************************************************* * * * The Definitive Guide To Wireless WarX'ing * * ----------------------------------------- * * v1.2.1 * * * * 09/04/02 * * * ************************************************* * * * by Slayer * * * * Slayer@Kraix.com * * * ************************************************* * * * www.KRAIX.com * * * ************************************************* Contents: --------- I. Introduction II. Types of Wireless Networking 1.802.11a 2.802.11b 3.BlueTooth 4.Radio Frequencies 5.IrDA III. Wireless Hardware 1. Routers 2. Access Points 3. NIC's 4. PCMCIA Cards 5. Antennas IV. Wireless Software (Tools) 1. NetStumbler and MiniStumbler 2. Kismit 3. WEPCrack 4. AirSnort 5. Fake AP 6. Wireless Security Auditor 7. THC-WarDrive 8. THC-RUT 9. MacStumbler 10. BSD-AirTools 11. PrismStumbler 12. Mognet 13. WarLinux 14. Wellenreiter 15. WaveStumbler 16. AiroPeek 17. Stumbverter 18. AP Scanner 19. SSID Sniff 20. Wavemon 21. AirTraf 22. AirJack V. Wireless White Papers 1. Wireless LAN Security : 802.11b and Corporate Networks 2. Wireless HOWTO for Linux 3. Hacking the Invisible Network : Insecurities in 802.11x 4. Cracking WEP Keys : Applying Known Techniques to WEP Keys 5. The Need for a 802.11 Wireless Toolkit 6. Wireless LAN Security 7. Linksys BEFVP41 VPN...Wireless Mini HOWTO 8. SSID Defaults 9. What's Up With WEP 10. Default List of Passwords VI. Wireless Web Sites 1. Netstumbler.com 2. Milehigh Wireless 3. Wireless LAN 802.11x - Technical Information and Software 4. PersonalTelCo 5. WarChalking.org 6. Wardriving.com 7. WirelessCloud 8. Sputnik 9. NYCWireless 10. War Strolling and Cabbing VII. WarX'ing (Why you're reading this :) 1. What is WarX'ing? 2. WarDriving 3. WarChalking 4. WarStrolling 5. Example WarX'ing Setups 6. Something to Think About VIII. Securing your WLAN 1. Configuration 2. WEP 3. MAC Filtering 4. Fake AP 5. Disable SSID Broadcasting 5. Power IX. Conclusion X. Shameless Plug ************************************************************************************** ************************************************************************************** ------------------------------------------------ I. Introduction ------------------------------------------------ This is my first _real_ documentation, so please...no flaming or anything. I put this together because I have been receiving a lot of emails and such regarding wireless networks. Everyone wants to know, what it is, how to do that, where to get this, is this legal...the list is huge. So instead of constantly sending out a bunch of small answers, I'm writing this paper to help you learn as much as possible. Side Note: Keep in mind that I am not an *expert* in this area. I did not design the 802.11x standard or anything. I've just done a lot with it :o). Disclaimer: The purpose of this document in it's entirety is for educational purposes only. It is in no way meant for destructive or illegal purposes. Neither I (Slayer) or Kraix.com condone illegal activity, or anything that you may do with this information. I (Slayer) and Kraix.com feel that you are mature enough to make your own decisions, and not place blame on anyone else for your actions. By reading this, you are agreeing that you take full responsibility for your actions, and that they have nothing to do with Kraix.com or me (slayer). ------------------------------------------------ II. Types of Wireless Networking ------------------------------------------------ As you may have already figured out, there are a few different wireless types out there; 802.11a/b, BlueTooth, Radio Freq, and IrDA are to name a few. There really isn't a standard yet, because everyone thinks that their idea is the best, and they're pretty stubborn about it. Basically though, each type of wireless networking has it's ups and downs. I'll try to give you a brief overview of the ones that I know of. 1. 802.11a (that's an "A" after the numbers) - This is probably going to be the new standard for home and small office networking. I'm not too sure yet if it'll surpass 802.11b, but hey...time will tell. 802.11 was the first wireless protocol to come out, and i believe it would run at about 1-2Mbps (don't quote me on that). A little while later 802.11b came out, and it was faster, so people moved over to adopt that one. Now, .11a has been redone so that it's even faster than .11b. .11a now runs at 54Mbps in the 5Ghtz band and it uses what is called the "orthogonal frequency division multiplexing encoding scheme," (trust me, I couldn't make that up ;). If you want to learn more about OFDM, go run a Google on it, because I'm not going to go into it, all I'll mention is that it's more secure than WEP (Ha, "secure" and "WEP" shouldn't even be in the same sentence). Range on these devices will vary, but you should be able to get about 300ft. from an access point. 2. 802.11b (that's a "B" after the numbers) - .11b was the next revelation in wireless technology after .11 and before .11a. It is now commonly referred to as Wireless Fidelity or "WiFi" (pronounced like SciFi). .11b has a thoroughput of 11Mbps, and can fall back to 5.5Mbps, 2Mbps, and 1Mbps. All that means is that as the signal gets degraded (or farther away), your connection will drop to these levels. Right now, .11b is more-so the standard of wireless networking. There are more wireless LAN's and WAN's running .11b than any other architecture. Because of this, you will find more tools, and uses with this. When people are out there WarX'ing, this is the protocol that they're using. (WarX'ing is described later on.) It's primary security encryption is Wired Equivalent Privacy, or WEP for short. WEP can be used in 64bit or 128bit forms. All prism 1 cards can utilize WEP 64bit, but you'll need a Prism 2 card to use 128bit. But either way, I would strongly recommend that you do NOT rely solely on this, bad bad idea. Once again, I'm not going into how WEP works (or doesn't work). Google it if you're interested. Range on these devices will vary, but you should be able to get about 300ft. from an access point. 