SkyJacker Theft from Above Imagine RIT 2014

Service Set Identifier (SSID) o human readable “network name” Devices store past SSID connections Wireless Basics

Steps for connection o Probing o Authentication o Association Probing o active o passive Wireless Basics

Wireless Basics (Probing) Active Directed Probe o client sends a named-specific SSID  AP with that SSID replies with probe response

Wireless Basics (Probing) Active Broadcast Probe o client sends a null SSID  all APs send probe response

More About Probe Requests Sent by devices seeking connection Devices will automatically connect to previously associated access points Requests are NOT secret

Mobile Devices Probe Requests iPad o probes for last three associated APs iPhone o probe based on movement Android o probe based on movement

Why Should I Care? Unique SSID given in probe request o use to determine physical location Rogue Access Point with same SSID o device will automatically connect o redirection of traffic/traffic injection

Enter SkyJacker Capture and display probe requests Imitate access point o create rogue AP o redirection of traffic