WIRELESS VILLAGE - PiClicker v2.0
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
stev0
Present, and (hopefully) Demo using a raspberry pi to detect wifi signal strength via audio click frequency.
 here buddy thanks for uh thanks for coming to my talk and showing some interest um i'll be slow showing this slide again uh uh during the questions portion so you can write that down or follow whatever uh so um my name is steven my friends call me stevo this is my 11th def con and my first time uh as a speaker so um yeah this is kind of cool uh this is uh my third year participating in the wireless capture the flag my team has won three years in a row uh and two of the years uh we won a black badge um my day job is uh i'm a system engineer or uh ops guy there's a lot of people like to call it and uh at night i like to play with security stuff so um now rick gave a a breakdown of what fox hunting was i'm not sure uh how many of you guys were there uh when you saw him uh go over that but uh basically they release people out there um with wi-fi foxes in their pocket that um have a bs s id and uh associated with it and we're supposed to uh go out there and try to track it down follow uh uh where it is and ask ask the person if they're the fox uh one of the new challenges which kind of cool i wrote this into my uh program is uh cracked the the wpa uh so um anyhow the the foxes actively avoid you so if you have like a wi-fi cactus on your back and uh you look like you're looking for somebody you're not going to catch the fox because they're going to avoid you um and sometimes they can go into non-public areas go hide and stuff so you have to like wait it out or what have you um so you have to you have to kind of be stealth about it and that's kind of what this tool what is based on is the ability to just have like your uh pie hiding in your backpack or you know wherever you want to put it and uh search for the fox from audio cues um so i just kind of went over this uh why i built this um and inspiration was kind of like a wi-fi gaiger counter wouldn't it be cool if you could like walk around and you know the frequency of the uh clicks would increase as you got closer to the uh the fox uh so uh last year my my team uh captured the fox with version one of this software and it's on github you can download it now and you can like throw it on your pie if you can get it to work um uh that that version uh has click only so it's just sound the configuration wasn't dynamic so it didn't have a web UI or anything like that and there wasn't any external interaction like um uh pulling from a uh api or something like that so uh version two is what i'm hopefully going to demo today uh if things go well and uh i'll go ahead and release that version uh to my github uh uh repo uh after defcon uh this has a web UI it's team aware so i have a slack integration so you can you can put a a slack command in say like add fox with the bss id and it'll talk to the database and my device will go and grab that dynamically um it also has a auto cracking feature with wi-fi two uh really cool tool it like it's point and shoot uh it's it's really simple uh if you haven't used it i'd recommend giving it a shot it's pretty neat um i have other ideas uh and actually uh zero was just talking to me about maybe doing a little collaboration with this so um yeah might might be cool i had a lot of fun making this too by the way so uh a minimal setup uh which is kind of what you see on the table here is going to cost you about 90 dollars uh so this particular version is running uh callie uh on the raspberry pi uh so it's a callie image um i'm using an alpha adapter that uh can go into monitor mode and do package inject injection uh it has a usb sound card because i couldn't get the onboard version to work um and uh it's a little particular about the usb sound card so some of them crash so you have to find the right one uh i'll probably work on that later i didn't have time this this go around uh obviously you have a battery pack and uh headphones so this is uh you can come up and look at it or this is what it looks like uh picture wise and i'll i'll uh post a link to the slides after so you can download them so from a program pro perspective um so me as a user i have my my phone with me and i'm connecting to a shared ap between me and the pi and um i interface with a web ui where i can issue commands i can select what bss id i want to scan for and there's also a flag to uh auto crack uh so it's not turned on by default um in the background it's got a um the scan the the cracking adapter basically uh that does the scanning the signal scanning and does the cracking the the program uh is controlled and it has a shared state among all the threads uh this is the first time i've actually written a multi-threaded application too which was which was interesting um so it's got a uh the ui module which you'll see where you you control it uh sound module which is what controls what is played sound wise um signal scanner which is telling it's constantly pulling when this is turned on uh telling you what the the um signal strength is and it depending on what the situation is it it'll play different sounds and um there's a module that pulls the the uh api to see if there's new foxes and it'll play sounds uh depending on if it's if it successfully successfully pulled it uh or um it had an error and i don't know you might you might hear both sounds you might just hear one uh and yeah so i