TRANSCRIPTION 🔗
WEBVTT
00:00:00.080 --> 00:00:03.520
The nice thing about this is it does recon by default.
00:00:03.520 --> 00:00:07.759
You don't have to configure it to start looking for networks and grabbing handshakes.
00:00:07.759 --> 00:00:08.960
It just does that.
00:00:08.960 --> 00:00:14.480
So you don't have to start, you don't have to really know a whole lot about where you're going.
00:00:14.480 --> 00:00:16.960
It just, it'll just do it.
00:00:23.280 --> 00:00:23.839
Got him.
00:00:23.839 --> 00:00:27.600
Come on, Cam.
00:00:27.600 --> 00:00:31.440
You are listening to the audit presented by IT Audit Labs.
00:00:31.440 --> 00:00:34.079
I'm your co-host and producer, Joshua Schmidt.
00:00:34.079 --> 00:00:41.759
Today we are joined by the usual suspects, Nick Mellum coming from Texas, and Eric Brown in the captain's seat of the IT Audit Labs studio.
00:00:41.759 --> 00:00:46.159
And today our guest is IT Audit Labs member, Cameron Birkland.
00:00:46.159 --> 00:00:50.079
We're talking about parenting, and you served this up.
00:00:50.079 --> 00:00:53.119
We had a story that you shared with us today.
00:00:53.119 --> 00:00:55.600
Um, wanna did you want to read this here?
00:00:55.600 --> 00:00:56.159
Yeah.
00:00:56.320 --> 00:01:04.239
So apparently a guy who works for a large but unnamed company has a nine-year-old son.
00:01:04.239 --> 00:01:12.239
The son wanted to do some advertising or some videos that um that he had made, I think, on on YouTube.
00:01:12.239 --> 00:01:16.159
And so he, you know, he went to his dad and said, Hey, I want to do this.
00:01:16.159 --> 00:01:21.120
And the dad said, Okay, well, let's put five dollars towards the ad campaign.
00:01:21.120 --> 00:01:24.799
And then maybe a week later he gets called into HR at work.
00:01:24.799 --> 00:01:29.680
And apparently he had run up a credit card bill of $118,000.
00:01:29.680 --> 00:01:45.680
Uh because his nine-year-old then hit had watched how his dad set up the ad campaign and set up a few campaigns of his own, some 30-minute ads on YouTube, and that wasn't wasn't cheap.
00:01:45.680 --> 00:01:55.040
Um, but the the gist of it was it turns out that the dad had saved his work credit card into his uh his Google account.
00:01:55.040 --> 00:02:01.200
The the latest update was that the dad didn't know if he was gonna retain his job or not.
00:02:01.200 --> 00:02:02.319
Probably not.
00:02:02.640 --> 00:02:03.120
Probably.
00:02:03.359 --> 00:02:03.760
Oof.
00:02:03.760 --> 00:02:04.959
That's a rough one.
00:02:05.120 --> 00:02:05.280
Yeah.
00:02:05.599 --> 00:02:07.040
It's an expensive lesson learned.
00:02:07.040 --> 00:02:11.840
Like, you know, one, why is he saving company credit cards into his personal account?
00:02:11.840 --> 00:02:16.879
And then two, why is he letting his kid into his account?
00:02:17.120 --> 00:02:20.479
I think this is something we actually see pretty regularly.
00:02:20.479 --> 00:02:27.360
So Google Chrome, browser most people use, integrates pretty tightly with your Google account.
00:02:27.360 --> 00:02:32.400
So when you go to log into Gmail, it'll ask, do you want to sign into Chrome too?
00:02:32.400 --> 00:02:45.599
So people on their work computer will go to check their personal email, then it signs in their Chrome browser at work into their personal account, then that syncs back and forth between their work and personal computer.
00:02:45.599 --> 00:02:50.319
I don't know for sure if that's what happened here, but it just sounds so familiar.
00:02:50.719 --> 00:02:59.520
And then you're sending, you're you're potentially syncing Google Drive and work documents are headed into your personal drive.
00:02:59.520 --> 00:03:00.000
Yep.
00:03:00.159 --> 00:03:04.960
It's all it's the the credit cards, the passwords, the everything, autofill.
00:03:04.960 --> 00:03:08.000
It's all syncing between your work and personal devices.
00:03:08.319 --> 00:03:17.680
I I don't know how I feel about a nine-year-old having unfettered access to YouTube ad campaigns, even with a little bit of oversight.
00:03:17.680 --> 00:03:23.599
Uh it's kind of my school of thought that nine-year-olds shouldn't be left alone on the internet.
00:03:23.599 --> 00:03:36.879
Call me old school, but we've had enough people and guests on the podcast talking about this now, giving us advice uh of just, hey, do not let the kids be in a room alone with the computer, especially if it's connected to the internet.
00:03:36.879 --> 00:03:42.800
Um, you know, please, there's no such thing as privacy for minors online.
00:03:42.800 --> 00:03:50.319
You need to be monitoring your child's um activity because you know, there's just so many nefarious actors online.
00:03:50.319 --> 00:03:54.400
I think the statistic that stuck with me the most was from Andre Champagne.
00:03:54.400 --> 00:03:58.719
He was the forensics investigator for Cook County in Illinois.
00:03:58.719 --> 00:04:10.240
And he, I think the uh stat was in any at any given time in the state of Illinois, there are 17,000 um child, child predators online at any given time.
00:04:10.240 --> 00:04:15.599
So extrapolate that out to the rest of the United States and then again to the world.
