How to Log Wi-Fi Probe Requests from Smartphones & Laptops with Probemon « Null Byte :: WonderHowTo

It's no secret that devices leak data, but sometimes they do so in ways you may not expect. Your phone, laptop, printer, and IOT devices leak Wi-Fi information that can (and is) used to track you.Today, we'll make a Wi-Fi probe logger with Probemon.py to track nearby devices by MAC address, signal strength, and APs they have recently connected to. We will explore tying this data to home or work locations with a database correlation attack to locate the owner of a tracked device.Passive Surveillance of Wireless DevicesIn cellular-based surveillance devices like the infamousDRTBOX, the device forces all cell phones in range to connect and give up their location and unique ID. This, combined with GPS, is enough to know who you are and where you are as long as your phone is on, without ever knowing you've been tracked. Using wireless probe frames instead, there is a much less complicated way to track users by their devices.Most Wi-Fi devices leak identifying information through the process they use to probe for wireless networks nearby. We'll use a Python-based probe logger to record the information from these probes to fingerprint and determine what kind of devices are nearby, and where those devices have been. For small, discreet tracking, Probemon works well on the Kali Pi.Don't Miss:Set Up a Headless Raspberry Pi Hacking Platform Running Kali LinuxSeveral Raspberry Pi based Probemon probe loggers.Probing the Probes (To Probe While You Probe)I've been fascinated with the concept of a "blind" security camera that detects presence without using a traditional lens setup. Now that most people carry wireless devices, you don't really need to see in the classical sense to detect a person or device being present.Traditionally, we have ultrasonic motion sensors, passive infrared sensors, and other people-sensors for monitoring if a person is approaching and triggering things like sounding an alarm or opening a door. Now that humans have evolved to clutch wireless close to them at nearly all times, you can usually assume a smartphone signature represents a person, and a person represents at least one laptop or smartphone with a wireless card.Wireless devices are always searching for Wi-Fi networks while the wireless cards are left enabled, sending out these identifying, unencrypted probe frames. Users typically leave Wi-Fi on, but even if they don't, several "smart switching" modes also send the same probes. I was excited to learn thatNik Harrishad taken my musings of a way to track people by their device to a new level by creating Probemon, a Python program that uses a wireless card to detect, classify, and log these probe frames to track these devices.How Probemon Tracks YouPhones and other wireless devices find Wi-Fi around them in two ways, by probing for any AP (a broadcast probe) or probing for the last AP or several APs the device has successfully connected to. These probes can be sniffed, logged, and the device MAC address fingerprinted to prove that a particular person's phone was at a certain place at a certain time.Probemon creates a CSV or text output file of all the wireless devices logged in range nearby and wasoriginally created to catch a graffiti artistby correlating the wireless network probe request from his smartphone to his home address. Several years ago, phones actually included the MAC address of the last AP they connected to, which allowed for easy lookup of the location of the AP as well as the manufacturer.In addition to fingerprinting the device, Probemon also allows us to see the last network the phone or laptop connected to. We can useWigle.netto look up the geolocation and build a profile of a user in a very short amount of time.The iPhone Makes an AttemptThis technique has poorer effectiveness against the iPhone due to the way the iPhone searches for Wi-Fi. It does so by sending out a "broadcast" ping or "to anyone" ping requesting for any nearby access points to reply rather than any specific one. Therefore, we will not see an iPhone asking for any specific APs. Tracking an iPhone is also somewhat harder (up until iOS 10) due to the fact that italso randomizes its MAC address when making these requests.In iOS 10, an Apple-specific element was added to the way iPhones probe for networks, allowing them to be effectively tracked again. Despite still being trackable, researchers described the technique used in the iPhone's probe requests as "closest to being pretty good."What You'll Need for a Probe LoggerProbemon is a Python