okay good afternoon good evening to everyone thank you
for coming to this last presentation def can't
2000 14 so and my name is
me go to Vegas II I mean in for sex
sense doing for money said since 2006
but I starting this world nice 14 as a technological
trouble-maker let stocking in this
in this Terms Celsus 2015 I start selling
my my skills and start doing and testing security out its
malware analysis now currently I mean the
is incident response incident handling
field and
of course I'm working currently for us small ways it's information security
company
Portuguese 1.college don't mean so
and today we'll talk basically
how technology can be used to track a sore
how get can technology can betray
our our steps and can betray
where our privacy and
in this case I will only focused and mob I'll
mobile devices but currently I am studying
made researcher
other protocols and
other fields but currently in this presentation will
on this flocking in mobile devices and while Wireless
technology saw
once again what is this I'll about
how mobile devices in this case smartphones
or tablet can leak information
sensitive in from information how can our
opponent adversary a person group
company and intelligence agency or government
can exploit it can gather that information and
can exploited against you or against group of people
and alt little all temp
last resource how can they use that information
to to track you down and to follow you
not in real time but
can give you and a good
can gave him very good view
where you work
where you live and what what kind of places
to you used to to visit cell
what is this now all about i'm hopeful
do a lot using evidence and into courts
this is not mobile tracking 101
its there's other several
waste to do it I will just focused in
in one of the ways and of course
don't to and we think
illegal I don't know what are the laws in in Romania Korean other countries
even in Portugal it was a very very gray
gray area and I need to contact some national cert
some some lawyer friends to try to to understand
if if this kind of activity even if it was
just for research it was legal of not
and even those people were okay possibly this is legal
possibly possible okay we'll give it a shot
so this
currently just in in the image to to show you
everybody North evolution of ten years
I can call little back in time I still remember my
my first mobile phone
of of my father entries 93 94 in prison use mobile phone
occupy all not all the car but it is completely huge
with with the back than 10 years later
was SMS GSM
little games and then 10 again
10 years later again and we have small
computers in our pockets with processors RAM
applications and operating system
and they their own programming language
to developed certain kind of tools so this are some numbers
of smartphone its Portuguese
later soul currently currently into until
did last year it was more or less 35
of of our population have smartphones is
3.5 millions we have an increase per year of
50 50 percent so
into total amount of users
were less forty-percent as a mobile phone worth
smartphone sorry so
this is just for
information purposes okay
let's about talk once again even more nowadays
with with deformation that
at were snowed and provide to to the world
there was a peak mess out about
what is it even that possible
to to to someone or to work report government to
two tractors donato or or from spy in
worldwide and I started
this this instigation to to learn a little bit
about that and
the conclusion for myself yes it is true
only only two only using only gathering information of
wifi Wireless salt this is normally
what happened when your smartphone or tablet or computer
I try to connect with them
to a router an access point said the probe request
hey I society whatever are you there
than the access point we'll
as for it yes ms II and
SSID that you're looking for please you can
you can you can connect and your smartphone or devices
will connected Sol
and this is standard
its I don't know wide internet thing internet
Engineering Task Force was this a good idea
just that all devices should
save to last societies that were connected
and once that device
find found and an access point or
wireless network with the same SSID try to connect
automatically don't ask just
connect but for that process
to begin they need to always send
all societies they were
connected ond on the previous I'll
our devices save that kind
are information and send it in the wild
cell wise nice so important
so we have a device smartphone with a wireless technology
we have mac Address
the same and that mac Address
will lead us two-person so
mac Address unique added to fire per person
saw this is currently
little bit outdated
I O S currently only saves three last connect
SSID is and a leak it out currently I believe the US
8 now just I'm
Fort Jen's right it depends a lot of the vendors
and diversions bat beware
with the new and you enter 5 not sure I believe the lollipop
looks like even if you have your WiFi
is able day still collecting it
and certain applications and
shoppers operating system as access to
all wireless networks that
are surrounding you Windows Phone I
don't don't have any database since this is a standard
and probably he'd be hastened
in this way so best way to compete just two
to collect this this coming week information with
with narrow down opened
open source and tools just to coffee or our
Wireless devices to be
a receptive to be a passive just to to
on passive monitor mode and it is
is example of what kind with permission you can
gay access you see that
discount mac Address the first all network
on bus began mates it
it's it's a very famous portuguese mall cell
and why is this a problem
well people tent to
connect to networks day and trust
or at least they use they think they can trust
home workplaces restaurants
bars cinema malls
and the SSI see SSID is tend to be quite unique
is especially and your workplace and
