Subject: [NEXTEL-1] Wireless Access: Warchalking

From: Marcel <[email-masked]>
Date: Tue, 07 Jan 2003 14:28:47 -0500

Wireless Access: Warchalking
Why should you care about this genre of graffiti? The idea
could take on very sinister forms if your company is
warchalked and nonregistered users use your network to get
on the Internet.
http://www.cio.com/archive/010103/10.html

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/

---

From: "meijin" <[email-masked]>
Date: Tue, 7 Jan 2003 18:37:10 -0600

Marcel:

After having gained a couple of different WLAN certifications and currently working on obtaining a couple more (primarily WLAN security related) in preperation for the new WLAN product that we will be rolling out this year, I can tell you that warchalking is not that big of a deal.

If the WLAN admin takes some very simple precautions like:

- Do not broadcast your SSID to the world
- Utilize encryption with the higher level the better (i.e. 128 bit encryption over 64 bit encryption)
- Utilize any sort of WEP encryption enhancements that the equipment supports (i.e. LEAP if using Cisco, etc.)
- Utilize MAC address filtering if your network is not too large
- Utilize a good Radius authentication server
- Set up a VPN to access the network
- Install and configure a good intrusion detection system (IDS...check out Air Defense)

Lots can be done. WLANs are not nearly as insecure as people would make them out to be as long as the person setting them up does their due diligence.

Anyone here got a WLAN up and running? I have an Orinoco AP-200 attached to my cable modem with an Avaya/Orinoco Silver PC-Card and an Avaya USB on the PC in my bedroom. Works very well.

Michael

ps - I got a mag mount antenna with an 8db gain and did a bit of war driving with NetStumbler. You would not believe how may wide open APs I found in a town as small as Temple. Good thing I am not a hacker!

---

From: Marcel <[email-masked]>
Date: Tue, 07 Jan 2003 20:15:01 -0500

The new trick is to broadcast trash "Trashcast" on the unlicensed (ooops Sorry Alan D.-
Licensed for us Hammy's) 2.4 Gig band and captured distant units information since it is
in constant "retry" aka sniffer mode. Last month a contractor working for Nextel lost a
lot of sensitive information that ended up on a hacker site due to the "Trashcast".

The funny thing is the same people who are selling the encryption software to the public
are selling "Cracker" software to Law Enforcement. A demo copy has been floating around
for a while now. It is only good for 30 days but everyone just deletes it after 30 days
and the re-installs it.

Go figure-

meijin wrote:

> Marcel: After having gained a couple of different WLAN certifications and currently
> working on obtaining a couple more (primarily WLAN security related) in preperation for
> the new WLAN product that we will be rolling out this year, I can tell you that
> warchalking is not that big of a deal. If the WLAN admin takes some very simple
> precautions like: - Do not broadcast your SSID to the world- Utilize encryption with the
> higher level the better (i.e. 128 bit encryption over 64 bit encryption)- Utilize any
> sort of WEP encryption enhancements that the equipment supports (i.e. LEAP if using
> Cisco, etc.)- Utilize MAC address filtering if your network is not too large- Utilize a
> good Radius authentication server- Set up a VPN to access the network- Install and
> configure a good intrusion detection system (IDS...check out Air Defense) Lots can be
> done. WLANs are not nearly as insecure as people would make them out to be as long as
> the person setting them up does their due diligence. Anyone here got a WLAN up and
> running? I have an Orinoco AP-200 attached to my cable modem with an Avaya/Orinoco
> Silver PC-Card and an Avaya USB on the PC in my bedroom. Works very well. Michael ps - I
> got a mag mount antenna with an 8db gain and did a bit of war driving with NetStumbler.
> You would not believe how may wide open APs I found in a town as small as Temple. Good
> thing I am not a hacker!

---

From: Marcel <[email-masked]>
Date: Tue, 07 Jan 2003 20:19:58 -0500

BTW- Congrats on the certifications.

meijin wrote:

> warchalking is not that big of a deal.

---

From: "meijin" <[email-masked]>
Date: Tue, 7 Jan 2003 21:16:15 -0600

Marcel:

Was the Nextel person using encryption? I have Sniffer Pro and WildPacket's AiroPeek and both are great sniffers. They can capture all the 802.11b data and reassemble it all very nicely. However, with simple WEP running the data is worthless...unless you have a WEP cracking tool. But even then you need around 100 megs of data to grab enough of the IV (Initialization Vector) clear text and get the WEP key (another good reason to rotate the WEP keys).