3. BlueTooth - BlueTooth is a wireless type for short range devices. You can get about 10 meters (that's about 30ft) away before you lose connection. Of course, that's in lab results. Real world, you can get about 25-ish, but hey who's counting ;). Anyways, BlueTooth is being integrated into a lot of portable devices for use of Sync'ing things together. Such devices are handhelds (Compaq's iPaq), phones (Sony-Ericsson), and other little gadgets. It's really a way to replace IRDa, and in that way it's beneficial. BlueTooth generally has a transfer rate of about 1Mbps. That's not too bad, considering that it's only syncing, or passing streaming media. Leeching news groups with it...no. Using this standard to sync devices, or to get rid of wires is a great idea, but I don't see us buying a can of Jolt out of a machine with our phone anytime soon. So far, the best ways that I've seen this protocol being used are in PDA's for syncing, and in the new Sony-Ericsson T68i cell phone that uses a wireless (BlueTooth) handsfree headset. I want one sooo bad. I'd even be willing to write s review about it if someone donated one to me (hint, hint, :o). 4. Radio Frequencies - Cell Phones. This is how they work, by using alternating encrypted radio frequencies. I could write an entire thesis on this alone, but I'm not. All I'm going to tell you is that Cell Phones use them :). Phreaking is not my expertise at all, and I'm not about to begin to talk about something that I don't know enough about. 5. IrDA - Infrared Data Association. Basically, the stuff you're remote controls use. It's using a beam of light that we can't see to send a signal. The restrictions on this are enormous, but hey...it works. IrDA is used a lot in Cell Phones, PDA's (especially Palm's, I think they were the first to use it, but I could be wrong), laptops, wireless mice/keyboards; the list goes on and on. The major downfalls for IrDA are distance and line-of-sight. IrDA can only go about 1-2 meters and doesn't work unless there is a direct line-of-site. It's nice to sync your palm or your phone with your contact list on your laptop without wires and all, but if your cat lays down between the two, end of connection. BlueTooth is starting to replace the uses for IrDA, because it can go farther, more secure, does not need line-of-site, and it's a lot faster. IrDA has a transfer rate of about 75Kbps (that's a "K", not an "M"). ------------------------------------------------ III. Wireless Networking Hardware ------------------------------------------------ For IrDA, BlueTooth, and Radio Frequencies, the hardware is basically built into the devices that's going to use it. There are a couple peripherals that you could buy, but they're not worth going into. I'm basically going to cover 802.11a/b hardware. The same type of hardware exists for both standards unless otherwise noted. 1. Wireless Routers - This is the most important piece of wireless technology that you will but when setting up a LAN or WAN. You must make sure that it's of the right archetecture, chipset (Prism 1 or 2), and that it has all the features that you need. For home use, you shouldn't spend over $200, unless you want some high-end stuff, or you're delving into the .11a world (.11a is a little more expensive). Pretty much every manufacture and their brother are making wireless routers. Linksys, 3com, Belkin, Intel, Cisco, Billy-Ray-Joe (just kidding). I personally use Belkin, and I haven't had any problems, but I would recommend that you buy a name-brand router. Remember, you get what you pay for. Remember that when you're looking at a Linksys $150 router on sale with 8 mail-in rebates from Best Buy. 2. Access Points - These are very useful in larger offices, or houses. They will relay the signal to extend your coverage. It acts kind of like a wireless hub. These are also made by all the same people that make the routers, and I suggest that if you purchase an access point, that you get the same brand as your router. Less likely to have compatibility issues. 3. Wireless NIC's - Um, it's a NIC (Network Interface Card) that's wireless. I think that this one is pretty self-explanitory. One idea though, is that instead of buying a wireless NIC, buy a PCI card that has a slot to insert a PCMCIA, or PC card, into it. These cards shouldn't cost more than $20, and you can use the PC card for more stuff. 4. Wireless PCMCIA (PC Cards) cards - These are the cards that go into your laptops, or other portable devices. There are two different architectures for these cards, Prism 1 and 2. 1 supports 64bit and 2 supports 128bit encryption. Almost all the cards are Type 2 cards (in relation to the thickness). In my opinion, the best cards out there right now are the Orinoco Gold cards. You can get them online for about $80. 5. Antennas - You can purchase, or make, external antennas that will increase your signal strength and distance. The most common form is called a Yagi (Like from Karate Kid, jk). These are sold all over the place online, and there are plans out that that show you how to build them from a scratch using a Pringles can and Radio Hack parts (Great way to disguise it for WarX'ing). One piece of hardware that you'll most definitely need is called a Pig Tail. This is a wire that will connect from your wireless card (on the antenna) to a thick coaxial cable or cable connector. The little piggies cost about $20. ------------------------------------------------ IV. Wireless Software (Tools) ------------------------------------------------ With the recent explosion of the wireless networking community, there has been a shadow within the software field. Recently it seems like there is a new wireless tool that comes out every day. I have tried to put together