Where's my meeting announcement? You got it up there? Yeah.
Welcome, folks. Welcome to the January meeting of the St. Louis Linux users group Gary's not here yet, so I will do the bookend.
This is the normal meeting that we have on a third Thursday of the month.
We'll start off with Q&A session and we'll turn the Floor over to… our speaker tonight, which is kamikaze joe who's also well known at the arch reactor for playing with a lot of tech and other interesting topics.
All right, I will. We'll open the floor at this point for general Q&A before we get started.
Oh, okay.
Oh, any announcements? That's a question. The… The new Linux user group will be on the 28th of January. So all in next week.
We don't have any of our sponsored meetings. And I was wondering if we wanted to do any kind of ad hoc thing Since everybody's kind of been cooped up for the last month or so.
And there might be something worthwhile doing something Since we have successfully, more or less brought the upgrade.
Through to our box server. So that's a thought.
I don't have any questions other than that. Or announcements.
Lower is open. Don't be shy, folks.
I suppose we're ready for the uh bigger then.
Oh, go ahead.
Shoot.
I got a question. Does anyone know people who are hosting like old CentOS vaults repos.
Not hosting, I probably have some pieces of plastic with metal flake in them that are CentOS 5 or CentOS 6.
All right. Yeah. Sent to us seven and eight, maybe.
How old are you?
You can get them from Alma Linux if you change your repos.
Okay, I'll take a look. Thank you. You…
I've got CentOS 7 in production. I switched them over to almo late repos last year Do you seem to be getting updates, so…
I might even do Rocky. Yeah, it used to be that like Princeton's math department would keep it But they must have updated their streams and stuff. And nope, we can't get it there anymore.
So are you looking for old installs or old packages or trying to keep an old OS alive?
Yeah.
Old packages, government wants us to test stuff on older OSs for reasons probably just what was current when the contract was made and hey, let's get some network monitoring tools on there that we can't do right now. So let's
Just want to find some way to monitor it.
Yeah. Reach out to me on the mailing list. I've got access to a few seven systems, I can see if their files cached. If you're looking for something specifically.
On the ballot this year, next month?
Oh, one other announcement. I'm still taking… bribes for people to not be on the ballot for next But I decided to reduce the price down to $10.
And people I like $5, which there aren't that many people out there that I like.
I mean, mostly $10.
Hey, Grant, quick question. I'm getting a… End of file air secure connection failed.
On that IP. Is that is that what will cause that?
So you can… connect or you can establish a TCP connection, but your web browser is having a problem negotiating the SSL on it.
Right.
Oh, wait a minute.
Let's do direct chat. So we don't hold up the presentation.
Yeah. Yeah.
Kamikaze Joe.
I don't like a plan.
Hello. My turn.
Hello. Yes, sir.
Yes, sir.
Okay, let's see. Let's share my screen here.
One thing we normally ask is. Do you prefer people to hold their questions until the end of your presentation or can they politely go, um.
Would you clarify that midway through?
I have no problem answering questions during it as long as it doesn't get like excessive, you know, I want to be able to get through the talk.
Select a window. Yeah, I am.
Here we go.
Okay, everybody see the Just the slides, right? Because I got many windows here.
Yes, sir.
Okay. Okay, then let's get started.
Right, just the slides.
My name is Joe. As sometimes kamikaze Joe, if it's online. And as mentioned before.
For March Reactor, I'm one of the founding members of Arch Reactor, do a lot of stuff there, of course. One of the things I do on a monthly basis is host the local 2600 meeting.
Which you guys are good enough to put on the calendar of IT events, and I appreciate that.
Anything that gets people into the doors of Arch Reactor? I consider a good thing.
Because then we get them to sign up and we get their money to help keep the place running. Anyway, this is a talk I did a few months ago.
At the local 2600. Is anybody just a general kind of temperature heard of the ponagachi before
Nope, not me. Never heard of it.
Sort of sort of. Me and only because I want to do your talk.
Sort of. Fair enough.
I heard about it years ago from Steve Gibson on GRC.
Security now.
Okay. Yeah, it's not like super new.
Yeah.
Or anything like that. It is several years old and uh But it's a little device I've just been kind of fascinated with it and just the kind of gamification of cybersecurity.
And whatnot. Primarily because, well, I'm in between at the moment but i i do I'm a security engineer.
Do pen testing and that sort of thing. So yeah, it was something that was very interesting to me.
So what is a ponagachi? Well, I can show you two here. I've got… Two for demo. This is my original one for you to see. This is Pona Chew.
And this one. This kind of hacky looking one is named Sniffazard.
I need a two Hey, they talk to each other uh but At their core, what they are are virtual pets that eat Wi-Fi.
And because everyone knows that good free range organic Wi-Fi is low calorie and part of a complete breakfast.
But what is it really? Well, Ponagotchi was developed by a hacker a while ago called Evil Socket.
He was spending summer 2019 traveling the u.s And while he was doing so, he began tinkering with a way to kind of automate Wi-Fi attacks um namely sending deauth packets and collecting handshakes.
As he continued to tinker with it. He decided to add some basic ai incorporated into it to allow for some optimization.
And then he slapped a cute little face on it and thus the ponagotchi was born.
Win Evil Socket. Shared his efforts online. The community quickly sprung up around the device.
And which has since pretty much taken over any all the development of the project and evil socket hasn't really touched it since.
But it is still pretty active community. Online. And so does it do anything else?
The way it operates is it hops across the Wi-Fi spectrum hunting for handshakes and handshake packets to capture. It uses some very basic AI to optimize its ability to capture handshakes and comes in this adorable little package.
Like so. Now I like so i I've already said AI a few times around by now. I know AI is a pretty big buzzword these days.
So please excuse its use through this talk. What I'm referring to by AI is a very simple reinforcement learning neural network.
That does very simple things. It's this kind of neural network that researchers teach it to play Atari games. This is not… The generative spicy autocorrect that all the tech bros have art on right now.
So does it do anything else well and it Like I said, a community has kind of sprung up around this. And so some of the additional features is it kind of Some people kind of also consider this a kind of crypto pager.
So they've developed, you can get it online through like proxying it through another system.
For doing a connection sharing and doing through that it can get access to what's called the Pwn Grid Network.
Which is basically You register, your Ponigashi registers with it.
And kind of gamifies the process by giving you a scoreboard of how many handshakes it's captured and and connections it's made and friends it's made. It'll also interact with other ponagotchis. That's why I decided I needed two of them.
And by doing so. Actually allows you to distribute the kind of the handshake handshake packet capturing work And I'm kind of giving you the overview now. We're going to get into more details on how all this works.
How does one get a ponagotchi? Well. First of all, you need a Raspberry Pi.
Pretty easy. You build one. You need a Raspberry Pi. At minimum, you want a Raspberry Pi 02W.
Pie three, four, and five are supported as well. But of course, there's a trade-off between power usage and having the beefier hardware.
Of course, you're going to need an SD card. I recommend something sturdy when you're using Raspberry Pis.
Like Samsung brands, the Samsung Evo brands They have been pretty reliable for me.
Because Ponogachi does a lot of writing to the card so you're… saving all those captures, you're going to need something reliable.
There's not an official list of supported displays But each support displayed has a specific module written for it in the GitHub repo. They're pretty clearly labeled. So like basically you can't go to their website and just get a full list. You got to go to the GitHub.
Kind of browse through the available modules and see what corresponds to displays.
Now, if your Pi doesn't support Wi-Fi on the five now This pie, the two doesn't Wi-Fi on the five gigahertz bands.
So. I think if you have like the four or five you can… But so if I wanted to add like the five gigahertz bands to this Pi, I can use a second Wi-Fi adapter And then I can capture the full spectrum.
And that's optional.
Stuff. Yes, you said you could use a SECTF Wi-Fi adapter.
Does someone have a question? Sorry.
A second. Sorry. Second.
Okay, I'm sorry.
Let me pull up the…
Window so I can see any like hands popping up or whatever
Is this slide deck going to be available?
Yes, it is actually online. Remind me at the end, we can go back to the beginning.
Okay.
There's a link to where the slide deck is.
Gotcha.
So… In my case, I did go with a Pi Zero 2W specifically for the portability.
Like I said, I like the Samsung 2 Evo Select Plus.
I also went for my display a wave share displays are there's wave share displays or e-paper displays are pretty much generally recommended because they're very low power being e-paper. Mine is a 2.3 inch e-paper.
Hat version. That's all my primary panaguchi.
But if you notice like if you notice like The Sniffigard one.
I've got a… the Raspberry Pi kind of adapter connected to a flipper zero. Flipper zero makes for a very expensive display.
But I needed something to do for a second one. And somebody wrote a nice little app that will make it function flipper zero function as a display for the Ponagotchi.
This meeting is being recorded.
You don't actually need as… You don't need any display if you don't want to. A lot of people don't use it.
You can actually connect to your device by Bluetooth or through internet connection sharing and kind of view what's going on as well.
But the whole kind of point is to have like kind of a little virtual pet. So a face is nice.
For power on my main one, I'm using a PiSugar battery pack.
Also pretty commonly recommended. I get about four hours off a full charge, which I think is pretty good for something going around Just… slurping up Wi-Fi all the time.
Weirdly, the plugin does require or the pie sugar does require a plugin module for some of the power management.
I found the easiest, just kind of a side note, found the easiest way to use it is to use it is use the built-in script.
But it's kind of weird because though the module is open source.
And hosted on GitHub. The script itself downloads everything from a Chinese content or chinese cd Which made me very kind of weirded out.
Being you know a security guy But… doing kind of a risk analysis I'm not storing any critical data on this device.
And any kind of effort to put it online surreptitiously, you need like some manual intervention So for a little pocket handheld device, I didn't really see the harm and it was just the easiest way to go about doing it.
So, but use your own judgment with that. So most of the hardware I selected specifically was because I found a convenient little kit online. Uh.
If you go to Tindy and search for Ponogachi. The pie sugar people who made the battery backup actually have a prefab kit For around $85, you get the screen, the case, the power supply.
And an SD card, you have to provide your own Raspberry Pi but that made it really simple to uh Just get all the pieces at once.
A lot of people part out or use different displays and things like that.
But they'll actually also, I think for another, for more money, sell you a kit with the Raspberry Pi if For whatever reason, you can't be bothered for a trip to Micro Center.
Excuse me. But that was the easiest way to get the hardware.
For the software that runs on the Ponagotchi, well, the OS itself is Raspian based.
Next month is used for the monitoring. Uses BetterCap.
The actual Ponagotchi service itself. Next month.
Is a firmware patching framework made specifically for Broadcom and Cypress Wi-Fi chipsets.
This is what enables the Pono Gachi to set its Wi-Fi into monitor mode and conduct the wireless attacks.
Yes.
Question. If it's… manufacturer specific how many Wi-Fi modules does that cover? I know it, I'm sure it covers what's on board But how many little USB Wi-Fi adapters are encompassed in that.
