Announcement

Collapse
No announcement yet.

Wireless foo at DefCon 12

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • Wireless foo at DefCon 12

    Check out my post over at DefCon12 wrapup for some wireless shinanigans. New tool released: Airpwn. Check it out...
    ~Auto

  • #2
    Please do not make posts that simply link back to other posts on this forum. We're tool using monkeys, we can figure out that you posted something somewhere else on here.

    I return whatever i wish . Its called FREEDOWM OF RANDOMNESS IN A HECK . CLUSTERED DEFEATED CORn FORUM . Welcome to me

    Comment


    • #3
      Sorry, man, figured there might be people interested in the tool that either didn't go to DC12, or didn't care to look at the after-Con wrap-up.

      It's a wireless IDS/Packet injector that was put to good (?) use at DC12. Go here for details: http://www.evilscheme.org/defcon/.
      ~Auto

      Comment


      • #4
        Ah, so you're one of the (many) shitheads keeping the Defcon wireless network unusable.

        Thanks, asshole.

        Really, I don't know why the Defcon organizers even try setting up a wireless network anymore, since every halfwit with a computer and a can of Pringles uses it to show off their l33test new DOS attack. With 5,000 people at Defcon, all it takes to fuck up the network are a handful of losers who've just discovered the TCP RST flag.

        Given that the Goons have a ton of real work to do at the con, it's amazing that the wireless network is ever up. In that light, my 10% success rate at using the wireless network this weekend is a fucking miracle--hats off to the network Goons.

        I anxiously await the day when all the hackers of the world rise together, and cry out as with one voice, "DOS and MitM attacks on unsecured wireless networks are lame!"

        Yeah, I may be waiting a while.

        Comment


        • #5
          The wireless network was just fine (short of the DHCP problems) to those who knew how to use it. We'd do a few bursts here and there to see how well the tools worked. For the most part, when it was on, we were doing image subsitution.

          If you had G (which it seemed most did) you were fine.

          If you knew anything about TOR, Privoxy, Stunnel, SSH Forwarding, IPSEC, PPTP, etc, you were fine.

          Yes, we could have RST every connection. We didn't.

          Yes, we could have De-auth flooded. We didn't (someone else did).

          Yes, we could have injected malware into every exe downloaded, or injected hostile javascript into every page. We didn't.

          And like everyone else has said on this thread, what were you doing on the network anyway? It's supposed to be fucked. You're supposed to be out at the pool with your friends.

          This wasn't a lame DoS attempt. This was a basic proof of concept. The possibilities of this tool are really quite impressive.

          Imagine going into Starbucks with this, and injecting ads for Pete's Coffee into every banner ad a wireless customer sees.

          Imagine going into the Republican National Convention and injecting pro-Kerry ads onto every wireless laptop?

          The concept for this isn't any different that a wired network, sure, but the *way* wireless networks are used is the difference.
          ~Auto

          Comment


          • #6
            Bah.

            It may not have been a DOS, but the way you did it was still lame. It's high-tech version of graffiti. If this was such a great concept, why didn't you submit it as a talk rather than acting like an adolescent idiot? I'm sure you would have found some willing "victims" in an audience, rather than imposing crap on innocent people who had no interest in it, and were just attempting to do something without your interference.

            People pulling childish pranks like this deserve to get thrown in the pool with their equipment.
            Thorn
            "If you can't be a good example, then you'll just have to be a horrible warning." - Catherine Aird

            Comment


            • #7
              Well, it wasn't submitted as a talk basically because we pulled it together just last week, so there wasn't time. We weren't sure just how effective it would be, with different IP stacks, timing, signal power, etc. We really didn't expect it to be quite as sucessful as it was. We did it in bursts of about 5-10 minutes every few hours, so the overall disruption was minimal, once we discovered we were really DoS'ing people.

              Really, though, do you expect these kinds of things NOT to happen on DefConNet? Like I mentioned, anyone who really needed access knew how to ensure it - SSH, SSL, IPSEC, these are the tools of the trade. Check out the comments on my cross-post - they're amazed anyone expected anything less.

