Wireless foo at DefCon 12

[skroo]

If you're replacing banner ads that their browser is already requesting anyway (not something you've injected) with ads of your choosing, I'd consider that fairly effective targeted marketing. It's not denying the customer anything they're paying for, they don't have control over what ads they get in the first place.

No, because the customer expects to receive *unmolested* wireless service. To extrapolate your argument out, it'd be perfectly fine for your local cable company to replace the ads on Fox for their programmes with ones for those on NBC because they don't like Fox.

And for political efforts, I thought it was the point to be inconvienent and obnoxious - people blocking a street, creating traffic snarls, etc. Use this to Stick It To The Man, whatever.

See, the problem with that logic is that it inconveniences the people who aren't part of the perceived problem. If you have a problem with (to use your example) Starbuck's, sending what amounts to little more than defaced content to their customers' browsers does shit-all to "stick it to the man": it just mildly annoys someone who paid for their service, assuming they even care or notice.

Let me give you a wider example of how well that brand of 'political effort' went down here recently when a small group of truckers blocked the 5 freeway during rush hour: they were arrested, and the rest of us who had our commutes made hell considered them lucky that the cops got to them first. Running around making a fool out of yourself doesn't draw worthwhile attention to or sympathy for your cause.

[gzzah]

Methinks this topic made a wrong turn somewhere. The ethics of doing something like this by another company are obvious, just look at the Gator spyware droppings and the latest flash ad pop-ups that overwrite nearly half your viewing screen (god I hate those!)

I do admire the hack because it's something that has always been theorized and discussed but until someone actually did it it was never really thought to exist. Foofus' talk was all about how security issues, until they're actually experienced by people, are always overlooked. Dan's OzymanDNS is also a fine example as is Dug's dsniff and the resultant arp mitm programs (c&a, ettercap) and lets not forget Kismet, l0phtcrack, aleph1's phrack article.....

My point is this --> . <---

No, my real point is that this is what Defcon is about. The expanding of technology into areas that hadn't really been thought about by the typical person. Does it seem childish? Yes, it does. ESPECIALLY when used to goatse innocent browsers. But that doesn't make the technology any less of an issue that, to be perfectly honest, wasn't something that was thought about by mainstream infosec people.

Ok, enough ranting for now. If anything this gives yet another reason to be wary of any public wireless communication system. Time to get rid of those 802.11b cards (crap they're all built-in our laptops now!!!) and step up to 802.11g and WPA.

[Thorn]

Well, it wasn't submitted as a talk basically because we pulled it together just last week, so there wasn't time. We weren't sure just how effective it would be, with different IP stacks, timing, signal power, etc. We really didn't expect it to be quite as sucessful as it was.

So because it was just done you attacked people rather than follow the proper way to present this?

We did it in bursts of about 5-10 minutes every few hours, so the overall disruption was minimal, once we discovered we were really DoS'ing people.

So now you admit it was a DOS, at least in part.

Really, though, do you expect these kinds of things NOT to happen on DefConNet? Like I mentioned, anyone who really needed access knew how to ensure it - SSH, SSL, IPSEC, these are the tools of the trade. Check out the comments on my cross-post - they're amazed anyone expected anything less.

Just because things like this happen at DefCon doesn't mean you have to contribute to the problem. Sure they need SSH, etc. Why? Because of moronic BS like this. You added to it further to it. Congratulations. That's hardly a justification to do more of the same.

And, Shipley references aside, permenantly damaging someone's elses gear is never cool, under any circumstances. Sticks and stones and all that, but when you're talking about damaging person or property, it's wrong, period, not to mention illegal. Anyone suggesting otherwise is more adolescent than you claim this prank to be.

If you incite someone, you have to expect consequences. I never said, I'd do it, but neither would I stop it. As I said "deserved."

You guys need to learn how to take a joke.

The point is, this kind of crap is not a joke.

There are no innocents at DefCon.

Rather presumptive, aren't you? There were quite a few people there who I know would consider pulling a stunt like this as highly unethical.

[AutoNiN]

...To extrapolate your argument out, it'd be perfectly fine for your local cable company to replace the ads on Fox for their programmes with ones for those on NBC because they don't like Fox.

I understand your point, and agree. Doesn't mean they don't do it. I've actually seen it done quite a bit - though not wholesale. Local programming overrides network commercials all the time. I'm sure there is an SLA stating how many they can do so, but I wouldn't doubt there is some market specific targeting there that trumps a contrary national ad.

And take the The Dish Network vs. Viacom fiasco we had a few months back. Viacom starts putting a scrolling banner at the bottom of the screen saying things about Dish that Dish didn't like, so they turned around and black barred it.

See, the problem with that logic is that it inconveniences the people who aren't part of the perceived problem. If you have a problem with (to use your example) Starbuck's, sending what amounts to little more than defaced content to their customers' browsers does shit-all to "stick it to the man": it just mildly annoys someone who paid for their service, assuming they even care or notice.

Yes, I know - I never meant to have those two examples linked - they were meant to be separate. The 'stick it to the man' reference was basically pick your own target to go after, whatever. It's a tool.

Let me give you a wider example of how well that brand of 'political effort' went down here recently when a small group of truckers blocked the 5 freeway during rush hour: they were arrested, and the rest of us who had our commutes made hell considered them lucky that the cops got to them first. Running around making a fool out of yourself doesn't draw worthwhile attention to or sympathy for your cause.

And I agree with you here as well. I never did understand that method of 'political effort'.

I appreciate gzzah's comment - This really has gone off course from what I was trying to accomplish. I'm not saying I regret any interesting comments I've sent or recieved - this has been an interesting topic. But it's really off point from the original intent of the project.

