Monthly news (July 2010)

This month I have some really interesting news. A lot of people would like to have Aircrack-ng on their phone (including me) but unfortunatly most phones can't work due to their drivers. Do you remember when I talked about NeoPwn v2 which is BackTrack Mobile?

A beta will be released before BlackHat/Defcon and will include Aircrack-ng. What's really great is that injection works with the internal card of the N900 (the original video can be downloaded here):

 

They also released 2 additional videos on Youtube:

• BackTrack Mobile (Nokia N900) - Packet Injection Aireplay-NG
• BackTrack Mobile (Nokia N900) - Mac Address Changer

Forum:

• There's a new section in the forum for BackTrack Mobile.
• Beini 1.2.1 was released. It can be downloaded from its website.
• Jano updated wesside-ng replacement, one-command WEP crack to save the key into a file.
• criser released WepCrackGui 0.8.1, a GUI for Aircrack-ng in C# (Mono). It can be downloaded on Sourceforge.

Other:

• BlackHat conferences will happen the 28th and 29th. Schedule can be found here.
• Besides BlackHat, there will also be BSides Las Vegas. There aren't as much talks as in BlackHat but they look really interesting.
• Defcon 18 (29 July - 1 August) posted the final schedule a week ago.
• Starting from 2011, the Wifi Alliance will not allow WEP and TKIP in certified Wifi devices. You can read more about it on WiFiNetNews.
• I missed the update (v2.1.7) of the patch for FreeRadius-WPE (Wireless Pwnage Edition) released in May.

Monthly news (June 2010)

Here is the 5th edition of our monthly news.

Project:

• We had some downtime on the server hosting trac and forum between the 16th and the 20th (hardware issues) and fortunatly nothing was lost. You can read more in these 2 posts: Trac and forum down and Trac and forum up again.
• The forum will be moved to the new server in a bit more than 2 weeks. The change will be transparent for you. And that means only trac and buildbot are left on the old server. They should be done before Defcon.

Forum:

• Airoscript not dead. It got some updates and is now renamed to Airoscript-ng. To get it, type svn co http://trac.aircrack-ng.org/svn/branch/airoscript-ng in a console.
• Beini 1.2.1 was released a few days ago. It can be downloaded it from its website.
• minidwep-gtk, a GUI of aircrack-ng in shell script, has been updated to work with Aircrack-ng 1.1.
• criser, the author of WepCrackGui, is developping a QT frontend for WepCrackGUI that should be included in the next release, v0.9. You can find instructions to get the sources and test it in this post. He also posted some screenshots. You can follow him on twitter: @wepcrackgui.

Other:

• I'll give a talk at Sharkfest about wireless security next week.
• digininja released a Karma patch for hostapd. It now works with ath5k and ath9k. It should work with prism54 and various other cards but that's untested.
• Backtrack 4 r1 was released. Changes: new kernel (2.6.34-rc6), packages updates, and new drivers. Note that it is an unofficial build meant for assesing hardware incompatibilities with the new kernel.
• The WiFi Alliances and WiGig announced alliance on multi-Gigabit wireless networks in the 60Ghz band. It will allow up to 7 Gigabit/s. You can read more here. The official press release can be found on WiGig website.
• Here is another GUI in Java for Aircrack-ng: GRIM WEPA.

Trac and forum up again

You probably noticed earlier today that the trac and forum were working again. They finally fixed the issue (which was according to them probably a bad RAM module or the CPU fan) by replacing completely the server (but keeping the hard drive).

I think that it's the CPU fan that failed, not the RAM module. But whatever, it works again and that was what we all wanted.

Trac and forum down

All started Sunday, around 6AM GMT, our 4-year old dedicated server wasn't responding anymore and even a hardware reboot didn't bring it up. So, I opened a ticket and the technicians noticed the power supply died and quickly replaced it.

Everything worked fine until Monday morning, 9AM GMT, the server started to be unstable. I first thought it was Apache because during my tests, the process used several times 100% CPU when it crashed.
Then I tried stopping Apache and MySQL, the 2 most consuming processes (the CPU usage was on average at 6% without these 2 processes) and even with that, it was crashing after 15 minutes.

I thought that our kernel might be corrupted due to the crash of the server, so I tried using one of their netboot kernel (as well as the hardware testing mode) and it kept crashing.

So, I just opened another ticket for this issue. I really wonder what's going on.

Also, the migration of the forum and trac to the new server was planned at the end of this month but it might happen sooner than expected (I'll try to do it this week-end).