Basically, whatever would be included with Raspian out of the box.
Yeah, the reason we're using Nexon is because we're using the functionality that is needed does not come out of the box with the base Raspbian install.
So we have to, so next month gets it added to it.
Then there's better cap. Bettercap is a tool.
For those unaware, conducts the actual Wi-Fi attacks under normal operation, it just kind of runs in the background and is managed by the Ponagachi service.
However, you can set your into manual mode and we'll discuss the various modes of opponogachi in a bit.
You can actually just use it better cap through its built-in web service You boot it into manual mode, you go to point a browser to the device log in with the default credentials And… which you'd want to change into the
In the… configuration file.
Anyway, so yeah, better cap is the thing that actually does the man in the middle packet capturing
There are two main attacks conducted by BetterCap. One is… DL thing, which sends out is sending out doth packets Which causes a wifi devices connected to Wi-Fi networks to disconnect Because for some reason in the Wi-Fi spec, they never thought to include that into it's kind of a troubleshooting thing.
Ideally, like if you're having engineer was having trouble with the Wi-Fi.
They could send it to you off packet kind of You know, particularly reboot the connection, as it were.
Then when the connection with the devices try to reconnect. That gives the Onagotchi now opportunity to capture the Wi-Fi handshake.
And it saves that it saves that capture later for potential cracking.
And it can also make use of partial handshake captures which is the clientless PM kid attack And I'm going to dive into these a little more.
As well. Dawh thing.
Do y'all think or Wi-Fi deauthentication attack is a kind of denial of service?
Attack that exploits the 802.11 protocol itself. Like I was saying, you basically send a signal that says, I'm disconnecting from the network now.
And… the 802.11 protocol contains provisions.
For what's called a deauthentication frame DUF packets don't require any kind of encryption regardless of the security setting on the access device.
So an attacker can easily send a deauth packet while spoofing a target's MAC address.
Forcing them to disconnect. And so this just kind of a overview guide of, you know, the back and forth You know, you can be in the middle of an authentication request and sending traffic back and forth.
And in the middle sends the deauthentication. Ap disregards any further data coming in and acknowledges the the authentication.
And as a result, the target is kicked off the network they were connected to, at least temporarily.
When the target then attempts to reconnect to the network. It'll have to reauthenticate. This is usually in the background and kind of invisible to the user. So if you're on your laptop.
Or your mobile device, you're not even going to notice this happening. You may see your wireless flicker for a second.
Saying disconnected, reconnected. Usually too fast for you to notice.
But that puts an attacker now in a position to capture the authentication handshake.
Fun fact. About doth pack. It's the uh kind of unrelated to the ponagotchi.
The FCC has actually fined hotels and other companies for launching Deauthentication attacks against their own guests. The purpose being to drive them off their own personal hotspots.
And force them to connect to paid for Wi-Fi services.
At the location. It's a little interesting.
That's not just… slap on the wrist fine. Some of those were five and six digit in front of the decimal point finds.
Yeah, because you're actively, that's considered actively jamming radio communications, if I remember.
If I understand correctly. Which they aren't happy about.
One second.
So handshake capturing. When connecting to Wi-Fi access points with a WPA enabled network.
Your device and the access point go through what's called a four-way handshake.
Four packets are exchanged. The client and the access point.
These are used to derive the session key from the Wi-Fi password.
Once this exchange is complete. The keys are generated and now your device is connected securely to Wi-Fi network.
The PMK, which is the The Wi-Fi password is used to derive the PTK.
Using a password-based hash key derivation function. Which uses HMAC SHA-1 encoding two encoder long the SSID and the MAC address.
So if we capture this entire handshake we can use the fact that we know what the MAC address is are and the SSID.
And then begin to brute force the remaining information. Which, following along.
The only unknown at that point is the password. This is, of course, very high level generalization And lacking all the specific math involved.
There is also a client list PKM PM kit attacks. So sometimes you get lucky, you get the entire handshake that's already in progress.
Or excuse me, sometimes you can capture a handshake that's already in progress, one that you didn't start with the de-auth.
In many cases, even a partial handshake. From an access point is usable to crackle Wi-Fi password.
Many modern routers include extra fields which In the… EAPOL frame.
Called a robust security network or RSN. This field includes what's called a pm kid This is a hash of the PMK.
The PMK name and the AP and client clients max.
It's meant as a way for access points to keep track of who has what PMK for each session.
The PMK name and the max are constant so This hash can be used to also derive the Wi-Fi key.
Opponent got the… Ponagotchi service itself is… is a platform that coordinates everything that's going on in the device between It provides a web interface to view a dashboard.
Which is generally merely Which also mirrors what's on the display if you have one active You can use it to check phone grid, manage your plugins.
It's when enabled, it's driven by the AI, manages better cap.
Kind of the overall coordination of what's going on. It is a daemon running on the… system.
Since all the software is open source, you can certainly jump through all the hoops of building a disk image from scratch, spend countless hours just trying to get it to work right.
That sounds like a lot of work. And fortunately, there are several pre-made images available.
There is the original image posted by Evil Sockets.
It's no longer being developed and is outdated. And a bunch of bugs that affect the AI mode.
I don't think it even runs on a current pie anymore.
Because I think my original was a Pi 1 that it used to run on. Now it doesn't even It just doesn't work anymore, which sent me looking for other images and i um by far the most popular image currently seems to be jail felonies image.
It has better CPU usage. It's actively developed, optimized, and there are more plugins installed by default.
Another popular image is called aluminum ice. Is also actively developed.
Better cap and next. Mon are both compiled from source on those images.
Has some updated dependencies and supposedly some crap crash prevention.
Because you do find that these ponagachis do kind of like crash and reboot frequently Particularly on like the Pi zeros particularly The resources are so constrained.
So then I'll just randomly happen to you. If it's a problem, you may want to try aluminum ice.
But I went with J felonies because it seemed to be the most current As far as packages went, and it was easiest to get running.
I tried the aluminum ices a little bit, but it wasn't as simple to get running as the jail felonies. I was able to pretty much just Grab that and go.
So actually using the ponagotchi in practice It's deceptively simple at first glance. Once it's up and running, you just walk around with it and let it do it Let it do its thing. But there's a lot more. Yeah.
Go? Back to the OS.
Sure.
The 3OS is there for a second. Besides possibly being newer or easier Are any of them particularly better for a particular set up for operation i mean other than just being newer or more robust I mean, why would you go back to an older one?
My primary goal was getting The older one, there's no reason to go back to evil sockets it's basically non-functional at this point.
I think maybe… I think I got it running on a running original Pi Zero W.
It does not function on a PI 0W2, if I remember correctly.
And I figured that out because… I know the newer ones.
Jail felony and aluminum ice, they do not run an original Pi Zero, which is why you need a Pi Or a W-2 at minimum.
Learn that the hard way how to When I was first doing this had to run to Micro Center and grab a couple of new ones because I only had pi zero ones and made that mistake.
Sounds like the primary use to use the older Eagle socket image is if you have that older pie laying around unused, you might be able to get some benefit.
Running the Pona Gosh.
Maybe if it's not doing anything.
But yeah, I know… some people were there you know if you're kind of more concerned about uh
Like the source of your binaries and things like that um that might be where the aluminium ice image comes in more handy knowing that they compile things from scratch as opposed to just using pre compiled binaries.
At least that's my understanding. Yeah, I didn't dive too much into it other than it's like, all right, got this one working. This one worked the easiest.
And that's what I decided to go with. I'm sure if you go out into the communities.
Okay.
They probably have some opinions. People on the internet tend to often have opinions about things
I wasn't particularly married to one or the other. I wouldn't judge it for running any of them as long as it worked and do what you wanted it to do.
Did I answer the question? You're welcome.
Yes, thank you.
So yeah, as I was saying. When you're first using the Ponogachi, you pretty much just walk around with it and let it do its thing.
But there's quite a bit more going on to it behind the scenes. We can dive into some of that. If you do have it running.
A face similar to this. See, I got something similar running on mine. I don't know how.
Probably not. Very similar face going on.
This image actually came from the Ponagotchi dashboard. I logged into. From here, we can kind of observe what the Ponagotchi is doing at any given time.
At the top, we've got the status bar. Which tells us where it's scanning on the Wi-Fi, how many access points it sees.
How long the system's been up Battery status and network connectivity is shown up here as well.
You can see on mine that BT says it's Got Bluetooth enabled.
Um. Batteries at 0% because I had it plugged in at this point.
So for 15 minutes we had It's hopping through channels.
Six APs. Sorry?
Channels. How can you tell that it's hopping through channels
Because it's got the star there Sorry, I probably should have specified that. Yeah.
Okay.
It's not on any one channel at the moment. Star means it's cycling.
It's these six APs in its immediate area. 13 in the parentheses, that means it's seen 13 The entire time it's been awake.
So since boot up, it's seen a total of 13. In the center of the dashboard is… The Ponagotchi's mood, the status of whatever… As well as there's the status of whatever action is currently taking.
As well, if he's any other ponagotchis in the middle. So we've got the name.
Kind of a idle face we see here Also indicated by the ellipses meaning it's looking around. If this were animated, these eyes would be looking back and forth.
To indicate that it's looking around. Also by the ellipses, if it found something, the next message would say something according to that or if it didn't see anything, it would say it's, oh, I'm sad.
They can also see that they can also see Sniffhazard 8, 14 at the bottom. So that's saying It also sees another ponagachi within range.
Its name. How many access points it's seeing at the moment, plus how many it's seen since it's booted up.
And at the very bottom. We have how many handshakes we've captured indicated by Pwned.
Again, the four indicates how many it's seen since since it's powered up The 32 is how many it's seen in total.
That it has saved to the SD card.
Is that pwned Include.
Brute forcing or just captured?
So none of the brute forcing actually happens on the device. Raspberry Pi is not strong enough to do brute forcing of hashes.
Right.
And you uh We'll get to that where you actually have to copy the hashes off onto like, you know, a desktop or something And either use John the Ripper or hash cat to actually do the cracking of the hashes.
We're just saving. The pwned means… it's captured a handshake and there's enough of that handshake.
That it can be used to do some brute forcing.
Okay. How so sees Sniffazard.
How are they communicating status if they're cycling the exit or the cycling Wi-Fi client across channels what are they doing to communicate? Because it's my experience When you're looking at the channels you can't be utilizing a channel.
Okay. Ah, okay.
Correct. And again, this is like a snapshot of a moment. Eventually it's going to come out of the uh the scanning mode, it's still going to say it's going to go back and say, hey, sniffer, are you still there? Cool.
Gotcha. Thank you. Okay.
And they'll share some information back and forth.
Yeah, so pound at the bottom, number of handshakes it's captured since it's been on, total number of handshakes.
Iot, that's where it says IoT there, that's the last SSID of the most recently captured handshake.
And then at the far right where it says ai That's the current mode that the Ponigashi is operating in.
And as I said, we'll get into the modes a little more.
There are three available modes, manual, auto. And AI.
Excuse me. In manual mode, the ponagotchi doesn't do anything on its own.
Doesn't do any sniffing, no deauthing, nothing. You use this mode when you're doing updates.
Or backing up your ponagotchi. Or wanting to use better cap as its own tool without all the automation Just it's using it as a standalone device you connect to the ponagotchi And kind of use it just as a Raspberry Pi with some
Wi-fi auditing tools. Auto mode is how the Ponagotchi gets started.
It boots up, automatically goes into auto mode. It starts sniffing around and capturing handshakes in a very default manner.
As defined by the defaults in the configuration files. It's perfectly functional at this point.
But doesn't have any of the optimization provided by the AI.
When you first power it on, the Ponagotchi will default to this mode while the AI's neural network is loading.
Because the neural network file is kind of large and can take a while, can take as much as 30 minutes. So you'll start with this and then eventually we'll just, it'll that auto will switch to AI and then it's
That's where it really starts to shine. Once the neural networks finish loading.
It begins to start tweaking the algorithm to optimize where and when it decides to default, where it sniffs And packets for maximum honeage.
Some of the basic moods that you'll see. As the name suggests, reflects how happy, sad.
Or aboard the ponagotchi is. The more white more exciting Wi-Fi activity there is around, the more handshakes it can capture, and the happier Ponagachi is.
If it's free. If activity is pretty slower parse The Ponogachi starts to get bored very quickly.
Sat and bored very quickly. That is not above pulling on your heartstrings and begging you to go for a walk or something like that.
And so, yeah, when this happens, the best thing to do is to take it someplace for a walk where there's a lot of Wi-Fi kind of my preferred preference nearby is I go to the local mall walk around there. All the stores have their own Wi-Fi.
That tends to make it pretty happy. So anywhere there's a lot of different Wi-Fi access points.
So crowded neighborhoods, shopping areas, that kind of thing. The AI, like I said, I've been talking about AI a lot.
The AI being used on the Ponagotchi is a method called of reinforcement learning called the Advantage Actor Critic.
Or A2CS. As the Ponagotchi continuously runs, the settings are optimized over time based on what the AI has learned.
Reinforcement learning agents have basically three components. There's an actor that tells the agent which choices to make.
Which is like someone trying to help you play a video game by telling you which buttons to press.
The critic provides feedback to the agent on those choices. It keeps score, tells you if your last move the last movie made was a good move or if it was a bad move or if you should have tried some if you should try something else next time.
The critic also provides feedback on the advantage. It's not enough just to know if a move was good or bad. You need to know how much better or how much worse you did.
Compared to what was expected. Move.
Like if the move was the only supposed to knock a few pit points off and enemy, but instead you ended up doing a critical blow well you're… that not only was that a good move, it was a much better move than expected.
This feedback occurs every few actions repeatedly review uh to repeatedly review and moderate the sample size. Looking around every now and then and kind of making sure you're going in the right direction.
Compare this to a Monte Carlo system, which waits until you've completed a whole game before it kind of critiques your actions.
Or a one-step system where it reviews choices after every step that you take.
In a real world scenario where the Pontagotchi exists. Walking around and doing interacting with Who knows how many networks. A one-step system is kind of too slow and inefficient.
And so there's no real conceivable end to the game. And there's no real end to the game for a Monte Carlo system to reach before It can analyze your actions. There's no set number of Wi-Fi access points that you're looking for.
So that's why the advantage actor critic is kind of the optimal approach here.
For the developers in the crowd. The Ponagotchis using a Python library called Stable Baselines, which is a reimplementation of OpenAI's baselines library.
Here's basically the Ponagotchi's main kind of loop oh hold on.
Yep. I think I'm missing some of the big picture.
So you talked about it last slide you talked about it analyzing scoring points and what actions to be taken What actions are there besides doing a disruption and enforcing a new handshake.
That's where this hopefully comes in.
Basically, it's it's Yeah, how it's… The different actions are How often does a handshake?
Yeah. Is the answer here on the page?
So it'll adjust depending on how much traffic it sees. How much uh how much how many access points it sees.
Whether or not there are other ponagachis. That it can make friends with.
The this uh the changes how frequently it will jump around on the spectrum.
Where it focuses its attention on the spectrum um so like particularly if there's another ponagachi in the area it'll actually divide up the channels and say, you take this half.
I'll take the other half and we'll each focus our work there.
And then… Yeah, how frequency how often it hops, where it's looking, and how often it's sending DAuth packets are kind of i believe the main functions.
Does that answer your question? Sure.
Let me expand on Gary's question. What endpoint goal is provided by the deauthenticate.
Sorry, say that again.
Okay. For some reason, I had the impression that by de-authenticating, you could capture the password when somebody re-authenticated.
Correct.
Okay. I just wanted to confirm that. Okay, and they see For any particular Wi-Fi setup there's multiple channels then that are available.
And that's why it'd be nice to have more than one Panagotchi is so they could divide up the number of channels and be watching across them rather than each of them having to hop from channel to channel.
Yes. And I think this is more an answer to your question.
Hey, we're learning something.
Here's the basic loop if anybody's interested.
As for what gets tweaked there. Different settings uh there's basically 20 different things that it tweaks.
Everything from wait times, timeouts, signal strength. Channel hopping, frequency of text the there is actually posted the reward functions After each loop or iteration, the score is calculated.
Judging how well it did. Basically, the more access points and handshakes acquired, the higher the score.
There's… See, it's been a while since I've reviewed this Just trying to go through this before the talk.
Like I said that. Settings.
I could probably pull up later if you want we can uh I know of those personality settings You can go through and kind of set the default configuration.
For all of those. So you can actually, which also has the added benefit of knowing what actually gets tweaked and adjusted.
Am I answering your question?
Okay, I guess. Yeah, and I guess we probably have a broad spectrum of familiarity with the current audience tonight So yeah, whether it's It may be obvious to some people why things need to be tweaked. And to some of us, it may not be
Obvious why there has to be multiple wanagotchis to watch that It seems like the whole idea here is to capture handshakes. That seems to be the primary goal.
That is the primary goal, yes.
And…
This is Stan. The Tanagotchis make friends. What does that constitute? Do they share the data?
Or they did just say, you take half and I take half.
Yep. They do.
They'll split up the spectrum so that Just like you said, the leech take half and then they'll share the results if they've If one's captured pack handshakes that the other hasn't.
They will share that data.
So A will transfer data to B and B will transfer data to A.
Correct.
Thank you.
And then I don't know if there is such a thing as an average Wi-Fi environment office setting or in a home setting Would you normally?
That's kind of, there's not, which is kind of the point of the ai Because there isn't an average setting kind of Wi-Fi environment.
So the idea is that as you move from environment to environment that it'll try to it'll do its best to try to tweak it to optimize it for that particular environment.
Okay.
I wonder how this thing would behave in mine So I'm using that.
Trick that unifieds allows to… use one SSID but multiple passwords And each password is a different… VLAN.
So it would… my understanding of the attack
Is yeah we'd… If there's mouth if there's There's multiple networks with the same SSID.
It will capture separate hashes for those.
I've seen it do that. And when it came time to crack it, you would you know kind of if you're cracking them all at once they would be treated as separate hashes.
So yeah, you'd be getting Assuming you have different passwords for different subnets.
If it captured a device connecting to a specific subnet, it would uh you'd get the password for that subnet.
My understanding is correct.
But it's an interesting idea. Sorry.
My concern would be if could differentiate or if it would cause… false positives or false negatives more noise in the process it's trying to deal with.
So I think the one caveat is I can't say for sure, because I think that where I I think the hiccup would be Because your base station probably has this is your base station maintaining the MAC address?
In that case.
Yeah, I don't know. Sounds like an experiment. I wonder if anybody on in the community.
Has encountered that.
Because, yeah, the hash is based off the password, the MAC addresses Together.
And I believe like when it saves a separate hash, it's by base station ssid with the base station Mac.
So if that's changing and your password's different that's And that might mess up your hashes.
Well, depending, and I'm coming at this from messing with host APD.
A long time ago. Depending how integrated it was getting to the just above the radio.
So like playing on the mac layer if it kept the same MAC address And each client.
Or each set of clients for different VLANs used a different Password.
It seems to me like from what you said about the hashes before hashes the hashes using 1Password for one subnet on the same MAC address.
Would basically make artificial noise for different password different subnet.
Same MAC address.
I'm just trying i'm thinking of my
To me, it's almost like having two basically identical APs side by side using the same SSID, same MAC address.
Right.
But different passwords.
So actually, so thinking more and more. And from what i was refreshing myself earlier tonight. With every… handshake file that it saves.
Each file contains a copy of every hash saved.
Or handshake safe. So if you've got four handshakes in there.
When it comes time to cracking it. So if it's all the same, it'll run all four handshakes. You can run all four handshakes.
Through John the Ripper. And it'll attempt to crack all four.
And if it's the same password, it'll come back like cracked four handshakes.
Here's the password for each of them. So if it is a different password on every handshake, I think it will.
Because these were on the same access point. I just happened to capture multiple handshakes.
It will probably give you the four different passwords if they Assuming they're in your password list, of course.
Right, but it would probably… more computation time.
Oh, yeah, absolutely. The only reason I don't have an adequate, unfortunately an adequate password cracking rig And we're going to get in more of the password cracking side of things.
When I did the demo, I stacked the deck. I had a word list. I knew the password that I needed was on the word list.
And we attacked a specific an access point specifically set up.
So yeah, in the end, it does come down computational needs and needs having enough hardware to throw it.
Hash.
So to answer Tyler's comment or question, it sounds to me like using the multiple different passwords has the benefit of dividing your network which multiple parts of multiple parts network security says is a good thing And it also has the advantage of the
Kind of introducing some noise or almost disinformation that will mean an actual brute force cracking attempt will have more data that it has to go through. So you're subdividing your network And you're making the pile to be brute forced.
Bigger. Sounds like a win-win to me.
Agreed.
I would say as long as they're all good passwords yeah You got a crap password on any of those you're just kind of, I think opening you've got for like if they're if they're all crap passwords, then you've got four ways to
Into your network at that point. So yeah, given good security practices everywhere else, yeah, I'd agree.
So are we now talking about cracking two different things.
The first thing we're looking at cracking is go into a coffee shop somewhere And there's a… a wi-fi and the customer is invited to use it it's the name of the network seems to be Bob's coffee.
And the password might be the password Not red coat.
Another password to the same network might be Not Starbucks.
And so there's two different possibilities. And are we saying that the first thing that Bonagachi does is Presuming I don't already have a password to this SSID.
It's going to find out what the password is? Yes.
Okay.
Not really. Ponagotchi itself is not going to do that. What the Ponagotchi is doing is it's watching the spectrum watching other devices connect to that device.
And capturing those packets and saving them. And ideally, if you have enough of that information you have enough of that information to crack the Wi-Fi password at a later time with enough time hardware.