Jeez...I probably know whoever it was...I helped with the initial setup of the WLAN...oh well.

Another interesting tool is FakeAP. It only runs under Linux right now, but is designed to create a ton of fake APs for the hackers to try and chase down and crack. Not the best defense, but every little bit helps.

Michael

---

From: "meijin" <[email-masked]>
Date: Tue, 7 Jan 2003 21:18:23 -0600

Thanks, but the first ones were not too difficult. The Certifed Wireless Security Expert and Cisco WLAN Field Engineer are supposed to be pretty tough. And I also have a Cisco CCDA coming up.

It was nice to find out that my partner and I were the first ones in the company to get the CWA certification though! <grin!>

Michael

---

From: Marcel <[email-masked]>
Date: Tue, 07 Jan 2003 23:11:46 -0500

I did not ask him all the nitty-gritty details. I was already helping him with one
problem and did not want to dig up more issues. Since he is probably reading this I'm sure
he will drop me an e-mail.

From his initial description he was professionally hacked. The data showed up  24hrs
latter on a website berating 802.11, touting bluetooth as more secure. I did get it since
bluetooth is short range and is just a vulnerable. The link is now dead. Hackers
why do they do what they do?

meijin wrote:

> Marcel: Was the Nextel person using encryption? I have Sniffer Pro and WildPacket's
> AiroPeek and both are great sniffers. They can capture all the 802.11b data and
> reassemble it all very nicely. However, with simple WEP running the data is
> worthless...unless you have a WEP cracking tool. But even then you need around 100 megs
> of data to grab enough of the IV (Initialization Vector) clear text and get the WEP key
> (another good reason to rotate the WEP keys). Jeez...I probably know whoever it was...I
> helped with the initial setup of the WLAN...oh well. Another interesting tool is FakeAP.
> It only runs under Linux right now, but is designed to create a ton of fake APs for the
> hackers to try and chase down and crack. Not the best defense, but every little bit
> helps. Michael

---

From: Marcel <[email-masked]>
Date: Tue, 07 Jan 2003 23:13:51 -0500

I did NOT get it since
bluetooth is short range and is just a vulnerable. The link is now dead.

Marcel wrote:

> latter on a website berating 802.11, touting bluetooth as more secure. I did NOT get it
> since

--
    "NEXTEL-1 IT'S NOT JUST NEXTEL"
  Note The New address
Subscribe to Nextel-1: http://www.groups.yahoo.com/subscribe/NEXTEL-1

  "NEXTEL2 FOR iDEN SOFTWARE DEVELOPERS"
Subscribe to Nextel2: http://www.groups.yahoo.com/subscribe/NEXTEL2

  "WIRELESS FORUM HOMELAND SECURITY GROUP"
     The Complete Resource for Wireless Homeland Security.
Subscribe to WFHSG:  http://www.groups.yahoo.com/subscribe/WFHSG

---

From: Rick Parrish <[email-masked]>
Date: Tue, 07 Jan 2003 21:51:23 -0600

meijin wrote:

> Marcel:
>  
> After having gained a couple of different WLAN certifications and 
> currently working on obtaining a couple more (primarily WLAN security 
> related) in preperation for the new WLAN product that we will be 
> rolling out this year, I can tell you that warchalking is not that big 
> of a deal.
>  

I thought the station id is broadcast in the clear - independent of the 
WEP setting.

*looks over should before typing*

At least when running ApSniff (works on LinkSys and other non-orinoco 
chipsets) I could see the Station ID even when WEP was on.

> Lots can be done. WLANs are not nearly as insecure as people would 
> make them out to be as long as the person setting them up does their 
> due diligence.

Absolutely!

>  <snip>
> Anyone here got a WLAN up and running? I have an Orinoco AP-200 
> attached to my cable modem with an Avaya/Orinoco Silver PC-Card and an 
> Avaya USB on the PC in my bedroom. Works very well.
>  
> Michael
>  
> ps - I got a mag mount antenna with an 8db gain and did a bit of war 
> driving with NetStumbler. You would not believe how may wide open APs 
> I found in a town as small as Temple. Good thing I am not a hacker!

