53

I just watched an interesting talk from Glen Glenn Wilkinson titled: The Machines that Betrayed their Masters.

He said that your phone is constantly broadcasting all the SSIDs it has ever connected to. How would an attacker be able to capture these wifi requests?

Improve this question
6
  • 1
    What research have you done? What have you tried? Are you familiar with Wireshark? Trying to gauge the appropriate level of the response for your personal situation...
    – D.W.
    Jun 30, 2014 at 21:43
  • 1
    I am highly skeptical of the claim that any device is "constantly broadcasting all the SSIDs it has ever connected to".
    – Michael
    Jul 1, 2014 at 18:40
  • 6
    It is not constantly broadcasting the SSIDs it has connected to. If it is connected to a network, it does not. However, if an iPhone is not connected to a network, it will attempt to probe for networks it knows.
    – Alan Shutko
    Jul 1, 2014 at 20:12
  • Related: troyhunt.com/2013/04/… and troyhunt.com/search/label/WiFi%20Pineapple
    – Harry Johnston
    Jul 2, 2014 at 0:04
  • 1
    I asked a similar question a while ago on the Android site. I heard about a hacker using this to setup a fake network with same name where users would connect to, after which he could track what they did on the web. android.stackexchange.com/questions/66244/…
    – SPRBRN
    Jul 2, 2014 at 12:33

6 Answers 6

Reset to default
48

Fairly easy to be honest, all you need is to do is listen for Probe Requests. There is a nice blog explaining how to go about setting up a computer with BT5 to listen for them here.

With a networking card that supports "Monitor mode", you are able to pick up so called "Probe requests". Once the networking card is set up to be in monitor mode you can use something like aircrack, wireshark or hoover to capture the probe requests.

For example when using ubuntu and wireshark, set the network card in monitor mode:

sudo ifconfig wlan0 down
sudo iwconfig wlan0 mode monitor
sudo ifconfig wlan0 up

Now start wireshark and set the filter for "wlan.fc.type_subtype eq 4".

That's it, now you can see all the SSIDs being probed for around you.

Improve this answer
5
  • 7
    Just out of curiosity, could you use Google's network mapping project to get a history of every place someone has ever connected to the internet? Because that sounds kinda creepy - but also pretty cool..
    – KnightOfNi
    Jun 30, 2014 at 14:20
  • 1
    In theory, yes. If the SSID and MAC are collected by google, one could find the location of this AP.
    – BadSkillz
    Jun 30, 2014 at 14:41
  • 1
    +1. This is the point where technology becomes scary to me. Being a computer science major, I know exactly how far this stuff can go. This is ridiculous! There are lots of cool and interesting uses for this type of data (Google's network mapping project), but just imagine if I were the creepy stalker type. One could map out behavioral patterns and use it to harm others. I understand why phones probe for previous networks, but this is kind of sick if you think about the possibilities for social engineering...
    – Chris Cirefice
    Jul 1, 2014 at 17:08
  • 3
    Not only can you collect information; you can also create a malicious access point that mimics an access point the victim will automatically connect to, then immediately have access to any non-encrypted network traffic their apps use as well as an open channel for remote attacks on the device.
    – R.. GitHub STOP HELPING ICE
    Jul 1, 2014 at 19:41
  • @ChrisCirefice The tech giants (GAFAM) are the creepy stalker types and they are using social engineering to dominate the world and make huge profits. It's sick, I agree.
    – Jake
    Mar 13, 2022 at 2:41
10

For example, using the great aircrack-ng, specifically the airodump-ng utility from it. The information you are looking for will show up under "Probes" in the lower section.

Improve this answer
6

This should work for most Linuxes:

sudo apt-get install aircrack-ng

sudo airmon-ng start <card>

sudo airodump-ng mon0

This outputs a list of what all devices are trying to connect to. Some devices only probe networks that are available, however, as you suspected, smartphones probe all networks that they know about, no matter whether they are available or not·

Improve this answer
0
6

After putting your wireless network card in monitor mode as mentioned in the other answers, you can do something like the following to print out MAC addresses and ssid. This code is dependent on the scapy library/tool.

#!/usr/bin/env python

from scapy.all import *
conf.iface = "mon0"


def handle_pkt(pkt):
    if Dot11 in pkt and pkt[Dot11].type == 0 and pkt[Dot11].subtype == 4:
        hwaddr = pkt[Dot11].addr2
        ssid = pkt[Dot11Elt][0].info
        print hwaddr, repr(ssid)

sniff(prn=handle_pkt)

Happy hacking

Alternative to airmon-ng is to use iwconfig to set the card in monitor mode (if it supports it) - The downside with this method, is that you cannot associate with an accesspoint while sniffing raw wireless packets.

ifconfig wlan0 down
iwconfig wlan0 mode Monitor
iwconfig wlan0 channel 1
ifconfig wlan0 up
Improve this answer
2
4

My approach to this was to use an OpenWRT (could be done with DDwrt or other similar projects) device (a TPlink 3600) and to use only tcpdump and monitor mode (not airodump). Using TCPdump lets you see all traffic (to profile area activity as well as watching for beacons/probes) The advantage to using a dedicated device is they are inexpensive, use little electricity, and have two radios that work independently. I used a flash drive mounted on /media/drive1 to hold the files. The below commands will watch channel 11 on the b/g/n bands and channel 149 on the a/n bands, obviously this can be changed to suit local needs. With this running at startup you can move the device to the desired area, plug it in, wait, and then unplug it and review the files from the flash drive on your PC. The possible wireless security audit scenarios with this platform are many.

Also, as a point of clarification to your original thesis that "phones broadcast the SSIDs of all networks they have ever connected to" this is a bit oversimplified: devices will send probes for any network currently in their wi-fi configuration, which for most users are all the networks they have signed on to in the past but you can easily remove unused entries from this list to reduce the information leaked by your device. An option like "only associate to broadcasted SSIDs, do not probe" would be desirable but alas this is really a low priority when it comes to security, compared to other issues on most mobile devices.

/usr/sbin/iw phy phy0 interface add mon0 type monitor;
/sbin/ifconfig mon0 up;
/usr/sbin/iw mon0 set channel 11;
/usr/sbin/iw phy phy1 interface add mon1 type monitor;
/sbin/ifconfig mon1 up;
/usr/sbin/iw mon1 set channel 149;

capdir="/media/drive1/`date +%Y%m%d-%H%M`";
mkdir $capdir;
echo "starting with $capdir" >> /tmp/capstartup

/usr/sbin/tcpdump -i mon0 -C 50 -w $capdir/mon0.pcap &> /tmp/error.myprog0 &
/usr/sbin/tcpdump -i mon1 -C 50 -w $capdir/mon1.pcap &> /tmp/error.myprog1 &
Improve this answer
1
  • Do you have any idea why one would get a busy error when trying to set the channel of mon0: command failed: Device or resource busy (-16)? I get a busy response whether I use iw or iwconfig to try to set the channel.
    – Jellicle
    Jul 23, 2015 at 16:04
1

Not only is your device sending probe requests to the networks it has been connected to (unless it is already connected), but in some cases it seems that when you are spoofing MAC address of another device in your surroundings (and this one is being shut down), it may even replicate sending probe requests to APs it was never connected to and are out of reach at the same time. At least this was my puzzling observation: How can spoofing a certain MAC address enable sending probe requests that I was never connected to?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .