WLAN Visualization Meets GIS Mapping

martin dodge writes "The Wireless Ntwork Visualization Project (Univ. of Kansas) has an interesting alternative to just dot maps of wlan base stations. These guys are mapping out the zone of availability using gis. nice maps using aerial photographs backdrops as well. If you are interested, check out other ways of mapping 802.11b network infrastructure. "

Implications

Would this mean crackers could more easily access weak networks (ie those w/o VPN)? And what about services designed for free web access through wireless LAN?

FYI, GIS==Geographic Information System

In effect, map data stored in a database. I've seen maps like those in the article before. The first I saw was in 1993, but it didn't have nice colors. It was from a company that determined FM signal coverage, when given the location of the transmitter and its signal strength.

I love it!

Those are better than the coverage maps that the cell phone providers offer. Their, almost certainly, far more accurate too.

Now, if we can just get them to do the project at a national level and post a searchable map, like Mapquest, on the web it would be awesome. Going on the road? Just grab a map before you go and stay connected the whole time, probably free of charge too! Since, so many of the WLANs aren't secured.

Re:I love it!

For doing this type of war driving, you don't need to actually connect to each AP. The card is put into a low-level promiscuous mode, so it can receive all packets. Every AP sends out a continuous stream of 'beacon' packets which the software can use to determine what networks are available. Also, at least on Prism-based cards, you get both a signal and noise measure for every packet received. So you just drive around snarfing up packets, and every one you get you can check for the source MAC address (to determine the AP) and the S/N ratio. No need to talk to the AP's at all, it's totally passive.

One thing you do need to do is change channels. 802.11b specifies 11 channels (in the US), so to be thourough you should check them all. To be efficient, you can only check 1,6,11 because that's what everybody uses. Depending on how many channels you are checking and how fast you scan puts a limit on how fast you can drive and expect to pick everything up.

Of course, if you are just checking out coverage for a specific AP, you can stay on it's channel and wander around the immediate area to get lots of good data points about it's coverage. It all depends on what exactly you are trying to accomplish.

One obvious application

Combined with a database containing the address of cable modem subscribers, Comcast can now conveniently use this data to ferret out their subscribers "stealing" from them using 802.11b. Watch for the Comcast van in your neighborhood!

Wireless Mapping

Useful but check out the dynamically generated node map from http://www.pdxwireless.org It's updated as the nodes go on and off.

Cool old use for new!

These were done years ago for FM radio coverage and many "more sophisticated" ham radio repeaters back in the late 80's. It's pretty cool and accurate enough. (although not very accurate inbetween distant points unless you add a topo data set to the GIS dataset.. Grass [baylor.edu] is an excellent GIS package for Linux that gives linux users the power of multi-million dollar GIS systems in their basement... and this is a great way do use that cool tool.

Maps? I want Road Signs

It interferes with my driving when I need to be looking for a 802.11 signal while watching the road at the same time.

Why don't they use some of their research funds to lobby the Highway Administration for road signs that would clearly mark places where there was donated bandwidth to be had?

Smoking Crack...

Their security tips [ku.edu]:

• use wep (airsnort)
  
• obscure your ssid (set client ssid to ANY)
  
• change default passwords on APs (duh)
  
• disable broadcast ssid, but you can't (haha)
  
• upgrade firmware (what's that gonna do)
  
• enable MAC filtering (Lucent WaveLAN cards have a tool to set their MAC address)
  
• Turn off your access points when you are not using them (how mann people are going to do that)
  
• Wave point placement and antenna selection (attacker can use a 12dBi yagi and point it straight at your house)
  

I don't think I'll be using their Consulting Services [ku.edu] any time soon...

Not quite the same but still...

I know its not the same sort of thing, but Interrorem have knocked up a perl script that converts Netstumbler (Wlan mapping tool) logs into UK streetmap locations.

You can see it in action here [interrorem.com]

Its very handy to get a clearer idea of where exactly those pesky APs are when you blat past them in a batmobile with a pringles tin sticking out the roof...

my little project at UCSD

Last year i took my laptop & gps & a few perl scripts and mapped out the wireless access at my campus (UCSD). I made some maps too. Pretty fun!

http://www.cs.ucsd.edu/~ghamerly/wireless.html [ucsd.edu]

Secuirty related questions.

