41 comments

[ 4.9 ms ] story [ 81.6 ms ] thread
> scans channels 1-13 in the 2.4GHz band

Really? No 5GHz support? US channels only?

> LAN network

You guys should just say LAN. LAN network is like ATM Machine.

I guess if one was interested in monitoring traffic of example their mobile phone, one could fix the phone to connect at 2.4GHz only. This would allow a capture to be made using this device.

Regardless 5GHz would have been handy to include.

No need to call out “ATM Machine” or “LAN Network”.

Repeating the last letter of an acronym in full is common in the English language because it provides clarity, flow, and disambiguation.

RAS Syndrome is a real thing
It is neither providing clarity nor disambiguation. Flow is subjective but I find it really disruptive because I know what the initialism means.

Seriously, how many people won't know what you mean when you say, "I need to stop by the ATM," but know what you mean when you add "machine"?

Just in case: http://www.acronympolice.org/

>Section 2: Single Acronym Violations (Punishable by shaking of the head in disgust with a slight grin and/or slightly audible groan or chuckle)

2.1 Single Word Acronym Violations: Single Word Acronym Violations consist of using one of the words contained in the acronym immediately before or after the acronym. An example of this would be ATM Machine. Since ATM stands for “Automated Teller Machine” saying ATM Machine is actually saying Automated Teller Machine machine.

Maybe the machine is capable of many other tasks but is currently emulating an ATM, in which case it really is a machine being an ATM, or an ATM machine...
(comment deleted)
As an English speaker I have never heard of this, best practice in formally written documents is to expand acronyms when first used eg LAN (local Area Network)
Also as an English speaker, you make a good point, which is regrettably obscured by your lack of commas.
Honest question - should that comma be a colon in: "Also as an English speaker, you make a good point"?
Maybe, I don't know. As long as something is used for delimiting I don't really mind what it is. I only made the comment because I had to read the sentence three times before I figured out what it was saying.
does this do anything beyond the capabilities of a vanilla kali install?
You can do WiFi monitoring with a vanilla macOS install. And I do mean vanilla.
last time i checked macbook built in wifi chipset didn't support monitoring mode, need external device.
No external device needed, just root access and I usually make a symlink to somewhere on $PATH:

  $ sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport  ~/bin/airport
  $ sudo airport sniff
  $ tcpdump -r /tmp/airportSniffxxxx.cap | less
It sure does, which is awesome! The UI even has support, and when it’s in monitor mode the WiFi status icon even turns into a solid fan shape with a little eye in it. It’s the little things.

‘jzelinskie has the short instructions in their comment.

I drank the linux koolaid and haven't used apple software in ages, but I will consider myself informed, good to know.
That looks extremely similar to some TP-Link MR3020's I got on Amazon for about $15/each. I can't imagine the software is worth that much extra, especially since it's just some open-source slapped together (probably running on OpenWRT -- that's what I put on mine). That said, I wonder where I can download the source.

The lack of 5 GHz is because, IIRC, these little routers are 2.4 GHz only.

It is the MR3020. The marketing image has the mode switch photoshopped out in an obvious way. The videos actually show the switch in place.
In User Manual video they connect to the device and it shows some info about it. The core is certainly what you guessed.

Model: TP-Link TL-MR3020 v1 Firmware: OpenWrt Barrier Breaker 14.07 / LuCI (0.12+svn-r10530) Kernel: 3.10.49

A lot of newer products use existing hardware platforms (esp. from startups) to get around FCC requirements. I had a look at the more detailed technical demo and it clearly looks like it adds a lot of value.
The MR-3020 is $30/each on Amazon and software is worth a lot more than the hardware :-) Hardware is commodity, Software is eating the world https://a16z.com/2016/08/20/why-software-is-eating-the-world...

I bought their device after I saw it at DEFCON and there is some good value addition in there with custom sniffer programs, channel hoppers etc. You could set some of it up yourself but I think getting it to work stably will be an issue. They've tied everything in pretty well.

Personally - it rids me of the pain of having to install Vmware, Kali and and have na external Wi-Fi card. I manage Wi-Fi deployments and this is easy to use with Wireshark.

I remember them mentioning at their DEFCON booth that a 11ac version (5GHz) is launching sometime soon. Waiting for it!

Vivek, I remember following your assembly tutorial back in 2009. It's great seeing you again, Good luck!
Love Vivek's work! attended one of his classes in Brussels years back at Brucon. One of the few people in the world who understands Wi-Fi security.
SOLVING BIG PROBLEMS WITH SMALL IDEAS!!! HACK INTO ANY BANK WEBSITE, HACK INTO ANY COMPANY WEBSITE ,HACK INTO ANY GOVERNMENT AGENCY WEBSITE, HACK INTO SECURITY AGENCY WEBSITE, ERASE CRIMINAL RECORDS, HACK INTO CRAIGSLIST AND REMOVE FLAGGING. HACK INTO ANY DATABASE SYSTEM,HACK PAYPAL ACCOUNT, HACK WORD-PRESS Blogs, SERVER CRASHED , HACK INTO ANY SCHOOL DATABASE AND CHANGE UNIVERSITY GRADES, no matter how secured. HACK INTO CREDIT BUREAU DATABASE AND INCREASE YOUR CREDIT SCORE ,HACK ANY EMAIL OR SOCIAL NETWORK AND KNOW IF YOUR PARTNER IS CHEATING ON YOU .HACK INTO YOUR PARTNER'S PHONE PICS, TEXT MESSAGES AND LISTEN TO CALLS TO KNOW IF HE IS CHEATING, UNTRACEABLE INTERNET PROTOCOL. HAVE YOU OR YOUR CHILD BEEN BULLIED ONLINE BEFORE AND WANT TO GET BACK AT THE PERSON, WE CAN HELP YOU TRACE THE ACTUAL LOCATION OF THE PERSON AND DO WHATEVER YOU REQUEST TO THE PERSONS COMPUTER. IS ANYONE BLACKMAILING YOU ONLINE AND YOU WANT US TO GET INTO THEIR COMPUTER AND DESTROY DATA AND EVIDENCES AGAINST YOU? CONTACT US TODAY AT:azzam4187@gmail.com
> scans channels 1-13 in the 2.4GHz band

I guess there is only one antenna so is it listening to every channel for 1/13th of the time or does it spend more time on channels with more traffic?

channels overlap widely. IIRC monitoring channels 1, 6 and 13 in cycle is enough.
Channels overlap, but not in the way you think. You need to monitor the correct channel to see the traffic on that channel. The overlap between channels is interference and kills Wi-Fi performance compared to sharing channels. 1, 6 and 11 in practice the only channels that should be used, not 13, and so there is where you will find almost every AP.

The others has been manually configured by someone that has no business touching networks, which may in itself make them interesting from a security point of view.

You also have to connect to the AP the packets are meant to if you want to decrypt them. Otherwise the source/destination mac addresses and the dBm are almost all you get. Traffic patterns can also be revealing, even if you can't inspect packets. And if you want to get all packets, not only you have to listen to all channels all the time but you also have to be as fast as the fastest AP around.

Btw around me now there are APs on the 1, 3, 5, 6, 7, 8, 10, 10, 11, 12 and 13 channels. I think people are desperate for some free channel and spread out as evenly as possible.

I got this after I saw it at their booth at DEFCON 25 last month. Good product especially if you just want to do Wireshark analysis without getting into the hassle of setting up a VM and external USB Wi-Fi card which supports monitor mode.
Has anyone dumped the firmware yet?