00:04:15.599 --> 00:04:21.040
What I would hope for, I guess, is that Alphabet would come in here and and you know, back some of this out of the way.
00:04:21.040 --> 00:04:22.000
Do the right thing.
00:04:22.000 --> 00:04:25.120
Well, you know, also their onus is kind of on them too as well.
00:04:25.120 --> 00:04:37.360
It's like, hey, you guys, how is this even possible to, you know, you know, not doing age checks or you know, you must you you have to have some sort of an age check or like restriction on this.
00:04:37.360 --> 00:04:40.639
I mean, wasn't there a warning at 50,000?
00:04:40.879 --> 00:04:42.160
That's what I was gonna ask.
00:04:42.160 --> 00:04:47.279
How does it get to $118,000 with no notification?
00:04:47.680 --> 00:04:48.160
I don't know.
00:04:48.160 -->
Load full transcript
00:04:51.519
But we've got another article too that maybe we dig into next time.
00:04:51.519 --> 00:04:54.240
And and we ought to do a little studio testing here, Cam.
00:04:54.240 --> 00:04:59.040
But the LG TVs apparently are just recording ramp.
00:04:59.040 --> 00:05:00.319
I mean, we knew this though, right?
00:05:00.319 --> 00:05:16.800
Like I don't know how this is news, but they're recording even apparently when they are quote unquote off, and then they're storing the information and they're and they're really um vigilant about getting the data off of the machine, port hopping and whatnot, so it's hard to block them.
00:05:16.800 --> 00:05:21.040
But uh that might be an interesting to do a little lab work here and actually see if we can watch it.
00:05:21.279 --> 00:05:23.920
Well, let's let our uh live viewers know what we're talking about here.
00:05:23.920 --> 00:05:27.040
LGTB caught spying even when offline or on standby.
00:05:27.040 --> 00:05:30.879
Gamer Nexus gives you another reason to never connect your smart TV to the internet.
00:05:30.879 --> 00:05:37.120
I think that's a little overboard, but Cameron was supposed to be on last week and he was a little busy taking care of some business.
00:05:37.120 --> 00:05:39.040
What kind of business was he taking care of?
00:05:39.279 --> 00:05:40.160
Well, you have to ask him.
00:05:40.160 --> 00:05:42.160
Oh, see, Cam, what were you taking care of?
00:05:42.160 --> 00:05:43.519
You ditched us.
00:05:44.399 --> 00:05:48.160
It was something that was more important than the podcast, unfortunately.
00:05:48.160 --> 00:05:50.319
Oh there it was.
00:05:50.480 --> 00:05:52.639
There you heard your first folks.
00:05:52.639 --> 00:05:54.800
We're not important enough for Cam.
00:05:55.439 --> 00:05:56.959
Cam, you brought this up last week.
00:05:56.959 --> 00:06:02.000
I'm trying to find one without a pop-up because I don't like I can't have my VPN on when uh when we're doing the podcast.
00:06:02.000 --> 00:06:04.480
Otherwise, I'm gonna be dropping in and out like Nick over there.
00:06:04.480 --> 00:06:09.519
But um how how did this come across to your your your news feed?
00:06:09.519 --> 00:06:10.560
And what do you think about this?
00:06:11.040 --> 00:06:17.360
Yeah, this started popping up on social media like uh when I want to say one week ago, maybe two at the most.
00:06:17.360 --> 00:06:20.480
Um Gamers Nexus is a YouTube channel.
00:06:20.480 --> 00:06:32.240
They kind of like uh they like exposing things like digging into the truth, kind of an investigative journalism kind of work, and they focused in on LG TVs.
00:06:32.240 --> 00:06:39.519
I want to say first and foremost that I don't think LG is the only company doing this.
00:06:39.519 --> 00:06:42.879
Um this is probably pretty normal.
00:06:42.879 --> 00:06:49.279
However, LG is the brand that they picked to really dig into, and they found some really interesting things.
00:06:49.279 --> 00:07:01.120
Uh basically, what
what they found is it is it is listening all the time, and and that what it's picking up of your voice does get translated into text inside the TV.
00:07:01.120 --> 00:07:12.480
So the the the kind of thought process there is if somebody had access to your TV, say a threat actor, they could see in plain text what you're saying in front of the TV.
00:07:12.480 --> 00:07:15.279
And it doesn't matter if the microphone's muted or not.
00:07:15.279 --> 00:07:24.000
A lot of TVs have a little switch at the bottom to make you feel better about, you know, you can mute the microphone, prevent it from activating, but it doesn't actually stop it from listening.
00:07:24.399 --> 00:07:32.959
You know, what what what are the ramifications of someone, you know, it's probably about building that bigger social profile if you really wanted to target somebody, right?
00:07:32.959 --> 00:07:40.079
Like if you really wanted to target a high net worth individual, for example, and you could start to socially gather details.
00:07:40.160 --> 00:07:40.319
Trevor Burrus, Jr.
00:07:40.319 --> 00:07:43.839
Like a Minnesota Viking, like we talked about, I think it was last year or the year before.
00:07:43.839 --> 00:07:44.480
Yes.
00:07:44.480 --> 00:07:48.480
Dallas Turner got fleeced for like 140k or something like that.
00:07:49.279 --> 00:08:00.399
You know, speaking of high net worth individuals, I I heard an interesting stat the other day that we're talking a little bit about social media, but Mark Zuckerberg, I think his security detail is like 90 people, right?
