WIFI PineApple Mark V & Mobile Device Traffic

Transcription

1 2/19/2015 WIFI PineApple Mark V & Mobile Device Traffic Over the years, as more people have migrated from computers to smart devices such as the iphones, ipads, tablets, Android devices and other mobile devices, I receive several calls per week where the client contends that their device has been hacked and data is being monitored and/or captured by a third party. Finally, after all of the time spent imaging devices, both jail broken and not jail broken, and sifting through the data (that was recoverable, and readable), I had problems determining if in fact there was data being sent from the device outbound to a third party. In a recent case, I found myself digging into the applications code on a jail broken device and plist files to see how the device was configured. Was GSM transmitters turned on and off? Was data being forced to be backed up and sent to a strange location using GSM LTE? While performing research on different types of malware that could capture data and stream it out and after actually looking into the application code of a well known application that was thought to be the bad guy s streaming application, my days of application coding and web sites coding came back. How many times, (in the old days) had I set a configuration file for start-up, then manipulated the code using software switches? It came back to me from my network management days that it really didn t matter so much if specific parameters were set to on or off at boot up, because it comes down to what the application controls on the interfaces. The application can programmatically turn the parameters on (x1x) and off (x0x) on command so unless you get to the device quickly to perform the exam, you may or may not be able to determine what the device configuration was set on a specific day and time. Dah! Then why do I spend so much time looking at plist files and trying to decipher the application code up front when I should be looking at the in-line application code? That is where I will find the switches being manipulated, code insertions, and timers set. Or, would it be easier to connect the client s device to some kind of device and watch the data stream, find out if it sending something out, how often, and to where? It occurred to me if I can see what is going on then I can identify some meaningful keywords, IP addresses, application name, and other items I can now do key-word searches on the device! It would be great to be able to record the sequences and perhaps use it as evidence?

2 Necessity once again became the mother of invention! Though I did NOT in any way invent the following process, I found that it did cut down on the time spent in some mobile examinations, and resulted in having captured data as evidence. How many times have we been told by the client, I know there is someone in my phone? Here is a way I found to perhaps answer this question for the client. After searching the internet for keywords associated with my issue, I ran across a device called the a WiFi Pineapple Mark V (WPM5) device. After researching the device is was evident that it could be used for hacking, but it is also used for penetration testing and data audits (monitoring). Perhaps this is just what I need. With this device and the latest copy of WireShark can perform a type of man-in-the-middle monitor? I ordered the device from the vendor and after receiving it, it took me a day-or-two to get the configuration down correctly, to remove the clutter from the WireShark trace but at the end of the day, I am now able to monitor and more specifically capture data packets between the mobile device(s) destination domains/ip addresses and zero in on specific applications on mobile devices. Hopefully, after the data capture, I can bring the recorded illicit conversation(s) into a court of law to actually replay the event(s) for the jury such as a video recording of a shooting would be used as evidence. A video recording of an event is nothing more than a data-stream (zero s and one s) being replayed using a video application, where in this event, the WiFi Pineapple Mark V is the camera, and WireShark is the data application. Will this work? So much for this preface. Now how does it work? How did I setup and monitor the data between the mobile device the WPM5 and the monitoring/auditing device? I am not going to get into all of the features, configurations and applications that the WPM5 can provide but only specifically how it can be used as a digital forensics tool to determine traffic flow inbound and outbound from a mobile device. The WiFi Pineapple Mark 5 is a Web Server. Following the instructions provide with the install manual, I configured the device with the following settings. Accessing the WPM5 locally can be performed over WiFi or connected via an Ethernet cable locally. During my testing, I found that connecting via the Ethernet Locally revealed less clutter when using WireShark to view the packets.

3 After connecting the WPM5 to the local computer s ethernet port (wired) open your chosen browser and Enter: When logging into the WPM5, you are presented with the login screen. Enter your configured userid and password you used for the initial setup.

4 The interface will provide the several options for the configuration. This is the main menu for the WiFi Pineapple Mark V.

5 Select the NETWORK pane. This display reveals specific information associated with all of the interfaces associated with the WPM5. When selecting the wired tab, you will see that the WiFi PA has a preset (default) IP address of , a (default) Netmask Ip address , a (default) Gateway IP address of , and I chose a DNS of (which is recommended by the makers of the device) The Next tab under the Network pane is the Wired tab.

6 This tab reveals the Static IP addresses associated with the WPM5 Wired connection. This is the Ethernet connection between the WPM5 and the host computer.