a list of tools, and their links, of what I think are probably the most useful. If I've used it before, or I know about it, I'll try to give a description about it also. 1. NetStumbler and MiniStumbler - Windows 2000, 9X, ME, XP, Pocket PC I have to say that these are by far the most widely used and proven wireless discovery tools on the net. Netstumbler will use your wireless card to detect all the wireless networks in the area. It will return the WLAN's SSID, channel, WEP or not, signal strength, and more! The GUI is insanely easy to use. Hell, even a L337 H4X0R could use this :). Two features that I really like are it's ability to modify the refresh rate of the scan, and that you can hook up a GPS unit to it to track your exact coordinates. You can then save this to a file and upload it to their server to add to their ever-expanding map of WLANs. MiniStumbler is the same as NetStumbler, except that it's for the iPaq handheld (oh the possibilities!). Homepage: http://www.netstumbler.com Readme: http://www.stumbler.net/readme/readme_0_3_30.html Download: http://www.netstumbler.com/download.php?op=getit&lid=22 (NetStumbler) Download: http://www.netstumbler.com/download.php?op=getit&lid=21 (MiniStumbler) 2. Kismit - Linux Kismet is a 802.11b wireless network sniffer. It is capable of sniffing using almost any wireless card supported in Linux, including Prism2 based cards supported by the Wlan-NG project (Linksys, Dlink, Rangelan, etc), cards which support standard packet capture via libpcap (Cisco), and limited support for cards without RF Monitor support. The latest stable release as of this writing is 2.4.6 on August 4th. You may want to go to the page to download the latest stable version. Homepage: http://www.kismetwireless.net Download: http://www.kismetwireless.net/code/kismet-2.4.6.tar.gz 3. WEPCrack - Linux WEPCrack is an open source tool for breaking 802.11 WEP secret keys. This tool is is an implementation of the attack described by Fluhrer, Mantin, and Shamir in the paper "Weaknesses in the Key Scheduling Algorithm of RC4". WEPCrack was the first publicly available code that demonstrated the attack. Homepage: http://wepcrack.sourceforge.net/ Download: http://sourceforge.net/project/showfiles.php?group_id=32993&release_id=49357 4. AirSnort - Linux AirSnort is a wireless LAN (WLAN) tool which recovers encryption keys. AirSnort operates by passively monitoring transmissions, computing the encryption key when enough packets have been gathered. AirSnort requires approximately 5-10 million encrypted packets to be gathered. Once enough packets have been gathered, AirSnort can guess the encryption password in under a second. Homepage: http://airsnort.shmoo.com/ Download: http://prdownloads.sourceforge.net/airsnort/airsnort-0.2.1.tar.gz?download 5. Fake AP - Linux Black Alchemy's Fake AP generates thousands of counterfeit 802.11b access points. Hide in plain sight amongst Fake AP's cacophony of beacon frames. As part of a honeypot or as an instrument of your site security plan, Fake AP confuses Wardrivers, NetStumblers, Script Kiddies, and other undesirables. Just so you know, some of the SSID's that are generated by Fake AP aren't exactly the cleanest of words :). Homepage: http://www.blackalchemy.to/Projects/fakeap/fake-ap.html Download: http://www.blackalchemy.to/Projects/fakeap/fakeap-0.2.tar.gz 6. Wireless Security Auditor - Linux on an iPaq WSA is an IBM research prototype of an 802.11 wireless LAN security auditor, running on Linux on an iPAQ PDA. WSA automatically audits a wireless network for proper security configuration, to help network administrators close any vulnerabilities before the hackers try to break in. Short and sweet: IBM's Linux version of Ministumbler. Still in Beta. Homepage: http://researchweb.watson.ibm.com/gsal/wsa/ Download: Can't get it :( . If you can, email me! 7. THC-WarDrive - Linux THC-WarDrive is a tool for mapping your city for wavelan networks with a GPS device while you are driving a car or walking through the streets. It is effective and flexible, a "must-download" for all wavelan nerds. Homepage: http://www.thehackerschoice.com Download: http://www.thehackerschoice.com/download.php?t=r&d=wardrive-2.3.tar.gz 8. THC-RUT - Linux THC-RUT (aRe yoU There) is a local network discovery tool developed to brute force its way into wvlan access points. It offers arp-request on ip-ranges and identifies the vendor of the NIC, spoofed DHCP, BOOTP and RARP requests, icmp-address mask request and router discovery techniques. This tool should be 'your first knife' on a foreign network. Homepage: http://www.thehackerschoice.com Download: http://www.thehackerschoice.com/download.php?t=r&d=thcrut-0.1.tar.gz 9. MacStumbler - Mac OS X MacStumbler is a little program that was written to emulate the workings of Netstumbler and Kismet for the Mac. It will only work with Apple Airport cards and is in extreme beta testing, so plan on you mac to crash a couple times trying to get this to run. There are a number of people out there using this, so it does work. The source code is also available if you're a fellow Mac coder and want to help out. Homepage: http://homepage.mac.com/macstumbler/ Download: http://homepage.mac.com/macstumbler/MacStumbler-06b.tgz (binary) Download: http://homepage.mac.com/macstumbler/06b-source.tgz (source) 10. BSD-AirTools - FreeBSD 4.4, OpenBSD 2.9/3.0, NetBSD 1.5.1+ bsd-airtools is a package that provides a complete toolset for wireless 802.11b auditing. Namely, it currently contains a BSD-based WEP cracking application, called dweputils (as well as kernel patches for NetBSD, OpenBSD, and FreeBSD). It also contains a curses based ap detection application similar to netstumbler (dstumbler) that can be used to detect wireless access points and connected nodes, view signal to noise graphs, and interactively scroll through scanned AP's and view statistics for each. It also includes a couple