program, which allows it to run on a flexible range of devices. Generally, Probemon performs quite well and is easy to install on Kali Linux. To use it, you'll need:a fully updated version of Kali Rollinga wireless network adapterpreferably a portable setup like a Raspberry Pi 3Don't Miss:Guide to Selecting a Wireless Network Adapter for HackingVarious wireless probe loggers based on the Raspberry Pi, one incorporating a network camera to activate only when a certain device is present.Step 1: Installing DependenciesFirst, let's set up some dependencies. After updating Kali, you'll need Python,Netaddr, andLibdnetto make this work. Kali Linux typically includes Python, but if not you can run:apt-get install pythonIf you try to run Probemon before installing the dependencies, it'll complain about whatever is missing.Probemon whining about netaddr during run.git clonehttps://github.com/drkjam/netaddrcd netaddrsudo python setup.py installcdgit clonehttps://github.com/secdev/scapy.gitcd scapysudo python setup.py installGreat! Let's get Probemon and run it for the first time.git clonehttps://github.com/nikharris0/probemon.gitcd probemonsudo python probemon.pyIf you see something like the following, than the script is ready to run.The script is ready to run.If it complains about a dependency or module being missing, odds are you'll need to find it on GitHub and install it likeScapyand Netaddr. I noted in my first build on a Mac, I needed Libdnet, but I didn't seem to need when installing on Kali.Step 2: Running Probemon to Intercept Wireless Probe FramesProbemon comes with a full suite of arguments to help you find and refine wireless probe frames.Probemon arguments you can apply during a run.First, you'll need to put your antenna into monitor mode. Runifconfigto find your antenna. Assuming it's wlan1, type the following into terminal.airmon-ng start wlan1Once that's started, we can start to capture data. To begin, run Probemon with:python probemon.py -i wlan1mon -t unix -o ~/WonderHowTo -f -s -r -lThis script logs the results to a file called "WonderHowTo" and displays the results on the screen as they come in live. You will notice MAC addresses, the manufacturer, and wireless networks that device is looking for along with the signal strength. I've removed the MAC addresses in the following screenshot.Intercepted probes.Step 3: Interpreting the Data — What Does It Mean?What have you created? It depends on what you want to measure. Probemon can be run remotely by a discreetly placed device to detect when a particular device, and user, are nearby. It can be used as a "who's home" board. For mobile devices, this is a fingerprinting and tracking ability that lets you identify and track mobile devices, and figure out where they're likely to be in the future. But how can we use this data to dig deeper into the history of the device and user?In our dataset above, there is a probe from a Liteon Technology device that is trying to connect to a network called "WPATubez." How unique can the name (ESSID) of this network be? Using local filters, there is often only one result.With a local filter applied on a Wigle.net database search, it is often trivial to find the address at which the AP in question is located. In this search example, only one AP with that name has been sighted within the last three years and is located in Burbank. We also discover that it is an open Wi-Fi network, allowing us to potentially launch a Karma attack against the user's device.Cross referencing the Wigle database.How is this useful? By creating an open wireless network, we can convince the device to join our network and scan it more intensively. We can also track when this device is nearby and monitor distance by signal strength, or go to a suspected home location and scan for the device when we expect the user carrying it to be present. Swapping the size of the antenna can also limit or expand the range depending on the requirements.Step 4: Defeating MAC Address SurveillanceFor one, turning off your wireless card when not in use and disabling "smart switch" mode will prevent your phone from giving away its MAC address when in "disassociated" mode (not connected to Wi-Fi).A program likeMacchangercan change your MAC address to something spooky that would make someone want to stop monitoring you. On boot, I like to have my Raspberry Pi assume the MAC address range of a particularly scary government defense contractor's computers. I don't really advise that, so instead, I'll show you how to randomize your MAC address.First, take the interface to be camouflaged down