I'm working on a project that ideally needs to be able to identify local wifi networks, and be able to recall them if they are approached again. Is there any unique identifying information that can be gathered about a network without needing to actually connect? Are there any potential legal issues that could come from this kind of passive data gathering?

  • Google had some legal problems because they recorded some unencrypted payloads during their passive WLAN sniffing. – CodesInChaos Oct 13 '15 at 9:48
  • True, but Google's issue was storing the payloads, not necessarily sniffing them. – Jon Story Oct 13 '15 at 10:01
up vote 2 down vote accepted

Using a sniffer on monitor mode you'll be able to capture:

  • MAC address of an AP
  • Level of protection 'WPA2, WPA, WEP, none'
  • MAC addresses of the clients connected to a specific AP

That process is called Passive sniffing, you can apply it with Airodump-ng tool on Kali.

  • That's pretty much exactly what I was hoping for, I can tie the information I need to the MAC address of the network or devices connected therein – Psycrow Oct 13 '15 at 10:06
  • Yeah, but you'll need to be close to the clients, and you might face some problems like hidden ssids. the more time you sniff, the more you'll be able to capture including hidden ssid – Emadeddin Oct 13 '15 at 10:34
  • Beware hidden ssid is false security. – daniel Azuelos Oct 13 '15 at 11:20
  • @Emadeddin Being close is probably a benefit in this case, and the only information I would really want to locate is the MAC address, and possibly the MAC address of other connected clients. I know there's a lot of factors involved, but when you say "quite close" could you give me an idea of how close? And roughly how long sniffing the MAC address would take? – Psycrow Oct 14 '15 at 10:24
  • On my Alfa card, it took me about 15-25 min or less. and for how close, it's about 10-15 m using the same Alfa card. – Emadeddin Oct 14 '15 at 16:33

On a linux distribution with a wireless interface operating in monitor mode, the following command...

airodump-ng --wps --manufacturer -- uptime -w prefix_for_log_files -i monitor_interface

...will capture the

  • ESSIDS
  • BSSIDS
  • Crypto strength and authentication scheme (Pre shared Key vs EAP/Radius)
  • Signal strength
  • Whether WPS is being used on the router
  • the manufacturer of the MAC addresses broadcasting
  • the uptime of routers detected
  • the MAC addresses of any wireless clients in range,
  • Client association with any access points in range.
  • ESSIDS/BSSIDS of access points that clients have previously attached to (for example, the device owners home router, hotels that they have used wifi at, etc)

This command will also write (-w) the captured data to a set of log files in xml, kismet, and csv format, as well as a dump of all traffic encountered in a .cap file. These files will provide First Seen / Last Seen times for each access point or wireless interface which has been detected, along with the highest detected signal / noise ratio (so for example you could deploy this to track people walking past your house with a very high degree of accuracy - provided they have wifi enabled on their phones, which is highly likely.)

As you can see, this simple command captures a great deal of information. Airodump-ng skips through channels by default, but this is generally measured in mili-seconds and what I have typically found is that any wireless device which is within the stated wifi standard range for more than a second will be found. Other devices two to three times further away will also typically show up within a few seconds / minutes too, depending on other ambient noise and reflections.

Airodump-ng will do this COMPLETELY passively, without broadcasting any detectable traffic at all, so can be safely considered indetectable.

The only danger of discovery of which I am aware is airodump-ng being attacked by a skilled attacker within range. Airodump-ng is on record as having been vulnerable in the past to buffer overflows, although this was patched AFAIK. However that does present the probably extremely slim chance that the airodump-ng instance you run can be exploited by a skilled attacker within range. I am certainly not aware of any exploit like this in the public domain at present with the latest version of airodump-ng.

Regarding the legality - usual caveats IANAL but as I understand it, in the UK at least, running airodump-ng is legal. I have this on the 'authority' of a penetration testing team who did a demo for my work recently, and who - they say - sought extensive counsel on this very topic. The long story short according to them was that you stray from legality when you use the captured data to run a cracking attack on another parties wireless crypto. But I would assume that also extends to capturing such data as would prove useful in a cracking attempt in preparation for such an attempt also - where it could be proved beyond a reasonable doubt that this is what you were up to.

I have spent some time with airodump-ng and cannot recommend it enough for wireless audits of the kind you have described.

  • Wow, that's a lot of information. Do you have any idea if there are similar tools available that would run on Android? I ask as my project would need to remember a unique identifier for networks that the user has been in close proximity too, and that would definitely be easier if the data was recorded via a phone. In regards to legality, I only intend to store the MAC address of these networks so it seems I wouldn't need to worry too much. – Psycrow Oct 19 '15 at 8:09
  • 1
    You could use Gmon from the Google Play store, or Wigle. They store the SSIDs, MAC Addresses, Crypto used, as well as GPS data. Gmon then stores this in a .KML file which can be dropped into Google Earth or queried using whatever XML tooling you have to hand. For Airodump-ng you need root. AFAIK the Nokia N900 is the best bet for monitor mode, which would allow you to run Airodump-ng. Anything else and you have to have compatible wifi chip, drivers, patch the kernel. If you have hopes of getting this to work on your existing phone or a general Android phone you face an uphill struggle. – TemperedGlass Oct 19 '15 at 21:56

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.