So to me, the use case that was presented whenever this came out 15 onward. I don't remember when.
Was, yes, you have a Wi-Fi network. You do not have access to you want to pwn it.
And get on it, it used to be very manual not script kitty.
To collect enough Wi-Fi association four-way handshakes so that you could subsequently brute force those and derive the Wi-Fi password.
Ponagachi, as I understand it, is a tool to assist in the data collection process that has some AI to try to tune its collection algorithms And has some nice personality features.
Is that fair, kamikaze joke?
That's 100% accurate.
Does that answer your question, I think, Lee? Or was it Gary?
It's Gary, but… Only sort of.
So I guess… very short direct question.
Okay.
What are we trying to capture here? The password to the SSID?
Or the the key for a particular user going back and forth.
The next day.
Oh. The… trying to capture the four-way handshake data that is an opaque blob that contains some things we want.
After we have captured it later on. We post-process it.
And get the password for the network. Through brute forcing.
Okay.
And I feel I should point out it's my understanding Wi-Fi networks.
Through five to 10 years ago. Every client used the same encryption methodologies. So if you managed to break the encryption using ponagotchi and brute forcing you could now have access to the wireless password And you could decrypt every client's
Wi-fi traffic. So now you're dependent on SSL or something like that.
That last part's not. Entirely accurate, at least not anymore.
I mean, I think…
Right, I was getting ready to say within the last five to 10 years It has been taken to the next level where you have a per client encryption key is that Fair joke.
Yeah, every client, yes. Every client has its own key. Correct. Correct. Correct.
Yeah, we had a before and an after that happened sometime in the last five to 10 years where before everybody used the same thing after it's per client.
Okay, I think it was longer than that but I'm not 100% sure myself.
Okay, I… time has been time has
So, yeah. I'd have to, I'm trying to remember if that was the difference between WEP and What's current now? Wp was different it was just broken Maybe that was the difference between WPA and WPA2.
I'd have to look into that.
Okay, so before 10 years ago, roughly decade ago, let's just leave that as a given.
Sake of discussion, yeah.
Sure.
So at that time the old way I go into bob's Coffee And I know that there's only one password, it's only one subnet, and it's not Redco is the password.
Now I can log on and in the old days, if I got that far in.
I could potentially see the naked traffic from every customer in the room.
Because it wasn't individually encrypted for each. Person. Yep.
I was anchor.
Yeah, there used to be a there used to be a single key And now every client does have a key.
Okay.
So every client's traffic you've You can get on the network because you know the password but you don't know every client's key.
The password is used to generate the key.
The specific key for each client.
Correct.
Now, but not 10 years ago. Okay, okay, okay. All right. And so Ponagachi is used break that initial SSID password.
Or the key for each client or both.
It would be a key for a single client which lets us get the password.
For a single client. Password.
For the SSID.
Oh, okay. Okay.
Yeah, so when you're capturing the handshake, you're capturing the key exchange.
Check your .
And because you know the MAC address and the SSID, which is used as part of the key exchange.
You can revert you can use that to reverse engineer. And get the password.
Okay, so the password to the SSID is now just one of the nice little tidbits that I can pick up from blockchain communication. Okay, cool.
Any more questions for the moment?
Oh, I have more, but I'll wait till the end.
Okay. So yeah, I think we're a little off topic. I mean, we were talking about the AI.
Okay.
And I was doing my best to explain it even though AI isn't my area of expertise.
The math behind the reward function After each loop is iterated, score calculated.
More access points. Basically, the more access points seen and the more handshakes captured.
The higher the score. The happier device.
Yeah, we've had some questions about making friends. I think we've kind of covered a lot about what this is.
Is going on here. As I said, while scanning. Do you all think capturing and everything else, your Ponogachi may periodically send out And this answers the question somebody had about how they communicate.
You send out advertisement packets, your ponagachi will send out advertising packets on whatever Wi-Fi channel happens to be scanning on.
It happens to be scanning.
It then also listens for other advertisement packets. While it's scanning.
This allows the Ponogachi to notice and recognize each other when they're in ranges.
Recognize each other.
Once they do, they become friends. And the more they see each other, the better friends they become.
And Friendly Ponagotchis tend to be happier. Display the happier mood more often.
Ponagotchis that our friends, as I mentioned before, start to exchange information with each other.
Like their name, their signal strength. Number of PO networks and the current channels they're on.
And which will begin to influence the Ponagotch's behavior. Friendly ponagotchis will start to split up the spectrum.
As again, I mentioned before, dividing the channels among them. Allowing them to distribute them to the work and capture more handshakes effectively.
One day, I'd love to be able to convince
A client while doing a Wi-Fi audit just to be able to have a fleet of these and just walk around an entire campus and have all my ponagotchis working together.
To audit the Wi-Fi of giant campus i think that would be a fun thing to do.
Pone grid. Does that sound fun?
That does sound…
It does.
So I mentioned Pwned grid before. Pwned grid is a service online that your Ponagotchis can connect to.
It gamifies the ponagotchi activity by reporting information about the ponagachi for ranking.
Ponegrid also facilitates ways to send encrypted messages between Ponogachi owners.
The original pwn grid. Set up by uh the community that in Evil Socket is still active But… Again, due to the lack of development on the original Ponagotchi image Most folks have moved over to O-Pone grid, which is a reimplementation of
Of the original PoneGrid API. You don't have to use this if you don't want to, if you don't want your ponagachi to be talking to others online.
You can disable the grid functionality within the Ponagotchi if you don't want to.
But when you are connected to the internet. You get submitted data about the neural network And… provides a way to judge how many networks Each one is pwned without actually relaying any of the network data itself.
Here in the screenshot, you can see a kind of the open grid leaderboard.
At the time of this screenshot several months old at this point.
Yeah. 360 plus.
Thousand, uh. Aps have been reported.
You get the top three rankings and who's done the most.
I often wonder like How do you get, unless you've had it for forever, how do you get, you're just going around with this thing everywhere to get 7,000.
Access points.
Just seems like a lot. I often wonder if they're just like generating their own ssids and Just to… spam the numbers or what have you.
Yes, how about that?
Okay.
What's that?
Ces. Take this to CES. I bet you can get 700 SSIDs off all the vendor booths.
That's fair. Fair point.
I suspect you'll also, Gachi will also get some friends.
Well, and if you do, you can send them messages. Uh…
The just expanding pride being high on this chart Why would I join such a thing? It sounds like I'm going to be visited by the The federal FBI. Well, the FBI, the computer security investigators you know it's like
So it's actually, you know. It's anonymous, essentially.
The names there are configured in the encryption. The… The only identification is actually identification is actually Unless you have a GPS hooked up to your ponagotchi, which you can do.
There is just a cryptographic hash that identifies and separates your ponagotchi from all the others.
And so like if you're on a public wi-fi to do all your submissions.
It'd be really hard to track somebody down based on that.
Because you're not really getting, there's not a lot… Aside from that ID, you're not getting anything submitted.
And if you're not doing the disassociations. And you're just passively sniffing I don't think there's anything illegal about it.
Might be immoral depending on what you do But I don't, am I missing something?
That's my understanding of it too. Like the only sketchy part really is the DAO thing.
And the fines that the I think it was FCC levied against some large hotels was they were de-authing anybody that was not the hotel's network And they were charging through the nose to use the hostel's network.
So it was anti-compete thing.
Right.
Well, one, that generated complaints. The FCC doesn't do anything until somebody actually complains.
Fcc. Two, if you deauth one Client.
Just to listen to the real… to the reauth. Good luck catching that.
Yeah.
You're going to have to be sitting there wondering with something like a… what is the pineapple To say, oh, that the yach came from five meters that way and then… to a whole bunch of radio translators.
And like I said, with the fc like
Trends. Most of the stuff that complain is persistent Oh, I'm going to shut you down.
And those are 10 times easier too. To track down because you're doing it time after time after time after time.
I know a lot of IDS will pick up like whether or not there's like a deauth attack going on being held against your network.
If you've got like a corporate Wi-Fi environment like you know.
Meraki or cisco or ubiquity.
Can't tell you which…
What AP is being Doing the Dios or is it just saying that I'm seeing a lot of deauts?
It should tell you what APs are picking them up.
Because I've definitely had… At my previous job, I've had the IT guy march into our office.
Me a time being like, what the hell are you guys doing now?
Because we were doing something like that. You're setting up for an engagement.
So he definitely knew where they were coming from.
And yeah, if I were to get caught, I'd be less worried about the fcc Because I have to think they like an individual, they'd just be like first time around, be like.
Knock it off before they try to send me a six figure bill.
I'd be much more worried about the computer fraud and Abuse Act.
Sending deauth packets than I am the FCC.
Yeah, the FCC. It's if you make us get out of bed and do something If you're bad enough to make us do it.
Shame on you. You deserve what you get. But I know from the radio friends it's like the pink tickle it's please stop doing what you're doing. We don't want to come talk to you.
Moving on, pone mail. I've met you.
Okay.
Okay. Still got a question here. Bit am i getting from being part of this wonderful shark I mean, I understand that it's questionable which agency may be interested in hanging me.
But why would I participate? Is there a feedback I'm getting from this? Well, first off.
Okay.
If you're put your personal real name up there, you're a fool.
I… I'm actually about to answer your question.
Again, why am I even considering this? What feedback besides pride of ownership and i get
All right.
Yes, there is a leadership board. The leadership board is Just complete bragging rights.
Okay.
And you don't even you can still connect to PoneGrid. And I think you can turn off the rankings.
Don't quote me on that. I'd have to double check. The other advantage to Pwngrid, though.
Sorry, fly. Is pone mail.
You can send messages. The Ponagacha can function as a sort of crypto pager uh whereas The Pwned grid system You can send and receive email, basically.
It's an overly complicated way to send encrypted email. I don't know if it's quite as complicated as trying to use PGP.
But it's close.
But if you allow your device to connect to the pone grid.
You can send messages through the PoneGrid system to other Ponagachis if you have their hash id Everything is at first before it even touches the PoneGrid server They're all encrypted with RSA public key And only the recipients have the private key.
Your phone mail address.
To send messages to Podomagachis is a cryptographic fingerprint. Which is which is the SHA-256 hash of your public key.
Like I said, it's all a little cumbersome.
You know, it's That's what else you can do, why you would want to connect to the pwn grid.
Aside from the leaderboard. If that's enough for you to do it, great. If not.
You know don't worry about it. Yeah, other than that, I don't think there's any other reason to do it.
Okay.
But you don't have to be… Like if a… And I believe you can it you keep track of the hash IDs of Ponogachis you've made friends with?
But then, yeah. You're apart from your friends. As long as you have that hash id You can send them messages and it goes up and then gets sent out where, you know, next time they connect they'll pull down the message and then reply. You can also use it to send files that way too.
Either text messages or images or other encrypted files.
Okay. Okay.
Well, it's very kind of out of band you know encrypted message.
New and fun ways to make friends.
Yeah.
I see too that you are sniffing this place.
So, uh… Cracking Wi-Fi. We've built our Ponagachi at this point. We've fed it. We've taken it for walks.
Now, what do we do with all these handshakes that we've captured?
We've kind of already talked a lot about this. The Little Pi Zero is definitely not powerful enough to do any kind of brute forcing password Correct. So we have to get it off there. And you can do this in multiple ways. You can either copy them over
By SSH or simply plug take the micro SD card out, plug it into your computer Once you've transferred those hashes.
You want to either use John the Ripper or hash cat to try to crack them.
In general. If you only have… a CPU, you'll want to use John the Ripper.
If you do have dedicated gpu or preferably more than one GPU.
I suggest using hash cat If we get to the demo portion, if we do the demo portion I can show you how to use John because this is an old laptop and that's all it can handle.
There are other alternate ways to do some of the hash we're cracking. There are some online services.
In no particular order. Banth XDE, online hash crack WSAC set stanov.org.
There are also some plugins for the Ponagach that will automatically load your handshakes to these services from the Ponagotchi so when you connect it to the internet and take your Pona Gachi online to connect a pone grid or what have you
It also takes the hashes and upload them to these services and queue them up for you.
I haven't messed with any of that. So.
If you decide to try it, let me know how it works.
Documentation. There's the original Ponagotchi wiki at ponagotchi.ai.
Ponagotchi.org is the new wiki. For current development, much more current information.
The old wiki is good for like kind of like a deep dive on how a lot of the hardware and stuff worked.
There is also a very active Ponagotchi subreddit of people doing various mods adding GPS is doing big ones, doing ultra thin ones There's even been development of, which I haven't messed with yet.
But it's on my long project to do list of There's been supporting of Onagotchi over to ESP32s.
Not nearly as… efficient like uh efficient doesn't do nearly as much. None of the AI stuff is running on the ESP32 version, it just kind of like default does the auth And I think capturing and that's it.
Any questions in the moment for a quick question break? We can try to do some of the demo.
I haven't had luck getting it to connect So we'll see how it works.
Ec32 is a what?
I'm sorry? Oh, sorry. Yeah.
Yes.
The ESP 32 is a 33 megahertz Microprocessor that that gets used in a lot of IoT I abused the hell out of it using ESP home My question was is were they looking at porting this over to run on the
Let's do it.
Hasbury Pi 2040 or 2350.
Um… That's a good question. I haven't.
Okay.
Last time I checked. So they hadn't done it for the original version the Was it the 35 is the newer one is that right?
I think it's a 2350 is the new one with the arm cores.
Okay. The newer one hadn't come out yet when I did this talk.
Not arm. Risk. You can either choose arm or risk
The new one hadn't come out yet when I had done this talk originally, so I hadn't seen anybody Try to do it. All I've seen it was the ESP32s.
A lot of them being done on what's called the cheap yellow display.
Which is a very… for like $10, $20, you can get a these like yellow circuit boards from like uh various online sources, either Alibaba, eBay.
Amazon, which have an ESP32 microcontroller built into it. But comes with a resist a very kind of like basic cheap resistive you know 320 by 240.
Resistive touchscreen display. There's even a… SD card slot built into it.
So I know a lot of people are using these. For the uh ESPod. Agachis.
Or is it i think they're calling it like ESPachis
So readily accessible kit you can get online. I just happen to have this one on my desk.
All right. The reason I ask is because the reason I ask Well, the RP2040 already knows how to do Python.
And Pimeroni. Makes a… what they call… the 2040W Badger.
Which is basically one of those soldered to the display.
Find out.
And a couple buttons. Which would be perfect for this application. It felt sitting there singing, listening
Is it possible to use a pie pica for the body?
That was two years. That's not going to be current.
Because I know our local YouTuber, Jeff Gerling, converted ESP Home to run on 2040, so… There's some possibility there.
I just don't know what magic.
Yeah, I know ESP Home will run on yeah I don't know.
I don't see anybody.
He's going to buy three or four instead of Pico. You don't know what you're talking about.
While you're searching, I did a little bit of sleuthing and it seems like the timeframe that I was calling five to 10 years ago.
Pre-wpa3 slash Wi-Fi 6. And after, so that might be after that the cutover point.
Wpa3 versus WPA2.
That's a lot sooner than I expected.
Yes. And it's right around the same time that Wi-Fi 6. I don't know which one did it.
Seems like one of the two. Were you saying?
That is a lot sooner than I expected.
Yeah, I remember hearing about it as a future tense thing like maybe five or six years ago.
Like it had been through standardization But vendors hadn't started producing it in mass yet.
For retail.
Okay, so we're saying that either pre-WPA3 or pre-WiFi 6. Once you got on to a private Wi-Fi SSID network.
That any of the other users of that network could be seeing each other's traffic.
Yes.
That is my understanding. It is predicated on a lot of assumptions but Yes.
Okay.
Who are you playing with sheep?
And as a matter of fact i abuse myself remembering back to us sitting around in a coffee shop type situation sitting there watching the traffic going back and forth and going Okay, that conversation, I bet that's the person sitting over at that table over there. You stand up, walk across the room, look over their shoulder and just a little bit to see who's
Whose laptop you were monitoring?
Yeah, pre that security enhancement you could… with enough effort, get back to get back effectively and unencrypted network.
Of course, if you're at the bread company and you know their password, you just get on.
Mm-hmm.
One of the things I had preloaded the tabs. Here's the ponagachi.org wiki.
All the background information uh they've got.
Links to cases. Various plugins that they have available.
The GPS, I think, is kind of the most common because then you can kind of or drive volume.
Doing your thing.
Some ui stuff people like to change way some of it looks anyway There's third-party images.
Here's a list of available screens.
Various hardwares do have open grid open as well.
You can see it's just 37 minutes ago somebody added a new Bye.
Okay, again. Why would I care about somebody adding an onagotchi in India or in Chile or Sweden.
Just bragging rights. I think that's it.
Or maybe see search by fingerprint. Let's see if we get any actual information.
Alrighty.
In the community.
So you can actually get you could add you could get Send them a message, talk some smack to him.
Any practical examples of sitting down in a panera in a panera I guess Panera wouldn't be good because that's an open one.
Let's…
You know sitting down in a business cracking their password for their SSID.
Um. I have not, just because i've not I need to get a, I don't have any… enough hardware at my disposal at the moment to do any kind of submit uh real cracking. So I've just been collecting hashes The only one I've done so far is like the one that i
Intentionally set up to break. Which I can demonstrate.
Let's see. Ooh, wait.
I must be misremembering because the misremembering because Last time I heard about this stuff.
I would swear people were using notebook computers to break some passwords now they might be bad passwords like eight characters or less alphanumeric But… For some reason.
Yeah, so I can show you, I can demonstrate that. I think.
I wanted to show you more like the more get into showing you the the dashboard but the dashboard I can't, for whatever reason I can't get connected to it.
It's supposed to be a matter of just uh connecting the device by usb and do an internet connection sharing with your device.
It's not wanting to behave.
But if you… If you like, everybody see the… My terminal.
Yeah.
Okay. So I can, though, walk you through hashes.
So I've got… These are all the different hash PCAPs that I've captured from Up until the last time I gave this talk.
Which is quite a few. I used to like take it around.
You can see arch reactors there. And just for the record, yeah, I've got our, you see arch reactor there, AR members.
But in the configuration, you can put a whitelist of
A block list of things to avoid. And say, don't say don't capture packets from this SSID.
And don't submit any information about this SSID.
To the uh to uh grid.
And just keep that.
Have you looked at like the My Spectrum, because obviously that's you know something that we have no idea where it is.
Is there one of those that you could show us to see what you captured?
I've got this one here, this super secret Wi-Fi do not hack I'm going to show you how to do that one.
If that's okay.
Are those standard PCAP files, like could T-Speed up or Wireshark ingest those?
Yep. Yep, they should be. Yeah, it's the… So yeah, we've got our collection of PCAPs there.
Do you?
Now, first thing I do have to do Because we're going to use John the Ripper.
So at this point, I've taken these, I've copied them all off of the SD card on my ponagotchi into this directory here.
John the Ripper is very particular about how to format hashes.
So… I can't just give it the PE cap. But fortunately there are tools therapy.
Yeah. So if I do, there's W. A PCAP to John is a tool that will let us format a PC file to… a hash.
So I'm going to go ahead and super brief. So we're just going to convert this PCAP to from super secret PCAP to super secret hash.
And yeah, if… And we can see some information out of this that I've actually got two handshakes captured In this… in this hash.
And if you saw my directory, I've also got a word list here
It's a very short word list. Yeah, just 64 in here, again, because I'm stacking the deck.
I think this word list is just like the top 50 passwords You know, most used passwords kind of thing.
That everybody uses and they shouldn't use. With one edition.
So I've got that. Now that I've got my hash, it's pretty simple. I just do john I specify my word list.
Word list.
Can you show us before you run, John, can you show the hash List.
Oh, yeah. I can't do that
So yeah, there's a prefixed of the ssid some information about There you can see… the actual hash. And then here's our second handshake
Thank you.
I could. You're welcome.
So yeah, John. White list equals word list.txt.
Super secret Wi-Fi.hash. And do… Here we go. Warren detected a hash so It looks like it had some partial handshakes, but Loaded two password hashes with two different salts.
No passwords left to hash. So it's churn through that data.
Obviously you didn't show them there. To actually view them. You got to type.
John Show. Super secret.
Ash. And then we'll get the information super secret wifi Right there, secret key and secret key.
That is the wife… password to the super secret wifi do not hack.
And that's how it's done. It happens to be the last entry on the word list.
So that's the of them.
Will you go back to Ash again? Yeah, your show hash.
I'm sorry?
So secret key is secret key the password for the super secret wi-Fi.
Do not hack. What are the next Numbers.
Yeah.
I believe those were those The… the MAC address of the access point.
Okay.
Okay, so the first okay the first block, I believe, is the MAC address of the client.
The second block is the MAC address of the AP.
Third ones, one of those is probably one of those second ones, probably like the bs ID or BSS ID.
And then the other being the MAC address. I don't know which is which.
Yeah, that's… Okay.
But we've got client Mac, AP Mac. Correct me. Call me out on my bullshit if I'm wrong.
No, it kind of smells like roses. It doesn't smell like a sewer.
So basically. Sample taken by by the Hagati.
But…
Was basically from two different back addresses and that's what it's that samples what it's using to Reverse.
Yeah, two clients connected to two So here's context of how this was done.
During the initial talk at 2600. We set up super secret Wi-Fi do not hack.
As an access point. I put the Wi-Fi password and AP or SSID on the whiteboard Before the talk said… promise this is secure. I know this is sketchy.
But so we have some test data. Will some people here please try to connect?
To this SID for us. If it didn't work, we were just going to use the arch reactor Wi-Fi.
But a couple of people did and we captured the handshakes.