kind of went over the the slag part so the team could be sitting at the the workstation and um they could type a command into slack that'll add the the mac address of the bss id um that'll in turn go to a flash gap in aws um and um the py clicker will download the latest data um yeah so it's just kind of an interactive component but i do some of this for work so the slack stuff and the uh api was was kind of fun to do uh so yeah i think i kind of went over some of the design principles now i'm gonna try to do a live demo uh i have screenshots just in case it doesn't work uh i i've practiced this a couple times so like we'll see uh we'll see how this turns out um all right stand by so initializing um um all right so sorry about that didn't realize i didn't have the microphone um so i am going to i clicked on the wrong one i have two active apis by the way so all right so that's the sound where it's not picking up signal and this should pick up in just a second any time all right so who wants to who wants to go like run away all right here you go yeah you need to come back yeah i'd like my api back thanks um yeah so you don't need to go very far like you know i'm gonna go down that way a little bit and he's holding it up to his badge now it doesn't do anything with the badge go go that way a little bit i want i want it to disconnect and play the sonar sound can you guys hear this okay all right cool hey what's going on the the program here is like this is the debug stuff it's not going to be nearly as verbose uh you know when when it's actually enabled all right so we lost signal all right you can come back now oh did you did you uh did you hide under okay okay if you put it in tinfoil it'll stop responding to what's that i think there's a lot going on in this room too so it kind of makes sense or did it switch off maybe i don't think it's possible someone's messing with it too like that's that is a very yeah anyway so it uh um especially when there's not a whole lot of interference it actually works pretty well so in order for it to start cracking it needs a number of successful polls how many is it's at right there okay 18 so that should be enough and we're going to let me see here you guys haven't seen the web UI yet have you sorry about that i forgot that i had it up here uh all right so does it say enabled we're cracking enabled so sorry it's a little awkward yeah it's doing its thing and i may have lost connection to the pile let me make sure yeah okay all right so that's why if i do an it's thing now i need to connect to it so it can properly deal with it all right did did it cap it yet i can't tell all right all right so now it's doing this cracking and it's a pie because this isn't very fast i thought about offloading that to the aws instance as well but uh didn't have time okay any day now all right figure bsc that's one hundred ninety two point one six that's that's the tone to like okay you can go on to the next one you can go grab the fox and say this is the passphrase so don't need any of those slides now all right this was just in case the demo got wonky all right so does anybody have any questions what's the play it was like super secret secure passphrase or something like that what's that yeah yeah anybody have any other questions or that word list i was like 200k or something like that the word list this this year is like six but three hundred thirty five k i think or actually i'm sorry lines so words yeah yes features i want to add bluetooth scanning i also during the during the signal scanning portion it's actually going through all the different bsside's and names i also want to generate a list of bsside's that are dynamic in that web interface that i showed you so that i don't know you can select one of those without having to actually do any configuration like i said i didn't have time to do that but yes no pictures i guess have i have i considered yes actually i have one so like my thought is like when you're doing the fox hunting is you can use omni to like get a general vicinity and then like when you have a lock on the fox and you can use the directional one yeah so that's that's the plan anyway yes sir i have thought about that i have thought about that but math is hard and i didn't have enough time so uh but yeah that that that's a awesome suggestion i have thought about it but yeah i didn't uh yeah maybe version three uh and like i said like the source code is going to be online so like if you guys want to contribute feel free uh it's it's totally welcome if you can bear my crappy code so all right guys well thank you very much and uh thanks
 here buddy thanks for uh thanks for coming to my talk and showing some interest um  i'll be slow showing this slide again uh uh during the questions portion so you can  write that down or follow whatever uh so um my name is steven my friends call me stevo this  is my 11th def con and my first time uh as a speaker so um yeah this is kind of cool uh  this is uh my third year participating in the wireless capture the flag my team has won three  years in a row uh and two of the years uh we won a black badge um my day job is uh i'm a system  engineer or uh ops guy there's a lot of people like to call it and uh at night i like to play with  security stuff so um now rick gave a a breakdown of what fox hunting was i'm not sure uh how many of  you guys were there uh when you saw him uh go over that but uh basically they release people out  there um with wi-fi foxes in