Пълният препис на Pineapple Pager: Wi-Fi Hacking, Spying Smart TVs and a $118K Ad Bill

00:04:51.519 But we've got another article too that maybe we dig into next time. 00:04:51.519 --> 00:04:54.240 And and we ought to do a little studio testing here, Cam. 00:04:54.240 --> 00:04:59.040 But the LG TVs apparently are just recording ramp. 00:04:59.040 --> 00:05:00.319 I mean, we knew this though, right? 00:05:00.319 --> 00:05:16.800 Like I don't know how this is news, but they're recording even apparently when they are quote unquote off, and then they're storing the information and they're and they're really um vigilant about getting the data off of the machine, port hopping and whatnot, so it's hard to block them. 00:05:16.800 --> 00:05:21.040 But uh that might be an interesting to do a little lab work here and actually see if we can watch it. 00:05:21.279 --> 00:05:23.920 Well, let's let our uh live viewers know what we're talking about here. 00:05:23.920 --> 00:05:27.040 LGTB caught spying even when offline or on standby. 00:05:27.040 --> 00:05:30.879 Gamer Nexus gives you another reason to never connect your smart TV to the internet. 00:05:30.879 --> 00:05:37.120 I think that's a little overboard, but Cameron was supposed to be on last week and he was a little busy taking care of some business. 00:05:37.120 --> 00:05:39.040 What kind of business was he taking care of? 00:05:39.279 --> 00:05:40.160 Well, you have to ask him. 00:05:40.160 --> 00:05:42.160 Oh, see, Cam, what were you taking care of? 00:05:42.160 --> 00:05:43.519 You ditched us. 00:05:44.399 --> 00:05:48.160 It was something that was more important than the podcast, unfortunately. 00:05:48.160 --> 00:05:50.319 Oh there it was. 00:05:50.480 --> 00:05:52.639 There you heard your first folks. 00:05:52.639 --> 00:05:54.800 We're not important enough for Cam. 00:05:55.439 --> 00:05:56.959 Cam, you brought this up last week. 00:05:56.959 --> 00:06:02.000 I'm trying to find one without a pop-up because I don't like I can't have my VPN on when uh when we're doing the podcast. 00:06:02.000 --> 00:06:04.480 Otherwise, I'm gonna be dropping in and out like Nick over there. 00:06:04.480 --> 00:06:09.519 But um how how did this come across to your your your news feed? 00:06:09.519 --> 00:06:10.560 And what do you think about this? 00:06:11.040 --> 00:06:17.360 Yeah, this started popping up on social media like uh when I want to say one week ago, maybe two at the most. 00:06:17.360 --> 00:06:20.480 Um Gamers Nexus is a YouTube channel. 00:06:20.480 --> 00:06:32.240 They kind of like uh they like exposing things like digging into the truth, kind of an investigative journalism kind of work, and they focused in on LG TVs. 00:06:32.240 --> 00:06:39.519 I want to say first and foremost that I don't think LG is the only company doing this. 00:06:39.519 --> 00:06:42.879 Um this is probably pretty normal. 00:06:42.879 --> 00:06:49.279 However, LG is the brand that they picked to really dig into, and they found some really interesting things. 00:06:49.279 --> 00:07:01.120 Uh basically, what

what they found is it is it is listening all the time, and and that what it's picking up of your voice does get translated into text inside the TV. 00:07:01.120 --> 00:07:12.480 So the the the kind of thought process there is if somebody had access to your TV, say a threat actor, they could see in plain text what you're saying in front of the TV. 00:07:12.480 --> 00:07:15.279 And it doesn't matter if the microphone's muted or not. 00:07:15.279 --> 00:07:24.000 A lot of TVs have a little switch at the bottom to make you feel better about, you know, you can mute the microphone, prevent it from activating, but it doesn't actually stop it from listening. 00:07:24.399 --> 00:07:32.959 You know, what what what are the ramifications of someone, you know, it's probably about building that bigger social profile if you really wanted to target somebody, right? 00:07:32.959 --> 00:07:40.079 Like if you really wanted to target a high net worth individual, for example, and you could start to socially gather details. 00:07:40.160 --> 00:07:40.319 Trevor Burrus, Jr. 00:07:40.319 --> 00:07:43.839 Like a Minnesota Viking, like we talked about, I think it was last year or the year before. 