Project RogueAP *update*

I have made available the current distribution of Project RogueAP. The firmware, described in more detail in an earlier post, is still in experimental stages (bugs) but has most of the desired functionality. The three main functionalities most desired are:

1. It does not bridge to a neighbouring Wifi, this is popular for "phishing" attacks using Evil Twin AP's.
2. It does not do any SSL spoofing / hijacking.
3. It does not do any telnet/ssh/ftp/pop3 type logging.
   

The reason I haven't made the entire source modifications made to OpenWRT available is because I made several errors during development and deviated from the developer standard, making it difficult to track my changes! Thankfully most of these only consisted of configuration adjustments however which can easily be identifed in the binary distribution, such as iptables rules, maradns configuration & lighthttpd setup. The source code for the Project RogueAP package is also included which installs CGI scripts and various other configurations for this attack to function.

To install on a supported router (note: I have only ever tested WRT54GL 1.1, if it works for you let me know!), you can apply the .bin through your firmware update facility or if you already use OpenWRT or similar firmware - you can apply the .trx file directly onto the router. From the CLI shell type the following after placing the .trx file on the file system:

mtd -r write openwrt-brcm-2.4-squashfs.trx linux

On reboot the Wireless ESSID will be set to "FREE-INTERNET", any user connecting to this AP will be blackhole'd and any IP request or DNS request will redirect the user to the RogueAP. E.g.

Reply from 3.13.3.7: bytes=32 time=7ms TTL=64

If a User makes a web request out of the RogueAP, they are intercepted and have IFRAME's for various domains injected into their session and a fake form login designed for phishing attacks is displayed. You can customize the domains to inject as hidden IFRAME on the router in /www/iframes.txt. Adding a domain to this file will cause the domain to be injected to users who browse the web service. A customizable login type form with an invalid response can be set in fail.html and rogueap.html, this is served by a lighthttpd CGI script which also logs any submitted form requests, for more information - see the contained SRCS directory.

root@RogueAP:/tmp# cat forms.log
[Sat Jan 1 00:10:18 2000] [192.168.1.2] [www.google.com] [fullname=a]

root@RogueAP:/tmp# cat cookies.log
[Sat Jan 1 00:13:15 2000] [192.168.1.5] [www.google.co.uk] [PREF=ID=21d2e63xxxxx9e50:TM=123xxxxx3337:LM=12379xxx3x7:S=t8ludSnxxx
xX6ES]

Most of these attacks are better implemented in other attack frameworks or software packages available online, however my thought was that most of these tool sets require $400 laptops to function. A modified firmware for a device means you can spend $400 and have 10 malicious access points to deploy cost saving on the attack or just $40 for one. In a world where the first consumer networking device worms (see: psyb0t) are already doing the rounds, it might not be long until we see remote hacks deploying similar firmware to this against corporations or unprotected home routers from remote locations (see: Russia!).

For those of you wondering how to admin the device, I made a decision to install SSH on Port 31337 with a default username 'root' and password 'rogueap'. I would of preferred not to set a default password as most end-users do not change them - thankfully, anyone installing this firmware is probably not a typical end-user! If you run into any problems, check the OpenWRT support forums for similar issues or contact myself and I will try to do my best to answer them.

You can download the distribution & source code from it's Google Code repository.