with:ifconfiginterfacenamedownThen, change the MAC address with:macchanger -rinterfacenameifconfiginterfacenameupThis should change the MAC address your wireless card leaks to the world. You can confirm this is working with:macchanger –showinterfacenameIn Practice: How to Use SIGINT in ReconIn our real world example, we'll use probe logging as a form of signals intelligence to find information on a target passively. In a hypothetical scenario, we want to audit the employees of an office building for ways to get into company accounts and devices.During an opportune visit to the office posing as a customer, we activate a Raspberry Pi probe logger for the duration of our tour of the building. We record probes created by printers, laptops, smartphones, and other wireless devices in proximity and mine the data for attack vectors.Probe logger example, one with a network camera.Types of data we're looking for include:The MAC address of printers and other wireless devices in the office, along with any networks they are searching for, associated with, or have no/weak passwords.The MAC address of smartphones and laptops belonging to users to create a "hot" list for confirming an employee is in range.Any wireless network a personal device is attempting to connect to which is GPS locatable, unsecured, or that reveals a home or work location.The manufacturers of the devices found and whether they are vulnerable.The best part about this kind of recon is that it is very hard to detect. It is completely passive and relies on capturing the emissions from the devices around you. Despite its low profile, creativity in tying data together can yield impressive results with this technique.Thanks for reading, and make sure to keep an eye on Null Byte for more hacking tutorials. You can ask me questions here or @sadmin2001 onTwitterorInstagram.Follow Null Byte onTwitterandGoogle+Follow WonderHowTo onFacebook,Twitter,Pinterest, andGoogle+Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by SADMIN/Null ByteRelatedHow To:Track Wi-Fi Devices & Connect to Them Using ProbequestHow To:Build a Pumpkin Pi — The Rogue AP & MITM Framework That Fits in Your PocketHow To:Use Kismet to Watch Wi-Fi User Activity Through WallsHow To:USB Tether Your Android Device to Your Mac—Without RootingHow To:Spy on Network Relationships with Airgraph-NgHow To:View Battery Levels for All of Your Devices in One AppHow To:Scan, Fake & Attack Wi-Fi Networks with the ESP8266-Based WiFi DeautherHow To:Share Your Windows 8 PC's Internet with a Phone or Tablet by Turning It into a Wi-Fi HotspotAndroid Basics:How to Connect to a Wi-Fi NetworkHow To:The Beginner's Guide to Defending Against Wi-Fi HackingHow To:Map Networks & Connect to Discovered Devices Using Your PhoneHow To:Tether a laptop to a Droid smartphone for free WiFiHow To:Use an ESP8266 Beacon Spammer to Track Smartphone UsersHow To:Recover a Lost WiFi Password from Any DeviceHow To:Can't Log into Hotel Wi-Fi? Use This App to Fix Android's Captive Portal ProblemHow To:Save Battery Power by Pairing Wi-Fi Connections with Cell Tower Signals on Your Galaxy Note 3How To:See Who's Clogging Up Your Wi-Fi Network with These Free Mobile AppsHow To:Spy on Traffic from a Smartphone with WiresharkHow To:Easily Share Your Complicated Wi-Fi Password Using Your Nexus 5How To:This DIY WiFi-Detecting 'Sting' Blade Is Perfect for Any Hobbit Looking for a HotspotHow To:Analyze Wi-Fi Data Captures with Jupyter NotebookHow To:Inconspicuously Sniff Wi-Fi Data Packets Using an ESP8266How To:See Who's Using Your Wi-Fi & Boot Them Off with Your AndroidHow To:Crack Wi-Fi Passwords—For Beginners!How To:Easily Store Your iPhone's Wi-Fi Passwords & Share Them with Anybody — Even Android UsersHow To:Hack WiFi Passwords for Free Wireless Internet on Your PS3How To:Connect to a network using Wi-Fi on a Mac computerHow To:Protect Yourself from the KRACK Attacks WPA2 Wi-Fi VulnerabilityHow To:Turn Any Phone into a Hacking Super Weapon with the SonicHulu 101:How to Cast Shows & Movies to Your TVHow To:This App Saves Battery Life by Toggling Data Off When You're on Wi-FiHow To:9 Tips for Maximizing Your Laptop's Battery LifeHow To:Get Free Wi-Fi from Hotels & MoreNews:PSP2 (Next Generation Portable) or NGPNews:In Just a Clik, Turn Your Smartphone into a YouTube Remote for Any Web DisplayHow To:Build Your Own "Pogo Mo Thoin" to Flash Any Xbox 360 DVD Drive for Under $5News:Art Meets Information Liberation with the Transparency GrenadeHow To:Hack Anyone's Facebook, Twitter or YouTube Account with Your Android DeviceHow To:Make Your Laptop Theft ProofHowTo:Get FREE In-flight Wi-Fi From Google