and and and and homies is very complicated to
to find 2345 SSI
same societies at least in the same country
of course we need to tweaking or the SSID is from
public wifi networks but
generally they are quite quite unique
and what is
when is the magic begins is when
you can correlate information when
you note that access point that wireless network
with that SSID is G located when
you have the geolocation the coordinates when you know
that
access point is soul weekend
track our people or at least we can know
what what what are two paths while
what the OT doing where where they connect
cell and we can of course visualize it
this with Google Maps and Google Street View but
how can we no
we r Wireless networks
way our located basically they are
yes and of course
weekend learn a lot of
a person just to analyze
the network C he it connects
K we see a mcdonnell's
free WiFi and wireless networks that okay
free shops are I'll whatever
okay this is just a normal person average Joe but
we attacked someone that pat is connecting
or currently connecting 20 5
100 company internet wifi
or dotted connecting to to a location that
that we know that is very pricey
okay this could be a very very interesting target for us
a burglar for example but
where okay desist on
examples of 10 my victims
with us with the permission at
talk week we can now with with Google Maps
where the location
where de where he was connected
but where we can gather discovery for mation
where can we get access
good geolocation to the coordinates
okay their ways and call database colored window but net
its Open Data and everybody can
can use it it's run by by volunteers for example
I can use network over here at
death camp and nice n to to this but the database okay
def and Afghan is using is located
over here with this coordinates but
for my point of view at least in the Portuguese case
it was not the best approach then we have
I don't know if you remember on on just news a couple of years ago
that they found out that the court the cars of
the Google Street View were collecting did
the SSID is and the wireless names
and saving it and went with that
saving did geolocation
of them and which was a a guide just
don't don't remember did the name of it and
it with and until a couple of years
by now and it was
possible 22 axis to
to this kind of of information currently I believe Google just disabled is
this functionality and they are only selling
selling it for I don't know intelligence
agencies or governments the company's own
or of course I can use a drone
it will be cool but a little bit expensive or
at least our police can do this
and 10 gather information about manifestations or
whenever the they want
but my approach was a little bit more
different I just I will
create my own map my
on database just to research purposes so
was a everybody can can do this cheap laptop
Android with iraq Raspberry Pi important is to have
while standard can
receive wireless
wireless connections and open source application
case metal or and erode and support
demands of G GPS
I had a little bit of problems trying to configure
I paradigm to to work with GPS
and the two 22 made
some some thirty scripts to to do it
that it works GPS tangle thirty-year-olds
back for your laptop or for whatever
okay and of course and good hiking shoes or you can do
getting your car and do it
into your neighborhood or in your city and okay saw
this is the most important think
to a target to target
operation most important miss to identify
to create a link between a person a face
and the mac Address sense
we know that kind of mac Address
are corresponding to to a person
okay that is game over we can know
if that person radios of
when 100 meters now we can deploy drones
a llover 2cd all over the streets and we can now
attacked X person is in this particularly
case location
and of course Cano did where he use
usually connect and possibly no
he's home address
so at this is normally the passive
way to do it just to
capture and
did information are using this that it is laptop
Justin in monitor mode just going walk
Ind
in the street in the first approach just walking in just
and receiving the information of
the access points i worth and
saving did the GPS data
of it and of course saving it
to into a database and mysqld
database backed the same way can be in use
to again information about your
your smartphone's on our your device and
and we can do in a more aggressive way
we can create able to attack and
I believe a
at least the last which are the people know see don't know I will
I will explain it so the temptation over here it's
important over here is to control
the flux the communication channel
and creating evil twin attack weekend weekend controlled
communication channel can control the communication channel weakened snippet
can sniff it we can access more information about
with this person is social networks email
any kind of cool identify your
and in a more aggressive way we can inject
our own malicious called JavaScript code we can past
the by the resort applications they are trying to to die alone
and and install and this is completely
invincible stupid
to our target and of course more tactical exploitation
after we gain access to data device we can have
access to whatever did information day
day where he have okay
just quick notes evil twin attack as we keep
we keep Wikipedia this is
steel works especially when you connect
to open wife eyes with with health
any kind of authentication sense
your smartphone sensor device
will automatically automatically connect to
to to tease open wifi don't check
the just don't know if it is true or not OK you have
this SSID I will connect if any of this and malicious
access point or malicious device he will connected
anyway thinking that access point is
widget budgeted by
it is not ten an attacker can
start controlled
communication flow saw again this is the
aggressive way
to do so you can
