802.11 Massive Monitoring

Presented at DEF CON 23 (2015), Aug. 8, 2015, 5 p.m. (60 minutes).

Wireless traffic analysis has been commonplace for quite a while now, frequently used in penetration testing and various areas of research. But what happens when channel hopping just doesn't cut it anymore -- can we monitor all 802.11 channels? In this presentation we describe the analysis, different approaches and the development of a system to monitor and inject frames using routers running OpenWRT as wireless workers. At the end of this presentation we will release the tool we used to solve this problem.

Presenters:

• Andres Gazzoli - Sr Developer, Core Security
  Andrés Gazzoli works at Core Security and is part of the Core Impact Pro developer team. He is a C++ developer with extensive experience in UI development. He enjoys everything related to wireless technologies and privacy.
• Andrés Blanco - Sr Researcher, Core Security   as Andres Blanco
  Andrés Blanco is a researcher at CoreLabs, the research arm of Core Security. His research is mainly focused on wireless, network security and privacy. He has presented at Black Hat USA Arsenal, Hacklu and Ekoparty, and has published several security advisories. Twitter: @6e726d

Links:

• https://defcon.org/html/defcon-23/dc-23-speakers.html#Blanco
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 slides/DEF CON 23 - Andres Blanco and Andres Gazzoli - 80211 Massive Monitoring - Slides.mp4
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 video/DEF CON 23 - Andres Blanco and Andres Gazzoli - 80211 Massive Monitoring - Video.mp4
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 video and slides/DEF CON 23 - Andres Blanco and Andres Gazzoli - 80211 Massive Monitoring - Video and Slides.mp4 (Video and Slides)
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 slides/DEF CON 23 - Andres Blanco and Andres Gazzoli - 80211 Massive Monitoring - Slides.srt (subtitles)
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 video and slides/DEF CON 23 - Andres Blanco and Andres Gazzoli - 80211 Massive Monitoring - Video and Slides.srt (subtitles)
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 video/DEF CON 23 - Andres Blanco and Andres Gazzoli - 80211 Massive Monitoring - Video.srt (subtitles)
• https://www.youtube.com/watch?v=uUCv9TQ9B7I

Similar Presentations:

• DEF CON 14 (2006) / Fun with 802.11 Device Drivers
• DEF CON 11 (2003) / Abusing 802.11
• DeepSec 2016 „Ten“ / 802.11 Complexity. An Introduction to 802.11 Protocol Chaos