Search the Community

Hacking Internet of Things (IoTs) has turned into a stunning practice for digital offenders out there, but messing with Traffic lights would be something more exciting for them. The hacking scenes in Hollywood films has recently been a wellspring of stimulation for the IT industry, in the same way as we’ve seen traffic lights hacked in Die Hard and The Italian Job, however these motion pictures dependably motivate programmers to perform comparable hacking assaults in everyday life. Security scientists at the University of Michigan have not just hacked traffic light signs in real life, additionally asserted that it’s really shockingly simple to perform by anybody with a laptop and the right sort of radio. On the off chance that we analyse the traffic light hacks in films and real life , in reality it’s much simpler. In a paper study, the security researchers tell us how an arrangement of real security vulnerabilities in traffic light frameworks permitted them to effortlessly and immediately seized control of the entire system of no less than 100 traffic signals in Michigan city from a solitary point of access. Specialists took permission from the road agency before performing the test, yet they didn’t reveal precisely where in Michigan they did they performed these exciting tests. LOOPS AND HOLES IN TRAFFIC SIGNALS The group, headed by University of Michigan computer scientist J. Alex Halderman, said that the network traffic frameworks are left helpless against three real vulnerabilities: * Decoded radio signs. * Utilization of factory set usernames and passwords. * A debugging port that is not difficult to attack. So these things leave the network accessible to everyone from professional hackers to script kitties. To save money on installation expenses and expand flexibility, the traffic light system makes utilization of remote radio signs instead of committed physical systems network links for its correspondence base – this gap was abused by the analysts. Shockingly, more than 40 states at present utilize such systems to keep traffic running as proficiently as they can. WIRELESS SECURITY IN THREAT The Traffic light use a combination of 5.8 GHz and 900 MHz radio signals, contingent upon the conditions at every intersection, for wireless correspondence in point-to-point or point-to-multipoint designs. The 900 MHz connections utilize “an exclusive convention with recurrence bouncing spread-spectrum (FHSS),” yet the 5.8 GHz version of the proprietary protocol is not quite the same as 802.11n. Researchers says that anybody with a laptop and a wireless card working on the same frequency as the wireless network traffic light — for this situation, 5.8 gigahertz — could get to the whole decoded system of networks. MAKING IT BETTER Presently, after getting access, next was to correspond with one of the controllers in their target system. This was carried out effectively because of the fact that the control boxes run VxWorks 5.5, a version which naturally gets built from source with a debug port left open for testing. This debug port permitted scientists to effectively turn all lights red or adjust the timing of neighbouring crossing points — for instance, to verify somebody hit all green lights on a given course. Additional, the capacity of a digital criminal to perform denial-of-service (DoS) attack on controlled intersections by setting off each intersection’s glitch management unit by attempting invalid setups, which would put the lights into a failure mode. FINAL SOLUTION Finally, the group called for manufactures and operators of the traffic signals to enhance the security of traffic signals network. It proposed that the traffic system’s administrators ought not to utilize default usernames and passwords, and they should stop broadcasting frequencies unprotected for onlookers and curious people. Besides, they additionally warned that gadgets like voting machines and even connected automobile could endure similar attacks. Now watch a New York car pass 55 straight green traffic light in 60secs | Daily Mail Online

Introduction Wardriving is an activity in which a person seeks wireless access points in moving vehicles with high gain antennas mounted on the top. Usually, this access point data is correlated with GPS positions and marked on publicly accessible maps such as WiGLE. On the other hand, wireless penetration tests are focused evaluations of wireless security pertaining to an organization. In both of these cases—and any type of wireless communication—antennas play a critical role. They can mean the difference between hassle-free communication and bitter frustration. However, antenna designs and related implications are arcane topics in requirement of sincere exploration by security enthusiasts. The antennas in your arsenal can make or break your wardriving or wireless penetration testing efforts. Whether you are a wardriving aficionado or a wireless penetration tester, this paper is intended to help you deduce the best antenna for your requirements. Terminology You Should Know Wi-Fi operates in the 2.4 GHz radio frequency that is measured in decibels or db. In order to be able to comprehend discussions germane to the performance of antennas, you must familiarize yourself with the following terms: dBm – dBm means decibel milliwatts. Wi-Fi network signal levels are usually measured using dBm. The negative sign is used because the transmission power is never strong enough for the signal level to be positive. For instance, to get a 0.00 dBm signal, you would need a transmission power of 0.001 watts. -30 dBm- Maximum possible value; you are right next to the access point (within a few feet). -67 dBm- Minimum requirement for timely packet delivery (e.g. for VoIP or video streaming). -70 dBm- Minimum requirement for reliable packet delivery (e.g. for web surfing). -80 dBm- Minimum requirement for maintaining a basic connection; you will experience some packet drops. -90 dBm- Barely able to maintain a connection; SNR is low; functionality is severely impaired. Link Quality: Simply stated, link quality is indicative of the SNR (Signal to Noise Ratio), which is a measurement of interference versus the strength of your ‘point-to-point’ or ‘point-to-multipoint’ link. Accordingly, higher link quality will imply lower number of packet errors. Antenna Gain: Do not be confused by this term, the antenna does not actually amplify anything. Antenna gain is a figure that reflects how efficiently your receiving antenna would convert Wi-Fi radio waves into electrical power. Antennas with a gain of 2 dBi, 5 dBi, 7dBi, 9 dBi, 13 dBi etc are available. A common mistake is to think that the one with a high dBi would be the best (e.g. 13 dBi). To understand why this is a misconception, consider the following rough sketch [Figure 1]: As evident from this figure, a higher (9) dBi antenna is suitable for long horizontal ranges with the receiver and transmitter at roughly the same elevation. However, if the transmitter is placed vertically above the receiver—as in floors of a building—then a 5 dBi antenna would be your best bet. If the transmitter is at a different elevation and at a long distance from the receiver, a 7 dBi antenna would offer you the right combination of elevation and range. A 2 dBi antenna aims to cover signals equally in all directions, and is not well-suited for wireless penetration testing or wardriving. How well do these antennas work? The short answer is: If correctly chosen, they perform well. The right type of antenna, with proper orientation, is able to pick up signals from miles away. However, it is imperative to point out here that many users who purchase external antennas end up being dissatisfied with their performance. The reasons for this are: Unrealistic expectations: This may seem obvious but these antennas are not magical devices that will pick up signals from great distances, especially when they are improperly chosen (wrong type of antenna) or have not been calibrated (aligned) well. Insufficient knowledge: If you are purchasing a wireless antenna, or constructing a custom one, you should be able to define your purpose and have the knowledge to choose the proper antenna that would satisfy this purpose. To test how well an external antenna performs in contrast with a laptop’s default antenna under the same conditions, we set up the following experiment. The distance between the access point and our antennas was carefully chosen so that the internal antenna could barely receive a signal at this point. Interfaces: ‘wlan0?- internal antenna, ‘wlan1?- external antenna, omnidirectional, 5 dBi Distance between AP and antennas: 7.62 meters or 25 feet Obstructions: Two concrete walls and two trees We noticed that at this distance, using the internal antenna, we were barely able to ping the wireless router at 192.168.0.1. As evident from the roundtrip delay time of several milliseconds [Figure 2], the internal antenna was performing poorly and there were multiple packet drops. At the same distance, our standard 5 dBi omidirectional external antenna was able to outperform the internal antenna, as evident by the decreased roundtrip delay time [Figure 3]. Let us examine the performance of both antennas in terms of link quality and signal levels. For the internal antenna, both the link quality and the signal level were extremely poor [Figure 4]. We were able to obtain a reliable connection using the external antenna under same conditions [Figure 5]. These results indicate that there is a definite performance boost when an external antenna is used—how significant this boost is would depend on the suitability of the antenna for the receiving conditions. This brings us to the next section. Choosing the Right Type of Antenna There are a variety of antenna types, and each type is built with specific needs in mind. There is no “best antenna for wardriving or penetration testing”. Understanding the design and purpose of each of these would help you choose the best one. An omnidirectional antenna spreads energy equally in all directions—which means shorter range. A directional antenna is able to take this same energy and focus it towards a particular direction—implying longer range in that direction. Omni-Directional Antennas This is the most common antenna type, and most if not all of you have seen one up close. For instance, the antenna on top of your car is an omnidirectional antenna. These can be used for ‘point-to-multipoint’ purposes such as to serve as the wireless router antenna that transmits signals to all devices in the vicinity [Figure 6]. These are not suitable to be used for point-to-point communications because transmitting signals in all directions, when you want them to go from point A to point B, is an inefficient choice. Suitability for wardriving: These are ideally suited for wardriving, since they grab signals from all directions while you are driving. However, there are some considerations: a 9 dBi omnidirectional antenna would allow you to capture far off signals from all directions, but it will miss access points in high buildings close to your vehicle. To understand why, see Figure 1. Accordingly, it is advised that you choose the correct dBi omnidirectional antenna suited for the areas you are going to drive in. Suitability for penetration testing: During a penetration test, you are aware of your target. Hence, a directional antenna pointed toward the target is more efficient than an omnidirectional antenna. However, you can use a 5 dBi omnidirectional antenna during perimeter testing. Parabolic Antennas Parabolic antennas depend on a curved parabolic