1. SkyJacker Theft from Above Imagine RIT 2014

2. Service Set Identifier (SSID) o human readable “network name” Devices store past SSID connections Wireless Basics

3. Steps for connection o Probing o Authentication o Association Probing o active o passive Wireless Basics

4. Wireless Basics (Probing) Active Directed Probe o client sends a named-specific SSID  AP with that SSID replies with probe response

6. Wireless Basics (Probing) Active Broadcast Probe o client sends a null SSID  all APs send probe response

9. More About Probe Requests Sent by devices seeking connection Devices will automatically connect to previously associated access points Requests are NOT secret

10. Mobile Devices Probe Requests iPad o probes for last three associated APs iPhone o probe based on movement Android o probe based on movement

12. Why Should I Care? Unique SSID given in probe request o use www.wigle.net to determine physical location Rogue Access Point with same SSID o device will automatically connect o redirection of traffic/traffic injection

15. Enter SkyJacker Capture and display probe requests Imitate access point o create rogue AP o redirection of traffic