              And, Shipley references aside, permenantly damaging someone's elses gear is never cool, under any circumstances. Sticks and stones and all that, but when you're talking about damaging person or property, it's wrong, period, not to mention illegal. Anyone suggesting otherwise is more adolescent than you claim this prank to be.

              You guys need to learn how to take a joke. There are no innocents at DefCon.
              Last edited by AutoNiN; August 4, 2004, 19:09.
              ~Auto

              Comment


              • #8
                Originally posted by AutoNiN
                Imagine going into the Republican National Convention and injecting pro-Kerry ads onto every wireless laptop?
                We'd laugh at you.

                Comment


                • #9
                  Originally posted by AutoNiN
                  There are no innocents at DefCon.
                  I'm innocent and I was at DC-- at least I do not recall breaking any laws while I was there...

                  Comment


                  • #10
                    Originally posted by skroo
                    We'd laugh at you.
                    Yeah, I'd laugh at myself too. It's all I could come up with off the top of my head. There just seemed to be a lot of pro-Kerry's at Con. Just really trying to get people thinking about things you can do with this.

                    With the kind of money people throw into advertising, it'd be a drop in the bucket to do the Starbuck's/Pete's Coffee thing, and fairly effective.
                    ~Auto

                    Comment


                    • #11
                      Originally posted by AutoNiN
                      With the kind of money people throw into advertising, it'd be a drop in the bucket to do the Starbuck's/Pete's Coffee thing, and fairly effective.
                      Effective how? At annoying people who paid for wireless access?

                      C'mon, this isn't really much better than the ideas the guy who got bundled offstage came up with.

                      Comment


                      • #12
                        So, your brainstorm was that public, unsecured wireless LANs are vulnerable to man-in-the-middle attacks? Impressive.

                        If someone's going to play vandal on the Defcon WLAN, you'd hope it would at least be with an idea that's not several years old.

                        Comment


                        • #13
                          If you're replacing banner ads that their browser is already requesting anyway (not something you've injected) with ads of your choosing, I'd consider that fairly effective targeted marketing. It's not denying the customer anything they're paying for, they don't have control over what ads they get in the first place.

                          And for political efforts, I thought it was the point to be inconvienent and obnoxious - people blocking a street, creating traffic snarls, etc. Use this to Stick It To The Man, whatever.
                          ~Auto

                          Comment


                          • #14
                            Originally posted by AutoNiN
                            If you're replacing banner ads that their browser is already requesting anyway (not something you've injected) with ads of your choosing, I'd consider that fairly effective targeted marketing. It's not denying the customer anything they're paying for, they don't have control over what ads they get in the first place.

                            And for political efforts, I thought it was the point to be inconvienent and obnoxious - people blocking a street, creating traffic snarls, etc. Use this to Stick It To The Man, whatever.

                            Yep...no denying your point here. For instance, when I got to Vegas, I was a heterosexual male...then I happened upon one of your goatse injections and now I have also turned my ass into the bat cave.

                            Don't be a douche.
                            perl -e 'print pack(c5, (41*2), sqrt(7056), (unpack(c,H)-2), oct(115), 10)'

                            Comment


                            • #15
                              Originally posted by Zhym
                              So, your brainstorm was that public, unsecured wireless LANs are vulnerable to man-in-the-middle attacks? Impressive.
                              Yeah, I did think it was pretty funny.

                              Originally posted by Zhym
                              If someone's going to play vandal on the Defcon WLAN, you'd hope it would at least be with an idea that's not several years old.
                              I'll admit the idea isn't novel, but I've never heard of anyone actually doing it. Theory is nice, but practical application is where it's at.

                              You don't associate to us, we don't poison DNS or ARP tables. We're effectively undetectible on the network. That we applied theory sucessfully has to count for something.
                              ~Auto

                              Comment

                              Working...
                              X