Stephan Bayer September 9, 2004 INLS 187

What is it? War Driving Software – WarDriving v. The benign act of locating and logging wireless access points while in motion. Access Point (AP) Identification Software

Its Purpose Allows you to map out vulnerable APs for future use or pinpoint them for hardening

Not a “Sniffer” or WEP Cracker Originally released as a tool that analyzed the header and IV fields of packet to determine – SSID – MAC address – WEP Usage – WEP Key length (40 or 128 bit) – Signal range – Access point vendor

Acronyms of things this software looks for SSID (Service Set Identifier) MAC (Media Access Control) IV (Initialization Vector) WEP (Wired Equivalent Privacy) The IV of a WEPpacket is included after the header and is used in combination with the shared secret key to cipher the packet’s data

War Driving Set-Up

GPS Netstumbler will detect relative position of APs with GPS Records GPS coordinate for the highest signal strength found for each access point Can be used to create maps Publish your maps to the web!

How it works Probe Request sent to broadcast destination address Response from APs contain network configuration information SSID WEP status etc

Instructions Download and install NetstumblerNetstumbler Set SSID or Network Name to ANY Start Netstumbler and click on the green arrow on the toolbar

Filters WEP usage IBSS or BSS type network IBSS – group of systems without AP – Not good to use as a bridge to internal LAN

Weaknesses Relies on one form of wireless network detection – Broadcast Probe Request Wireless vendors offer an option to disable the feature on APs

Conclusion AP identification software – Can actually be used to set up your home network Used for War Driving Not illegal, but ethics are questioned Sources: Hacking Exposed, Google Image Search