pcstru Posted May 13, 2014 Posted May 13, 2014 So we have some clever clogs who are attempting to hack our wireless network, which while unlikely to succeed, is causing our radius server some unnecessary work. We want to track them down. We have a Meru system and can see the AP they are using, so we know approximate location, we also have a MAC address - assuming it is not being spoofed. What tools can we use go the last few yards and collar the perpetrators?
hallb15 Posted May 13, 2014 Posted May 13, 2014 Use a site like MAC_Find: Vendor/Ethernet/Bluetooth MAC Address Lookup and Search to find the manufacturer of the device. That will help narrow it down. Especially if its a smartphone. As you know the approx. location, you could use CCTV to look for anyone acting suspiciously with said brand of device above. 1
abillybob Posted May 13, 2014 Posted May 13, 2014 Get a cocker spaniel I hear they're great for sniffing out trouble
zag Posted May 13, 2014 Posted May 13, 2014 I'd use MAC address filtering on the network and just deny that specific MAC address. In terms of finding them, just look on the wireless controller for when they are active and go round a look at the computers. You will catch them eventually. We had exactly the same problem a while back and found a room upstairs with some laptops that a student had going for 2 weeks! It can really pull a network down. We found this just by walking round. 1
pcstru Posted May 13, 2014 Author Posted May 13, 2014 The MAC relates to android. @zag, I'm tempted to block the MAC at the core switch but a MAC can be spoofed too easily for that to be a robust solution. An ideal solution might be something that will look at all wireless traffic, filter on a MAC address and present a signal strength. We are quite a large school so there are hundreds of students having around, all looking at their phones!
pete Posted May 13, 2014 Posted May 13, 2014 Depending on how long your radius logs are kept before they're rotated, chances are one of the kids involved will have tried his school username to login. Search the event logs for the offending mac address + username. 2
hallb15 Posted May 13, 2014 Posted May 13, 2014 Use arp to get the IP address from the MAC address. Or try LANSpy Network Security & Port Scanner - LanSpy its useful to have anyway. Have a play with wireshark to look at packets from that IP addr and see if you can find out what they are doing... 1
cpjitservices Posted May 13, 2014 Posted May 13, 2014 I'm guessing they are trying to hack the wifi because they don't have the credentials to be able to log-in and use it ? Do they not have the credentials because they are not supposed to use the Wi-Fi ? or do they just not know the security passphrase ? If they do have access and are trying to get the Pass-phrase then chances are they will be using a tool such as Cane & Abel to try and show the password - then I'd block the MAC address at the Core Switches, shame you aren't using captive portal then - any blocked MAC addresses will be redirected to a website - then you could display something like 'this MAC address has been banned.' 1
pcstru Posted May 13, 2014 Author Posted May 13, 2014 I'm guessing they are trying to hack the wifi because they don't have the credentials to be able to log-in and use it ? Do they not have the credentials because they are not supposed to use the Wi-Fi ? or do they just not know the security passphrase ? Both! It seems to be the type of attack you might use on a secured domestic access point. The RADIUS authentication for that SID is looking for machine credentials prior to an exchange of keys (that's as I understand it). If they do have access and are trying to get the Pass-phrase then chances are they will be using a tool such as Cane & Abel to try and show the password - then I'd block the MAC address at the Core Switches, shame you aren't using captive portal then - any blocked MAC addresses will be redirected to a website - then you could display something like 'this MAC address has been banned.' I'm not very keen on relying on MAC address in this situation because of the ease of spoofing it. I suppose blocking it makes it no worse for us but I don't want to give them any heads up. I really want to be able to collar them!
cpjitservices Posted May 13, 2014 Posted May 13, 2014 Both! It seems to be the type of attack you might use on a secured domestic access point. The RADIUS authentication for that SID is looking for machine credentials prior to an exchange of keys (that's as I understand it). I'm not very keen on relying on MAC address in this situation because of the ease of spoofing it. I suppose blocking it makes it no worse for us but I don't want to give them any heads up. I really want to be able to collar them! Collar them ? when you block the MAC address... and that person can lo longer get access to anything at all... They may not know about MAC spoofing because hacking access points really is childs play, they may have done it at home with standard Thomson/Techicolor routers but now it's more sophisticated. They may just come knockin' and say.... 'I cant get on the wifi' ....