their pocket that um have a bs s id and uh associated with it and  we're supposed to uh go out there and try to track it down follow uh uh where it is and ask  ask the person if they're the fox uh one of the new challenges which kind of cool i wrote this into  my uh program is uh cracked the the wpa uh so um anyhow the the foxes actively avoid you so if you  have like a wi-fi cactus on your back and uh you look like you're looking for somebody you're not  going to catch the fox because they're going to avoid you um and sometimes they can go into  non-public areas go hide and stuff so you have to like wait it out or what have you um so you  have to you have to kind of be stealth about it and that's kind of what this tool what is based on  is the ability to just have like your uh pie hiding in your backpack or you know wherever you want  to put it and uh search for the fox from audio cues um so i just kind of went over this uh why  i built this um and inspiration was kind of like a wi-fi gaiger counter wouldn't it be cool if you  could like walk around and you know the frequency of the uh clicks would increase as you got closer  to the uh the fox uh so uh last year my my team uh captured the fox with version one of this  software and it's on github you can download it now and you can like throw it on your pie if you  can get it to work um uh that that version uh has click only so it's just sound the configuration  wasn't dynamic so it didn't have a web UI or anything like that and there wasn't any external  interaction like um uh pulling from a uh api or something like that so uh version two is what  i'm hopefully going to demo today uh if things go well and uh i'll go ahead and release that  version uh to my github uh uh repo uh after defcon uh this has a web UI it's team aware so i have a  slack integration so you can you can put a a slack command in say like add fox with the bss id  and it'll talk to the database and my device will go and grab that dynamically um it also has a  auto cracking feature with wi-fi two uh really cool tool it like it's point and shoot uh it's  it's really simple uh if you haven't used it i'd recommend giving it a shot it's pretty neat um  i have other ideas uh and actually uh zero was just talking to me about maybe doing a little  collaboration with this so um yeah might might be cool i had a lot of fun making this too by the way  so uh a minimal setup uh which is kind of what you see on the table here is going to cost you  about 90 dollars uh so this particular version is running uh callie uh on the raspberry pi uh so  it's a callie image um i'm using an alpha adapter that uh can go into monitor mode and do package  inject injection uh it has a usb sound card because i couldn't get the onboard version to work  um and uh it's a little particular about the usb sound card so some of them crash so you have to  find the right one uh i'll probably work on that later i didn't have time this this go around uh  obviously you have a battery pack and uh headphones so this is uh you can come up and look at it  or this is what it looks like uh picture wise and i'll i'll uh post a link to the slides after so  you can download them so from a program pro perspective um so me as a user i have my my phone  with me and i'm connecting to a shared ap between me and the pi and um i interface with a web ui  where i can issue commands i can select what bss id i want to scan for and there's also a flag to  uh auto crack uh so it's not turned on by default um in the background it's got a um the scan the  the cracking adapter basically uh that does the scanning the signal scanning and does the cracking  the the program uh is controlled and it has a shared state among all the threads uh this is the  first time i've actually written a multi-threaded application too which was which was interesting  um so it's got a uh the ui module which you'll see where you you control it uh sound module which  is what controls what is played sound wise um signal scanner which is telling it's constantly  pulling when this is turned on uh telling you what the the um signal strength is and it depending  on what the situation is it it'll play different sounds and um there's a module that pulls the  the uh api to see if there's new foxes and it'll play sounds uh depending on if it's if it  successfully successfully pulled it uh or um it had an error and i don't know you might you might  hear both sounds you might just hear one uh and yeah so i kind of went over the the slag  part so the team could be sitting at the the workstation and um they could type a command into  slack that'll add the the mac address of the bss id um that'll in turn go to a flash gap in aws um  and um the py clicker will download the latest data um yeah so it's just kind of an interactive  component but i do some of this for work so the slack stuff and the uh api was was kind of fun to  do uh so yeah i think i kind of went over some of the design principles now i'm gonna try to do a  live demo uh i have screenshots just in case it doesn't work uh i i've practiced this a couple  times so like we'll see uh we'll see how this turns out um all right stand by  so  initializing  um  um  all right so sorry about that didn't realize i didn't have the microphone um so i am going to  i clicked on the wrong one i have two active apis by the way so  all right so that's the sound where it's not picking up signal  and this should pick up in just a second  any time  all right so who wants to