00:08:00.399 --> 00:08:01.759
Billionaire guy.
00:08:01.759 --> 00:08:04.480
Um Warren Buffett, zero.
00:08:04.480 --> 00:08:07.680
Also billionaire, but different businesses.
00:08:07.680 --> 00:08:08.000
Trevor Burrus, Jr.
00:08:08.079 --> 00:08:09.920
More respected than the Zuck, though, I think.
00:08:09.920 --> 00:08:10.240
Yeah.
00:08:10.240 --> 00:08:14.959
People would like to troll troll Zuckerberg a lot more than Warren Buffett.
00:08:15.199 --> 00:08:15.439
Right.
00:08:15.439 --> 00:08:17.120
Are you smiling on the camera, Josh?
00:08:17.279 --> 00:08:17.519
I am.
00:08:17.519 --> 00:08:18.160
Okay, good.
00:08:18.160 --> 00:08:23.920
And you know, I think Warren Buffett probably lives a little bit of a different lifestyle than Mark Zuckerberg.
00:08:23.920 --> 00:08:24.399
Probably.
00:08:24.399 --> 00:08:30.399
He's not out there doing jujitsu, you know, in San Francisco and rolling around in Lamborghinis and stuff.
00:08:30.399 --> 00:08:33.120
I think he still does he still live in Omaha in the Bronx?
00:08:33.120 --> 00:08:33.679
Yeah.
00:08:33.679 --> 00:08:34.480
Okay, well, there you go.
00:08:34.480 --> 00:08:35.519
I always thought about that.
00:08:35.519 --> 00:08:43.039
You know, if one remember back in the day when it was like, well, I mean, this still happens, like the paparazzi and stuff, and it'd be like Britney with her shaved head and stuff like that.
00:08:43.039 --> 00:08:44.879
It's like she's still going out the deep end.
00:08:44.879 --> 00:08:45.519
Yeah, yeah.
00:08:45.600 --> 00:08:46.879
Hey Crazy Brittany.
00:08:47.120 --> 00:08:48.320
Hey, I got an idea.
00:08:48.320 --> 00:08:50.559
Why don't you move the hell out of Hollywood?
00:08:50.559 --> 00:08:50.720
Yeah.
00:08:50.720 --> 00:08:53.840
Should shouldn't everybody have a right to be wherever they want to be?
00:08:53.840 --> 00:08:56.960
I don't think people have a right to be where they want to be.
00:08:56.960 --> 00:08:59.919
I mean, I think they have the freedom to move about freely.
00:08:59.919 --> 00:09:05.200
But uh, I mean, you know, it's it's get people are just trying to make some money out there, you know.
00:09:05.200 --> 00:09:06.240
They snap a picture.
00:09:06.320 --> 00:09:09.759
It's like you don't think people have the right to be where they want to be, Josh?
00:09:09.759 --> 00:09:13.200
Well well now we're getting into the hard-hitting stuff here.
00:09:13.519 --> 00:09:14.879
Josh, maybe you want to go over to Iran.
00:09:14.879 --> 00:09:18.639
I want to be on the moon, but I don't have a right to be there, you know.
00:09:18.960 --> 00:09:20.480
Who's to tell you you can't?
00:09:20.799 --> 00:09:22.639
If you build a rocket, you could go to the moon.
00:09:23.279 --> 00:09:28.720
I mean, everybody has a right to a a peaceful existence, maybe, but like, yeah, I don't know.
00:09:28.720 --> 00:09:31.039
Like you're brought you you're you know, public figure.
00:09:31.039 --> 00:09:31.600
I don't know.
00:09:31.600 --> 00:09:39.360
I have no idea what that's like, but I I just think if I were Britney in 1997, I'd be getting the hell out of Hollywood, is all I'm saying.
00:09:39.360 --> 00:09:42.159
Maybe maybe on one hand she liked the attention.
00:09:42.559 --> 00:09:43.759
Oh, that's gotta be it.
00:09:44.000 --> 00:09:44.320
Yeah, yeah.
00:09:44.320 --> 00:09:48.720
It's like Zuckerberg, maybe he likes having an entourage because that's the only way he can have friends.
00:09:49.039 --> 00:09:49.919
Feels important.
00:09:51.440 --> 00:09:52.879
Pineapple pager.
00:09:52.879 --> 00:09:55.440
We've been uh wanting to talk about this for a while.
00:09:55.440 --> 00:09:55.919
Yep.
00:09:55.919 --> 00:09:58.480
Eric's got one, Cameron's got one.
00:09:58.480 --> 00:09:59.759
Do you want to show that to the camera?
00:09:59.759 --> 00:10:02.399
Like, do the whole yeah, there you go.
00:10:03.360 --> 00:10:05.440
I'm not cool enough to have one.
00:10:05.679 --> 00:10:06.000
No.
00:10:06.000 --> 00:10:10.879
No, Eric bought Cameron's for for him, and uh, we still haven't got one yet.
00:10:10.960 --> 00:10:16.799
So I don't know what's going on there, but uh when we hit a hundred thousand downloads, then you get one.
00:10:17.120 --> 00:10:18.320
Then you get one.
00:10:18.320 --> 00:10:20.960
We've already passed a hundred thousand downloads.
00:10:20.960 --> 00:10:22.399
No, no, I haven't okay.
00:10:22.399 -->
00:10:24.159
Here's the pineapple pager.
00:10:24.159 --> 00:10:28.399
Cameron, give us a little overview, tell us what it does, tell us what people are using this for.