00:07:43.839 --> 00:07:44.480 Yes. 00:07:44.480 --> 00:07:48.480 Dallas Turner got fleeced for like 140k or something like that. 00:07:49.279 --> 00:08:00.399 You know, speaking of high net worth individuals, I I heard an interesting stat the other day that we're talking a little bit about social media, but Mark Zuckerberg, I think his security detail is like 90 people, right? 00:08:00.399 --> 00:08:01.759 Billionaire guy. 00:08:01.759 --> 00:08:04.480 Um Warren Buffett, zero. 00:08:04.480 --> 00:08:07.680 Also billionaire, but different businesses. 00:08:07.680 --> 00:08:08.000 Trevor Burrus, Jr. 00:08:08.079 --> 00:08:09.920 More respected than the Zuck, though, I think. 00:08:09.920 --> 00:08:10.240 Yeah. 00:08:10.240 --> 00:08:14.959 People would like to troll troll Zuckerberg a lot more than Warren Buffett. 00:08:15.199 --> 00:08:15.439 Right. 00:08:15.439 --> 00:08:17.120 Are you smiling on the camera, Josh? 00:08:17.279 --> 00:08:17.519 I am. 00:08:17.519 --> 00:08:18.160 Okay, good. 00:08:18.160 --> 00:08:23.920 And you know, I think Warren Buffett probably lives a little bit of a different lifestyle than Mark Zuckerberg. 00:08:23.920 --> 00:08:24.399 Probably. 00:08:24.399 --> 00:08:30.399 He's not out there doing jujitsu, you know, in San Francisco and rolling around in Lamborghinis and stuff. 00:08:30.399 --> 00:08:33.120 I think he still does he still live in Omaha in the Bronx? 00:08:33.120 --> 00:08:33.679 Yeah. 00:08:33.679 --> 00:08:34.480 Okay, well, there you go. 00:08:34.480 --> 00:08:35.519 I always thought about that. 00:08:35.519 --> 00:08:43.039 You know, if one remember back in the day when it was like, well, I mean, this still happens, like the paparazzi and stuff, and it'd be like Britney with her shaved head and stuff like that. 00:08:43.039 --> 00:08:44.879 It's like she's still going out the deep end. 00:08:44.879 --> 00:08:45.519 Yeah, yeah. 00:08:45.600 --> 00:08:46.879 Hey Crazy Brittany. 00:08:47.120 --> 00:08:48.320 Hey, I got an idea. 00:08:48.320 --> 00:08:50.559 Why don't you move the hell out of Hollywood? 00:08:50.559 --> 00:08:50.720 Yeah. 00:08:50.720 --> 00:08:53.840 Should shouldn't everybody have a right to be wherever they want to be? 00:08:53.840 --> 00:08:56.960 I don't think people have a right to be where they want to be. 00:08:56.960 --> 00:08:59.919 I mean, I think they have the freedom to move about freely. 00:08:59.919 --> 00:09:05.200 But uh, I mean, you know, it's it's get people are just trying to make some money out there, you know. 00:09:05.200 --> 00:09:06.240 They snap a picture. 00:09:06.320 --> 00:09:09.759 It's like you don't think people have the right to be where they want to be, Josh? 00:09:09.759 --> 00:09:13.200 Well well now we're getting into the hard-hitting stuff here. 00:09:13.519 --> 00:09:14.879 Josh, maybe you want to go over to Iran. 00:09:14.879 --> 00:09:18.639 I want to be on the moon, but I don't have a right to be there, you know. 00:09:18.960 --> 00:09:20.480 Who's to tell you you can't? 00:09:20.799 --> 00:09:22.639 If you build a rocket, you could go to the moon. 00:09:23.279 --> 00:09:28.720 I mean, everybody has a right to a a peaceful existence, maybe, but like, yeah, I don't know. 00:09:28.720 --> 00:09:31.039 Like you're brought you you're you know, public figure. 00:09:31.039 --> 00:09:31.600 I don't know. 00:09:31.600 --> 00:09:39.360 I have no idea what that's like, but I I just think if I were Britney in 1997, I'd be getting the hell out of Hollywood, is all I'm saying. 00:09:39.360 --> 00:09:42.159 Maybe maybe on one hand she liked the attention. 00:09:42.559 --> 00:09:43.759 Oh, that's gotta be it. 00:09:44.000 --> 00:09:44.320 Yeah, yeah. 00:09:44.320 --> 00:09:48.720 It's like Zuckerberg, maybe he likes having an entourage because that's the only way he can have friends. 00:09:49.039 --> 00:09:49.919 Feels important. 00:09:51.440 --> 00:09:52.879 Pineapple pager. 00:09:52.879 --> 00:09:55.440 We've been uh wanting to talk about this for a while. 00:09:55.440 --> 00:09:55.919 Yep. 00:09:55.919 --> 00:09:58.480 Eric's got one, Cameron's got one. 00:09:58.480 --> 00:09:59.759 Do you want to show that to the camera? 00:09:59.759 --> 00:10:02.399 Like, do the whole yeah, there you go. 00:10:03.360 --> 00:10:05.440 I'm not cool enough to have one. 00:10:05.679 --> 00:10:06.000 No. 00:10:06.000 --> 00:10:10.879 No, Eric bought Cameron's for for him, and uh, we still haven't got one yet. 00:10:10.960 --> 00:10:16.799 So I don't know what's going on there, but uh when we hit a hundred thousand downloads, then you get one. 00:10:17.120 --> 00:10:18.320 Then you get one. 00:10:18.320 --> 00:10:20.960 We've already passed a hundred thousand downloads. 00:10:20.960 --> 00:10:22.399 No, no, I haven't okay. 00:10:22.399 -->

