This is the wireless access point for my little office here.
Total seminars and not that big of an office so we only need one AP and this guy is passing out an SS
ID of private say.
And it works great.
We've got WPA to encryption on their big long shared keys so it's very very hard to crack them.
But what would happen if somebody came into the office you know that Bob over in sales and he doesn't
like how good of a signal he's getting over there he doesn't want to bother the I.T. Department is not
evil Bob's just a little dumb.
So Bob comes in and he gets one of these little home routers from his local computer store and he takes
this and he plugs it in to my wired network.
Now think about that for a minute.
Now again Bob is not evil he's just dumb.
But what you've just done is you've given people access to the network via an an authorized access point.
So we call this a rogue AP So a rogue AP is nothing more than an authorized access point so they happen
innocently enough and it does happen.
Now if this happened we would know fairly quickly.
Number one Bob would be shooting out an SS ID of links this or whatever the default as his ID is there.
This thing's probably got a built in DHC server be messing up the network.
Passing out some crazy like when they need to 168 out one IP address range.
And we would yell at Bob shake his finger and make him buy lunch the next day.
But what if we took it another step.
What if we took this access point and instead of just innocently plugging it in.
What if we intentionally gave it the SS ID of private.
Well you now have what's known as an evil twin.
Now rogue access points and evil twins don't have to be devices like this.
As long as you have some type of Internet service so people don't know that they're on the wrong thing.
You can get away with that.
I can take this phone right here make it a hotspot and give it an SS ID of private people could get
on the internet with this thing.
They couldn't get to my actual network because of that plugged in on my network and whoever has this
phone is going to get a really big bill.
But this could easily be an evil twin.
We can also be a rogue access point if you don't do it on purpose.
So what I want to talk about is some of the fun that we can have with evil twins in particular.
Now what I've got here is so I've got my access point and I've got my laptop right here that's running
Cali Linux and built in Akali Linux are a lot of tools that I'm going to assume you have the right network
card.
I can make this thing look at Barksdale taste like an access point.
Everything I need.
The problem that I have here is that everybody's still connecting to this physical access point.
So a really easy way to take care of that is to get one of these.
This is what we call NATO 2:11 jammer.
OK it's not NATO 11 jammer it's really just a piece of styrofoam with a stick stuck in it.
And the reason it is is because 10:42 jammers are completely illegal in the United States so I don't
have one but here's a picture of a few.
So your idea of what they look like
now if I have one of these jammers I can do some very interesting things.
These jammers for example can be programmed a million different ways I can set this jammer up to jam
the entire 2.4 gigahertz spectrum and if everybody was running just on 2.4 gigahertz.
You've got the best denial of service you've ever seen in your life.
I could knock everybody off completely but we can do stuff that's a little bit more sophisticated.
One of the things that we can do is I can take this jammer and I can program it to be on channel 6 so
I can do a quick survey using either my phone or a regular laptop and I can see that private is currently
on channel 6.
So as long as I'm close enough to jam the signal I can drop this jammer down and jam up Channel 6.
In the meantime my little laptop over here who's an evil twin of private is now on channel say channel
one and any wireless device is designed that if a particular channel messes up it jumps and looks for
the SS ID on a different channel.
Now if I don't have the username and passcode.
No big deal.
I'm going to have to do is as soon as they link into this I can have a redirect page pop up it says
welcome to private please enter the passcode and count on at least 15 percent of all people to not realize
that that's not the right way to do it.
Bingo.
I've got myself the code.
The cool part about this is that again I'll provide Internet access here just as well so I could put
a cellular win card in here whatever I might want to do.
And for a lot of people they're not going to realize that they're not on the correct wireless network
anymore.
And I have now generated what's known as an absolute perfect man in the middle attack.
Absolutely.
Go into Google do whatever you want to do.
In the meantime I'm running wireshark or something like that and monitoring everything that's taking
place in terms of traffic between you and whoever else you might want to talk to the downside to this
type of attack is that it needs one of these and wireless jammers really are difficult to get here in
the United States.
They are federally illegal but you don't really need it.
We can get rid of this completely and instead do something called a D authentication attack.
Let me show you how that works.
So here's my little network here's my wireless access point that's broadcasting out on say Channel 6
and the SS ideas stuff now right here is just one of my many clients and he's made a good connection
to this guy.
And what I can do is using the right tools so let me go and bring in my evil Kalli laptop that's running
with the cool wireless NIC.
I can actually run programs that will show me all of the clients that are authenticated to this particular
wireless access point.
And I can then use that information to send out what are known as the authentication or more quickly
known as dieoff commands.
These commands basically tell those clients that they need to get off of this wireless network.
They'll get off the network.
And then what we want them to do is then to connect to us and then once again our man in the middle
attack is running perfectly rogue access points are a real problem whether it's an unintentional innocent
rogue access point or somebody doing something very dangerous by creating an evil twin.
They can be a real problem on our wireless networks.