Wireless fun with your Macbook

Since OSX Snow Leopard there is an Airport wireless API that allows some fun tricks but it takes some minor setup to use it properly...

First make sure you can easily run the new Airport API utility:

sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/sbin/airport

Now you have easy ability to scan and sniff packets:

airport scan



And the sexiest feature is to dump packets in monitor mode:
sudo -s airport sniff 11

Note that you still cannot actively inject and sniff without using a realtek USB wifi card.

To stop the airport utility from sniffing drop it into the background and kill the process ID:

ctrl+z
then
sudo -s killall airport

So what kind of attacks are possible without injection? Well any wireless traffic (non encrypted via WEP/WPA/HTTPS) on the channel your sniffing you can then read with a packet inspection tool like tcpdump which comes by default on your Mac. A pcap will be saved in the /tmp directory, simply read it in with tcpdump to see what fun you captured!

Gregs-MacBook-Air:tmp gregmartin$ ls /tmp |grep air
airportSniffmcg8L2.cap

To print the ASCII content of all HTTP traffic:
tcpdump -s0 -Anr /tmp/airportSniffmcg8L2.cap port 80

or

tcpdump -s0 -Anr /tmp/airportSniffmcg8L2.cap port 80 |grep -i pass



Here we see an Android phone at the Boingo wireless captive portal ready to log in!

Of course you can use any libpcap tool such as Wireshark to analyze the resulting file.

American Airlines now has in flight Wifi

American now has Wifi access on select planes, including 747 and MD-80's. Fees are $9.95 US for an all day pass and are currently running a free promotion for first time users.

The free promo requires registering an account using only an email address and code which they provide, no credit card is required. This means you can probably sign up using multiple email accounts and username for as long as the promo lasts.

When you sign up it assures you that the system is very secure and tested thoroughly by the FAA, the captive portal authentication is SSL based but after authenticating you are still vulnerable to any standard wireless man in the middle attack as there is no WEP, WPA or VPN protection.

Setting my radio to monitor mode quickly showed everyone's traffic on the flight, so security is non-existent at best.

Speeds were very good, similar to DSL connection but lots of intermittent latency made video streaming from Hulu unwatchable.

Here is a screen grab of an in-flight speed test.