No Common SSIDS

I wrote nocommonsssids to quickly remove the top ssids (from wigle.net) from the preferred network list in OSX so that it does not auto connect to them. 

Running this will help stop you from being caught by an EvilAP attack along the line of the Mana Common demo I put together earlier this month.  You should also run a VPN anytime you connect to a public wireless network. 

Using Mana To Spoof Common SSIDs.

I had the opportunity to speak at a “micro- conference” yesterday for the Midwest Cyber Security Alliance with the state auditor Nicole Galloway. 

I wanted to use this opportunity to make a bold statement since I knew there would be influential people in the audience who wanted to listen Nicole talk about her new cyber security auditing initiative. 

I wrote Mana-Common that builds on Dominic White’s amazing Mana project.

My project used in conjunction with a Ralink 5370 Chipset USB Wireless Card broadcasts 7 of the most popular SSID’s according to wigle.net.  Protip: It is easily modified to target smaller audiences who may have saved corporate SSIDs on their devices. 

Here is a demo of the terminal output:

Mana Demo  

Here is a screenshot of my iPhone picking up the networks:

image

If you have any questions please reach out to me on twitter @jgamblin.

HackAPie: A Wireless Hacking Sandbox

I am getting ready to teach a “Building Your Own Security Lab” series of classes and I really needed a safe place for people to try their hand at wireless hacking.
I built HackAPie that uses a RaspberryPI (this canakit) and openwrt that broadcasts 5 unique wireless networks to crack using tools like wifite and kali.

There are still a few bugs to work out but people have asked me if I would share this and I think I have it in a place where I am comfortable doing that.  If you have any suggestions or questions please reach out to me at [email protected] or @jgamblin on twitter.

Building A Security Lab

My mentor and I are in the middle of spinning up an information sharing group with local security professionals and next Friday is our first “working session” and we are discussing what building a security lab* looks like and costs.

We really hope to start walking through the tools in future meetings but here is what my security lab build looks like and roughly costs.

image

(Not sure why my blog doesn’t like tables. Here is a link to the excel spreadsheet.)

I really hope to pick up some information on what other people have in their labs that I am missing. 

*I am not sure if the correct term here is lab, toolkit or security testing platform. You pick.