RE: How to track down a wireless hacker

[cwright () bdosyd com au]

 “Of course you can track a wireless attacker due the fact that he is broadcasting a trackable signal”.

First, it is not necessary to broadcast to monitor wireless traffic. The attacker can remain passive. Passive 
monitoring does make a discernable variation in the RSSI, but I do not see the resources being deployed for this reason 
(and we are talking well into the 6 figures for this).

So let’s address this in detail.
To do so, let’s look at the threats first, we have:
-       Friendly – unprotected wireless networks deployed in ignorance.
-       Malicious – This is either a malicious rouge attacker or a planted rouge network or AP.
-       Unintended – Equipment deployed without authorisation and likely incorrectly configured (this group commonly 
includes Infrastructure rogues).

The friendly and unintended threats are easy to find. They will either be an AP or wireless card in the local 
proximity. These are easy to trace. As such we can ignore these for the purpose of this post.

There are a variety of means to discover rogues on the wireless network. These include:
1       Wired-side AP fingerprinting
2       Wired side MAC prefix analysis
3       Wireless-side warwalking
4       Wireless-side client monitoring
5       Wireless-side WLAN IDS

If your intention is to test your own mal-functioning or mis-configured equipment on your network, then there is no 
crime. If you know it is not your device and you attack it in full knowledge, then a crime is the result. For example, 
you can run a Nessus AP Fingerprint Scan on your own (or what you believe is your own) equipment with impunity 
(assuming permissions and rights).

In the case of an attacker external to the network, we can ignore options 1 and 2. If the attack was a rogue device (an 
AP for instance) on the wired-side network, scanning is legally ok. The scanning of your own equipment is an acceptable 
legal option. This still does not allow the right to actively attack the device on discovering it is a rogue. This is a 
matter of intention. 

As for Wireless-side analysis… This is easy to do, but it is time consuming, error prone (there is a low risk of 
false-negatives and a good chance of false positives) and is likely to bypass or incorrectly correlate moving targets. 
Kismet will allow you to save filters based on the BSSID’s and MAC addresses discovered. Kismet would then be 
configured to ignore all authorised networks. This allows the creation of a baseline. The baseline allows for the 
alerting of exceptions – that is unauthorised AP’s.
AiroPeek NX is a commercial option for those companies that do not like to use open source software. Either method is 
time consuming and requires an audit for a “point in time” event. Warwalking can not be set to wait and report on 
exceptions.

AirWave RAPIDS is a commercial option to conduct both wired-side and wireless-side monitoring and assessment. It 
monitors and reports on wireless activity and flags (and alerts) new networks as potential rogue AP’s. This is an 
expensive option with a license required for all clients. There are also issues. Either poor monitoring facilities will 
result or wireless networking will be impacted for the hosts.

There are Wireless-side LAN IDS deployments. Aruba is an example. Again these are costly and require that a sensors is 
deployed at all facilities using wireless (and if you really want to be safe those that do not as well).
None of this helps us find the rogue – we only find out that one may exist.

So how can we discover the rogue you ask finally?
First there is a manual analysis process using the signal-to-noise ratios (SNR). SNR is maximised when the devices are 
associated. In this, the idea is to map the SNR and locate the antenna (note the antenna and not the rogue itself).  
These techniques rely heavily on guess-work. Kismet and a GPS will help.

Directional analysis makes this a little easier. This requires a directional antenna and RSSI (Radio Signal Strength 
Information which is the signal and noise levels associated with a wireless device). Channel hoping should be disabled 
when doing this and it is essentially a matter of trial and error.

Rapfinder (open source) is a tool that aids in this process. AirMagnet is a commercial tool (handheld) that is designed 
to locate the source of the radio signal (as you get closer the clicks increase in frequency like a Geiger counter). 
Next we get to triangulation. Even this is not 100% accurate due to RF interference, signal loss and radio signal 
distribution patterns (which vary based on the physical position). Aruba AirMonitor with 3 sensors will find local AP’s 
with a fair degree of accuracy. 

However, this takes us to the point. An attacker is not always going to be placed locally. The range with a good yaggi 
high gain antenna is a radius of over 10km. That is over 300 square km. So have fun searching, it is about 30,000 
households, businesses etc ... 

It is not a flippantly easy task to track a wireless attacker. People get lucky, this is about how it works.

Regards,
Craig Wright (GSE-Compliance)


________________________________________


From: Jan Heisterkamp [mailto:]
Sent: Mon 12/11/2007 1:55 AM
To: ep
Cc: Craig Wright; pen-test () securityfocus com
Subject: Re: How to track down a wireless hacker
I lost who started this thread.
Of course you can track a wireless attacker due the fact that he is
broadcasting a trackable signal and you can do it pretty accurate. But
he question behind is "And then?"

What will you do?
1.
If the attacker is in house you might have to close all the doors, call
the security stuff and confiscate all the laptops running wireless. The
attacker goes arested and the rest of the user will take their case to
the court, sueing you for damages.
2.
If the attacker is, let us say in a car in the street and you have
tracked and localized him what are you able to do?
You can't touch him, neither arrest him, you have no legal right to do
so; probably you will se the attackers golden finger he hits the road.

The energy you are wilt to afford to track this freak down you had
better spent before in securing your Network.
It's a fact, that you messed it up and not he.
I guess there is waiting some homework for you...

Regards
Jan

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------