other tools to provide a complete toolset for making use of all 14 of the prism2 debug modes as well as do basic analysis of the hardware-based link-layer protocols provided by prism2's monitor debug mode. Homepage: http://www.dachb0den.com/projects/bsd-airtools.html Download: http://www.dachb0den.com/projects/bsd-airtools/bsd-airtools-v0.2.tgz Download: ftp://ftp.dachb0den.com/pub/projects/bsd-airtools/bsd-airtools-v0.2.tgz 11. PrismStumbler - Linux Prismstumbler is a wireless LAN (WLAN) which scans for beaconframes from accesspoints. Prismstumbler operates by constantly switching channels an monitors any frames received on the currently selected channel. Homepage: http://prismstumbler.sourceforge.net/ Download: http://www.monolith81.de/download/prismstumbler-0.5.0.tar.gz 12. Mognet - Linux Mognet is a free, open source wireless ethernet sniffer/analyzer written in Java. It is licensed under the GNU General Public License. It was designed with handheld devices like the iPaq in mind, but will run just as well on a desktop or laptop. Homepage: http://chocobospore.org/mognet/ Download: http://www.monolith81.de/download/Mognet-1.14.tar.gz 13. WarLinux - Um... It is the OS. A new linux distribution for Wardrivers. It is available on disk and bootable CD. It's mainly intended use is for systems administrators that want to audit and evaluate their wireless network installations. Should be handy for wardriving also. I hope you have a lot of CDs ready for this one. One guy took a pic of all the CDs he went through just to get this thing to work, there had to been at least 20 of em! But hey, in the end he got it! Homepage: https://sourceforge.net/projects/warlinux/ Download: http://prdownloads.sourceforge.net/warlinux/warLinux.iso?download 14. Wellenreiter - Linux Wellenreiter is a GTK/Perl program that makes the discovery and auditing of 802.11b wireless networks much easier. All three major wireless cards (Prism2 , Lucent, and Cisco) are supported. It has an embedded statistics engine for the common parameters provided by wireless drivers. Its scanner window can be used to discover access-points, networks, and ad-hoc cards. It detects SSID broadcasting or non-broadcasting networks in every channel. Non-broadcasting networks could be uncovered automatically. The manufacturer and WEP is automatically detected. A flexible sound event configuration lets you work in unattended environments. An ethereal / tcpdump-compatible dumpfile can be created for the whole session, so detailed analysis at another location is easy. GPS support tracks the location of the discovered networks immediately. Automatic associating is possible with randomly generated MAC addresses, so you don't have to work with your real MAC address anymore. Wellenreiter can reside on low-resolution devices that can run GTK/Perl and Linux/BSD (such as iPaqs). A SSID bruteforcer is included now too. Homepage: http://www.remote-exploit.org Download: http://www.remote-exploit.org/modules.php?name=Downloads&d_op=getit&lid=25 15. WaveStumbler - Linux WaveStumbler is console based 802.11 network mapper for Linux. It reports the basic AP stuff like channel, WEP, ESSID, MAC etc. It has support for Hermes based cards (Compaq, Lucent/Agere, ... ) It still in development but tends to be stable. Homepage: http://www.cqure.net/tools08.html Download: http://www.cqure.net/tools/wavestumbler-1.2.0.tar.gz 16. AiroPeek - Windows 98, ME, 2000, XP (COMMERCIAL $1495 for 1 year!) AiroPeek is a comprehensive packet analyzer for IEEE 802.11b wireless LANs, supporting all higher level network protocols such as TCP/IP, AppleTalk, NetBEUI and IPX. AiroPeek contains all of the network troubleshooting features familiar to EtherPeek. In addition, AiroPeek quickly isolates security problems, fully decodes 802.11b WLAN protocols, and analyzes wireless network performance with accurate identification of signal strength, channel and data rates. Homepage: http://www.wildpackets.com/products/airopeek Download: http://www.wildpackets.com/demo_buy/demos/apw (DEMO) 17. Stumbverter - Windows 2000, 9X, ME, XP StumbVerter is a standalone application which allows you to import NetStumbler's summary files into Microsoft's MapPoint 2002 maps. The logged WAPs will be shown with small icons, their color and shape relating to WEP mode and signal strength. As the AP icons are created as MapPoint pushpins, the balloons contain other information, such as MAC address, signal strength, mode, etc. This balloon can also be used to write down useful information about the AP, notes, etc. Homepage: http://www.sonar-security.com/ Download: http://www.sonar-security.com/files/StumbVerter_V010_full.zip 18. AP Scanner - Mac AP Scanner is a small Macintosh-only application that will detect all in-range open 802.11 wireless network access points. It will show you a pretty little graph and show potential channel conflicts. Homepage: http://homepage.mac.com/typexi/Personal1.html Download: http://homepage.mac.com/typexi/.cv/typexi/Public/AP%20Scanner%201.0%20Dist.sit-link.sit 19. SSID Sniff - Linux A nifty tool to use when looking to discover access points and save captured traffic. Comes with a configure script and supports Cisco Aironet and random prism2 based cards. Homepage: http://www.bastard.net/~kos/wifi/ Download: http://www.bastard.net/~kos/wifi/ssidsniff-0.36.tar.gz 20. Wavemon - Linux wavemon is a ncurses-based monitoring application for wireless network devices. It currently works under Linux with the Lucent Orinoco cards. Homepage: http://www.jm-music.de/projects.html Download: http://www.jm-music.de/wavemon-current.tar.gz 21. AirTraf - Linux AirTraf is a package with many features. On a basic level, it performs packet capture/decode in the 802.11b wireless level. It gathers and organizes packets captured over the air based on the type of traffic (management, control, data), according to the dynamically detected access points (in case there are multiple in a given area), and performs bandwdith calculation as well as signal strength information on a per wireless node basis. It determines the SSID of access points, the channel it is operating under, the number of wireless nodes connected to the access point of interest, the overall load on the access point, as well as the bandwidth utilized by all connected wireless nodes. And as of AirTraf-0.3-1beta, AirTraf is database-aware, meaning that multiple sniffers can be polled via a central polling server periodically to gather up2date information, and saving the information for long-term load analysis over periods of days, weeks, months, and even years. The other feature of AirTraf includes tracking of access related activity generated in the area, it tracks all probe/authentication/association requests made to a given access point, and by observing access point's reaction, make a judgment as to the nature of activity, and determine whether the activity is hostile or friendly. (currently fairly unstable, and being worked on) Homepage: http://airtraf.sourceforge.net/index.php Download: http://prdownloads.sourceforge.net/airtraf/airtraf-0.5.0.tar.gz 22. AirJack - Linux AirJack is a nifty tool that will let you take over a connection to a WLAN. Short-short version: You DOS the AP filling it with forged ARP packets confusing the hell out of the AP causing it to dump. Then the clients start to look for a new AP, because they lost their connection. What the find is your box as the AP, and then when the real AP comes back, you're the middle man. Get it? Homepage: http://802.11ninja.net/ Download: http://802.11ninja.net/airjack-v0.6.2-alpha.tar.bz2 ------------------------------------------------ V. Wireless White Papers ------------------------------------------------ After spending a couple days scouring the net for information on wireless networking and other such topics. I have come across a few white papers that I have found to be useful or interesting. White papers are documents that are instructional or informative. This document that I am writing can be considered a white paper. The following are links and brief descriptions of each white paper that I found. Some are HTML files, PDF documents, and even PowerPoint slides from different conventions. 1. Wireless LAN Security : 802.11b and Corporate Networks - A white paper written by the company Internet Security Systems. Link: http://documents.iss.net/whitepapers/wireless_LAN_security.pdf 2. Wireless HOWTO for Linux - This is a pretty informative guide on how to get your Linux box up and running for a wireless LAN. Remember that these are just guidelines, and that you'll have to make changes depending on your card, distro, and box. Link: http://www.ibiblio.org/pub/Linux/docs/HOWTO/other-formats/html_single/Wireless-HOWTO.html 3. Hacking the Invisible Network : Insecurities in 802.11x - A nice long white paper written by iDEFENSE. This document goes into great detail as to the vulnerabilities of wireless networking, I'm talking binary here. Link: http://www.net-security.org/dl/articles/Wireless.pdf 4. Cracking WEP Keys : Applying Known Techniques to WEP Keys - This is a Power Point slide presentation from @Stake about how to go about cracking WEP keys, and the logistics behind it. If you're new to WEP, I recommend it for a quick overview. Link: http://www.lava.net/~newsham/wlan/WEP_password_cracker.ppt 5. The Need for a 802.11 Wireless Toolkit - This is a PDF white paper written by a guy from @Stake that was presented during the Black Hat Briefings in July of 2002. Link: http://www.packetfactory.net/projects/radiate/802.11_toolkit-2.0.pdf 6. Wireless LAN Security - Here is an excellent white paper in HTML format that describes everything that you need to know about wireless security, it's vulnerabilities, methods of attack, and much more. Link: http://www.packetninja.ca/starrrt.html 7. Linksys BEFVP41 VPN Router to OpenBSD IPSec Server + Wireless Mini HOWTO - This document describes how to use the Linksys BEFVP41 VPN Router as a VPN Client to an OpenBSD IPSec Server. Link: http://ruff.cs.jmu.edu/~beetle/download/befvp41.html 8. SSID Defaults - Here is a TXT file that lists most of the manufactures default SSID's, default password login pairs, channels, and some other useful tidbits. Link: http://www.wi2600.org/mediawhore/nf0/wireless/ssid_defaults/ssid_defaults-1.0.5.txt 9. What's Up With WEP - Here's a quick read from IBM on how WEP works and other things WEP. There are some pictures that should help you out if you're reading impaired >:) Link: http://www-106.ibm.com/developerworks/library/s-wep/?article=wir 10. Default List of Passwords - I think this one is pretty self-explanatory. It's a huge list of default password and login settings for routers, firewalls, and everything else. If I were you, I would save this list, because who knows how long it'll stay here. Link: http://www.aaws25.hemscott.net/Default%20password%20list.htm ------------------------------------------------ VI. Wireless Web Sites ------------------------------------------------ I have compiled a list of my favorite 10 wireless web sites and list them here for you. Most of these sites all deal within a specific area of wireless, but there is some overlap. You'll just have to go there and check it out! 1. Netstumbler.com - The home of probably the most famous wireless tool on the net. Not only that, but they have current wireless news and events, a forum, geographical WLAN locations, and more. Definitely a must. Link: http://www.netstumbler.com 2. Milehigh Wireless - If you live in the Denver area, this is the perfect site for you. They talk about their free coverage ideas, and more. Link: http://www.milehighwireless.net/wiki-moinmoin/moin.cgi 3. Wireless LAN 802.11x - Technical Information and Software in German and English - Wow, what a long ass name. You will find a ton of links to