7 The Next tab under the Network pane is the Access Point tab. This is where the WPM5 Access Point function is configured. During an actual mobile exam, I would recommend the examiner set this SSID to match the SSID and Password that was used natively by the client s mobile device. If the examiner is able to use the same SSID and Password used by the client to connect to their original access point, then once the device is powered up and on the network, it should automatically connect to this SSID and the WPM5. For testing purposes, I used a SSID of Guest with no password set. On the mobile device, I selected the Guest network. The mobile device connected to the WPM5 via Wifi and the data would be routed through the host computer (man-in-the-middle) connection where WireShark was used to capture/review the data packets. I did not make any other changes in the Network pane. Exit the WPM5 menu

8 Connection Summary: To make it clear, in my testing, there are three components. 1. The client s device (connected to the WPM5 via WiFi to the SSID) a. SSID used was Guest b. NO Password was set 2. The Wifi PineApple Mark V (configured as an Access Point) with the clients Access Point SSID if possible, but for testing the WPM5 SSID is set to Guest. 3. The monitoring PC work station was connected to the WPM5 using an Ethernet Cable (wired). 4. NOTE there are MS Windows network configurations changes that need to be made. (see below) 5. On the mobile device (iphone) settings, I turned OFF Cellular Data, and Turned ON Airplane Mode, then set the Wifi back to ON, (leaving Airplane Mode to ON) and selected the Guest SSID. This would force all data traffic to the Wifi PineApple Mark V. The WiFi Pineapple Mark 5 has a STATIC IP address of and like a regular WiFi Router will assign (DHCP) clients IP addresses in the range of When connecting the local computer via Ethernet or Wireless, the WiFi Pineapple will use a default gateway IP address of On the Widows (host) computer, Open the Network and Sharing Center. The Windows host computer will be in-the-middle of the network configuration. The Windows host computer needs to be connected to an existing Wifi connection with a connection to the internet. (This is your normal every-day Wifi connection to the internet) Data traffic from the client device (Wifi) will connect to the Wifi Pineapple SSID. The Wifi Pineapple will connect to the windows host computer via Ethernet (wired) connection. The windows host computer will be connected to the internet via Wifi to the examiner s Wifi Access point (not through the Pineapple).

9 On the Windows host computer, using the latest WireShark application, the examiner will be able to monitor inbound and outbound traffic to the mobile device. On the Windows host computer, accessing the network adapter settings, the Pineapple-Facing adapter (Ethernet Adapter) needs to be configured with a static IP address of (IPV4 only) do Not make any changes to IPV6. This is because the WPM5 communicates to the host computer via this IP address.

10 The Internet-Facing adapter (Examimer s WiFi Access Point) is configured normally which is obtain an IP address automatically (DHCP) and obtain the DNS server address automatically. NOTE: Access the wireless Network Connection Properties for the examiner s Internet-facing adapter. Click on the Sharing tab and check Allow other network users to connect through this computer s internet connection. This will facilitate the pass-thru connection through the examiner s computer and will allow WireShark to capture the network traffic as it passes through the examiners work station. Once WPM5 has been configured, the Host computer s WIFI adapter is set to shared, and the DNS configured on the Host Computer s Ethernet port, the examiner is ready to Startup the WireShark application on the Host computer.

11 Wifi PA Network Settings ABOUT Kernel IP Route connection Default Route is Default Route is : Wired IP Netmask Gateway DNS Access Point OPEN Access Point Guest Channel 11 Hidden (UNCHECKED) Secure Management Access Point SSID Mgmt WPA2 Password Disabled (checked) Client MODE (not selected) not connected Mobile BroadBand Not Selected

12 WireShark on Host Computer When starting up WireShark, you will see the two adapters. 1. Internet Facing Wifi Adapter (your normal adapter facing the Internet) 2. Pineapple Ethernet Facing Adapter (LAN Adapter connected to the Wifi Pineapple) On WireShark select: Capture Interfaces Check the Pineapple Ethernet Facing Adapter. NOTE: If you select the Internet Facing adapter, WireShark will capture the HOST computer s packets as well as the Pineapple packets. This will capture unnecessary packets (CLUTTER). When Selecting the Pineapple Ethernet Facing Adapter, you will capture only the packets associated with the Pineapple and the remote devices connected to the Pineapple. If you have any questions, please contact me: Gary Thomas [email protected]