I can see the headlines now ... "Feds hunt for elusive cyber criminal 
known only as ... the "Fort Hood Hacker".
(:^P

-rick

---

From: Marcel <[email-masked]>
Date: Tue, 07 Jan 2003 23:24:40 -0500

In the last 6 months at least a dozen "Hard-core" hacker groups have shown up kicking down
doors and taking no prisoners. Most of them seem to target large corps and they  get
pleasure spreading company business all over the web.

Hackers love 802.11 because it leaves no evidence behind unlike wired hacking.
Here is an article that im sure most have read but it brings up some good points so I will
post it again.
========================================================================

Researchers Lure Wi-Fi Hackers
By Ed Sutherland

The sorry state of Wi-Fi security has become one of the
most well known secrets of the 802.11 networking
standard. The ease of setting up a wireless networking
using 802.11-based technology is mirrored by the
effortless way hackers, snoopers and the just-curious
can detect, enter and use Wi-Fi networks used by corporations, coffee shops and your
corner
neighbor.

Within every metropolitan area, there are hundreds or thousands of unprotected access
points,
estimates government contractor Science Applications International Corporation (SAIC).

If an open access point is like honey to a bee, SAIC decided to devise a "honeypot," in an

effort to study how and why intruders attack wireless networks. Rob Lee, a former U.S. Air

Force security investigator turned chief of SAIC's information security operations, says
this is
likely the first time a honeypot has been created to study only wireless security.

How does a honeypot work? It essentially is a closed system with no valid users and no
purpose beyond presenting an attractive target for intruders. Hidden beneath a deceptively

open computer are layers of systems to detect, track and log the movements of intrusion
attempts. Data collected is then used to refine security protocols and head off future
attacks.

In the case of SAIC, its Wireless Information Security Experiment (WISE) consists of
several
open computers, five Cisco access points and two omni-directional high-gain antennas. Each

connection attempt is carefully logged as an 802.11b "sniffer" detects every intrusion
attempt.

Lee hopes the information gleaned from the experiment will provide a better profile of the

average wireless intruder, by determining whether Wi-Fi intrusions are used to spawn
further
attacks or simply to freeload an Internet connection.

"These numbers will initially be based on wireless networks installed with defaults and
very little
configuration," according to an overview of the WISE project. The WISE Web site said
results
will then be collected indicating the effectiveness of even simple security has on the
intrusion
rate.

As time goes on, Lee envisions using the detection system to learn about the tools Wi-Fi
hackers employ, as well as discerning any telltale signs that might be incorporated in
future
wireless security. Lee says the intent of the experiment was never to entrap hackers for
later
prosecution.

According to SAIC, WISE has two phases. The first phase consists of several computers
connected through access points that are then tied together with bridges to create a lab
large
enough to cover a metropolitan area. The second phase, according to SAIC, could include
satellite broadband access and linking the lab to another city.

Lee has said another component to the WISE honeypot may be Internet access through a Web
proxy allowing connection attempts to be intercepted while presenting a banner, so that
Internet
usage can be legally monitored.

The WISE honeypot was officially opened June 15th, but researchers at SAIC report little
activity: just one quick ping sweep of the computers and a few attempts at gaining
Internet
access.

My attempts to contact Lee resulted in SAIC spokesperson Zuraidah Hashim reporting no
further activity. A possible reassessment of the honeypot's future may be on the way.

---

From: Rick Parrish <[email-masked]>
Date: Tue, 07 Jan 2003 22:32:05 -0600

Marcel wrote:

>Rob Lee, a former U.S. Air Force security investigator turned chief of SAIC's information security operations, says
>this is likely the first time a honeypot has been created to study only wireless security.
>
This sounds a little hyped-up. Marcel - can we have the date and 
publication in which this article appeared?

>Internet access.
Location, location, location! Article does not indicate where (either 
specifically or as vague characterization) where the honeypot(s) are 
located.

-rick

---

From: "meijin" <[email-masked]>
Date: Tue, 7 Jan 2003 23:08:53 -0600

REPLY:
  Actually Rick, you can just turn off the broadcast of the SSID and it has nothing to do with having WEP enable. Broadcasting the SSID is the equivalent of shouting to the world that the network is there and ready to be accessed. If they know what they are doing, they can still find the SSID, but why make it easy? With Wi-Fi it is like taking alot of small steps to get to the finish line.