software, sites, HOWTO's, and a ton of other stuff here. Hey and if your German, you're all set. Link: http://www.monolith81.de/software_linux.htm 4. PersonalTelCo - Here's a nice page about WarDriving with some helpful links. There are some other sites in this page relating to wireless stuff, but they may be hard to find. Link: http://www.personaltelco.net/index.cgi/WarDriving 5. WarChalking.org - The official WarChalking homepage. The Blogging system here is pretty cool. It allows anyone to write stories relating to Warchalking, and then the story is rated among other warchalkers as to whether or not it gets published. You'll find some cool stories, pictures, and other misc. stuff here. Link: http://www.warchalking.org/ 6. Wardriving.com - I think this one is pretty self-explanatory. This site is devoted entirely to Wardriving. Just go to it, I know you're going to. Link: http://www.wardriving.com 7. WirelessCloud - WirelessCloud is a southern California based organization that is set out to provide free 802.11 access. I wish them luck! Link: http://www.wirelesscloud.net/wirelesscloud/index.htm 8. Sputnik - These guys have made a couple different products that are very useful in the wireless industry. They also have some news articles relating to wireless, but they don't get updated too frequently. Link: http://www.sputnik.com/ 9. NYCWireless - Ah, my hometown organization. These guys rule. They are another org out there that's trying to get free 802.11 access through-out New York City. They have already done a lot in the city, covering a lot of areas, and parks in the city. They've been featured on TechTV for a game they invented, and they also hold monthly meetings to go over new stuff. Everyone's invited and it's always free. Even if you don't live in NYC, you need to check these guys out. Link http://www.nycwireless.net/ 10. War Strolling and Cabbing - Here's another NYC based guy that's going around Manhattan and mapping out the wireless networks. Using MacStumbler, it looks like he's getting a large area pretty covered. Doesn't look like he's doing any chalking though, so you'll have to check out the site to find the networks. Link: http://www.joemaller.com/wifi/ ------------------------------------------------ VII. WarX'ing (Why you're reading this :) ------------------------------------------------ 1. The first question that's probably in your head is, "What the hell is 'WarX'ing'". Well it's pretty simple. Right now there are many different types of Wireless scanning going about. You have WarDriving, WarChalking, WarStrolling, WarBoating, WarFlying, the list is endless. Because of this, I've adopted the term WarX'ing; the "X" is the variable for the different kinds. No matter what mode of transportation you use, you're doing the same thing...scanning. So instead of all these terms, I've decided on one simple term that covers them all. Judging by the context of the document, story, or whatever; I think you'll be able to figure out if they were on foot, or in a car. The prefix "War" originally came from the good-ole days of BBS'ing. To find a modem on the other end of a phone line, you would do what is called WarDialing. Think of this as a primitive IP scan. You'd enter in a set of phone numbers to dial (ex. 555-1000 - 555-1100 ) and then the WarDialing program calls each number in the list to see if there's a modem at the other end, and then either makes a note of it, or tries to connect. I think you can see the connection here. For those of you that have no clue what WarX'ing (WarDriving/chalking/strolling/etc) is, I will go into more detail about each area below. 2. WarDriving - WarDriving is the act of scanning for wireless networks with a mobile device while driving around in a car. The most common form is when you take a laptop into a car and then turn on a stumbler to detect the networks. As the open networks appear you can either continue on, and make a list or a map, or pause to look around their network. 3. WarChalking - WarChaliking is the act of labeling a discovered network so that other WarX'ers can easily notice an open network and the details about it. The idea most likely originated from the old-school hobo chalking symbols. It's just a guess. If you go to Warchalking.org, they have a little cheat-sheet to help you out on how to draw out everything (CheatSheet: http://www.blackbeltjones.com/warchalking/warchalking0_9.pdf). I will attempt to draw out what the symbols are with my wonderful ASCII art skills. :) --------------------------------------- Open Node: SSID )( BW Closed Node: SSID () WEP Node: SSID AC (W) BW BW = Bandwidth and AC = Access Contact. --------------------------------------- These three symbols are the ones from the little cheat-sheet. These are very adequate, but I propose a more detailed symbol for open nodes, because there's just more to know. Proposed Symbol For Open Nodes: SSID This will show (1) an open node, (2) the SSID, (3) CHannel, (4) BandWidth, CH )( ST (5) signal STrength, 1-3 depending, (5) and that the defaults have been BW changed. Signal strength: 1 = Not Good, 2=Good, 3=Excellent. SSID This will relay the same info as the one above, but the colons (:) will CH:)(:ST signify that the router is using default settings. BW With the use of these more enhanced symbols, fellow WarX'ers will know a lot more about the Node at hand, and whether or not it's worth it to stop and connect. After running into many )('s that have poor quality, or non-default settings, I feel that this could really help out everyone in the community, if we just took an extra 2 seconds. 4. WarStrolling - WarStrolling is just like WarDriving and all the other one's expect that you do your scanning on foot. You can either carry around a laptop or a handheld to detect the networks. By WarStrolling, you will have more time to delve into the networks that you stumble into, but you are also a lot more noticeable carrying around a laptop. If you have a handheld (like an iPaq) on the other hand, you will go unnoticed, but you can't do as much. If you're going WarStrolling, I would suggest that you use MiniStumbler from www.netstumbler.com. See the tools section in this white paper. 