00:10:28.639 --> 00:10:47.840
All right, so the pineapple pager, or I'm gonna say uh Wi-Fi Pineapple has been around for quite a while now, but it's always been a Wi-Fi reconnaissance and kind of hacking tool, and it's gone through many um revisions, many different generations, and this is the most recent.
00:10:47.840 --> 00:10:53.200
This is kind of the culmination of the series of Wi-Fi pineapples.
00:10:53.200 --> 00:10:58.639
This thing packs a lot of power into a small form factor.
00:10:58.639 --> 00:11:05.120
One of the biggest things that it's recently come out with is it can do Wi-Fi 6 now.
00:11:05.120 --> 00:11:13.519
Um, previous generations of Wi-Fi Pineapple could not do six gigahertz, but this thing can support Wi-Fi 6E.
00:11:13.519 --> 00:11:25.759
There's one downside, and that all of the Wi-Fi pineapples and actually any Wi-Fi pen testing tool nowadays has the same problem is it can't touch WPA3 networks.
00:11:26.240 --> 00:11:28.480
You mentioned Wi-Fi 6, right?
00:11:28.480 --> 00:11:40.320
Which you're talking about true Wi-Fi 6, WPA3, but the Wi-Fi 7 standard is actually Wi-Fi 6, is it not?
00:11:40.879 --> 00:11:46.879
I know so Wi-Fi 6 is still 5 gigahertz and Wi-Fi 6E is 6 gigahertz.
00:11:46.879 --> 00:11:48.080
So that's a small correction.
00:11:48.399 --> 00:11:48.879
There it is, yeah.
00:11:49.200 --> 00:11:51.840
6E is 6 gigahertz as well as 7.
00:11:52.639 --> 00:11:58.960
So the Wi-Fi, what they call Wi-Fi 7 is actually 6E, I think.
00:11:58.960 --> 00:12:00.159
Yeah.
00:12:00.159 --> 00:12:02.480
Or or yeah, is it 5G E.
00:12:02.720 --> 00:12:03.759
It's a false advertisement.
00:12:04.080 --> 00:12:05.120
It it kind of is.
00:12:05.120 --> 00:12:06.080
Yeah.
00:12:06.480 --> 00:12:08.879
This pager though is is really new though, right, Camp?
00:12:08.879 --> 00:12:11.120
Didn't it just come out like within the last year?
00:12:11.519 --> 00:12:12.000
Yep.
00:12:12.000 --> 00:12:13.759
It's uh it's the newest tool.
00:12:14.080 --> 00:12:15.279
After DEF CON or something?
00:12:15.519 --> 00:12:16.559
Yeah, something like that.
00:12:16.559 --> 00:12:21.039
It's the newest tool for Mac 5 um in the Wi-Fi Pineapple series.
00:12:21.519 --> 00:12:22.879
So it's not a pager, actually.
00:12:22.879 --> 00:12:26.720
I mean, well for people that were born post 9-11 like yourself.
00:12:26.720 --> 00:12:28.879
Um pre.
00:12:28.879 --> 00:12:29.360
Oh, okay.
00:12:29.360 --> 00:12:30.639
Okay, you're OG.
00:12:30.639 --> 00:12:31.440
2000.
00:12:31.440 --> 00:12:32.159
Okay.
00:12:32.159 --> 00:12:32.960
All right.
00:12:32.960 --> 00:12:35.600
I was like, yeah, I was getting ready to go to college.
00:12:35.600 --> 00:12:45.519
But so if you remember the movie like Hackers, or if you were alive during the 80s and 90s, um, if you were a high octane business professional, you had a pager, right?
00:12:45.519 --> 00:12:47.039
I'm sure Eric had one, right?
00:12:47.200 --> 00:12:48.960
I did, I'm sure you were rocking the pager.
00:12:48.960 --> 00:12:49.440
For sure.
00:12:49.440 --> 00:12:56.639
I I I never actually had the beeping pager, you know, like where the kind of just sends the little message.
00:12:56.639 --> 00:12:57.600
Never had that.
00:12:57.600 --> 00:13:03.840
The first one I had was the BlackBerry Rim, and it might have even been before Blackberry had it.
00:13:03.840 --> 00:13:13.120
No, I think it was the Blackberry Rim 960 or 950, where it was this pager form factor, and it had a full keyboard on it.
00:13:13.120 --> 00:13:19.600
So you could do um, you could do email and texting over the thing.
00:13:19.600 --> 00:13:33.840
With that pager, you you could text a number or email a number, and then it would make a phone call and then transcribe what you had said into voice.
00:13:34.159 --> 00:13:36.080
And people were using these to hack and stuff.
00:13:36.080 --> 00:13:41.600
Because like I remember back in the early hacker days, like people were hacking using payphones, um, pagers.
00:13:41.600 --> 00:13:42.320
Oh, yeah, yeah.
00:13:42.320 --> 00:13:43.679
This was the early hacker tool.
00:13:43.679 --> 00:13:44.720
That was freaking.
00:13:44.720 --> 00:13:46.720
Freaking, right, yeah, on the phone.
00:13:46.720 --> 00:13:58.000
Um, where you could like you know, I think on the movie hackers, like if you could get the dial to tones of the buttons and then you could put those into the uh the mouthpiece of the phone and and get through to certain certain areas.
00:13:58.320 --> 00:13:59.759
You could play those tones back.
00:13:59.759 --> 00:14:00.080
Yeah.
00:14:00.080 --> 00:14:00.559
Yeah.