I'll keep you updated.

Monthly news (May 2010)

Project:
- Aircrack-ng 1.1 was released a bit more than a week ago. A lot of bug fixes (including the buffer overflow in different tools) and improvements have been done. The most noticeable changes are the addition of airdrop-ng by TheX1le and the interaction in airodump-ng.
The following screenshot shows some of the possibilities of the interaction (more details in the wiki and in the manpage). In this case, when you color an AP, its clients are automatically colored the same:


Forum:
- criser released v0.8 of his C# (Mono) GUI, wepcrack. He uses git for his source control and if you want to use the latest source and don't know much git, read the following. He is looking for someone who can design an icon for his software.
- Zermolo released permutator beta 1.3. It generates incremental wordlists/dictionaries based on your needs. The package by Jano contains the source code and an Ubuntu package.

Other:
- ShamanVirtuel released a GUI to capture WPA handshakes called Autohs-GUI. His project is hosted on Google Code along with a few other programs.

Aircrack-ng 1.1

Aircrack-ng 1.1 is released ;)

A lot of bug fixes (including the buffer overflow in different tools) and improvements have been done. The most noticeable changes are the addition of airdrop-ng by TheX1le and the interaction in airodump-ng.

Here is the changelog:
- airdrop-ng: New tool by TheX1le.
- airodump-ng, aircrack-ng, airdecap-ng, airbase-ng: Fixed buffer overflow in airodump-ng due to forged eapol frame.
- aircrack-ng: Fixed multicast detection (WPA handshake detection).
- airodump-ng: Added interaction (see wiki for the commands).
- airodump-ng: Fixed client time in netxml file.
- airtun-ng: Add WDS and bridge support.
- airbase-ng: automatically set privacy bit to 1 if WPA or WPA2 is used (-Z or -z option).
- airmon-ng: Updated iw URL for v0.9.19.
- airdriver-ng: Fixed link for madwifi-ng.
- aireplay-ng: Chopchop enhancement to not stop but wait on deauth packets.
- tkiptun-ng: Fixed segfault.
- wesside-ng: Fixed compilation bug with recent version of gcc.
- cygwin: Compiling sqlite isn't necessary anymore, libsqlite3-devel package can be used.
- osdep: Strict aliasing and x86_64 fix.
- osdep: Add tap support for Darwin/OS X. Still require tuntaposx from sourceforge to work.
- All: Fixed compilation on cygwin 1.7.
- All: Fixed compilation on recent version of OSX.
- manpages: Fixed aireplay-ng manpage for attack 0: not disassociation packets, deauth packets.
- manpages: Added the keys for interaction in airodump-ng.
- patches: Added regulatory domains override patches for atheros drivers (ath5k, ath9k and ar9170).
- patches: Added 2.6.32 patch for r8187 driver (ieee80211).
- Makefiles: Fixed make uninstall.

Download: aircrack-ng-1.1.tar.gz

Monthly news (April 2010)

Project news:
- ebfe, who created airolib-ng, released an exploit for airodump-ng, aircrack-ng, airdecap-ng. You can find more information in his blog (Post 1, Post 2) but it just makes the tools crash, no real exploit released. It will be fixed in the next few days before the release (v1.1).
- Nearly everything has been moved to the new server, only forum, trac and buildbot needs to be moved :).
- Do you remember I wrote that trac didn't display svn commits for some unknown reason? That's now fixed, I just had to comment out a line in trac.ini.
- For those who can't open the website due to URL filtering, use whydoyoublock.me. It's not a mirror, it points to the exact same content as www.aircrack-ng.org.

Forum news:
- Patches to override the regulatory domain for ath5k, ath9k and ar9170.
- The work on the C# GUI for aircrack-ng, WepCrackGUI, continues. And here is a blog post in italian about it.
- Beini now has its own website. Here is the forum thread.
- Wordlist generation:
    * Here and there
    * Here is a script by Zermolo to generate wordlist with only numbers, called permutate and another post in the same thread about the same subject with JTR.
    * Creating custom rules for John.
    * Word field is an incremental word list generator.

Other news:
- I'll speak at Sharkfest. It will take place in the main campus of the Standford University, June 14-17.
- Ever heard about NeoPwn? Version 2 will be based on the Nokia N900 and will be Backtrack Mobile.
- Remember spoonwep and spoonwep 2? Shamanvirtuel is working on spoonwep 3. Public beta release is planned between 15th-30th April.
- If you're using SliTaz, you might be interested to know that they released v3.0 a week ago.