Aircrack-ng on phones (Android, iPhone and others)

I've often seen questions like "How can I get Aircrack-ng on my iPhone/Android/Symbian/[ADD YOUR OS]?". Let me clarify the status for phones.

In order to have Aircrack-ng running on the phone, there are several requirements:

1. Being able to cross compile (because the CPU on your phone has a different architecture than the one on your computer). So if you cannot find a cross compiler for that specific platform, forget it.
2. A wireless card. Most phones have one these days, so that's easy.
3. If your phone is Linux based, you will also need to be able to be 'root' to run the commands.
4. The driver must allow monitor mode. That's usually where almost all phones fail because only a few have that. Sometimes the card doesn't have a stable monitor mode. The reason behind it is that it must be low power (and cheap to manufacture) so the chipset (and its firmware) is very limited.

To give you a quick answer, only one phone meets all the requirements with its internal card: the Nokia N900 (it needs the 'power' kernel available in the extra-devel repositories). While doing monitor mode/injection, the battery last about 4h.

• iOS devices: Forget it because it is never going to happen, Apple is consumer oriented and doesn't really care about the computer security industry. Plus,  iOS is too closed source and AFAIK the chipset is not capable of proper monitor mode. You could argue that it is available via Cydia. It's true but you don't have any monitor mode capabilities, so it doesn't worth it (also don't bother sending me Cydia bug reports, I don't read them).
• Android: Forget it with the internal card. However, it will be possible with an external USB card. Dragorn, the author of Kismet Wireless is working on it.
• Other OS: Forget it (for the same reasons as Apple).

Monthly news (July 2010)

This month I have some really interesting news. A lot of people would like to have Aircrack-ng on their phone (including me) but unfortunatly most phones can't work due to their drivers. Do you remember when I talked about NeoPwn v2 which is BackTrack Mobile?

A beta will be released before BlackHat/Defcon and will include Aircrack-ng. What's really great is that injection works with the internal card of the N900 (the original video can be downloaded here):

 

They also released 2 additional videos on Youtube:

• BackTrack Mobile (Nokia N900) - Packet Injection Aireplay-NG
• BackTrack Mobile (Nokia N900) - Mac Address Changer

Forum:

• There's a new section in the forum for BackTrack Mobile.
• Beini 1.2.1 was released. It can be downloaded from its website.
• Jano updated wesside-ng replacement, one-command WEP crack to save the key into a file.
• criser released WepCrackGui 0.8.1, a GUI for Aircrack-ng in C# (Mono). It can be downloaded on Sourceforge.

Other:

• BlackHat conferences will happen the 28th and 29th. Schedule can be found here.
• Besides BlackHat, there will also be BSides Las Vegas. There aren't as much talks as in BlackHat but they look really interesting.
• Defcon 18 (29 July - 1 August) posted the final schedule a week ago.
• Starting from 2011, the Wifi Alliance will not allow WEP and TKIP in certified Wifi devices. You can read more about it on WiFiNetNews.
• I missed the update (v2.1.7) of the patch for FreeRadius-WPE (Wireless Pwnage Edition) released in May.

Monthly news

A few things happened last month:
- The google phone, Nexus One was rooted and it has a bcm4329 chipset and it looks promising.
- Airodump-ng (in svn trunk) now has interactive mode: you can control it with keys. You can find the documentation in the wiki.
- A really small (only 10MB) distribution based on MicroCore Linux, console only.
- I'm sure you saw it, Backtrack 4 was released a few weeks ago.
- OSX Compiling (Ticket 687) should be fixed now (svn trunk revision 1657).
- New version of Beini: 1.0 RC5.2
- The developement of the GUI in C# (Mono) is quite active.

Last but not least, aircrack-ng will be 4 years old by the end of february :)