00:14:00.559 --> 00:14:15.919
And then there was a paper clip trick where if you put the the paper clip into the mouthpiece of the receiver and held it up to the phone, like touched it, kind of shorted the connection out, you could make a free call.
00:14:16.240 --> 00:14:16.559
Okay.
00:14:16.559 --> 00:14:23.440
So we evolved, you know, this this whole like idea of hacking with a little tool, I think, is carried on over to the pineapple pager, right?
00:14:23.440 --> 00:14:27.600
Because it's not actually a pager, but it's that the point is it's a little fun tool.
00:14:27.840 --> 00:14:28.159
Yeah.
00:14:28.159 --> 00:14:31.679
So this this is a total callback to those days.
00:14:31.679 --> 00:14:40.159
And it's actually designed very specifically after the like an the old Motorola advisor pager.
00:14:40.159 --> 00:14:44.559
I get I can't show it, but it looks like just like it.
00:14:44.960 --> 00:14:46.480
I'll find I'll find it for you.
00:14:46.480 --> 00:14:47.600
So keep going.
00:14:47.600 --> 00:14:48.399
Tell us, yeah.
00:14:48.399 --> 00:14:52.080
So I mean hackers like these uh these little gadgets I've noticed.
00:14:52.080 --> 00:14:52.799
Right?
00:14:52.799 -->
00:14:56.399
I mean, it kind of stems back from what we were talking about with the freaking and the pagers.
00:14:56.720 --> 00:15:04.320
The thing about what this can do is you can actually do pretty much anything the pineapple can do using your own hardware.
00:15:04.320 --> 00:15:10.480
But the nice thing about this is it it's built to do all this so easily with an easy-to-use interface.
00:15:10.480 --> 00:15:10.879
Right?
00:15:10.879 --> 00:15:12.320
Like it's got a color screen.
00:15:12.320 --> 00:15:16.320
You can scroll around, you can download some payloads and just execute them.
00:15:16.320 --> 00:15:19.039
That's what makes these uh so useful.
00:15:19.039 --> 00:15:27.200
And like this, the Pineapple pager, for example, right out of the box, it's already scanning your Wi-Fi networks and collecting handshakes where it can.
00:15:27.200 --> 00:15:34.080
Um, one of the problems I've ran into, of course, nowadays is um a lot of networks are WPA3.
00:15:34.080 --> 00:15:44.960
There's still a ton of backwards compatibility with WPA2, but pretty much all modern devices are defaulting to that stronger encryption method.
00:15:44.960 --> 00:15:51.120
So this thing isn't quite catching quite as much as it could have maybe a year or two ago.
00:15:51.120 --> 00:16:05.039
But I've still still caught like at least one handshake at home just off of my own uh you know legacy network that I have to have set up for like the the doorbell camera and whatnot.
00:16:05.519 --> 00:16:40.559
So maybe a little um intro to Wi-Fi, just 30-second overview, which is something interesting about how Wi-Fi works and how uh and and why we're able to or used to be able to catch these handshakes before WPA3 with Wi-Fi devices, your your your phone or your computer, um, they're always if they're not connected to a Wi-Fi network and Wi-Fi is turned on, they're always trying to connect to a Wi-Fi network.
00:16:40.960 --> 00:16:42.399
Kind of like the LGTV.
00:16:42.879 --> 00:16:44.799
Kind of like the LGDV, yeah.
00:16:44.799 --> 00:17:01.039
So they're they're always beaconing out, um, for example, like let's say you connected to a Starbucks Wi-Fi network, and then you connect it to your home network, and then you were at work and you connected to the work network.
00:17:01.039 --> 00:17:06.400
So you've got those three networks in your Wi-Fi history.
00:17:06.400 --> 00:17:16.079
And then you go, say, to um a restaurant and you're gonna watch the football game and bring your laptop out to a little work.
00:17:16.079 --> 00:17:30.799
Well, when you when you open up your laptop and if Wi-Fi is enabled, it's gonna try to reach out to those three networks, because those three networks are in its history, if you haven't cleared its history, and it's gonna say, you know, home network, are you there?
00:17:30.799 --> 00:17:35.279
Work network, are you there, or Starbucks network, are you there?
00:17:35.279 --> 00:17:41.440
And because those three networks aren't there, they're it's they're not gonna get a response.
00:17:41.440 --> 00:17:57.359
Now, where the Wi-Fi pineapple comes into play is the Wi-Fi pineapple, if there's uh a device like the pineapple running in the environment, when the Starbucks beacons out, so says, Starbucks, are you there?
00:17:57.359 --> 00:18:00.240
The Wi-Fi pineapple is gonna say, why, yes, I am.
00:18:00.240 --> 00:18:08.960
And it's going to purport to be the Starbucks network or the restaurant network or whatever other network, your home network.
00:18:08.960 --> 00:18:14.640
So if you were, say, at Starbucks and you were connected to your home network, right?
00:18:14.640 --> 00:18:19.039
Like if you looked and you're like, oh, it says, you know, I'm on Nick's home network, right?
00:18:19.039 --> 00:18:23.359
If that was the name of Nick's home Wi-Fi, or, you know, or if it was Mr.
00:18:23.359 --> 00:18:29.200
Miyagi or whatever, whatever the network is, um, it's going to, you're like, well, how could I be connected to Mr.
00:18:29.200 --> 00:18:32.400
Miyagi, my home network, but I'm not at home?
