Configuring WPA manually

Configuring WPA is Ubuntu is no problem if NetworkManager works flawlessly. However, sometimes it doesn't. Here's how to configure WPA from the command line:

1. Get wpa supplicant sudo aptitude install wpasupplicant
2. Run wpa_passphrase which reads stdin and outputs the PSK that you'll need
   
3. Create a configuration file, say /etc/wpa_supplicant.conf, with the the text following this numbered list
   
4. sudo wpa_supplicant -B -D wext -i eth0 -c /etc/wpa_supplicant.conf (B for background, D for driver (wext is a generic linux driver, ipw2100 does not work), i for interface, c for path to conf file)
5. You should be connected at this point. Run dhclient to request an IP address from the server. ping something to make sure you can reach the outside.
6. (optional) This process can be automated on startup by editing the /etc/network/interfaces file appropriately
   

ctrl_interface=/var/run/wpa_supplicant

network={
ssid="My Network"
key_mgmt=WPA-PSK
psk=<generated passphrase>
}

As always, look at the man pages for more details: man wpa_supplicant and man wpa_supplicant.conf and man wpa_passphrase

Why default settings on your wireless router is a BAD thing

Lots of people recognize that 802.11 wireless networks are really cool and want to have them. They go to Best Buy, grab a Linksys router, run home and, without going through the standard setup, plug the router into their network connection and turn it on. Hopefully you are not one of these people because these people leave their router completely vulnerable to whoever wants to take control of it.

Here, I will show how to discover one of these networks, how to get in to it, and what you can do once you're in command. I will be using the Linksys WRT54GL as an example, but the lessons here are very applicable to other makes and models as well.

First, the discovery. You're going to need a tool like kismet for this. If you're on Ubuntu Edgy Eft (like me), a simple sudo apt-get install kismet will install it on your machine. If you don't have apt-get or a comprable tool (such as yum on Red Hat flavors), you'll have to download and compile it from source yourself. Once you have kismet, edit the /etc/kismet/kismet.conf file. Edit the line that begins with "source=" to whatever is appropriate. The first value should be what comes up after the Nickname section of this command: iwconfig | grep Nickname. The second value should be the desired wireless interface (something like eth1... also on that same line of the previous command) and the third value is whatever you want to name this interface. Mine is source= ipw2100,eth1,wireless. More info is in the README under "Capture Sources." Fire up kismet with sudo kismet. Any detected networks that have the "F" under Flags (and, with color enabled, the line should come up as red) are networks with factory-default settings. These routers are often named "linksys" or "NETGEAR" or the like. If you want to change around the interface in kismet, edit the /etc/kismet/kismet_ui.conf file.

Now that you have your target, log onto the network and (hoping that this isn't a honeypot) point your browser to 192.168.1.1 (this IP address may vary depending on the make and model of the network that you're hacking... NETGEAR routers, for example, are 192.168.0.1). When prompted for a username and password, enter admin/admin. These are factory-set values that can be found for other models by searching on the Internet. For example, here and here (and here for D-link and here for Belkin). Congratulations, you're in.

What to do now? Well, as far as the router is concerned, a lot of things. Change the broadcasted ESSID of the network to "lol u R h4cked!" under Wireless->Basic Wireless Settings. Enable a password in Wireless->Wireless Security so that the legitimate users of the network will not be able to log on. In Access Restrictions, set the router so that it ceases to operate for five hours on Tuesdays. Etc. Of course, there are more things that you could do by exploiting the actual network itself, but that's beyond the scope of this entry.

Airsnort / WEP

Airsnort is the most widely used utility for cracking WEP. Get it on Ubuntu Dapper with sudo apt-get install airsnort. Here is a nice guide (with pictures!) to using airsnort on Linux. Airsnort uses an exploit described in this paper (postscript format) to obtain a WEP-encrypted password. Wikipedia has a more digestible summary of WEP flaws. wepcrack is another (and was the first) utility to implement the WEP exploit described above.