So now you admit it was a DOS, at least in part.

Yes, we knew of the DoS potential, and I've never denied it. Yes, it was a prank, and the goatse touch was over the top. I'm sure TubGirl wasn't any better. This wasn't meant to be an ethical demonstration - it wasn't meant to be an unethical demonstration - we tried to straddle the line between malicousness and benign-ness (?). We could have DoS'd the whole network all the time, or installed malware. We could have inserted Jesus or Buddah pop-ups. We could have scanned for only pornography image requests and responded with a 'Find a Girlfriend that doesn't end in JPG' instead. In the end, we did what we did.

If there was ever a place, anywhere in a public forum, to test this technology, it was DefCon. Given some time, we may have come up with some better pictures. But the overall results would have been the same/similar.

Thorn, I appreciate that you are a Wi-Fi professional. I think that's a good thing. I'm actually looking forward to your book, now that I've had an opportunity to chat with you. And really - you're right - this was a childish prank. But try to look past the prank and appreciate the application of this antiquated theory.

You must admit the tool we've developed has interesting rammifications. It could be used in the methods I've already (somewhat poorly, it seems) mentioned. It could also be loaded with malicious activity detection signatures (malware download, backdoor activity, etc) and be used to close connections - call it an out-of-band wi-fi intrusion prevention system. I know, I know... resetting the connection only works for TCP, and only works some of the time. But... it _does_ work.

So fault us for poor presentation - but don't discount the tool.

I still think it was pretty funny though. One of those 'had-to-be-there' things I guess.

[Thorn]

...Yes, we knew of the DoS potential, and I've never denied it. Yes, it was a prank, and the goatse touch was over the top. I'm sure TubGirl wasn't any better. This wasn't meant to be an ethical demonstration - it wasn't meant to be an unethical demonstration - we tried to straddle the line between malicousness and benign-ness (?). We could have DoS'd the whole network all the time, or installed malware. We could have inserted Jesus or Buddah pop-ups. We could have scanned for only pornography image requests and responded with a 'Find a Girlfriend that doesn't end in JPG' instead. In the end, we did what we did.

If there was ever a place, anywhere in a public forum, to test this technology, it was DefCon. Given some time, we may have come up with some better pictures. But the overall results would have been the same/similar.

Thorn, I appreciate that you are a Wi-Fi professional. I think that's a good thing. I'm actually looking forward to your book, now that I've had an opportunity to chat with you. And really - you're right - this was a childish prank. But try to look past the prank and appreciate the application of this antiquated theory.

You must admit the tool we've developed has interesting rammifications. It could be used in the methods I've already (somewhat poorly, it seems) mentioned. It could also be loaded with malicious activity detection signatures (malware download, backdoor activity, etc) and be used to close connections - call it an out-of-band wi-fi intrusion prevention system. I know, I know... resetting the connection only works for TCP, and only works some of the time. But... it _does_ work.

So fault us for poor presentation - but don't discount the tool.

I still think it was pretty funny though. One of those 'had-to-be-there' things I guess.

AutoNIN,

Let me be clear. My issue is not the tool, its the execution.

Actually demonstration of vunerablities is a very good thing. Anyone can sputter about how it is possible in theory to do "Exploit X" without ever coding a line, and therefore never proving a damned thing. You and any others at evilscheme.org who wrote this should be complimented for taking the time and effort to actually code the program, get it working and move from theory to proven fact.

As a practical joke, this type of thing is funny to spring on friends, but in my mind its hard to justify when you do it to a unsuspecting stranger. Especially when the clueless schmuck is just trying to get to his webmail and not bothering you. Then the vunerablity and the tool (not to mentiion the time to get it working) gets reduced to the level of an eight-year old making prank calls. While it's true that no one in his right mind should be using that network without some security, obviously some people are either ignorant of such things, stupid or both. That doesn't mean that anyone should be taken advantage of them. That's like shooting fish in a barrel.

Personally, I'd prefer to see a seperate wireless network setup just for demonstration of attacks/exploits/what-have-you. In fact, I'll go so far as to sponsor such a network next year if there is any interest and it can be worked out with the powers that be. That way people could mess with it to their heart's content. Would it stop the probelms with them main wireless network? Absolutely not. However, it might reduce the annoyance factor by a couple of points, and maybe save someone from getting thrown in the pool.

By the way, I hope you enjoy the book.

[ck3k]

I'm innocent and I was at DC-- at least I do not recall breaking any laws while I was there...

well, i suppose i was 21 at the time.....;)

A few of my friend's got that airpwn thing, it was stupid, yet to see there faces it was somewhat funny.

[s1ax0r]

So, your brainstorm was that public, unsecured wireless LANs are vulnerable to man-in-the-middle attacks? Impressive.

If someone's going to play vandal on the Defcon WLAN, you'd hope it would at least be with an idea that's not several years old.

better pr0n would be nice too. The "ANUS of Truth" and the Chinese shit sprayer are just getting old....

S1ax0r

[AutoNiN]

Actually, she's Japanese. They're really big into that whole 'Scat' thing.

[gzzah]

Actually, she's Japanese. They're really big into that whole 'Scat' thing.

Don't forget about the Germans.

[s1ax0r]

Actually, she's Japanese. They're really big into that whole 'Scat' thing.

Japanese huh? my bad...

She's definately a pro at it though....

[AutoNiN]

Considering that from all appearances, it was a one-shot-one-skill sort of deal - I'd say she's quite talented... in the most unusual (and patentedly useless) ways.

[alklloyd]

Don't forget about the Germans.

"What the hell is wrong with German People?"
Al