  I figure that as long as I don't hack some Japanese guy in Cali and steal his Nokia hacking software I am safe! <grin!>

  Michael

---

From: Marcel <[email-masked]>
Date: Wed, 08 Jan 2003 02:08:15 -0500

Rick Parrish wrote:

> This sounds a little hyped-up.

It is a little hyped-up but that is what "Joe-Da- Reader" wants to hear. Buzz words like investigator, Airforce,
security grab the readers attention. I turn on my hype filter and get the plain vanilla version.

> Marcel - can we have the date and

I knew someone was going to ask for the URL..... I was hoping I would not have to dig in my
archives...................Here you go  http://www.80211-planet.com/columns/article.php/1452411

Here is some info on SAIC     http://www.saic.com/wireless/

> specifically or as vague characterization) where the honeypot(s) are

Here is a Honey Pot White Paper
http://www.spitzner.net/honeypot.html

 More on the project
http://www.tracking-hackers.com/

BTW- They are waiting for the iDEN/ Wi-Fi card they see this as a way to hack into Nextel's customer base.

---

From: Rick Parrish <[email-masked]>
Date: Wed, 08 Jan 2003 02:21:18 -0600

>http://www.tracking-hackers.com/
I highly recommend this link ...
http://project.honeynet.org/

-riok

---

From: Rick Parrish <[email-masked]>
Date: Wed, 08 Jan 2003 02:39:00 -0600

meijin wrote:

>     Actually Rick, you can just turn off the broadcast of the SSID and
>     it has nothing to do with having WEP enable. Broadcasting the SSID
>     is the equivalent of shouting to the world that the network is
>     there and ready to be accessed. If they know what they are doing,
>     they can still find the SSID, but why make it easy? With Wi-Fi it
>     is like taking alot of small steps to get to the finish line.
>
Thanks Michael! Don't have an AP (or a wireless card anymore for that 
matter - was using a borrowed one for a while) so I didn't know the 
option was available.

>     I figure that as long as I don't hack some Japanese guy in Cali
>     and steal his Nokia hacking software I am safe! <grin!>
>      
>     Michael
>
As annoying as his book was, it turns out Tsutomu Shimomura wrote some 
interesting info on the DSL modem I use ...

http://security.sdsc.edu/self-help/alcatel/  (see "Patches and Tools" 
half-way down).

I find it ironic that the guy lives up to the ideals of "hacker" while 
at the same time contributing to the hysteria and paranoia of the masses 
through his book and related movie "Take Down".

-rick

---

From: Marcel <[email-masked]>
Date: Wed, 08 Jan 2003 04:06:09 -0500

Hackers are some of the best security experts around. When I was doing some research on
iDEN back doors who do you think opened the door a "hacker".

When Nextel revealed it was going to include 128 Bit Encryption in their new Wackberry who
was the 1st one to find the "Cracker" program used by law enforcement? A" Hacker"!

These guys live for a challege~~~~~

Rick Parrish wrote:

> I find it ironic that the guy lives up to the ideals of "hacker" whileat the same time
> contributing to the hysteria and paranoia of the massesthrough his book and related
> movie "Take Down".-rick

---

From: "Todd Ellis" <[email-masked]>
Date: Wed, 8 Jan 2003 06:03:03 -0500

I do, running 7 PCs on a Linksys system at home, using 128 WEP.  My neighbor
across the street is using the same configuration and on a different
channel.  From my second floor, I can "hear" two other WLANS in this
"technie" neighborhood.  In fact, I am using mine right now as I send this
message...

Todd Ellis
  -----Original Message-----
  From: meijin [mailto:[email-masked]]
  Sent: Tuesday, January 07, 2003 7:37 PM
  To: [email-masked]
  Subject: Re: [NEXTEL-1] Wireless Access: Warchalking

   <snip>
   Anyone here got a WLAN up and running? I have an Orinoco AP-200 attached
to my cable modem with an Avaya/Orinoco Silver PC-Card and an Avaya USB on
the PC in my bedroom. Works very well.

  Michael

---

From: "Todd Ellis" <[email-masked]>
Date: Wed, 8 Jan 2003 06:11:28 -0500

Michael:

Let me know when you are going to be back in Cary.