The way that Airsnort works is by passively monitoring all packets sent over a wireless network and then observing those packets for patterns it can exploit. The key to this is setting your wireless card to promiscuous mode: sudo iwconfig ethx mode Monitor. While you have this mode enabled, you will not be able to access the Internet.

One of the problems with monitoring traffic to crack WEP is if there is no traffic to montior in the first place! That is, the network isn't being heavily used. Solution: traffic injection. Aircrack-ng is a tool that supports this, among other things (homepage, tutorial, wikipedia page). Packet injection, however, is not a passive activity.

Books on the subject (links to Amazon.com pages):

• Wi-Foo: The secrets of wireless hacking
• 802.11 Wireless Networks: The Definitive Guide

TODO: Add sections about hidden SSIDs, MAC address filtering
http://www.cs.wright.edu/~pmateti/InternetSecurity/Lectures/WirelessHacks/Mateti-WirelessHacks.htm#_Toc77524653
http://docs.lucidinteractive.ca/index.php/Cracking_WEP_and_WPA_Wireless_Networks

Linux PCI Wireless cards (and the bcm43xx driver)

It's a pain in the butt when manufacturers of PCI wireless cards don't release a driver to go with their hardware. Case in point: broadcom, whose card I purchased. Luckily, there is a hacked driver available from the community.

Links:

• Ubuntu docs wireless troubleshooting guide -- very good
• Ubuntu docs guide for using the bcm43xx class of cards
• Another (worse) guide for bcm's

Note to self: whatever I do, do NOT use ndiswrapper for wireless drivers. All the kernel hackers tell me it's bad... and, they were right. I believe it attempts to load the Windows driver on top of a layer that enables the cooperation of the hardware and the Windows driver. When I tried to use it, it crashed GNOME. Grrr...

The jury's out on whether this actually works or not (I have yet to get this desktop in range of a usable wireless signal) but I can iwlist eth0 scan for stuff and get results back so I'm optimistic...

Update: this thing works (most of the time). Sometimes it will inexplicably lose the signal and I'll have to connect again. Not the biggest deal in the world, but still pretty annoying.

Waseem comes to the Linux/Wireless rescue

Waseem just helped me configure my wireless on my Compaq laptop (that is now running Ubuntu Dapper Drake). Any network that is publicly accessible will be viewable (if, of course the wireless card/network is enabled) in the drop-down box in Network Setting --> wireless --> Properties. It will not automatically connect to any network it senses. Here is some command line wizardry to help configure wireless settings:

1. Need to know name of network interface -- type in iwconfig to find that out (usually its name is eth1 or the like)
2. Then you want to scan the nearby places to see what networks you can use -- iwlist < network > scan returns a list of potentially usable networks... it also tells you if you need an encyption key (password) to access the network
3. To tell your network card that you want to use a certain network -- iwconfig <network> essid <name>
4. Now to tell it the password (if neccesssary) -- iwconfig <network> key <password> (Waseem isn't sure if this is the same accross networks... some require hex keys, some require ASCII keys, etc.)
5. Now you need to tell Linux "I want to start using this connection" -- ifconfig <network> up (of course, to turn it off, the same command with down instead of up)
6. To get an IP address using DHCP -- dhclient < network >
7. If you're not using DHCP, you need to tell ifconfig about the IP address request (Waseem isn't sure how to do this)

Command summary:

• iwconfig -- configure a wireless network interface
• ifconfig -- configure a network interface
• iwlist -- get more detailed information from a wireless interface

Edit: As I've gotten to school, I've noticed a problem: for some reason my comp gets confused when there's multiple wireless networks with the same name; or, rather, one wireless network with multiple routers broadcasting the same network. I need to specify the router's MAC address if I want to connect. Here are the commands:

1. Tell your interface that you want to roam on a network: iwconfig <network> mode Managed
2. Specify the connection point: iwconfig <network> ap <MAC address>
3. From here it's the same as any wireless connection: ifconfig <network> up
4. Request an IP address: dhclient <network>