00:10:24.159 Here's the pineapple pager. 00:10:24.159 --> 00:10:28.399 Cameron, give us a little overview, tell us what it does, tell us what people are using this for. 00:10:28.639 --> 00:10:47.840 All right, so the pineapple pager, or I'm gonna say uh Wi-Fi Pineapple has been around for quite a while now, but it's always been a Wi-Fi reconnaissance and kind of hacking tool, and it's gone through many um revisions, many different generations, and this is the most recent. 00:10:47.840 --> 00:10:53.200 This is kind of the culmination of the series of Wi-Fi pineapples. 00:10:53.200 --> 00:10:58.639 This thing packs a lot of power into a small form factor. 00:10:58.639 --> 00:11:05.120 One of the biggest things that it's recently come out with is it can do Wi-Fi 6 now. 00:11:05.120 --> 00:11:13.519 Um, previous generations of Wi-Fi Pineapple could not do six gigahertz, but this thing can support Wi-Fi 6E. 00:11:13.519 --> 00:11:25.759 There's one downside, and that all of the Wi-Fi pineapples and actually any Wi-Fi pen testing tool nowadays has the same problem is it can't touch WPA3 networks. 00:11:26.240 --> 00:11:28.480 You mentioned Wi-Fi 6, right? 00:11:28.480 --> 00:11:40.320 Which you're talking about true Wi-Fi 6, WPA3, but the Wi-Fi 7 standard is actually Wi-Fi 6, is it not? 00:11:40.879 --> 00:11:46.879 I know so Wi-Fi 6 is still 5 gigahertz and Wi-Fi 6E is 6 gigahertz. 00:11:46.879 --> 00:11:48.080 So that's a small correction. 00:11:48.399 --> 00:11:48.879 There it is, yeah. 00:11:49.200 --> 00:11:51.840 6E is 6 gigahertz as well as 7. 00:11:52.639 --> 00:11:58.960 So the Wi-Fi, what they call Wi-Fi 7 is actually 6E, I think. 00:11:58.960 --> 00:12:00.159 Yeah. 00:12:00.159 --> 00:12:02.480 Or or yeah, is it 5G E. 00:12:02.720 --> 00:12:03.759 It's a false advertisement. 00:12:04.080 --> 00:12:05.120 It it kind of is. 00:12:05.120 --> 00:12:06.080 Yeah. 00:12:06.480 --> 00:12:08.879 This pager though is is really new though, right, Camp? 00:12:08.879 --> 00:12:11.120 Didn't it just come out like within the last year? 00:12:11.519 --> 00:12:12.000 Yep. 00:12:12.000 --> 00:12:13.759 It's uh it's the newest tool. 00:12:14.080 --> 00:12:15.279 After DEF CON or something? 00:12:15.519 --> 00:12:16.559 Yeah, something like that. 00:12:16.559 --> 00:12:21.039 It's the newest tool for Mac 5 um in the Wi-Fi Pineapple series. 00:12:21.519 --> 00:12:22.879 So it's not a pager, actually. 00:12:22.879 --> 00:12:26.720 I mean, well for people that were born post 9-11 like yourself. 00:12:26.720 --> 00:12:28.879 Um pre. 00:12:28.879 --> 00:12:29.360 Oh, okay. 00:12:29.360 --> 00:12:30.639 Okay, you're OG. 00:12:30.639 --> 00:12:31.440 2000. 00:12:31.440 --> 00:12:32.159 Okay. 00:12:32.159 --> 00:12:32.960 All right. 00:12:32.960 --> 00:12:35.600 I was like, yeah, I was getting ready to go to college. 00:12:35.600 --> 00:12:45.519 But so if you remember the movie like Hackers, or if you were alive during the 80s and 90s, um, if you were a high octane business professional, you had a pager, right? 00:12:45.519 --> 00:12:47.039 I'm sure Eric had one, right? 00:12:47.200 --> 00:12:48.960 I did, I'm sure you were rocking the pager. 00:12:48.960 --> 00:12:49.440 For sure. 00:12:49.440 --> 00:12:56.639 I I I never actually had the beeping pager, you know, like where the kind of just sends the little message. 00:12:56.639 --> 00:12:57.600 Never had that. 00:12:57.600 --> 00:13:03.840 The first one I had was the BlackBerry Rim, and it might have even been before Blackberry had it. 00:13:03.840 --> 00:13:13.120 No, I think it was the Blackberry Rim 960 or 950, where it was this pager form factor, and it had a full keyboard on it. 00:13:13.120 --> 00:13:19.600 So you could do um, you could do email and texting over the thing. 00:13:19.600 --> 00:13:33.840 With that pager, you you could text a number or email a number, and then it would make a phone call and then transcribe what you had said into voice. 00:13:34.159 --> 00:13:36.080 And people were using these to hack and stuff. 00:13:36.080 --> 00:13:41.600 Because like I remember back in the early hacker days, like people were hacking using payphones, um, pagers. 00:13:41.600 --> 00:13:42.320 Oh, yeah, yeah. 00:13:42.320 --> 00:13:43.679 This was the early hacker tool. 00:13:43.679 --> 00:13:44.720 That was freaking. 00:13:44.720 --> 00:13:46.720 Freaking, right, yeah, on the phone. 00:13:46.720 --> 00:13:58.000 Um, where you could like you know, I think on the movie hackers, like if you could get the dial to tones of the buttons and then you could put those into the uh the mouthpiece of the phone and and get through to certain certain areas. 00:13:58.320 --> 00:13:59.759 You could play those tones back. 00:13:59.759 --> 00:14:00.080 Yeah. 00:14:00.080 --> 00:14:00.559 Yeah. 00:14:00.559 --> 00:14:15.919 And then there was a paper clip trick where if you put the the paper clip into the mouthpiece of the receiver and held it up to the phone, like touched it, kind of shorted the connection out, you could make a free call. 00:14:16.240 --> 00:14:16.559 Okay. 00:14:16.559 --> 00:14:23.440 So we evolved, you know, this this whole like idea of hacking with a little tool, I think, is carried on over to the pineapple pager, right? 00:14:23.440 --> 00:14:27.600 Because it's not actually a pager, but it's that the point is it's a little fun tool. 00:14:27.840 --> 00:14:28.159 Yeah. 00:14:28.159 --> 00:14:31.679 So this this is a total callback to those days. 00:14:31.679 --> 00:14:40.159 And it's actually designed very specifically after the like an the old Motorola advisor pager. 00:14:40.159 --> 00:14:44.559 I get I can't show it, but it looks like just like it. 00:14:44.960 --> 00:14:46.480 I'll find I'll find it for you. 00:14:46.480 --> 00:14:47.600 So keep going. 00:14:47.600 --> 00:14:48.399 Tell us, yeah. 00:14:48.399 --> 00:14:52.080 So I mean hackers like these uh these little gadgets I've noticed. 00:14:52.080 --> 00:14:52.799 Right? 00:14:52.799 -->

00:14:56.399 I mean, it kind of stems back from what we were talking about with the freaking and the pagers. 00:14:56.720 --> 00:15:04.320 The thing about what this can do is you can actually do pretty much anything the pineapple can do using your own hardware. 00:15:04.320 --> 00:15:10.480 But the nice thing about this is it it's built to do all this so easily with an easy-to-use interface. 00:15:10.480 --> 00:15:10.879 Right? 00:15:10.879 --> 00:15:12.320 Like it's got a color screen. 00:15:12.320 --> 00:15:16.320 You can scroll around, you can download some payloads and just execute them. 00:15:16.320 --> 00:15:19.039 That's what makes these uh so useful. 00:15:19.039 --> 00:15:27.200 And like this, the Pineapple pager, for example, right out of the box, it's already scanning your Wi-Fi networks and collecting handshakes where it can. 00:15:27.200 --> 00:15:34.080 Um, one of the problems I've ran into, of course, nowadays is um a lot of networks are WPA3. 00:15:34.080 --> 00:15:44.960 There's still a ton of backwards compatibility with WPA2, but pretty much all modern devices are defaulting to that stronger encryption method. 00:15:44.960 --> 00:15:51.120 So this thing isn't quite catching quite as much as it could have maybe a year or two ago. 00:15:51.120 --> 00:16:05.039 But I've still still caught like at least one handshake at home just off of my own uh you know legacy network that I have to have set up for like the the doorbell camera and whatnot. 00:16:05.519 --> 00:16:40.559 So maybe a little um intro to Wi-Fi, just 30-second overview, which is something interesting about how Wi-Fi works and how uh and and why we're able to or used to be able to catch these handshakes before WPA3 with Wi-Fi devices, your your your phone or your computer, um, they're always if they're not connected to a Wi-Fi network and Wi-Fi is turned on, they're always trying to connect to a Wi-Fi network. 00:16:40.960 --> 00:16:42.399 Kind of like the LGTV. 00:16:42.879 --> 00:16:44.799 Kind of like the LGDV, yeah. 00:16:44.799 --> 00:17:01.039 So they're they're always beaconing out, um, for example, like let's say you connected to a Starbucks Wi-Fi network, and then you connect it to your home network, and then you were at work and you connected to the work network. 00:17:01.039 --> 00:17:06.400 So you've got those three networks in your Wi-Fi history. 00:17:06.400 --> 00:17:16.079 And then you go, say, to um a restaurant and you're gonna watch the football game and bring your laptop out to a little work. 00:17:16.079 --> 00:17:30.799 Well, when you when you open up your laptop and if Wi-Fi is enabled, it's gonna try to reach out to those three networks, because those three networks are in its history, if you haven't cleared its history, and it's gonna say, you know, home network, are you there? 00:17:30.799 --> 00:17:35.279 Work network, are you there, or Starbucks network, are you there? 00:17:35.279 --> 00:17:41.440 And because those three networks aren't there, they're it's they're not gonna get a response. 00:17:41.440 --> 00:17:57.359 Now, where the Wi-Fi pineapple comes into play is the Wi-Fi pineapple, if there's uh a device like the pineapple running in the environment, when the Starbucks beacons out, so says, Starbucks, are you there? 00:17:57.359 --> 00:18:00.240 The Wi-Fi pineapple is gonna say, why, yes, I am. 00:18:00.240 --> 00:18:08.960 And it's going to purport to be the Starbucks network or the restaurant network or whatever other network, your home network. 00:18:08.960 --> 00:18:14.640 So if you were, say, at Starbucks and you were connected to your home network, right? 00:18:14.640 --> 00:18:19.039 Like if you looked and you're like, oh, it says, you know, I'm on Nick's home network, right? 00:18:19.039 --> 00:18:23.359 If that was the name of Nick's home Wi-Fi, or, you know, or if it was Mr. 00:18:23.359 --> 00:18:29.200 Miyagi or whatever, whatever the network is, um, it's going to, you're like, well, how could I be connected to Mr. 00:18:29.200 --> 00:18:32.400 Miyagi, my home network, but I'm not at home? 00:18:32.400 --> 00:18:43.599 Well, because there's a device that is replaying that wireless signal and kind of quote unquote tricking you into connecting to that network. 00:18:43.599 --> 00:18:55.039 And then once you connect, now it's acting as a device that's the term is man in the middle, where then it could pass that connection on to the internet. 00:18:55.039 --> 00:19:03.279 It could serve up a fake web page, like your, you know, your Facebook page, so that when you log into it, it captures the creds. 00:19:03.279 --> 00:19:12.240 Like you could start to do lots of manipulation with that traffic once you have a device um in the middle intercepting that traffic. 00:19:12.240 --> 00:19:17.359 So that's kind of the how Wi-Fi attacks are able to work. 00:19:17.359 --> 00:19:28.319 And then there's things called war driving, where um, you know, back when Wi-Fi was was kind of new, people would go around and collect Wi-Fi networks. 00:19:28.319 --> 00:19:30.640 And, you know, it's like a radio in a Pringles can. 00:19:30.640 --> 00:19:33.759 So you could get, you know, you didn't have to be right up on somebody's house. 00:19:33.759 --> 00:19:35.680 You could drive by a business, their house, whatever. 00:19:35.680 --> 00:19:40.720 And you're just collecting all of these handshakes and the names of these wireless networks. 00:19:40.720 --> 00:20:04.559 And then the more handshakes that you have, you could just apply, um, you could you could start to decrypt them and use computers that could could um you know had a lot of CPU and could work on the decryption so that you could the the next time you were in that area, likely they hadn't changed the wireless password, and you could then um connect to that network. 00:20:04.559 --> 00:20:23.839 So some of the the security work, like if you're if you're going to do a pen test, one of the things that you could do is you could sit

in the parking lot and connect to that company's Wi-Fi network after hours as a vector or a way into that business. 00:20:23.839 --> 00:20:36.400 You could also drop something like this with a solar power source in the bushes outside of the business and capture a bunch of those handshakes and come back later and crack them and lots of different things you can do. 00:20:36.400 --> 00:20:42.400 Now that's a lot harder to do with um Wi-Fi 3. 00:20:42.400 --> 00:21:02.640 And the there used to be in there, I'm sure there still is, I just don't remember the name of the site off the top of my head, but people would post the names of all of the different Wi-Fi networks and the handshakes that they got and the location of those networks into this kind of massive online database's website that you could go to. 00:21:02.640 --> 00:21:10.799 And if you're like, oh, you know, I want to go to IT Autolabs and what's their wireless password? 00:21:10.799 --> 00:21:18.480 And you you know, you could you could do that to to do fun or malicious things against that business for whatever reason. 00:21:18.480 --> 00:21:27.519 But Cam, that that's kind of out of favor now with Wi-Fi three because you can't do that as easily with Wi-Fi 3. 00:21:27.839 --> 00:21:28.079 Yep. 00:21:28.079 --> 00:21:31.440 So you can still, you know, go war driving, right? 00:21:31.440 --> 00:21:35.759 You can still this thing has a GPS module that they sell on Hack5's website. 00:21:35.759 --> 00:21:38.559 Last I checked, it was out of stock, fortunately. 00:21:38.559 --> 00:21:45.279 But you can run around with this thing and start collecting GPS coordinates and network names and information. 00:21:45.279 --> 00:21:51.759 And if if it so happens that it's a network that's vulnerable, it can collect handshakes from that too. 00:21:51.759 --> 00:21:54.720 And the website I think you're talking about was wiggle.net. 00:21:55.200 --> 00:21:55.440 That's it. 00:21:55.680 --> 00:21:57.039 It's W I G L E. 00:21:57.039 --> 00:21:59.599 And this thing actually does integrate. 00:21:59.599 --> 00:22:01.119 With Wiggle. 00:22:01.119 --> 00:22:02.799 You can put this thing in wiggle mode. 00:22:02.799 --> 00:22:04.000 Haven't done that. 00:22:04.000 --> 00:22:07.359 But it's still something that people do regularly. 00:22:07.359 --> 00:22:15.119 They'll just drive around with a GPS and a big Wi-Fi antenna and just collect up all the networks around. 00:22:15.519 --> 00:22:25.200 And so if you're going to be, you know, using this not as a hacker, but as maybe a whitehead hacker or as a security researcher, then um how how would you approach? 00:22:25.200 --> 00:22:27.759 I'm assuming that's what you guys use it for. 00:22:27.759 --> 00:22:33.920 And and how how does that kind of help you understand where attack factors are, or is it just kind of a fun thing to use? 00:22:33.920 --> 00:22:36.240 But it's kind of it can be both. 00:22:36.240 --> 00:22:36.720 Yeah. 00:22:36.880 --> 00:22:39.119 Um it's

it is fun to use. 00:22:39.119 --> 00:22:47.119 It makes it makes the process of like hacking into Wi-Fi networks to the point where you don't fully need to understand it. 00:22:47.119 --> 00:22:55.359 I mean, you'll you'll get to know it as you use it, but as far as um like white hat stuff goes, this is pretty good for that. 00:22:55.359 --> 00:23:08.000 This is like if you're doing a kind of a physical vulnerability assessment, let's say, this is a pretty simple way for to be able to say, like, yeah, your network's vulnerable to these basic attacks. 00:23:08.000 --> 00:23:11.359 Because this little pager size device can exploit them. 00:23:12.400 --> 00:23:17.519 So can you walk us through like you you get it, you're you're gonna do some researching, some security research. 00:23:17.519 --> 00:23:20.480 What what are you what are the first couple of things you're gonna do to learn to learn more? 00:23:20.799 --> 00:23:25.920 Yeah, so basically the the nice thing about this is it does recon by default. 00:23:25.920 --> 00:23:30.079 You don't have to configure it to start looking for networks and grabbing handshakes. 00:23:30.079 --> 00:23:31.279 It just does that. 00:23:31.279 --> 00:23:36.720 So you don't have to start, you don't have to really know a whole lot about where you're going. 00:23:36.720 --> 00:23:39.119 It just it'll just do it. 00:23:39.680 --> 00:23:42.400 Eric, have you been using yours to do any security research? 00:23:42.400 --> 00:23:46.480 I took mine out to the state fair and got a bunch of a bunch of handshakes. 00:23:46.720 --> 00:23:52.559 Yeah, it the the the downside of it though was um it it fills up really fast. 00:23:52.559 --> 00:24:06.240 For whatever reason, the the one that just the default um Pine AP that it installs with, I think has a limit of 64 um in the SSID pool. 00:24:06.240 --> 00:24:20.880 So you can um you can increase that through other applications that you know somebody I think somebody has written one that would increase the the size of that pool, but I'm looking at it now. 00:24:20.880 --> 00:24:33.680 I've got 64 in that Wi-Fi pool, and there's names like John Tran 2021 ATT Wi-Fi B N. 00:24:33.680 --> 00:24:36.960 I mean, there's this there's Love Shack. 00:24:36.960 --> 00:24:38.319 Oh boy. 00:24:38.319 --> 00:24:40.240 I wonder if that's Caleb's. 00:24:40.240 --> 00:24:49.599 Yeah, so it's uh it's interesting because you can just kind of flip through and see all of them, and then if you go to a different place, it would be picking up. 00:24:49.599 --> 00:24:55.839 And this is probably picking up from maybe cars that were driving by the uh the building or whatever. 00:24:56.240 --> 00:24:57.279 So well then what? 00:24:57.279 --> 00:25:00.000 So then you you get these handshakes, but then what? 00:25:01.039 --> 00:25:06.319 So and I I believe what we're picking up here is um probing requests. 00:25:06.319 --> 00:25:16.319 Like when the when the devices are turned on, they look for the networks

that they want to connect to and start sending out you know packets out into the air. 00:25:16.319 --> 00:25:18.319 Is this network here? 00:25:18.319 --> 00:25:21.920 And the the pineapple starts collecting those. 00:25:21.920 --> 00:25:27.680 Now by default, it's not going to pretend to be those networks, you have to turn that on. 00:25:27.680 --> 00:25:35.279 But the next step is saying, Yes, this is your enterprise network, go ahead and connect. 00:25:35.279 --> 00:25:35.759 Uh-huh. 00:25:35.759 --> 00:25:36.160 Right. 00:25:36.160 --> 00:25:39.599 Setting up a spoof page or a Facebook login to get credentials or something. 00:25:39.599 --> 00:25:49.759 Yeah, and then and then yeah, once you get a device to actually connect to your fake network, then you're you're pretty open as to what you can do from there. 00:25:50.160 --> 00:25:50.559 Gotcha. 00:25:50.960 --> 00:26:02.000 It it's kind of a fun demo to do, like if you go into an organization and then you're just, you know, you're able to just show on the screen as part of like a you know, security awareness training or whatever. 00:26:02.000 --> 00:26:09.279 Um on people's devices they've connected to lots of different networks. 00:26:09.279 --> 00:26:17.279 So when you put up somebody's home network on there, like you Love Shack or what it was this one, C Tuck Run. 00:26:17.279 --> 00:26:22.319 Um uh they're like, wow, you just hacked me. 00:26:24.960 --> 00:26:30.000 You could go to uh you can go to a client site and do the do the war driving, like uh what is it, the wiggle? 00:26:30.000 --> 00:26:34.240 You know, let them know what's available from the from the parking lot, war wigglers. 00:26:34.880 --> 00:26:35.680 War wiggler. 00:26:35.680 --> 00:26:36.000 Yeah. 00:26:36.319 --> 00:26:37.279 War wiggler. 00:26:38.079 --> 00:26:39.359 Well, we're running low on time. 00:26:39.359 --> 00:26:42.000 Do we have anything else we want to talk about with the pineapple pager? 00:26:42.000 --> 00:26:44.000 Otherwise, I got a I got an outro now. 00:26:44.000 --> 00:26:45.359 We're gonna do an outro segment. 00:26:45.359 --> 00:26:46.240 Oh, interesting. 00:26:46.240 --> 00:26:47.920 It's called Eric Reacts. 00:26:47.920 --> 00:26:49.279 Eric Reacts. 00:26:49.279 --> 00:26:50.880 I'm looking forward to this new segment. 00:26:50.880 --> 00:26:54.880 This is something I want to I've seen before and I wanted to share with you here. 00:26:54.880 --> 00:26:56.000 Squatching. 00:26:56.000 --> 00:26:57.599 No, no, no, no. 00:26:57.599 --> 00:26:58.960 So this guy's coming in. 00:26:59.200 --> 00:27:00.960 Okay, yeah, he's got he got a good slip coming in. 00:27:00.960 --> 00:27:02.400 Aggressive angle there. 00:27:02.400 --> 00:27:03.519 He's coming in. 00:27:03.519 --> 00:27:06.559 The wind is at a crosswind to the runway, right? 00:27:06.559 --> 00:27:09.519 So you can see the plane's nose is pointed into the wind. 00:27:09.519 --> 00:27:11.039 Last minute, right? 00:27:11.039 --> 00:27:16.079 Maybe

the last 50 feet, he's gonna kick it straight, aim down the runway, didn't quite get it straight. 00:27:16.079 --> 00:27:18.400 But yeah, planes land and take off into the wind. 00:27:18.400 --> 00:27:20.559 So uh I don't see anything wrong with this one. 00:27:20.559 --> 00:27:23.200 It's a little aggressive from the the crosswind. 00:27:23.200 --> 00:27:25.440 He's probably got like a 30-knot crosswind here. 00:27:25.440 --> 00:27:27.839 So so have you have you made a landing like that before? 00:27:27.839 --> 00:27:29.039 Oh, all the time. 00:27:29.039 --> 00:27:30.400 Oh my god. 00:27:30.400 --> 00:27:36.799 Once watch when he gets low here, when he gets about treetop height, the wind is gonna shift right there. 00:27:36.799 --> 00:27:38.000 You just saw it. 00:27:38.000 --> 00:27:38.400 Uh-huh. 00:27:38.400 --> 00:27:42.400 Um, and now he's gonna he just didn't put enough left pedal in there. 00:27:42.400 --> 00:27:42.880 Okay. 00:27:42.880 --> 00:27:45.920 We're we'll go out, you know, Josh, and we'll do some of these. 00:27:46.079 --> 00:27:46.720 Oh my God. 00:27:46.799 --> 00:27:47.440 I don't know, man. 00:27:47.440 --> 00:27:49.359 You might have to have a barfeg ready to go for that. 00:27:49.359 --> 00:27:52.000 But I mean, you're not gonna feel anything. 00:27:52.000 --> 00:27:54.319 You're just gonna be you're gonna be looking out the window. 00:27:55.279 --> 00:28:00.960 When I'm pointing sideways, looking down the runway out of my right window, I'm gonna feel something. 00:28:02.720 --> 00:28:04.400 Don't look out the window. 00:28:05.279 --> 00:28:09.759 We're coming in for a landing and the point plane's pointing at a 45-degree angle to the runway. 00:28:10.000 --> 00:28:25.680 So then what you do when you get low, you're gonna push, you're gonna push on the pedal, straighten it out, uh, and then you're going to put the wing that is the upwind wing, you're gonna land that wheel first, and then you're just gonna ride it out, touch the other one down. 00:28:25.680 --> 00:28:27.119 It's a crosswind landing. 00:28:27.119 --> 00:28:29.839 You gotta do them to even get your pilot license. 00:28:30.720 --> 00:28:33.200 Did everybody watch the Netflix documentary about Boeing? 00:28:33.200 --> 00:28:34.480 I need to. 00:28:34.640 --> 00:28:37.599 I need to watch the other one, the the Trump hide and go seek one, too. 00:28:37.599 --> 00:28:38.240 I gotta watch that one. 00:28:38.240 --> 00:28:39.200 I haven't watched that one yet. 00:28:39.200 --> 00:28:39.759 I don't know. 00:28:39.759 --> 00:28:41.599 Was that the only Reacts video? 00:28:41.599 --> 00:28:41.920 Yeah. 00:28:41.920 --> 00:28:42.640 Oh, just one. 00:28:42.640 --> 00:28:43.519 We can do more. 00:28:43.519 --> 00:28:44.799 We gotta get more of these. 00:28:45.200 --> 00:28:45.839 He'd like that. 00:28:45.839 --> 00:28:46.960 I was getting excited. 00:28:46.960 --> 00:28:50.079 You never know when you're gonna hit him with a squatching video. 00:28:50.079 --> 00:28:53.440 All right. 00:28:53.440 --> 00:28:54.960 That was a fun one, guys. 00:28:54.960 --> 00:28:59.039 You've been listening to the audit presented by IT Audit Labs. 00:28:59.039 --> 00:29:05.200 I'm Joshua Schmidt, your co-host producer, Eric Brown, Nick Mellon, and Cameron Birklin coming today from IT Audit Labs. 00:29:05.200 --> 00:29:08.640 Talked about Pineapple Pager and a little bit of news. 00:29:08.640 --> 00:29:11.680 You can like, share, and subscribe and share us with your friends. 00:29:11.680 --> 00:29:12.720 Please pass the word along. 00:29:12.720 --> 00:29:15.200 We got video down Spotify and Apple. 00:29:15.200 --> 00:29:18.000 And please uh source us wherever you get your podcast. 00:29:18.000 --> 00:29:19.279 We'll see you in the next one. 00:29:19.680 --> 00:29:23.359 You have been listening to the audit presented by IT Audit Labs. 00:29:23.359 --> 00:29:32.160 We are experts at assessing risk and compliance while providing administrative and technical controls to improve our clients' data security. 00:29:32.160 --> 00:29:44.880 Our threat assessments find the soft spots before the bad guys do, identifying likelihood and impact, or all our security control assessments rank the level of maturity relative to the size of your organization. 00:29:44.880 --> 00:29:49.279 Thanks to our devoted listeners and followers, as well as our producer, Joshua J. 00:29:49.279 --> 00:29:53.440 Schmidt, and our audio video editor, Cameron Hill. 00:29:53.440 --> 00:30:06.720 You can stay up to date on the latest cybersecurity topics by giving us a like and a follow on our socials, and subscribing to this podcast on Apple, Spotify, or wherever you sourced your security content.