create your own server
your own laptop price paid by whatever
DHCP server with a bind for
for DNS weights to
proxy to to start sniffing and
the communications okay erode and to beef
for for injection
of our mullis's JavaScript and of course
MySQL database to to save all information
of course this can be done by its laptops and rights or russ berry pies or
whatever that run
Linux or have what I double
K K this can be used by
K widget in legitimate purposes
okay can be to to a restaurant or or
or shop trying
to see try to shake
your hours of
how many people are are in this shopping disc and
this kind of hours and of course it can be used to
to helped did law enforcement's to identify and follow criminals
and of course can be used to more sinister
proposes to track not only a single individual but
to track all all true panel
and elation okay
this is
the architecture of can be dining
large-scale we have several drones Ind
deployed on the wild just
get information about declines
this kind of
and of information and can be saved
in a storage server and it will be sent to another server where
they have to it coordinates server
will scheck did the SSID is
are India the server
with the GPS data then on the
left path weekend we can see
after evil twin attack if it was
well secede we can see what we can do
to we can control to flow channel so can use my cell strip
to 12 SS to to to force
to past forms secure check secure channel to plaintext channel
okay man in your proxy we can inject
our malicious
JavaScript or and doing
traffic sniffing soul
this is the metrics that I gather with
in in Lisbon so one
1200 115 1500
units the vice Pres our it's a lot
soul there's a lot of people that use
all not always but don't have feeling
don't don't know trust
too much in the its in this device so Lisbon Airport
traffic jams subway stations malls tourist stops
okay just it's the lock a lot of people's
for for just one hour and
from that exactly
was gather wat almost 900
unique devices from that one-quarter
leaks at least one SSID
but the they were a lot mordant
leaks 23 I shake
there were some with 89 10 and
8 percent for a vote for the rule or we know of at least that
day connected to open
wife ice network so or vulnerable to or at least
think it'll full able to an attack so
but I can't protect for yourself okay ternal wall
your WiFi devices when you're not using it
okay don't say your societies that use
and cool way to do it was possibly randomized are
your Mac Address so if your adversary was
trying to create a link
or try to target you he will never know
at least it would be more more more difficult to
to know that that and mac address that's always changing
it will you saw
this is this this is nothing you
this problem was it a identify its
in between 2000-2005 allotted
talk about it how it was a very bad idea
to devices connect the Altima connect
in out away tuned
to wireless networks there was something similar was made by the company sense
post in London in
2000 13 I believe they the creator
K very who Framework about this i think is
loopy framework go negotiated check it out
and currently the litter Nick from to find foundation is creating
a database with all the devices the modals
and mortars all and companies that
produced this this kind of device that are vulnerable
to this problem so
in the future as I say I will
truly interesting in
study more protocols that can using use
to identify
or at least can booty your privacy any
in jeopardy can people to wifi GCN GPS
and FC or if idea and
the funny part is all these protocols
Irene our smartphones so
if you turn off what your wifi
probably one of other particles will
will be good enough to current
track you so I
currently have little teamo over here
about my just
three
non just
known okay with
with the data that I can access for
for the study and just
okay we'll know blasted the first
art like addresses of the devices and on the right parts
are GPS data so we know
this mac Address where
accessing some point of their life
to were in this access points
GPS so am
keys everything just
to if you have
any questions you can contact me to in to tease
email so now thank you very much
guess
question i kno dat
the wireless devices sand the up
as society's in plain text just in the probe requests
when they connect to certain when they try to connect
first but after day are connected 30 access point that don't sound
probe request anymore is that right okay so
I guess that when you collected this data use and
fate the of packets and and set up something like
air I know that there is a method with area a replay and GE
from the aircraft Angie seats to you up
configure it to responds you all the program quest
and you can actually see the lists of the societies on all the devices around
you provided the fact that before
you send a pic the of pocket or for everyone to disconnect
identify I didn't say any did
packets I was just in monitor mode just a passive
I didn't you just use their adopted in tunis anything no no no no no no
ok as because that
will be against the law and okay K
yeah I can confirm that as I D get broadcast
sort percy to that completely passively to Android
this like out a scanning feature which was in the early versions
so which was pretty easy 2-0 now you need to get in
some sort of in haines mood to
dis cost like Google network detection
something that is exactly and this features for some time India already
and basically even if wifi is of
you stop you continue broadcasting US's ID's and Google's XD
and collecting there while a slander and looks like you're
mobile is violence switch off but it's not exactly inside in it
on by default there is a bill that many went well what question
to do you know if you are airplane mode that
that that feature it's currently enabled
as to the not come from that
I was Agnes not his
you okay
thank you so much for presentation okay thank you
thank you all for coming see you all next year