So this came from while I was giving my initial talk in a room full of people.
The Ponagotchi captured these during my talk. And that's where those that's why I got two of them.
Good.
That's the context. Now, if you… Going back to the list of PCAPs, you can see everyone is listed by SSID and then a hex number. That's the MAC address of the access point.
Say that again, because I looked at those numbers and they did not seem the expected length.
Am I miscounting?
Um.
That's six octets, right? Isn't that what you need for a Mac address?
I think I was miscounting. Before.
Two, four. Yeah, for 12 characters.
Or hexets or whatever. Okay.
So in some cases you'll see like, yeah, here's one that was IoT and there's multiple MAC addresses.
The multiple MAC addresses, meaning IoT, that access point It has four interfaces.
Yeah, probably being repeated over a campus. I think that's… that's somewhere near arch reactor, but not arch reactor, if I remember correctly.
I remember seeing that.
Okay, quick question. What if the SSID is hidden? Doesn't matter.
Doesn't matter.
Well, then it saves it in hidden. I mean, it saves the handshake, but that I do imagine that makes it more difficult to crack the hash as part the key derivative part of that algorithm is knowing… both the MAC addresses as well as the SSID.
So I imagine those would be particularly hard to Crack.
My under…
I think that's somebody plain hiding in plain sight and they've named their SSID.
Hidden. My understanding is that not broadcasting an SSID just makes it harder for lay people to find.
It is still part of what is transmitted I believe in clear text it like What was… ether stimbler, Wi-Fi stumbler or something in the early 2000s.
It was trivial to see trivial. Non- broadcast SSIDs.
I don't remember how you do it, but I do remember that it is trivial.
Enough so that I know what Apple devices warn you not to do it.
What does it say?
Oh, it's even worse because your device is always looking for that SSID, so it's always sitting there and say, are you Are you there?
So. Okay, these are Write that one has.
So yeah, some of these it's captured You can see the zeros don't actually have any handshakes in them And zero file size. So let's take a look at that one.
Hit in that corner.
Oh. Yeah.
That's the SSID right there.
Yeah.
Where is the SSID? Highlight that again, please.
And I know that's it because that's my SSID
Okay. Oh, Secret Lair. Okay. Okay.
Yeah.
Very good.
And I do have a hidden SSID, so.
Nice and secure. Hiding the SSID is as useful as Mac filtering.
Yeah.
It's still transmitted in actual traffic. You just have to know where to
Yeah. I know it's only keeping dumb people out.
Yes.
Well, it's keeping the average muggle from looking at their list of networks and not seeing it.
Yeah.
Preventing him from seeing it. That's all.
So we were briefly talking about the three MAC addresses. I was just looking some of that up.
The first one is like the first one is like access points MAC address.
Uh-huh.
The second one is the transmitting device is MAC address.
Okay.
The third one is like the MAC address that's the source of the frame. And those would be different like if you had a PlayStation connected to a gaming adapter The first would be your access point.
The second would be the gaming adapter. The third one would be the PlayStation connected to the gaming adapter.
That's my understanding.
Okay, so I basically had it backwards.
Or my misunderstanding is worse than I thought.
It's a nuance. Look it up when you need to do something with it.
Right. So, yeah, if you stack the deck, Pat.
Correcting the passwords pretty easy. But… At some point, I do want to go through at least try I think AT&T.
I believe those are usually those are usually
Numerical by default.
I would consider what I've seen on the fiber to the home AT&T stuff.
Respectable. Alphanumeric mixed case.
Uh-huh.
Device specific. And that's the default. And then they encourage you to change it from there.
Okay.
I think I'm thinking of the old two wire ones. By default numeric, which I don't have any here now that I look.
Okay, I don't know.
Hey, Joe, would you open one of those real quick and just… point out for me again the point X or the hash from the SSID or the password rather
On the hashes? Yeah.
Yeah, point out the hash, confirm it where it is in the Back in.
Oh, in the packet.
Yeah.
Nice use of XDG Open.
I remember doing so. No. Do I not have…
Well, it didn't work, though.
No Wireshark. Or at least XDG doesn't know about it.
No, I guess I haven't installed. I didn't install it after I rebuilt my laptop.
Yes, I'm an arch user.
No, you're not. You didn't tell us until you showed us.
Fair enough.
What does that make me?
Because I decided to elect for the path of pain also.
After I blew up links meant.
To me. Arch is easier than Gen2. Gen2 is easier than Linux from scratch.
I said pain. I didn't say torture.
Okay.
That depends.
I have been dabbling in Knicks and I hate it. But I also see the advantage.
That sounds like we have some masochists around here.
Basically what happened is my vm farm like crapped itself and I had to rebuild all my VMs. So I'm like, oh, well, maybe I'll do it from using a declarative OS.
And I'm regretting it. All right, we were looking for…
The hash for the password.
I'm wondering if he was talking about where he ran john double dash show or something.
Oh, I thought she was asking for the packet. Oh, is that what you were looking for?
Which was after the
Either way. Either way. No, that's okay. I wasn't sure which one was which.
My mistake.
See, then… I mean, that's easier to show you.
And maybe I'm way off. Here, but is John the Ripper a… of jack the ripper?
It is a variation, yeah.
Okay.
I mean, the naming is anyway i don't know if there was a I don't think there was a Jack River password hasher.
Cracker. I think it was just…
I thought it started as that years ago.
Cheaters.
You can frame.
Anyway, sorry. So, yeah.
Each handshake starts here In here.
Some information about it and basically the hash starts here It goes until… about here.
Because then these are the MAC addresses.
So that that's all the hash from the password.
Yeah. Yeah. Yeah. Okay.
For that handshake.
And why so many periods? Spaces, period.
Right?
That's just, I think that's Vim not interpreting the… x values into a character.
Run that use XXD to show that file. Please.
Xxd, right? All right.
Yes. X-ray, X-ray Delta. It's a command.
At the shell, sorry.
Oh.
Text editor, right?
Not editor. X-ray, X-ray delta space.
Okay. Display.
The… then your super secret thing.
Okay, here we go.
Oh, that's…
There are two E's.
That's… Who has an ASCII table handy.
Do we have to offer a prize? Who's got their eschat? Come on, come on.
I've got it open. 2e is a literal period. It's probably being used as padding.
Okay.
Www.askitable.com.
Or just ask chat GPT? Corresponds to the period.
I asked a vendor for a certain piece of hardware they didn't have it.
They gave me a chat GPT answer going, you don't actually need this hardware. There's a software implementation.
No, I wanted the piece of hardware. I was avoiding said software.
Piss off.
No, I haven't seen that. There's an old trick of chat gpt is asking a detailed enough question and it doesn't go off into left field.
Okay.
Does anybody use Kali Linux or any of these components incorporated within Cali?
Um.
I mean, I use Kali Linux. On a semi-regular basis.
Better caps available, I believe. I don't think it's part of the default install.
I believe John the Ripper is included
Okay.
But I mean, there are similar tools that are pre-installed. Maybe I'm wrong.
The only two of us.
Okay, so what we've seen here is a demonstration is one panagati going out and looking at a number
I'm mistaken. Better cap is part of
Go ahead. Good.
Sorry, BetterCap is part of Cali. I was just saying I'd better cap is part of Cali.
Which is the main tool that the ponagotchi uses to do the uh Wi-Fi on it that uh do the deaw thing and capture the packets.
Okay. Or… for completeness, Cali Linux is known for being a distro that is tailored for use in security.
Type applications. We've had two or three talks on cali linux by Tony Z. I believe all of them are in our archive If anyone is interested in those Go to the archive.
Get the latest there.
Yes.
Mm-hmm.
So the demo that you just did was taking… Onagati, one device And that went out and looked at a number different networks or subnetworks.
Yes.
And then you had offload these data capture files and use a different machine to go through the PCAP files to find the the passwords.
Find the hash for the password.
Yes.
Okay. And that's all we've done so far is find the hash.
Right.
Yeah, of a specific of a specific For a specific AP, yeah.
It would take a lot more computing that what we're looking at.
No. No, John the Ripper showed the password.
Well, that's because it was a simple one.
Yeah, it…
Yeah, but I mean, it would, it would… It would just take longer to find something more complex.
Yeah.
Right. That's what I was saying to Gary. If it was a complex password r camel case or something like that, this could take a heck of a lot longer to guess it.
Days.
To be more specific, what we did, the full steps were, yeah, we had We had the capture files. We formatted the capture files.
And to hash it files that John the Ripper would understand And then… ran a word list against uh the hash file that a specific hash file that had two captured handshakes in there.
And yeah, one of them matched up. And it was intentionally a simple set up.
Okay. And it would take more time or it would take more time more data being input, more captured data being input.
For something more complicated. More time and preferably better hardware.
Given the option, I would… I actually prefer using
Another tool hash cat for doing hashes.
But it is dependent on having GPUs at your disposal
The more the merrier. And you can also do things with that where like give it patterns. Like if I Like I said, if I happen to know that it is a hash is completely numeric.
I can say just try, I can feed it a pattern and say just to all the numbers from 000 from 10 zeros to 10 nines.
And it'll accept patterns like that or If I know.
A very common situation is uh corporations have a habit of doing like a habit of doing for when resetting customer or user passwords, resetting them to like season, year, and an exclamation point.
By the help desk.
So you could say a pattern, you know, you pick one of these four seasons And the last three years of passwords.
Or three years. As a pattern.
And churn through all those. I mean, password hashing could be probably a whole other talk which I would like to build a talk around at some point one day.
But I know there are competitions on just developing more efficient patterns and things like that for just doing the hashing.
Or it could just be me and… Encrypt the damn thing and send it to the manager.
Oh wait, I have a PCA. And infrastructure are all set up and functioning inside of Our company, so that works.
Bye. I used to have to hand out those passwords.
So did I.
And then… And then when the responsibility got handed to another team to do the help desk. We don't want to hand out passwords.
Management looked at me and says, what? It's not my job anymore. He said, fix it.
So I came up with a script that would reset a password And send it to the manager in an encrypted email.
Wait, you've got the managers to use encrypted email?
Everyone in our company has handed a PKI card and they're told to activate it.
Activate it.
It was really funny when they looked at my code and said, we're supposed to implement this in the new Empower ID instance and like I have it working in PowerShell. What's wrong with you?
The only thing I could think of would be better is there's a software called Flash Paper that We've accepted as a secret distribution.
Method or you give somebody a URL and it hands them the password.
On the other hand, somebody could just intercept the URL and you know That's annoying.
Nobody liked my idea, which was on Why don't we just send it to them in teams?
It's…
It's encrypted.
And have you ever tried to log into Teams? Nobody's going to get in there.
Yeah, especially when you don't have wind blows. That's it.
I use Teams. Every weekday from a mac from a web interface on my Linux system.
That actually is not as… Windows centric as Microsoft used to be.
No.
Well, did you not hear about the… patch at the Microsoft contributor tried to push into the Linux kernel.
No. Not surprised.
