-
@ Pablo Xannybar
2023-08-07 01:11:08Welcome one and all to another OPSEC post! The moral of this story, which I'm putting at the top in case you cba to read the entire thing, is don't use public WiFi.
If you want the more detailed version, read on. The following is, of course, presented purely for educational purposes only.
Public WiFi attacks are easyyyy
A public unsecured WiFi network with a login page that pops up when you connect instead of a password is a hacker's dream come true. You can passively run attacks on hundreds of people in a sufficiently crowded area just by turning a router on and broadcasting an SSID (network name) that matches a public one nearby that many people will connect to. Hotels, trains, stations, airports, even your local Starbucks are just some examples of places that can easily be targeted.
To demonstrate just how little is required to pull this off, I published a list of the most common WiFi SSIDs along with an explanation of the security implications, and that's just public knowledge. Strictly speaking, thanks to KARMA, even this isn't technically necessary - but it depends how targeted an attack needs to be. In a targeted attack you likely only want to spoof certain networks. Whereas if an attacker wanted to simply cast a wide net, KARMA is the more useful attack.
Today I am focusing on a simple evil portal attack targeting one network because it's super easy, very customisable, and extremely effective. There's a lot of other attacks you could do instead, and others that pair well with this one (e.g. deauthentication, KARMA, MITM, SSL stripping, etc) which indeed something like a Pineapple could easily do automatically while serving up the captive portal.
But to really hammer home how easy it is for anyone to do this, I am going to run through how to do it on a Flipper Zero, the recently popular hacker tool that fits in your pocket.
First thing's first...
Wtf is an evil portal?
This attack requires two parts:
-
An "evil twin" WiFi network. This simply requires you to look for a network people around you are likely to connect to (such as your hotel's WiFi) and set your network to broadcast the exact same SSID.
-
Set your network to require a captive portal to be filled in as soon as people connect. This will look like a legitimate sign in page, but in fact will store any credentials entered in plaintext on your device.
And... that is literally it.
Almost all captive portals are served via plain HTTP over the LAN. Since this is by far the most common setup, modern phones and computers expect it, and therefore are designed to not throw up warnings about the page being insecure (even though it is) when you access a captive portal.
In other words, unless you are savvy enough to ask why your hotel WiFi needs your Google password, which I assure you the vast majority of people aren't, it will look perfectly legit and most people blindly trust these things and will happily provide their details.
How do I do it?
All you need is a Flipper Zero and the WiFi developer board.
If you have the Unleashed firmware with the full apps pack, and it's up to date, you will already have the Evil Portal app under
Applications > GPIO > [ESP32] Evil Portal.You can install it manually on the official firmware, but personally I recommend switching to Unleashed anyway because it's much better.
Once you have the app and the WiFi dev board, just flash the board, make sure you have the portal files and AP config (containing the SSID) on your microSD card, and you are ready! Note: if you use Unleashed, you can also flash the board directly from the Flipper.
As for the SD card files:
In the releases section you will also need to download and extract the
evil_portal_sd_folder.zipfolder. This .zip file contains aevil_portalfolder.Put the
evil_portalfolder into theapps_datafolder on your SD card.By default the portal confirms the app is working but is non-functional otherwise. Choose a portal from the community directory and put the
index.htmlin thatevil_portalfolder too.To set the SSID, simply change the contents of
ap.config.txt(also inside theevil_portalfirectory) to match the network you want.And that is it! Yes it's as easy as copying a few files.
Now once that's all done, just grab your Flipper, open Evil Portal, start it, and watch the screen. It should confirm the SSID is the one you set in
ap.config.txtthen you can grab your phone, scan for WiFi, and connect to your evil twin. It should show the captive portal you added. Type in some bogus info and it should show up in the screen of the Flipper. You can save your booty by hittingSave logsin the main menu.Again this is a very basic version of this attack using a low range device to transmit only one SSID. With the correct hardware and software, you can conduct multiple attacks at once, for instance deauthentication attacks to make devices disconnect from the real network and switch to yours, and KARMA attacks capturing the probes devices send out when looking for known networks and broadcasting that list of SSIDs, meaning anyone walking past with WiFi on is going to connect to your network.
A VPN does nothing to protect you from this as captive portals are served up by the LAN and networks block internet access until you pass the captive portal. It isn't too hard to bypass one nowadays (for instance by spoofing the MAC address of someone already connected) but again - a normie won't do this. They'll just type their details in.
Do people seriously fall for this?
Yes.
Why does this work when it's so blatantly insecure?
As I explain here, it simply exploits the way WiFi intentionally works by design.
WiFi is designed so that you connect to other routers with the same SSID. This is so mobile devices can "roam." For example imagine you're in a large office. One router can't cover all of it. You instead will have multiple routers across the building. As you walk through it, your phone will switch to the router with the strongest signal, provided it has the same SSID and security level.
That last bit is important, and it's why I focused on unsecured public networks as easy targets. If a network uses modern encryption with a strong password, it is much more difficult to attack. Still possible, but more difficult. And a device will not auto connect to a network with the same SSID if the real network is encrypted but the fake one is open, for example.
As for the captive portals - as aforementioned, they're simply poorly implemented in the vast majority of cases. Because most are served over plain HTTP from the LAN, devices have no choice but to blindly accept whatever page it is given as being legitimate. If the standard was to host captive portals externally on a secure TLS server, this would be a lot more difficult. But everyone is lazy, so it's easy. It is really that simple.
How can I protect myself?
Don't use public WiFi.
-