00:18:32.400 --> 00:18:43.599
Well, because there's a device that is replaying that wireless signal and kind of quote unquote tricking you into connecting to that network.
00:18:43.599 --> 00:18:55.039
And then once you connect, now it's acting as a device that's the term is man in the middle, where then it could pass that connection on to the internet.
00:18:55.039 --> 00:19:03.279
It could serve up a fake web page, like your, you know, your Facebook page, so that when you log into it, it captures the creds.
00:19:03.279 --> 00:19:12.240
Like you could start to do lots of manipulation with that traffic once you have a device um in the middle intercepting that traffic.
00:19:12.240 --> 00:19:17.359
So that's kind of the how Wi-Fi attacks are able to work.
00:19:17.359 --> 00:19:28.319
And then there's things called war driving, where um, you know, back when Wi-Fi was was kind of new, people would go around and collect Wi-Fi networks.
00:19:28.319 --> 00:19:30.640
And, you know, it's like a radio in a Pringles can.
00:19:30.640 --> 00:19:33.759
So you could get, you know, you didn't have to be right up on somebody's house.
00:19:33.759 --> 00:19:35.680
You could drive by a business, their house, whatever.
00:19:35.680 --> 00:19:40.720
And you're just collecting all of these handshakes and the names of these wireless networks.
00:19:40.720 --> 00:20:04.559
And then the more handshakes that you have, you could just apply, um, you could you could start to decrypt them and use computers that could could um you know had a lot of CPU and could work on the decryption so that you could the the next time you were in that area, likely they hadn't changed the wireless password, and you could then um connect to that network.
00:20:04.559 --> 00:20:23.839
So some of the the security work, like if you're if you're going to do a pen test, one of the things that you could do is you could sit
in the parking lot and connect to that company's Wi-Fi network after hours as a vector or a way into that business.
00:20:23.839 --> 00:20:36.400
You could also drop something like this with a solar power source in the bushes outside of the business and capture a bunch of those handshakes and come back later and crack them and lots of different things you can do.
00:20:36.400 --> 00:20:42.400
Now that's a lot harder to do with um Wi-Fi 3.
00:20:42.400 --> 00:21:02.640
And the there used to be in there, I'm sure there still is, I just don't remember the name of the site off the top of my head, but people would post the names of all of the different Wi-Fi networks and the handshakes that they got and the location of those networks into this kind of massive online database's website that you could go to.
00:21:02.640 --> 00:21:10.799
And if you're like, oh, you know, I want to go to IT Autolabs and what's their wireless password?
00:21:10.799 --> 00:21:18.480
And you you know, you could you could do that to to do fun or malicious things against that business for whatever reason.
00:21:18.480 --> 00:21:27.519
But Cam, that that's kind of out of favor now with Wi-Fi three because you can't do that as easily with Wi-Fi 3.
00:21:27.839 --> 00:21:28.079
Yep.
00:21:28.079 --> 00:21:31.440
So you can still, you know, go war driving, right?
00:21:31.440 --> 00:21:35.759
You can still this thing has a GPS module that they sell on Hack5's website.
00:21:35.759 --> 00:21:38.559
Last I checked, it was out of stock, fortunately.
00:21:38.559 --> 00:21:45.279
But you can run around with this thing and start collecting GPS coordinates and network names and information.
00:21:45.279 --> 00:21:51.759
And if if it so happens that it's a network that's vulnerable, it can collect handshakes from that too.
00:21:51.759 --> 00:21:54.720
And the website I think you're talking about was wiggle.net.
00:21:55.200 --> 00:21:55.440
That's it.
00:21:55.680 --> 00:21:57.039
It's W I G L E.
00:21:57.039 --> 00:21:59.599
And this thing actually does integrate.
00:21:59.599 --> 00:22:01.119
With Wiggle.
00:22:01.119 --> 00:22:02.799
You can put this thing in wiggle mode.
00:22:02.799 --> 00:22:04.000
Haven't done that.
00:22:04.000 --> 00:22:07.359
But it's still something that people do regularly.
00:22:07.359 --> 00:22:15.119
They'll just drive around with a GPS and a big Wi-Fi antenna and just collect up all the networks around.
00:22:15.519 --> 00:22:25.200
And so if you're going to be, you know, using this not as a hacker, but as maybe a whitehead hacker or as a security researcher, then um how how would you approach?
00:22:25.200 --> 00:22:27.759
I'm assuming that's what you guys use it for.
00:22:27.759 --> 00:22:33.920
And and how how does that kind of help you understand where attack factors are, or is it just kind of a fun thing to use?
00:22:33.920 --> 00:22:36.240
But it's kind of it can be both.
00:22:36.240 --> 00:22:36.720
Yeah.
00:22:36.880 --> 00:22:39.119
Um it's
it is fun to use.
00:22:39.119 --> 00:22:47.119
It makes it makes the process of like hacking into Wi-Fi networks to the point where you don't fully need to understand it.
00:22:47.119 --> 00:22:55.359
I mean, you'll you'll get to know it as you use it, but as far as um like white hat stuff goes, this is pretty good for that.
00:22:55.359 --> 00:23:08.000
This is like if you're doing a kind of a physical vulnerability assessment, let's say, this is a pretty simple way for to be able to say, like, yeah, your network's vulnerable to these basic attacks.
00:23:08.000 --> 00:23:11.359
Because this little pager size device can exploit them.
00:23:12.400 --> 00:23:17.519
So can you walk us through like you you get it, you're you're gonna do some researching, some security research.
00:23:17.519 --> 00:23:20.480
What what are you what are the first couple of things you're gonna do to learn to learn more?
00:23:20.799 --> 00:23:25.920
Yeah, so basically the the nice thing about this is it does recon by default.
00:23:25.920 --> 00:23:30.079
You don't have to configure it to start looking for networks and grabbing handshakes.
00:23:30.079 --> 00:23:31.279
It just does that.
00:23:31.279 --> 00:23:36.720
So you don't have to start, you don't have to really know a whole lot about where you're going.
00:23:36.720 --> 00:23:39.119
It just it'll just do it.
00:23:39.680 --> 00:23:42.400
Eric, have you been using yours to do any security research?
00:23:42.400 --> 00:23:46.480
I took mine out to the state fair and got a bunch of a bunch of handshakes.
00:23:46.720 --> 00:23:52.559
Yeah, it the the the downside of it though was um it it fills up really fast.
00:23:52.559 --> 00:24:06.240
For whatever reason, the the one that just the default um Pine AP that it installs with, I think has a limit of 64 um in the SSID pool.
00:24:06.240 --> 00:24:20.880
So you can um you can increase that through other applications that you know somebody I think somebody has written one that would increase the the size of that pool, but I'm looking at it now.
00:24:20.880 --> 00:24:33.680
I've got 64 in that Wi-Fi pool, and there's names like John Tran 2021 ATT Wi-Fi B N.
00:24:33.680 --> 00:24:36.960
I mean, there's this there's Love Shack.
00:24:36.960 --> 00:24:38.319
Oh boy.
00:24:38.319 --> 00:24:40.240
I wonder if that's Caleb's.
00:24:40.240 --> 00:24:49.599
Yeah, so it's uh it's interesting because you can just kind of flip through and see all of them, and then if you go to a different place, it would be picking up.
00:24:49.599 --> 00:24:55.839
And this is probably picking up from maybe cars that were driving by the uh the building or whatever.
00:24:56.240 --> 00:24:57.279
So well then what?
00:24:57.279 --> 00:25:00.000
So then you you get these handshakes, but then what?
00:25:01.039 --> 00:25:06.319
So and I I believe what we're picking up here is um probing requests.
00:25:06.319 --> 00:25:16.319
Like when the when the devices are turned on, they look for the networks
that they want to connect to and start sending out you know packets out into the air.
00:25:16.319 --> 00:25:18.319
Is this network here?
00:25:18.319 --> 00:25:21.920
And the the pineapple starts collecting those.
00:25:21.920 --> 00:25:27.680
Now by default, it's not going to pretend to be those networks, you have to turn that on.
00:25:27.680 --> 00:25:35.279
But the next step is saying, Yes, this is your enterprise network, go ahead and connect.
00:25:35.279 --> 00:25:35.759
Uh-huh.
00:25:35.759 --> 00:25:36.160
Right.
00:25:36.160 --> 00:25:39.599
Setting up a spoof page or a Facebook login to get credentials or something.
00:25:39.599 --> 00:25:49.759
Yeah, and then and then yeah, once you get a device to actually connect to your fake network, then you're you're pretty open as to what you can do from there.
00:25:50.160 --> 00:25:50.559
Gotcha.
00:25:50.960 --> 00:26:02.000
It it's kind of a fun demo to do, like if you go into an organization and then you're just, you know, you're able to just show on the screen as part of like a you know, security awareness training or whatever.
00:26:02.000 --> 00:26:09.279
Um on people's devices they've connected to lots of different networks.
00:26:09.279 --> 00:26:17.279
So when you put up somebody's home network on there, like you Love Shack or what it was this one, C Tuck Run.
00:26:17.279 --> 00:26:22.319
Um uh they're like, wow, you just hacked me.
00:26:24.960 --> 00:26:30.000
You could go to uh you can go to a client site and do the do the war driving, like uh what is it, the wiggle?
00:26:30.000 --> 00:26:34.240
You know, let them know what's available from the from the parking lot, war wigglers.
00:26:34.880 --> 00:26:35.680
War wiggler.
00:26:35.680 --> 00:26:36.000
Yeah.
00:26:36.319 --> 00:26:37.279
War wiggler.
00:26:38.079 --> 00:26:39.359
Well, we're running low on time.
00:26:39.359 --> 00:26:42.000
Do we have anything else we want to talk about with the pineapple pager?
00:26:42.000 --> 00:26:44.000
Otherwise, I got a I got an outro now.
00:26:44.000 --> 00:26:45.359
We're gonna do an outro segment.
00:26:45.359 --> 00:26:46.240
Oh, interesting.
00:26:46.240 --> 00:26:47.920
It's called Eric Reacts.
00:26:47.920 --> 00:26:49.279
Eric Reacts.
00:26:49.279 --> 00:26:50.880
I'm looking forward to this new segment.
00:26:50.880 --> 00:26:54.880
This is something I want to I've seen before and I wanted to share with you here.
00:26:54.880 --> 00:26:56.000
Squatching.
00:26:56.000 --> 00:26:57.599
No, no, no, no.
00:26:57.599 --> 00:26:58.960
So this guy's coming in.
00:26:59.200 --> 00:27:00.960
Okay, yeah, he's got he got a good slip coming in.
00:27:00.960 --> 00:27:02.400
Aggressive angle there.
00:27:02.400 --> 00:27:03.519
He's coming in.
00:27:03.519 --> 00:27:06.559
The wind is at a crosswind to the runway, right?
00:27:06.559 --> 00:27:09.519
So you can see the plane's nose is pointed into the wind.
00:27:09.519 --> 00:27:11.039
Last minute, right?
00:27:11.039 --> 00:27:16.079
Maybe
the last 50 feet, he's gonna kick it straight, aim down the runway, didn't quite get it straight.
00:27:16.079 --> 00:27:18.400
But yeah, planes land and take off into the wind.
00:27:18.400 --> 00:27:20.559
So uh I don't see anything wrong with this one.
00:27:20.559 --> 00:27:23.200
It's a little aggressive from the the crosswind.
00:27:23.200 --> 00:27:25.440
He's probably got like a 30-knot crosswind here.
00:27:25.440 --> 00:27:27.839
So so have you have you made a landing like that before?
00:27:27.839 --> 00:27:29.039
Oh, all the time.
00:27:29.039 --> 00:27:30.400
Oh my god.
00:27:30.400 --> 00:27:36.799
Once watch when he gets low here, when he gets about treetop height, the wind is gonna shift right there.
00:27:36.799 --> 00:27:38.000
You just saw it.
00:27:38.000 --> 00:27:38.400
Uh-huh.
00:27:38.400 --> 00:27:42.400
Um, and now he's gonna he just didn't put enough left pedal in there.
00:27:42.400 --> 00:27:42.880
Okay.
00:27:42.880 --> 00:27:45.920
We're we'll go out, you know, Josh, and we'll do some of these.
00:27:46.079 --> 00:27:46.720
Oh my God.
00:27:46.799 --> 00:27:47.440
I don't know, man.
00:27:47.440 --> 00:27:49.359
You might have to have a barfeg ready to go for that.
00:27:49.359 --> 00:27:52.000
But I mean, you're not gonna feel anything.
00:27:52.000 --> 00:27:54.319
You're just gonna be you're gonna be looking out the window.
00:27:55.279 --> 00:28:00.960
When I'm pointing sideways, looking down the runway out of my right window, I'm gonna feel something.
00:28:02.720 --> 00:28:04.400
Don't look out the window.
00:28:05.279 --> 00:28:09.759
We're coming in for a landing and the point plane's pointing at a 45-degree angle to the runway.
00:28:10.000 --> 00:28:25.680
So then what you do when you get low, you're gonna push, you're gonna push on the pedal, straighten it out, uh, and then you're going to put the wing that is the upwind wing, you're gonna land that wheel first, and then you're just gonna ride it out, touch the other one down.
00:28:25.680 --> 00:28:27.119
It's a crosswind landing.
00:28:27.119 --> 00:28:29.839
You gotta do them to even get your pilot license.
00:28:30.720 --> 00:28:33.200
Did everybody watch the Netflix documentary about Boeing?
00:28:33.200 --> 00:28:34.480
I need to.
00:28:34.640 --> 00:28:37.599
I need to watch the other one, the the Trump hide and go seek one, too.
00:28:37.599 --> 00:28:38.240
I gotta watch that one.
00:28:38.240 --> 00:28:39.200
I haven't watched that one yet.
00:28:39.200 --> 00:28:39.759
I don't know.
00:28:39.759 --> 00:28:41.599
Was that the only Reacts video?
00:28:41.599 --> 00:28:41.920
Yeah.
00:28:41.920 --> 00:28:42.640
Oh, just one.
00:28:42.640 --> 00:28:43.519
We can do more.
00:28:43.519 --> 00:28:44.799
We gotta get more of these.
00:28:45.200 --> 00:28:45.839
He'd like that.
00:28:45.839 --> 00:28:46.960
I was getting excited.
00:28:46.960 --> 00:28:50.079
You never know when you're gonna hit him with a squatching video.
00:28:50.079 --> 00:28:53.440
All right.
00:28:53.440 --> 00:28:54.960
That was a fun one, guys.
00:28:54.960 --> 00:28:59.039
You've been listening to the audit presented by IT Audit Labs.
00:28:59.039 --> 00:29:05.200
I'm Joshua Schmidt, your co-host producer, Eric Brown, Nick Mellon, and Cameron Birklin coming today from IT Audit Labs.
00:29:05.200 --> 00:29:08.640
Talked about Pineapple Pager and a little bit of news.
00:29:08.640 --> 00:29:11.680
You can like, share, and subscribe and share us with your friends.
00:29:11.680 --> 00:29:12.720
Please pass the word along.
00:29:12.720 --> 00:29:15.200
We got video down Spotify and Apple.
00:29:15.200 --> 00:29:18.000
And please uh source us wherever you get your podcast.
00:29:18.000 --> 00:29:19.279
We'll see you in the next one.
00:29:19.680 --> 00:29:23.359
You have been listening to the audit presented by IT Audit Labs.
00:29:23.359 --> 00:29:32.160
We are experts at assessing risk and compliance while providing administrative and technical controls to improve our clients' data security.
00:29:32.160 --> 00:29:44.880
Our threat assessments find the soft spots before the bad guys do, identifying likelihood and impact, or all our security control assessments rank the level of maturity relative to the size of your organization.
00:29:44.880 --> 00:29:49.279
Thanks to our devoted listeners and followers, as well as our producer, Joshua J.
00:29:49.279 --> 00:29:53.440
Schmidt, and our audio video editor, Cameron Hill.
00:29:53.440 --> 00:30:06.720
You can stay up to date on the latest cybersecurity topics by giving us a like and a follow on our socials, and subscribing to this podcast on Apple, Spotify, or wherever you sourced your security content.