5. Examples on WarX'ing - I'm going to go over two different scenarios on how you can begin WarX'ing today. The first one is the most common, WarDriving. If you are a beginner WarX'er you might have to do a little research on the net about certain things, but I'll try to go into as much detail as possible. The first thing that you are going to need is a laptop. Nothing fancy really. If you are going to run a Windows OS, I would recommend Windows 2000. XP will really piss you off once you find out that it doesn't like to let go of an AP after it finds one! If you're going to run a flavor of Linux, make sure that it's a current kernel and that you will have the drivers ready to get it to use your wireless card, it can be a real pain in the ass at first, but well worth it in the long run. This brings us to our next piece of hardware, a wireless PCMCIA (or PC Card) card. Prism II if possible, but not required. Make sure that it 802.11b (That's a "B"). If you use an "A" card, you won't pick up shit because the tools are for "B". Another thing that I would recommend (but is not necessary) is a DC to AC converter. This is a little box that will convert your car's cigarette lighter socket into an AC socket, so you can get juice for your laptop from your car. Just make sure that it will supply enough wattage to power it. Now load up your laptop with your favorite tools, and hit the road! I will once again empower my ASCII art skills to make a little diagram: Windows WarX'ing Box Linux WarX'ing Box -------------------- ------------------ OS - Windows 2000 (NO XP*) OS - Favorite Compatible Flavor (Debian) Wireless PCMCIA Card (Prism II*) Wireless PCMCIA Card (Prism II*) AC/DC Power Converter* AC/DC Power Converter* NetStumbler Kismet Favorite Port Scanner* Favorite Port Scanner* Windows Share Exploiter* Favorite Exploits* GPS Unit* GPS Unit* White Lightning Jolt Cola :) WEPCrack* AirSnort* FakeAP* * optional THC-RUT* SSIDSniff* AirJack* Cherry Bomb Jolt Cola >:) My Setup -------------------- Dell Inspiron 4000 Laptop Debian Linux Orinoco Gold Hermes PCMCIA Card 40 watt AC/DC converter Kismet nmap Exploits to test my *own* network >:) No GPS (i don't care) WEPCrack AirSnort FakeAP (for home use really) THC-RUT THC-Wardrive SSIDSniff AirJack AirMonkey Cherry Bomb & White Lightning Jolt Cola :) I'm also currently building my own portable yagi. The GPS device is used to map out the coordinates of the located WLAN's. You can then upload them to a central server (like netstumbler.com) and add them to the ever growing map, or you can download a program like Stumbverter and make your own maps. You are obviously going to be able to do a lot more with a linux box, but not everyone is leet (i just wanted to use that word) enough to do so. I would also like to point out that there is not an * after Jolt. This is a necessity because the best time to go strolling around is at 3 in the morning when Joe Shmoe is asleep with is router and cable modem on :). Once you are on a network, there is an endless possibility of the things you can do. I'm not even going to go into them, but from the list above, and with some common sense, I think you can figure it out. A little side note (this should be obvious), make sure that your box is set to DHCP, because if it's not, you'll never connect to the network, unless you're lucky enough to be set to the same class and subnet. If you need help setting up your Linux box with a wireless card, go to the white papers section of this doc, there's a couple links there that should help you out. The other area that you could dive into is WarStrolling. In this example, I'll tell you how to do the equivalent of above, but with a handheld. Pop this badboy in your pocket and start walking around! You will need 4 things to WarStrole, (1) Handheld PDA that either has a built in 802.11b device, or one that is capable of adding one to it, (2) a PCMCIA card adapter for your handheld (if needed), (3) a PCMCIA Wireless 802.11b card, (4) and stumbling software. I've heard of a couple people porting a version of linux to their iPaq's and then running linux programs on it, but I don't have any experience in this. I'll show you the setup which I use: My WarStrolling Setup --------------------- Compaq iPaq 3950 Compaq iPaq PC Card Expansion Paq Plus (includes an extra battery!) Orinoco Gold Hermes PCMCIA Card (Same one from my laptop) MiniStumbler Original Jolt Cola (It's hot out :) That's it. I just turn it on and drop it into my pocket. While walking around NYC, catching open WiFi networks is like finding Ford in Detroit. You could also port over some network tools to play with while looking for networks, but I generally don't add anything fancy. There is an alternative to the PC cards though. For the handhelds, you could buy a compact flash adapter (if you need it), and then purchase a compact flash 802.11b card. They're not as strong as the PC cards, and some won't be recognized, but it is possible. The two major benefits to these cards over PC cards is that they are a lot smaller, and they take less power to use. 6. Something to Think About - When I first started, I was thinking, wow...I'm virtually undetectable, and even if they do notice I'm on their network, they could never find me. Well, after breaking into my own network, I found out that is very, very wrong. So I'm here to give you a couple pointers that should help you out. - Change your computer name to something like "IISMonitor", "WorkStation5", or something else that's inconspicuous. If a net admin sees a box on his network labeled "Ul7R4 L337 H4X0R", he's going to wonder. - If you're running a Linux