Can anybody comment on the following:

Linksys (and other folks) have a flag that disables the SSID broadcast 'feature' of their basestations.

According to netstumbler.com:
"Linksys' latest firmware update for WAP11 includes closed network support. It disables the SSID beacon broadcast and as a result no longer shows up on either the Boingo or CyberPixie roaming clients, nor on Apsniff or NetStumbler network discovery tools. "

Is this REALLY a security 'adder' or can folks discover the network in other ways?

Our .11b network has 128wep, MAC list restriction, and SSID broadcast turned off. I realise that someone can sniff the traffic and decrypt the packets by cracking WEP, but this would otherwise prevent them from doing something ON the network, right?

We're investigating adding our VPN to the mix, but it's a non-trivial network topology change for a group that really doesn't have sensitive data.

Re:Secuirty related questions.

It certainly raises the bar with regard to mapping.

Many APs allow the user to turn off the SSID broadcast, however if someone nearby has popped their WLAN card into monitor mode, this will enable them to listen into the raw 802.11 frames that carry all your precious data.

Plus anything else that happens to float by on channel 10 for instance.

sniffer-pro and more importantly airopeek both do this.

Mac list restrictions can be overcome in this manner as well: you can specify a MAC by using Ifconfig under linux :)

kismet does this nicely as part of its "ip address space" discovery work, along with cisco infrastructure enumeration with CDP.

Your plan *should* be pretty secure against casual "browsers". Unless your company has made some enemies recently or is worth something in "Commercial Intelligence" terms, you should be pretty clean.

Of course, I would put a VPN in *as well*...

Grass - Public Domain GIS System

For those interested in doing some GIS work of your own, there is the public domainGeographic Resources Analysis Support System [baylor.edu].

Also, most GIS work is done using ESRI's GIS and Mapping software [esri.com].

Netstumbler

With netstumbler [netstumbler.com], it's easy to map out your freshly discovered APs easily. After you have returned from some wardriving, simply export your netstumbler log, and upload it here [netstumbler.com]. It will output a Microsoft MapPoint 2002 file which will display a pushpin covered map which shows you all the APs that you just discovered.

Working in cellular

When I worked for Sprint and other Clients we had mapping similar to this made using software such as Planet made by MSI. Planet was cool, it would help map out coverage for a given area. However it was still needed to go out and drive the network. I worked a project in Tijuana using some equipment made by DTI that had 8 scanners in it and would record about a thousand channels of data to be later displayed on a map. It was cool when you would look at the map and actualy see the coverage of each cell tower based on the driving that had been done.

reinventing the wheel

They've essentially reinvented a commercial app that's been on the market for about 5 years - deciBel Planner [169.144.68.41].

map limitations

The problem I'm having with their maps is that there is no distinction between 'no signal' and 'no data'. This can easily be seen by the oddly shaped coverage oozing down a street. Obviously the signal doesn't preferentially go down the street, there is just no data within the block to know what the signal is doing there. There should really be some sort of distinction for this to be truly useful.

Its not as trivial as it seems because coverage can in fact ooze down the street due to tall buildings lining the block, for example. This can either be directly measured or maybe even modeled if one knows the the types of structures in the map.

Not a new idea

These people http://i3.com/ have a business that cators to the cell-phone industry. They provide maps with builings, etc that can then be used by the providers when their engineers are trying to design their wireless networks (where to put antenna for best coverage).

From what I can tell, they're just taking i-cubed's idea and applying it to 802.11...something providers will surely do if they ever want to blanket areas with coverage (as cell providers do this now).

Pretty cool anyway, but I must point out prior established work in this area.

They also have some really cool images of my town from above.

MOD PARENT UP!

Downtown Boston is a mess, and Cambridge is downright Byzantine. No wonder them Haavaad and MIT folk is so smart. They have to be to navigate the f*cking streets.

I also betcha Cambridge maps as one, big, continuous WLAN. f*ckers.