Todd Ellis

  -----Original Message-----
  From: meijin [mailto:[email-masked]]
  Sent: Tuesday, January 07, 2003 10:18 PM
  To: [email-masked]
  Subject: Re: [NEXTEL-1] Wireless Access: Warchalking

  Thanks, but the first ones were not too difficult. The Certifed Wireless
Security Expert and Cisco WLAN Field Engineer are supposed to be pretty
tough. And I also have a Cisco CCDA coming up.

  It was nice to find out that my partner and I were the first ones in the
company to get the CWA certification though! <grin!>

  Michael
    ----- Original Message -----
    From: Marcel
    To: [email-masked]
    Sent: Tuesday, January 07, 2003 7:19 PM
    Subject: Re: [NEXTEL-1] Wireless Access: Warchalking

        Yahoo! Groups Sponsor
              ADVERTISEMENT

  Your use of Yahoo! Groups is subject to the Yahoo! Terms of Service.

---

From: "Todd Ellis" <[email-masked]>
Date: Wed, 8 Jan 2003 06:14:53 -0500

That is correct.  I can see my neighbor's SSID and know he is WEPing, but I
can't get in.

---

From: "meijin" <[email-masked]>
Date: Wed, 8 Jan 2003 08:47:30 -0600

Todd:

Unfortunately not any time soon I think. We were only there for a wireless certification class. The next two I have are going to be in Dallas.

Anything up?

Michael

---

From: Marcel <[email-masked]>
Date: Fri, 10 Jan 2003 04:09:46 -0500

Marcel wrote:

>  Last month a contractor working for Nextel lost a

This is  not the 1st time Nextel had Security Issues...........
====================================================================================
Security Flaw Could Let Hackers Defraud Nextel Customers

By Maria Godoy, TechTV News

A security flaw in the website for US mobile phone company Nextel could easily allow hackers
to rack up cell phone charges while millions of unsuspecting customers foot the bill,
according to a source who contacted ZDTV News.

The vulnerability, which exists within the section of the Nextel website that allows users to
manage their account information online, can only be exploited by an existing Nextel customer,
said the source, who discovered the problem Thursday night while attempting to view his
account information.

The source, a systems administrator from Michigan who wishes to be identified only by his
online handle, Tap, noticed the potential vulnerability in the URL and decided to test it.

Tap slightly altered the part of the URL that reflected his account number and was able to
access another customer's account information. Tap provided ZDTV News with evidence of the
break-in, which was verified by SecurityFocus, a leading Internet security firm.

Tap said he did not notify Nextel about the potential security flaw for fear of being
prosecuted as a hacker, but he did alert SecurityFocus.

Elias Levy, chief technology officer for SecurityFocus, confirmed that the hack threat is
limited to Nextel customers.

"This somewhat limits the danger of the problem, although Nextel obviously has thousands of
customers," Levy said.

Actually, according to Nextel's website, the company has more than 5.5 million customers.

Once logged into the main Account Manager page, a devious customer could easily access the
account information of other customers by slightly altering the URL on the page. The flaw
could allow pranksters to cancel or add expensive features to another customer's cell phone
service.

People coding in these Web applications ... often don't have enough knowledge about security.
-- Elias Levy, SecurityFocus

A prankster could even activate a new cell phone and add it to a customer's service plan,
potentially racking up thousands of dollars in cell phone calls while charging the customer.
This type of scam is likely to go undetected until the defrauded customer's monthly statement
arrives.

Nextel had not responded to inquiries from ZDTV News at the time of this posting.

The fatal flaw lies in the fact that users are only required to authenticate themselves the
first time they log in, not every time they retrieve a record, Levy said.

Levy of SecurityFocus said this type of security vulnerability is quite common among websites
that require users to authenticate themselves before logging in, although banking websites
that use this feature usually get most of the media attention.

SecurityFocus has seen at least a thousand different websites with similar errors during the
past year, Levy added.

"The problem is very basic. People coding in these Web applications, though they may be
excellent programmers, often don't have enough knowledge about security," Levy noted.

No one particular technology exists to fix the problem, Levy observes. To minimize potential
security risks, he recommends that companies bring in third-party auditors to review their
programmers' code.

Originally posted September 15, 2000

---

From: Rick Parrish <[email-masked]>
Date: Sat, 11 Jan 2003 00:37:07 -0600

<snip>

<snip>

This is a good example of a web developer failing to distinguish between
authentication and authorization - this is a common problem in deploying 
new
software systems that haven't yet evolved a mature security model.

-rick