapper and you need it, you're stuck in 32-bit land, which is not always a bad place to be.

Eventually I had three useless access points hanging off my BT5 laptop. Useless because I didn't have a DHCP server. ISC's dhcp3d is fine, but I settled on udhcpd because it's simpler and it's in BT5's software repository.

Here comes another observation: udhcpd is broken. Well, that's not entirely true. The manual page is broken. The date on the man page is "2001-09-26", so that should be a dead giveaway that it just ain't right. It states that "option namesvr" is the setting for DNS in the config file but oddly... it doesn't work! A quick Google search and you'll find the real setting is "option dns". As long as you take the man page with a grain of salt you'll be OK.

Another "gotme" was the "subnet" line in the config file. The man page says:

subnet ADDRESS

But they meant...

subnet MASK

Jeez. Woe betide the literal-minded. "255.255.255.0" is not an "address", people!

Oh, and speaking of man page fuck-ups, the airbase-ng option for the BSSID is not --bssid or -b, it's -a! Fucking -a! -b and --bssid do nothing. That was a real WTF moment. I quote then man page:

If the BSSID is not explicitly specified by using "-a  ", then the current MAC of the specified interface is used.

-b and --bssid are "Filter Options", which are never clearly explained in the man page.  Some HOWTOs out there make the same mistake, so beware.

So much for RTFM.

You need to assign an address to the atx adapter airbase-ng pulls out of its ass and make that the gateway ("option router"), enable IP forwarding in the kernel and set up iptables to forward everything from your DHCP scope out to the Internet.

Once you have all that in place, you're ready to rock and/or roll. The first thing you'll notice is it's a damn slow access point. But it gets the job done.

Put everything into scripts so it'll all be there when you need it. I would hate to have to do this cold on a spur of the moment assignment. Your victim/suspect would drink his coffee and be out the door before you got your first packet.

Back To Plan "A"

"Auto Godlike" was just a bit too much.

Some players are going to have nightmares tonight because of it. They went home crying their little eyes out.

Sorry about that.

Plus for some reason it seemed to be a little "sticky", meaning it just wouldn't reset itself between games. I know I've seen that before. Godlike has a mind of its own sometimes.

And when everybody's getting beat, no one wants to hang around. It really cleared the place out, which is not the point.

So it's back to "Auto AutoAdjust", which is capable of Godlike if it has to be. The spread is hard-coded to ten instead of half the high score. That way, Classic ]I[ will never go into AutoAdjust (the high score is only 10). There are better ways of doing that but for now it's a quick fix.

I need to put a little finesse into it as well. It shouldn't kick in if a bot is winning, only a human. That might take a little work, but bots are pretty obvious because they have a zero ping.

When the admin says "KICK OUT THE JAMBS" that's when everything kicks in, so watch out for it.

Auto "AutoAdjust" Bots

I added a twist to the action today. I'm not sure how it's going to work, but it's an idea I have been tossing around in my head for quite some time now.

It goes like this: as soon as the point spread between the number #1 player and the number #2 player is greater than or equal to the winning score divided by two, the bots (if any!) go into AutoAdjust mode.

Meaning, of course, the bots will become as skilled as the best player.

When the high score is less than or equal to two, implying a new game has started, AutoAdjust shuts off. It will also shut off if no one is playing at all.

I'm not sure this is a good idea or not, but some players are just too fucking good. And it may not be good for Classic ]i[, which has low winning score.

I may clean out the firewall filters and shut off the ban hammer just to see how this idea plays out with cheats. Unfortunately, it doesn't kick in if there is more than one cheat, since the point spread between the number #1 and number #2 players wouldn't hit the maximum allowed.

There are also some variations of this that have been going around in my head, like turning on "Fat Boy" mode when the spread is too great. Or maybe adding more bots.

The possibilities are endless!

School Proxy Admin Learns About Self-PWNAGE

I'm always on the lookout for proxy news. You may remember this story about Florida government workers bypassing URL filtering in the workplace (one of my present job duties is Network Nazi for a large organization). And yes, I'm well aware of the proxy angle in the latest Palin Pwnage but I'm really tired of her and that's so "last week" anyway.

It seems this fellow decided to open his school's filtered proxy to the world so that students wouldn't have to be bothered entering a user name and password to use it.

His reasoning...

"My thought was why would someone use a proxy that has a filter on it? "

The result: tens of thousands of users from all over the world slam his proxy, using it to forum-SPAM the planet, and resulting in his IP address getting blacklisted by Google ("We're Sorry...").

Then he decides the right thing to do is blog about his PWNAGE.

Jesus.

In a way this is commendable. I've known many admins who would attribute an event such as this one to "getting hacked" in one way or another and initiate a massive cover-up, but the guy did own up to screwing the pooch all by himself. (In fact, we have an assclown admin at work who smashed the Exchange servers single-handedly and the entire IT department, from the top down, conspired - successfully - to cover it up. This is one of the reasons they don't like security - we uncover the truth.)

Still, in many business environments, this is the kind of crap that gets you canned on the spot.