pcstru Posted May 13, 2014 Author Posted May 13, 2014 Use arp to get the IP address from the MAC address. Or try LANSpy Network Security & Port Scanner - LanSpy its useful to have anyway. Have a play with wireshark to look at packets from that IP addr and see if you can find out what they are doing... They are not on the network so don't have an IP address. I think kismet would be able to raw monitoring (rfmode) which would let us see traffic and the mac address, I really need to then be able to distinguish the signal strength to do warm/cold and close in on their physical location. Either that or we somehow let them have a key so we can reel them in - honeypot?
cpjitservices Posted May 13, 2014 Posted May 13, 2014 They are not on the network so don't have an IP address. I think kismet would be able to raw monitoring (rfmode) which would let us see traffic and the mac address, I really need to then be able to distinguish the signal strength to do warm/cold and close in on their physical location. Either that or we somehow let them have a key so we can reel them in - honeypot? Reel them in sounds like a plan. If you let them on they will have an IP, then locate the IP to the closest Access Point if you can and then you'll be close. How are you going to give them the wifi passphrase though ?
pcstru Posted May 13, 2014 Author Posted May 13, 2014 Collar them ? when you block the MAC address... and that person can lo longer get access to anything at all... They may not know about MAC spoofing because hacking access points really is childs play, they may have done it at home with standard Thomson/Techicolor routers but now it's more sophisticated. Collar them - yes! I want them to know if they try it, they will get caught and there will be consequences. They may not know how to spoof an MAC but it is so trivial that if they don't give up, it is almost certainly their next port of call. Kisment will let me see the packets, I just can't see how to get a handle on the signal strength in relation to a MAC address.
pcstru Posted May 13, 2014 Author Posted May 13, 2014 Slightly amusing aside, when I was out looking for them, I spotted some lads acting suspiciously round one of the bike cages. They were trying to hack a combination padlock - so at least I can chalk up one hacker today! 1
cpjitservices Posted May 13, 2014 Posted May 13, 2014 Slightly amusing aside, when I was out looking for them, I spotted some lads acting suspiciously round one of the bike cages. They were trying to hack a combination padlock - so at least I can chalk up one hacker today! Nice one, i'm not 100% sure how you're going to be able to get the location exactly.
Haptic Posted May 13, 2014 Posted May 13, 2014 So we have some clever clogs who are attempting to hack our wireless network, which while unlikely to succeed, is causing our radius server some unnecessary work. We want to track them down. We have a Meru system and can see the AP they are using, so we know approximate location, we also have a MAC address - assuming it is not being spoofed. What tools can we use go the last few yards and collar the perpetrators? Have you looked at Airtight? I don't mean ripping out and replacing the Meru system, but adding the senor only AP's (which are cheap) as an overlay. http://www.edugeek.net/forums/our-advertisers/121639-airtight-networks-secure-cloud-managed-wifi.html Chris
pcstru Posted May 13, 2014 Author Posted May 13, 2014 To be honest, I'd ban the MAC before spending any money!
pcstru Posted June 30, 2014 Author Posted June 30, 2014 I set up a laptop with ubuntu to run Kismet and ... they stopped!
CHR1S Posted June 30, 2014 Posted June 30, 2014 Anyone with a working knowledge of Backtrack would know how to spoof their MAC, would know what can and cant be hacked and would at least attempt to cover their tracks.
Sheridan Posted June 30, 2014 Posted June 30, 2014 I use MAC filtering on top of radius to try and minimize this kind of thing. Obviously I don't have a BYOD wireless system yet! Its does require maintenance but at least you're putting a first line of defence in, not exactly rock solid but it slows down the lazy hacker!
pcstru Posted September 5, 2014 Author Posted September 5, 2014 So an update : I found out a couple of things. First, Meru's Interactive Per-Station Event Logging Shell described Here allows me to track events by their MAC address and shows me which AP they are trying to connect to. That allows me to track to a reasonably tight location when they are in a class. I then have two techniques to narrow it further : 1. Set Intersection : Monitoring for a week or two - not constantly but looking a few times within a lesson time and recording the approx location. I can then tie that in with timetable data to narrow down which classes were close to those locations at that time. 2. Wireshark : Use Wireshark with the wireless card in monitor mode + Promiscuous, use a filter to only show traffic from the MAC address I'm interested in. Capture and display the RSSI headers which give a signal strength for each captured packet. I have this on a small, light netbook running Ubuntu (windows seems to prevent access to network card functions which are critical to this) so I can wander over to the location the Meru monitoring gave me and pretty well tie it down to a class on signal strength. Generally devices seem to give away what they are (HTC, Samsung etc), so if necessary we could use that to narrow it down to a few students and proceed from there. I'm hoping the warning I put to a class this morning will have the necessary effect. If it does I'm 1 down, 5 to go.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now