who wants to go like run away all right here you go  yeah you need to come back yeah i'd like my api back thanks  um yeah so you don't need to go very far like you know i'm gonna go down that way a little bit  and he's holding it up to his badge now it doesn't do anything with the badge  go go that way a little bit i want i want it to disconnect and play the sonar sound  can you guys hear this okay all right cool  hey what's going on the the program here is like this is the debug stuff it's not going to be nearly  as verbose uh you know when when it's actually enabled all right so we lost signal  all right you can come back now oh did you did you uh did you hide under okay  okay if you put it in tinfoil it'll stop responding to what's that  i think there's a lot going on in this room too so it kind of makes sense  or did it switch off  maybe i don't think it's possible someone's messing with it too like that's that is a very  yeah anyway so it uh um especially when there's not a whole lot of interference it  actually works pretty well so in order for it to start cracking it needs a number of successful  polls how many is it's at right there okay 18 so that should be enough and we're going to  let me see here you guys haven't seen the web UI yet have you  sorry about that i forgot that i had it up here  uh  all right so  does it say enabled we're cracking enabled  so  sorry it's a little awkward  yeah  it's doing its thing and i may have lost connection to the pile let me make sure  yeah  okay  all right so that's why if i do an it's thing now i need to connect to it so it can properly  deal with  it  all right did did it cap it yet i can't tell all right  all right so now it's doing this cracking  and it's a pie because this isn't very fast i thought about offloading that to the aws instance  as well but uh didn't have time  okay any day now  all right  figure bsc that's one hundred ninety two point one six that's that's the tone to like okay you can  go on to the next one you can go grab the fox and say this is the passphrase so  don't need any of those slides now  all right this was just in case the demo got wonky all right so does anybody have any questions  what's the play it was like super secret secure passphrase or something like that  what's that yeah yeah anybody have any other questions or  that word list i was like 200k or something like that the word list this this year is like six  but three hundred thirty five k i think or actually i'm sorry lines so words yeah yes features i want  to add bluetooth scanning i also during the during the signal scanning portion it's actually  going through all the different bsside's and names i also want to generate a list of bsside's  that are dynamic in that web interface that i showed you so that i don't know you can select  one of those without having to actually do any configuration like i said i didn't have time  to do that but yes no pictures i guess have i have i considered yes actually i have one so  like my thought is like when you're doing the fox hunting is you can use omni to like get a  general vicinity and then like when you have a lock on the fox and you can use the directional one  yeah so that's that's the plan anyway  yes sir  i have thought about that i have thought about that but math is hard and i didn't have enough time  so uh but yeah that that that's a awesome suggestion i have thought about it but yeah i  didn't uh yeah maybe version three uh and like i said like the source code is going to be online  so like if you guys want to contribute feel free uh it's it's totally welcome if you can bear my  crappy code so all right guys well thank you very much and uh thanks
DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_0_8063.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_8064_8447.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_8448_10823.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_10824_11387.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_11388_12407.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_12408_12983.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_12984_13439.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_13440_13943.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_13944_14015.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_14016_14147.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_14148_14879.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_14880_15803.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_15804_16031.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_16032_16103.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_16104_16559.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_16560_16751.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_16752_17015.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_17016_17075.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_17076_17231.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_17232_18311.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_18312_18815.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_18816_19031.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_19032_19991.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_19992_20867.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_20868_20963.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_20964_23423.png DEF_CON_26_WIRELESS_VILLAGE_-_stev0_-_BSSI_finding_foxes_with_acoustic_help_piClicker_BRf3WGekgHc_23424_25196.png