box, spoof your MAC address. When you connect to a WiFi LAN, you will broadcast your MAC address to the router, so don't give them your real one. If you're running Windows, I'm sorry but I currently don't know how to spoof MAC addresses on a Windows box...I don't know if it's even possible. - Don't sit in one place for too long. Just like cell phones, it is possible to triangulate your position. I was talking to a guy out in California that's working on a Stumbler detector. Basically it consists of three Honeypot WiFi routers set up in a triangle. When you walk inside the boundary...BAM, he's got ya. - Use your head, don't sit outside a large corporate office at 3 in the morning with a custom spray-painted laptop that says "H4X0r" all over it. These places do have security, and you'll stick out like a soar thumb. - Don't do anything destructive. There's no point in formatting a poor guys machine just because he doesn't know as much about computers as you do. Just think about if you formatted a Doctors machine with some really important shit on it. You talking about real peoples lives here. Changing an SSID to "SpreadEgl", or leaving a note on his desktop telling him how to secure his stuff...eh, that's borderline. ------------------------------------------------ VIII. Securing your WLAN ------------------------------------------------ There are some real simple steps to securing your WLAN, but most people don't follow them. The most common reason for a security hole in a WLAN is laziness. People somehow feel that whatever they're buying, it comes already secured. This is a BIG problem. When you purchase a new router, or firewall, they come with default settings and passwords. If you've read everything up to here, you would have seen a couple links to places that publish huge lists of default settings. This takes us to our first step. 1. Configuration - Like I just said, when you purchase a new wireless router, is comes with a default username/password, channel, and SSID. When an experienced WarX'er is tooling around, the first thing that (s)he'll notice is the SSID. If it's se to Linksys (Linksys's default SSID) or tsunami (Cisco's default SSID), they know that there's a real good chance of breaking into that router. So rule number one is CHAGE YOUR SSID. Keep in mind that if you make it something like "Don't Even Try", you're just beggin to get hacked. Just use common sense. Next, change your username and password. make your password a non-dictionary word, more than 8 characters, alphanumeric and non-alphanumeric symbols, and don't match it to your SSID, that would defeat the purpose. You may say, "Well no one ever come in my apt but me, so I don't need a fancy password." Most wireless routers have a Web Administration menu. Once a hacker or WarX'er is on your network, all they have to do is type in your routers IP into a browser, and BAM, they have control of your network. 2. WEP - Enable WEP, 128-bit if possible. I know that WEP can be cracked, and that it's not a magic answer to WiFi security, but it's just not worth the time and effort of cracking a network with WEP enabled when there are two others in the same area without it. Think of it like The Club for your car. It's just a deterrent to tell the thief to take the car next to your instead :). 3. MAC Filtering - Most WiFi routers will allow you to filter access to your WLAN by MAC address. You can add in the specific MAC addresses that you wish to allow, and if a requesting computer with an invalid MAC address wants it, it says "No". Yes, there is a way around this too (MAC Spoofing/MAC Brute Forcing), but once again...it's a deterrent. 4. Fake AP - Go download the program called Fake AP. It's an excellent little program written by a couple drunk blackhats from DefCon last summer. This will flood the air waves with a ton of fake AP SSID's. This way a WarX'er will have a list of all these bogus AP's with yours hiding in there somewhere. It's like looking for Joe-Bob in Iowa, and then dropping Times Square around him. 5. Disable SSID Broadcasting - Some of the higher-end WiFi routers will allow you to disable the broadcasting of the SSID. This will help out a lot, because if a WarX'er can't connect to what it can't see. Of course there are ways to passively monitor the traffic to determine an SSID, but again...this is a deterrent. Are we catching the pattern here? 6. Power - This is by far the most secure way to keep WarX'ers out from your network, WiFi or not...turn the power off. Pretty simple huh? If you're not using your WLAN, turn it off. Not only will you save on power costs, but it's a sure bet on keeping people out while you're asleep or out getting drunk :). ------------------------------------------------ IX. Conclusion ------------------------------------------------ It's not really a conclusion, but more of me just saying good-bye. I really hope that this helps a lot of you out there and that maybe you even learned something. I just feel that after all these years of reading these white papers, I needed to return something. So, this is my contribution. If you would like to make any comments or suggestions, please email me at slayer@kraix.com . I will try to respond, but no guarantees. ------------------------------------------------ X. Shameless Plug ------------------------------------------------ If you're into photoshop, hacking, piercings, tattoos, or just misc cool stuff, go to Kraix.com. There's a ton of stuff there for you, and I promise you'll love it. There's no other site out there on the net like it. All PS tutorials are one of a kind, not ripped from other sites, or ideas taken from other people, 100% originality. www.KRAIX.com The Definitive Guide To Wireless WarX'ing is Copyright 2002 by Kraix.com. All Rights Reserved. Please email Slayer@Kraix.com for permission to publish. This article is free to distribute in its current format, and unchanged.