Comment by cwingrav | Hacker News Reader

Comment by cwingrav | Hacker News Reader

Parent Full thread

I need help with something much more nefarious. I know of a location in a downtown area where someone has set up a malicious wifi "thing". I'm guessing the PWNAGOTCHI since the device changes patterns and comes and goes? It has learned how to use deauth to do man-in-the-middle attacks and absolutely closed down wifi in a half block radius by sending RTC packets of 12 second wait times and also waiting for others to send RTC packets and transmitting over them. Businesses close to it have no wifi. As you move away, wifi starts to improve. And no, it's not flooded as there is plenty of open air time not being used by the many devices there.

Steps taken: - Have talked to multiple business owners nearby and they can't figure out why their wifi won't work. - Comcast Business is worthless and weeks of calls by business owners and multiple tickets have led to nothing. - Have talked to the mayor of the town and their tech guy agrees something is wrong. - A "smart guy" that works for the government doing security did a quick scan and said it was because one wifi was on a channel between 1 and 6 so the overlap was causing the problem... that wasn't it. - Have approached university researchers to see if their students would be interested in looking at/for it. No response. - Have walked with laptop watching signal strength and know roughly which building it is coming from.

From what I understand, there is NOTHING one can do to attack it, other than sending massive RF interference, which would be a crime in itself.

How the heck does one get rid of this thing? Any suggestions?

Find a ham. We go nuts on people polluting the airwaves. Even wifi. Most hams will know exactly how to help.

Did you talk to the FCC?

Eg. https://www.fastcompany.com/3050060/company-that-blocked-wi-...

Yes, I told the people about this precedent. And the FCC. Not really my place to get them to call.

I think people don't believe a technical glitch is a real world problem. I've tried to tell them that it is definitely impacting their business (restaurants and cafes) and so there is in addition, a monetary impact, just as if someone was causing damage to their business that drove away customers.

Actually, numerous studies have shown that restaurants that offer wifi spend a surprising amount of time assisting customers with logging in, and the average sit time skyrockets when people are checking email instead of consulting the menu. If these aren't designated cyber cafes we're talking about, it could be good for business. On the other hand, the situation described here would drive me crazy and I would be fantasizing about picking locks and climbing on rooftops trying to find the evil little device.

My thought also. It might be a hotel or conference or somewhere the host can charge for wifi. That should narrow down the culprits.

Use the guide I posted here to locate the device responsible using the signal-strength in Wireshark (search for NKOM).

Could be you can break the device by flooding it with fake SSID, using AirPlay-ng. A bit more technical but should be possible with every Mac or most WIFi dongles that support monitor-mode (could be illegal).

I did follow it and found roughly where it is. But, have not talked to that landlord. It is a 3 story building with a handful of apartments in an old stone and brick building locked at the ground floor (i.e. refection is a problem but I imagine signal strength outside the door would be a good indicator once inside).

Not sure about breaking the device by flooding with SSIDs? Sorry, not my area here. From what I know, it isn't on any network (it does appear to have a network with an SSID though), but it is attacking up and down all nearby devices regardless of channel or SSID.

"Flooding with SSIDs" means generating lots of fake SSIDs each second to trick that device into attacking those fake SSIDs and keep it busy. Keept it genrating even more (use several wifi adapters) until the other device goes crazy. You can use some of the tools (like aireplay) from the aircrack-ng suite for generating fake SSIDs

"I did follow it and found roughly where it is. But, have not talked to that landlord. It is a 3 story building with a handful of apartments in an old stone and brick building locked at the ground floor (i.e. refection is a problem but I imagine signal strength outside the door would be a good indicator once inside)."

Have you considered that what you are seeing is unintentional ? I myself have set up many different (RX only!) experiments in GNU Radio, etc., and had to leave them sit for weeks at a time while I was busy with actual work.

Maybe someone was tinkering/playing/experimenting and just left it on ? I would suggest putting up a polite, but loud and eye-catching one page sign at the entrance to this building alerting someone that they are dramatically impacting their neighbors.

Look for the one SSID that is unaffected and I'd bet you'd find the culprit. It's possible that someone set it up solely to screw up WiFi for everyone else but I'd bet money that the reason why they did that is specifically so that the spectrum is left wide open for themselves. WiFi in an apartment right next to a bunch of businesses generally sucks because of the density, it's probably just some selfish script kiddy thinking they're some uber l33t hacker and thinking they can't be caught screwing over their neighbor's WiFi.

Contact your local HAM group.

They do this kind of thing - it's called a "fox hunt".

Confused, it seems you realize this might be a crime, but you've talked to everyone except the most obvious point of contact—law enforcement. Is there a reason that's not an option?

"There you go, giving a fuck when it's not your turn to give a fuck" --Bunk Moreland, The Wire

Finding a cop that's willing to go out on their own to find a potentially unsolvable crime is going to be pretty hard. There are way bigger cases they are already tasked making them too busy to actually get interested in this kind of non-violent/non-life threatening case. 1st world problem: my wifi isn't working because someone else's wifi is being mean.

While I agree somewhat, most decent officers will follow up if you give them enough info and make a point to keep updating them. We got a stolen phone back this way by being the "detective" and having the officers knock on candidate doors. Took about 4 hours, and their knowledge of the suspects history, family, and whereabouts was invaluable.

Agreed. But evidence? I've tried to convince the businesses to talk to the police. But, what they heck do the police/businesses do? How do you prove that there is a crime? They probably would believe me and would probably knock on doors and probably get a warrent. Then what? I'm not a professional cyber security person so how do I prove that device if found is causing damage?

Also, the device is intermittent. I can collect traces, but who do I send them to?

I called the police once when I noticed a wifi AP that was MiTM'ing traffic at the local Kroger. They sent someone out and said it was a misconfigured system in the Deli.

Guy was real nice and seemed to understand what I was worried about.

In the US, what law makes it illegal to MitM network traffic using a WiFi evil twin or other technique? I'm genuinely curious because I was under the impression there are generally no such statutes and that the only thing that would be illegal is if the MitM used found credentials.

It doesn't have to be illegal for the cops to check it out. Sometimes it scares people off.

I had an officer acquaintance who said he pulled over a car with a shotgun in the back seat and asked who it belonged to, nobody was willing to claim it. He impounded it as abandoned property despite it being perfectly legal to possess.

Possibly the CFAA?

The CFAA only applies to protected computers and intrusion into those computers. Watching network traffic or modifying network traffic in a MitM possition, without using found credentials doesn't seem to rise to the level of a computer intrusion. Of course, it's unlikely a protected computer is going to be connecting to a public WiFi AP in the first place..

https://en.wikipedia.org/wiki/Protected_computer

> The only computers, in theory, covered by the CFAA are defined as "protected computers".

> In practice, any ordinary computer has come under the jurisdiction of the law, including cellphones, due to the interstate nature of most Internet communication.

https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act#P...

Have you considered contacting the landlord for that apartment building?

Contacting the police about any computer-related crime is just as (if not more) likely to land you in their sights as it is to resolve the problem. Cops in the US routinely pin crimes on people to close cases and juke their stats.

In Norway I did that but the similarity to FCC could only look at signal strengths and radio spectrum (not data), it was the equivalent to NSA that had the power to look into network traffic.

Turn on protected management frames on the equipment, should make it at least more difficult to deauth.

Reply on news.ycombinator.com