F'n with the wifi leechers Options

[woody]

http://www.ex-parrot.com/~pete/upside-down-ternet.html

funny

[zetec]

reminds me of my favorite bash quote:

#202477 +(5795)- [X]

(Mootar) morons.
(Mootar) these people who live in my apartment complex are connected to my wireless
(Mootar) they must think they're super-cool hackers by breaking into my completely unsecure network
(Mootar) unfortunatly, the connection works both ways
(Mootar) long story short, they now have loads of horse porn on their computer

In other news, when AirPwn was first unleashed at Defcon (Defcon 5, I think it was), the hackers used a similar technique to replace all images with goatse, or redirect to goatse, etc. The cool thing is, they directly injected the packets into the wireless without having to do anything to the router. I forget the exact details, but essentially they totally hijacked the signal.

There was some video of that, it was hilarious. This one fat kid couldn't figure out what was going on, so he just sat there and started into the gaping anus for like 5 minutes straight.

[impala454]

just do a MAC address access list...

[Seeker]

http://www.ex-parrot.com/~pete/upside-down-ternet.html

funny

older than jesus

[zetec]

found it:

http://evilscheme.org/defcon/

At Defcon 12 this year my cow-orkers and I brought along a little piece of code called "airpwn." Airpwn is a platform for injection of application layer data on an 802.11b network. Although the potential for evil is very high with this tool, we decided to demonstrate it (and give it its first real field trial) on something nasty, but harmless (compared to say, wiping your hard-drive)

Over the course of defcon, we fielded 7 different airpwn configurations to see how well it worked, and of course to watch as 31337 h4x0rz got goatse up in their mug. The configurations were:

* HTTP goatse, 100% of the screen
* HTTP goatse replacing all images
* HTTP goatse as the page background via CSS
* HTTP tubgirl replacing all images
* HTTP "owned" graphic, replacing all images (eventually I felt bad about all the ass pictures)
* HTTP javascript alert boxes, letting people know just how pwned they were
* FTP banners (while this worked, nobody pays attention to FTP banners so we abandoned this quickly)

In all honesty, the reaction to airpwn wasn't exactly what I had expected. When I was writing the code, I imagined that the second I turned airpwn on we'd hear immediate groans of disgust radiating out at the speed of light. In practice, airpwn's effect was simultaneously more private, and more full of personal drama. First off, the full-screen goatse seemed to be too powerful. The second it flashed on the screen, the savvy user would have the browser closed already. This made it incredibly difficult to actually catch the victims on film. Based on the logs generated by airpwn we would be hitting multiple people per second, but finding someone with goatse up on their screen was still a bit of a challenege.. Once we did find a victim, the results were pretty hillarious.. I had tears rolling down my cheeks on multiple occasions. The typical goatse reaction went something like this:

* Open browser, see goatse, jump backwards a little
* quickly close browser, take a breath
* open browser, see goatse, close browser (faster this time)
* scratch head, quit browser process, re-launch browser
* see page indicating that goatse will load soon (page header, etc.) immediately close browser.
* open up browser preferences, click all the tabs, look for the "no goatse" checkbox
* clear the browser cache
* open browser, see goatse, close browser
* open network preferences, click on all the tabs, look for the "no goatse" checkbox.
* disconnect from network, re-associate
* open browser, see goatse, close browser

At this point, the less l33t people would generally give up and either 1) do something else or 2) look deep into goatse's anus with a 10-yard stare.. The more l33t victims would launch ethereal and try to figure out what was going on.. Eventually they would mumble something about "rogue APs" (WRONG!) or ARP poisoning (WRONG!) or DNS poisoning (WRONG!) and do something else..

After a few hours, it quickly became apparent that the image replacement mode was the only mode that would sustainable for long periods of time. The full-screen goatse amounted to a complete DoS of HTTP, which was just plain rude. The javascript injection (with dialog boxes talking about the victim being pwned) was by far the most distruptive. Most people (quite sanely) immediately turned off their laptops or whipped out ethereal in full COUNTERHACK mode. The goatse image mode was disruptive enough to be fully fucking hillarious, yet still left HTTP enough alone to be usable. I guess image-maps were the only things we truly broke with that mode (hint: click the anus!)

Overall, airpwn was just about the only reason why defcon was amusing this year.. Without airpwn I think I would have been mostly asleep and would have just IRCed the entire time.. If you want to play with airpwn yourself, an early alpha has been posted to sourceforge..

[impala454]

again... MAC address access list... yeah its more of a pain to set up everyone, but hey if it keeps you from seeing tubgirl

[zetec]

actually read that site... not 100% sure that would prevent an airpwn attack. it's not an AP, it actually injects packets into a stream.


Besides MACs can be spoofed.

[impala454]

yeah but you have to know which MAC to spoof basically means someone would have to actually get a hold of a piece of your hardware physically (or get you to give it to them somehow). the only real downside is it makes it a pain to add new devices and it would make public wireless in hotels & coffee shops useless. but for home network, no better way to secure it imho.

[zetec]

nah, i have an old issue of 2600 that outlines in detail exactly how to spoof a mac without knowing what it is beforehand. (required that somebody else be connected that WAS authorized. Basically, you spoof their mac, then wait until they get frustrated since no transfers will really complete because everything's going all crazyday with their connection, then once they give up, you take over.


it works, but fuck it just get EVDO

[impala454]

interesting... even so, I'd still say having a MAC address list is pretty secure compared to a lot of methods. i guess anything is probably crackable though.

[The Fanatic]

If you don't secure your wireless network, you don't deserve to have it all to yourself.

This post has been edited by Dr. Gonzo: Jan 17 2007, 03:32 PM