I broke a few things.
How would you be able to apply it?
Microsoft's part of the Linux Foundation's board.
That's freaky.
They contribute engineering hours. To a Linux kernel.
No, what I'm saying is how would you, what tool would you use to apply a patch a Windows patch to a Linux kernel.
Oh, okay.
No, it was a link kernel patch. There was an engineer who was applying some obscure C group memory thing and it broke a whole bunch of shit and it's like What was this? Why did it take this long for somebody to notice?
But it was a good, legitimate thing. It wasn't something that you shouldn't have been doing.
It wasn't malicious, it was just bad code.
Oh, it was bad code. Okay.
Okay.
Though I wouldn't put it past Microsoft to try to
Anyways.
Okay, cool. If I may take a giant step backwards and look at the big picture here.
What we have done with this demo is we took One Panagotchi device.
And… build a PCAP file with a number of SSID.
Nuts that uh that's We captured some data on.
Took that off to another machine. And used Jack the Ripper or john the ripper.
And analyze that and we got the passwords for the SSIDs.
And that's where we have gotten to at this point, correct?
And then…
No, no, it got the individual's password. Not just the SSID's password.
No, we only got the…
Well, there was only one password on the SSID.
Yeah. There's only one password.
There's a hash from each hash Node.
A hash from each. Each node has its own private encryption key.
Now in WPA3. But we have not in the demonstration tonight cracked that.
Yeah.
Well, there's nothing to crack. It's a random hash. It's just created for that session at the node. That's what I was driving at. In order to crack that, you would have to have a fast machine sitting right next to you ponagotchi
And you'd have to actively try working on breaking that during someone's session or or the alternative would be to completely capture all of the encrypted traffic and after the fact put it through a fast machine to crack the hash.
Yes.
Wrong. The problem with capturing everything is I don't think there's not enough CPU on a pi 0 to… handle that kind of data stream.
This is like, what? 50 bytes at the most.
Well, let me take Gary's and take a half step back.
It seems to me like there's two very useful functions for Ponagi.
Number one, identifying the existence of a Wi-Fi network And number two, giving you a fairly straightforward way to recover the password.
Which means the primary end use of a pontagotchi is to jump on a network that you hadn't had the password for.
Ponagati will collect… the hashed password.
You then have to do something else to brute force that.
Oh, yeah, right. I…
That group forcing is predicated on having a dictionary large enough that actually contains the real password and compute resources to process to do the brute force to find the password that works.
So if you have a sufficiently long and strong password that is not in a dictionary.
It's going to take quite a bit. To be able to recover the password.
Yeah, it, it… very quickly gets
Every year there's a year people that gets published.
If you're using a pre-shared You can use the hash of voting That's interesting.
Say again leader with some background noise.
There are some ways. I just asked uh chat gpt how to use a hash to connect to a network without decoding it.
And it says it's possible. Especially with a pre-shared key.
Basically the hash of the password is your pre-shared key right
If you have that with Linux. Yeah, go ahead.
That. The simple answer is yeah it's a hash appreciator. Technically, it's a hash of the… key MAC address and SSID.
Okay, show you.
But because you're because you know the MAC addresses and the ssid the only variable left is the password and that's what you're cracking.
Well, if that's the pre-share key, you can use just that hash.
To log on to the network.
If you have… So it's the ssid.
The password and what was the third piece
Well, it in in The message.
Mac address, both MAC addresses of the client and the AP.
So if you spoof the mac address technically the captured hash should function.
I think, but you start getting into other variables. There's also something that I feel like is an elephant in the room here.
And that is I have not heard or seen any discussion of 802.1X.
Which once you have… the key to get on the network You then have to authenticate additionally to stay on the network If you do not successfully authenticate you are deauthenticated.
So it can be an additional layer.
Yeah, this will not help with that.
No.
That takes us back a step, in which case the only real application for a ponagoti practical application is identifying Wi-Fi networks.
I think it has some layer eight. Implications.
Well.
Proving to management that something is not as secure as it could be.
Please give me funds, you know, layer nine to be able to improve our security posture.
Okay.
Yeah, in the 802.11x stuff. That's usually in a more corporate environment if you were just If you wanted to get on your neighbor's Wi-Fi.
You know this is still of possibility.
Yeah.
Why I want my neighbor's Wi-Fi, I've got three times the speed they do.
Because you're not doing something that you want to be traced back to your neighbor instead of you.
I don't dislike any one of my neighbors that much. I'll just use a VPN or VPN and jump out of Europe.
Yeah.
Or you are a free printer. Jump onto their network, connect to the printer and secure the email out of them.
Or have you ever seen that joke?
Here's the table I was looking for. This company updates this every year.
Number of characters how complicated And in this case, they're using 12 rtx 4090s which is What those are about.
Two grand a piece. I think right now.
So a substantial investment in hardware And how long it would take.
To crack a password. So as soon as like even just lowercase, if it's just a lowercase passphrase as soon as you hit 14… 12 characters, you're at a thousand years.
So it… long passwords are very useful is the point there.
Yeah.
And it doesn't take much. Even though like every year these numbers get lower and lower but uh
Ever still upper and lowercase letters even for 10 characters, a thousand years
Yeah.
So I wonder how long it would take NSA. Probably half an hour.
The nice thing about the math is it tends to be constant.
Whomever you are. It's just what resources do you have to throw at it.
Yeah.
Okay, so…
I think it would be more… advantageous to figure out a way to use like These easy displays to… let's say… pull the guest Wi-Fi's password and display it as a one of those…
A QR code. And then have the best password rotate.
The QR code kind of thing. Is that what you're thinking of?
More often to… Change the password just more often than knock people off the… Networks.
That way you have more of a more rotating secret.
That would do the job. And… You could say, you know, as long as it was more than that password is more than nine characters and you rotated it every three weeks.
You can use the table to determine how often you needed to rotate that.
And I'll counter with what does the guest Wi-Fi in a hotel provide that you're actually trying to protect save from keeping non-guests.
Off of it.
Printer in the business center
I've been in some hotels that I wouldn't be surprised if the point of sale system was on the same network as everything else.
Yes, but that is… now incompetence on their network people. That's not I'm not blaming the network.
For that fault.
I mean, I think when it comes down to it, like all this comes ultimately down to incompetence because if you're enforcing good password policies you know, everything's WPA2 or better, preferably WPA3.
You're you're… network is properly segmented.
So that you're not putting sensitive systems on the same network as the public wi-fi like This only works if you're not following best practices.
Yeah.
Okay, so again let me back up
End of the day, I built a ponagachi because I thought it was fun and I thought it was cute.
I didn't buy it because I thought I was going to buy it.
Crack all the Wi-Fi in the neighborhood.
But it could be used for that.
Yes. Of course, if you don't like your neighbor.
Could be.
Hacked her Wi-Fi and sent an open email message to some rag head in the sand pile and have the homeland knocking on the door in a couple days yep Okay, so in the In the big picture here, we talked earlier about
Having… Pontagotchi friends, multiple Pontagotchi.
So… If I was interested in doing something.
I would want to have two, three, four onagachis.
And I would… set them up to set them up watch and figure out who my neighbor or whatever is wi-fi SSID was.
And have all four of these machines. All four of the Panagotchis.
Getting PCAP files of of this data going to that particular data back and then back and then I would have to offload all those PCAP files give them to Jack the Ripper or john the ripper.
Or the other program you mentioned. And have that then have that process that information and that would hopefully then be able to discover what the password to that SSID.
Was. That much is correct.
I don't think if i don't think I don't think you if you're if you're talking about I think the fleet of Tamagotchis is only… useful if you are
Really trying to collect a lot of wi-fi from different SSIDs over a large ish area over like a campus wide area If you're specifically targeting your neighbor more than one ponagotch really doesn't help you. If you're targeting a single person.
You just need the one. More handshakes really doesn't necessarily mean better.
If you're assuming that they only have one singular password.
Because you just need the one complete handshake to capture And start cracking on that.
Okay.
Um. If you're specifically targeting a neighbor I would actually be more conscientious of when you're doing the capturing.
Either when they get up or figure out when they get home from work.
Ideally, when they get home from work, because then you're capturing them as they're approaching home. That's when their device is going to first see the Wi-Fi and then do that handshake that you want to capture.
Sometimes when you're doing the capturing is just as important as like how you're capturing.
See, I'd be…
I would take a different approach for the neighbor. I would not.
Breach and send the email because the email because that's going to garner attention from people who would go well okay, you didn't send this. Who might have done this to attack you and look at you.
Whereas if you watch the traffic from their network, even if it's encrypted, and go, oh, it's evening and I saw a pizza delivered and hey, I'm starting to see a whole bunch of traffic. I bet they're streaming.
I'm going to start sending some disassociates. Okay, stream pick backup since more disassociates.
And be annoying. In a way that will take them a long time to figure out.
You will cause you will cause the FBI knocking on the door will be a super big spike adrenaline and problems, but it's going to go away quickly.
Whereas you could maintain messing with their network months or years.
Which is the cause for…
And in that scenario, I would go back, I would then agree that a fleet would be helpful because then you've got multiple devices sending out multiple deauts on multiple channels.
Just to mess with your neighbor.
Yeah.
Depends what your goal is.
Yeah.
All right, so…
How does this compare to a pineapple?
Depends on the pineapple.
Pineapple does… Yeah, I think a pineapple can definitely do this kind of attack.
One of the other things a pineapple does kind of Their main advertising function is that uh It will also try to spoof a home Wi-Fi.
Because most mobile devices are all Like, hey, it's my home network here?
And by default, APs say, no, it's not here. I'm not it.
Whereas the pineapple says, yes, I'm right over here and we'll and hopefully get your device to connect to it.
I've been here for a long time. Man alive. And are there any other forms of this new folk music besides
Hold on one second we've got somebody Okay.
Steve muted.
So, sorry.
I… can actually think of an interesting use for the Tamagotchi, not the Tamagotchi, Ponagotchi.
Would be if multiple of us had one and we got together somewhere for pizza or burgers or what have you, and we brought our ponagachis, they would find each other and make friends And would be interesting to see what we could exchange.
Or if you had a fleet of cab cars. But opponent got you in each one and drive around town, see what you find. And when they come back to the depot at night type thing.
They would all yeah they would all share their information.
This would seem to be gathering a large number of of nuts.
And especially if you're just driving around town it sounds like just a lot of excessive information.
Oh, that's great.
You could… organize that a bit better too because like I think I've mentioned before, you can add a GPS module to your ponagotchi.
And get some location data in addition to just the handshake data. So you know where in the situation where you're driving around a fleet around a city, you'd want to know where those SSIDs are So you can log GPS data along with that.
Okay. Okay.
I just remembered.
And I think there's even a plugin that will upload that data to wiggle.net.
That open uh that public open database of geolocated SSIDs.
And some of it is it's interesting to do, to learn, to see what can be done.
Both just for knowledge gain and also as a defender to see what could be gained around your environment and what you might want to protect against or go oh Hiding my SSID really doesn't do anything and it sure does cause annoyance for other things.
Maybe I should consider other options.
Gotcha. Gotcha.
Sure makes for some interesting conversation too.
Yeah, no kidding. So one of the early.
I'll call it expectation possible.
Things that we were suspecting Pontagotchi might be capable of doing.
The idea of actually watching an individual's watching an individual conversation.
On a network. I mean, what we've demonstrated here is how to get the password to an SSID to someone else's Wi-Fi network that we haven't been given a password to.
So let's just presume Yeah, we were back in the back the coffee shop scenario and we had the password And now we're to that thing of the Wi-Fi 6 are WPK3.
Um you know is pontagotchi a tool that is useful for watching and individuals conversation.
I would say not particularly.
My understanding… I would think that would think Unless I'm wrong, if you knew the individual and could identify their MAC address I think you could… get ponagotchi.
To capture you know, send some deauths capture run it through some brute forcing, hopefully optimized brute forcing.
And conceptually get their specific encryption information.
I think once you had that. You could start doing some things.
Certainly, if it was pre-WPA3, and you had the common network password you could then join that network. So you're now inside of the encrypted network And you can play all sorts of ARP spoofing games, what have you.
The layer two is your oyster. Type thing
But that doesn't get you inside traffic in the network that is encrypted though.
Like SSL or TLS.
Yeah, and that fire sheet was one of the things I alluded to earlier getting into the network is one thing.
Then it turns into what can you do once you're in there?
And it really depends on the site. And the security posture of that site.
Yeah. You know so certainly there would be some plain text data you could gather like Who are they talking to outside, IP addresses and stuff like that.
The other thing you could do is if they don't know if they don't if the user does not follow good security practices.
You could do an active monkey in the middle And when they try to connect to their site.
It actually connects to something you control that gives them a questionable TLS certificate And they go, I don't know why this is getting a pop-up. Yeah, I'll accept it and I'll go on.
And now you're in the TLS stream. They are connecting to you. You become an active proxy and retrieve the data while you're vacuuming everything you want.
You have more layers you have to attack at But Konigotchi gets information for one of the layers.
Right. Okay.
Once you're at man in the Middle, like the ponocachi is kind of out of the loop at that point. It's done its job.
And you're using other tools. You know.
Yeah.
Kali Linux or a pineapple or what have you.
Oh, I would be willing to bet the software you would run that's on Kali that can run just about anywhere else probably could run.
On the pie. It's just its compute power is going to be so limited it'll take forever.
Oh, yeah. Yeah.
But software can run many places.
Yeah. Well, nobody says you you can't use a different pipe.
Oh, yeah.
Right.
You know for sure
No, you could absolutely use people are building for this on fours and fives and Yeah. Running it and even hooking up multiple radios to get more of the spectrum.
Yeah.
Or if you want to be kind of devious. Take the software that's running on it and run it on a higher-end notebook, preferably one that has a GPU.
I think it's… I believe it's written in Python, so it should run on anything.
You know, for example, this is for example
Yeah.
And if you watch Jeff Geerly. He's hooked, I believe he's hooked GPU to up to a raspberry Pi with something adapter or was that a different SPC?
I know he did the raid on a pie. I don't know if he did the GPU.
He was doing something where he attached A PCIe graphics card.
Thought it was to a pie, but it might have been a different SBC.
Could have been. I don't remember. I just remember the raid one.
Yeah. Yeah, pies don't have PCI Express.
The compute module does.
That may be what he was doing it with.
It was… Well, but that's a socket that's not a
You know that's not something you plug into. That's something you plug into a motherboard with PCIe.
Although it's amazed me for a long time why the commute, why nobody's built a backplane for compute modules.
They tend to be referred to as carrier boards and I've seen a whole bunch of them.
Where it's like i've like back planes that are slightly larger.
And then a compute module all the way up to back planes.
Or carrier modules that are the size of an ITX. Motherboard and it's what features do you want? What footprint do you want?
What backplane can also mean multiple things like multi slot. What are you thinking?
I was thinking about building a cluster with him.
Somebody and I can find the name here shortly. Has built a 1U rack mount that it takes a number of compute modules on blades and they're independent systems, but they have optimized space, power, cooling, connectivity. So it's a one you
Did you, did the blade actually ship? I thought it was stuck in FCC hell.
Chassis that you slot 10 to 20 of the things in the
I don't. Yeah.
I'd have to check Jeff Geerling's website. He was the one touting it. I got a… a cluster board that they slot into like memory with a right with a right right here bye.
Mm-hmm.
Haven't gotten… things to behave for me.
Yeah, and that was just one particular thing. There's multiple that do it.
I just, again, I just picked up another one Basically, it converts their compute module over to the standard PI format, but everything's on its tail end so It's a lot easier to… Manage.
Yeah.
Then again, I'm kind of tired of dealing with arm and tired of arm It's inability to, you know.
Press F12 to boot up booting and installing the last.
Yeah.
I always have to get some stupid. Image from one stupid person I've been fighting with three Orange Pie Pros.
I don't think that's… Specifically, I think that's the SBCs and choices they have made.
No.
So if… Either we've gone through phase one Password.
To this. Particular SSID.
Or it was a coffee shop and they just gave us the password to it.
That now i'm watching. We, for instance, sitting there with his laptop doing something on the network Can I also use the pontagotchi then to use watch his traffic going back and forth across this network And then I would have to take that PCAP file
And try and figure out how to break and understand what his traffic was.
Or is that beyond the use for the pontagotchi?
I mean, there's Given powerful enough hardware there's no reason that there's no reason the system the hardware running the Panagotchi software Couldn't do that but couldn't do that at that point, you're outside of the ponagotchi software package.
The opponent Gachi software package is basically the automation of the automation the deauthing and capturing of handshakes.
Plus the gamification options that with the pwn grid when accessible.
Though it is an extensible system. There are lots of plugins out there Maybe you could develop a plugin.
To do that extra stuff.
I'm really surprised at the gamification. Am I just being an old curmudgeon?
Of, okay, game, so what? I mean, or it's… Is there actually… Nostalgia okay
Yeah, I mean, kind of the same
It's nostalgia. Remember, Tamagotchi's back in…
Yeah, by the same logic, why give it a face?
The Flipper Zero does the same thing and About ready to override it because it's always mad at me.
Okay, so next month our presentation will be by Joe and Kamikaze joe will explain to us how to get into somebody, some individual person's stream now that we've gotten onto his SSID subnet Sounds good. Sounds good to me. Yeah, yeah.
Anyway. Any other… Questions, comments, specifics here to So get Joe to quickly follow up on.
I'm going to quickly drop links to the slides in the chat.
For anybody interested. They're not like PowerPoint slides, basically.
The kind of workflow i've kind of uh I've developed, particularly for 2600 is i There's a GitHub repo where all of this is written out in Markdown.
Plus, including all of my notes that I was using to conduct the talk and everything.
That's in a GitHub repo. We have a GitHub workflow that takes that, uses Pandoc to use that convert the markdown into this reveal.js slide deck, which is hosted at a GitHub IO link that I've also posted.
So feel free to browse either of those. Other 2600 talks are posted in the GitHub repo as well.
I may plug quickly, you know, next 2600 I haven't posted it up on the meetup yet, but we're having a uh a home lab show and tell for people to show off.
Their server rigs and stuff that they got running in their houses.
If anybody's interested in that.
Everybody dealt with the N100 processors? I've heard good things from them.
Or from other people online, but… I'm trying to build a K3 cluster.
Diet pie has been kicking my butt.
We do exceedingly little with SBCs and have found VMs on even a modest machine to be more conducive, even for things as simple as I want to boot different media, be it a CD-ROM or the network.
Well, that's why I was looking at the N100 because it's an Intel processor.
It's not an ARM processor. But it's built on an SBC.
People are thinking, I will quickly point out that 26 group.
As mentioned. As I understand it, Joe, correct me if I'm wrong about any of this, 2600 is a worldwide organization It's existed for decades.
Uh… The St. Louis chapter I know has been around for probably at least 20 or 25 years. I don't know joe exact date of its origin because of its origin 225 years ago, I remember 22 years ago going to food court at the gallerias where we were meeting back then
One. I've always…
We're actually the second incarnation of 2600 in St. Louis. As you said.
Oh.
Yeah, so as you said, yeah, it's a worldwide organization based around the 2600 Hacker Quarterly Magazine, which first started publishing in 1983.
Which the title being a reference to the phone the phone frequency used to Get free phone calls back on the old pots telephone systems.
Yeah, at some point they declared first Friday of every month to be meetup day where hackers meet up and organizers submit locations where people can meet up in the magazine Yeah, the original 2600 Used to meet up at the Galleria Food Court. I went there several times myself.
It was kind of a bunch of kids making Frank phone calls, albeit very elaborate prank phone calls When I went there, Redbox chili pepper would call a movie theater, have their dialogue schedule phone line forward to someone's cell phone
And we would just take turns answering it. Sit uh with goofy movie titles and stuff like that.
That eventually kind of died off. Everybody grew up, got jobs, families, that sort of thing.
People stop meeting up there. When Arch Reactor started, there was a a few members wanted to kind of reinstate 2600 and bring it back.
We confirmed that the Galleria meetup had died that nobody was attending it anymore.
Reached out to 2600.org. And submitted Archer actor as the new address. And eventually I kind of inherited the organizational duties for that meetup and so This saying his art reactors is now… 16 years old.
We had our fifth or we're going on 16th. We had our 15th year anniversary in october The new 2600 is been around for 15 years.
And yes, as I said, first Friday of every month. At our tractor.
I'm sure you said the new 2600s you know local or local worldwide.
The local St. Louis chapter. Has been around as long as Arch Reactor.
Okay. Okay.
Because our director, a few of us at our director reads started read read bringing it back.
Okay.
So there was a point is there was a time of there was an indefinite amount of time between where the Galleria food court died off and was resurrected at Arch Reactor. I don't know how long that was exactly.
And in the meantime the CIS and the FBI have quit looking for all of us who have been at the Gallery of boot camp okay never mind
Statute of limitations.
All right. Interesting presentation. Thank you. I need to drop and do family stuff so Have a good evening.
Thanks for having me.
I guess probably is probably As I say, if there's anything else that we need to be asked real about. Otherwise, maybe this is where we wrap up for the evening.
Book in, book in.
Last chance. Everybody think Okay. Okay, this has been the monthly St. Louis Linux user group meeting st louis log It is Thursday.
The 16th of January. 2025. As I say, this group meets uh monthly Art of Slew organizes uh for presentations or four meetings a month that are all online right now we don't need in person anymore and go to STLinux.org.
That's our homepage and you'll find our archives ways to get to the other thing. It's also a calendar that's maintained calendar.
And with that, thank you all for coming this evening. And big thanks to Joe Copel Kamikaze joe uh wonderful presentation. Thank you.
Really