surface dish that focuses signals towards a central point [Figure 7]. This enables these antennas to put out incredible gains. However, parabolic antennas are highly directional, which means you need to ensure that they are pointed in the right direction, otherwise they might completely “shield” the signal. Because of their high gain, they are suitable for long range point to point communications. Suitability for wardriving: A parabolic antenna would pick up wireless signals from miles away but only from a single direction at a time. Hence, if you want to map Wi-Fi access points in multiple directions while driving, this is not the best choice. Suitability for penetration testing: Given their long range, parabolic antennas can be very suitable for targeted wireless intrusions, since they allow you to carry out tests from far away once you have positioned them toward target access points. Yagi Antennas Yagi antennas, named after Dr. Hidetsugu Yagi, have a central beam with many individual elements supported by this beam [Figure 8]. These elements constitute radiators and reflectors. A variation is the ‘Vagi’ antenna, which is comprised of two beams side by side. Suitability for wardriving: Yagi antennas are directional, which means they are not the best choice during wardriving. They would pick up far off signals from a particular direction, while missing out on signals in the other directions. Suitability for penetration testing: Like parabolic antennas, Yagi antennas are capable of picking up signals from miles away. Their high gain (e.g. 25 dBi) makes them ideal for penetration testing when you have them pointed towards the target. The Vagi antenna is an attractive choice for penetration testing since they are small and lightweight, yet offer substantial gains. Backfire antennas Backfire antennas are known to have a small size but a significant gain. This makes them a very attractive choice for point-to-point or point-to-multipoint communications. How do they differ from parabolic antennas? There is no parabola; the reflector surface is flat. Their resonant cavity structural design makes them capable of achieving the high gain. For suitability toward wardriving and penetration testing, see ‘Parabolic Antennas’. Building Your Own High Gain Antenna If you have followed this discussion on antennas so far, building your own antenna can be a fun exercise. For this, you will need: About 1-2 inch of 12 gauge copper wire or an omnidirectional antenna A smooth metallic parabolic reflector such as aluminum foil, a can, an 8 inch dumpling strainer, etc. How to Make a Cantenna Cantennas, antennas made out of cans, have been very popular among enthusiasts since they are easy to make and everything you need is in your home. The idea is to use a ‘Pringles’ or similar can, and introduce a copper wire near the bottom from the side of the can [Figure 9]. Calculations regarding the placement of the copper wire need to be precise. You can use this calculator to ensure accuracy. However, if the can is very narrow, you would need to point this antenna very precisely towards the signal direction and even then you would not notice significant gain. Moreover, if you are using a long cable, signals would suffer attenuation. Note: Although a Pringles can is often mentioned, it is not a good can to be used for these purposes since it is too narrow. In fact, any cantenna is a bad choice for serious penetration testing. How to Make a Parabolic Antenna If you have an omnidirectional antenna available [Figure 6], the task becomes easier. Now, all you need to do is find a parabolic reflector that can “turn” this omnidirectional antenna into a parabolic antenna. This parabolic reflector can be any smooth metallic surface that can converge radio signals over the omnidirectional antenna—and this is what improves the antenna gain [Figure 10]. Accurate placement of the omnidirectional antenna in front of the parabolic reflector is of prime significance. There is no increase in antenna gain if an inexperienced person has placed the omnidirectional antenna too far or too close to the parabolic reflector so that it completely misses the focal point. Hence, for accuracy, use this parabolic antenna focal point calculator. Alternatively, if you prefer to avoid making calculations, you can use freely available parabolic reflector templates which have been drawn to scale. These templates explicitly mark the focal point of the parabolic reflector so that you do not have to make calculations. For instance, you can print and use the parabolic reflector template in Figure 11. You would need a square sheet of reflective material that you can place vertically on the straight line drawn in this template, and bend the sheet until it synchronizes with the parabolic curve in the template. Notice the marked focal point (black spot) in the template; place the omnidirectional antenna at that point. Note: We have discussed making parabolic reflectors; however, if you want to build a 2.4 GHz omnidirectional antenna from scratch, it can get quite convoluted. You can follow this link to build such an omnidirectional antenna. Comparison to Commercial Antennas These homemade antennas are capable of giving you results as good as commercial antennas. However, you need to be accurate while building these. Imprecise measurements, design flaws, or implementation errors would result in inefficient antennas with no significant gain. Turning Your Laptop’s Internal Antenna to an External Antenna In case you have some 5 or 7 dBi antennas from your old wireless router lying around [Figure 6], and you want to avoid purchasing a USB antenna unit, you can attach these to your laptop’s built-in internal antenna unit. For this, you will need: U.FL male to RP-SMA pigtail cable Knowledge of laptop disassembly and assembly, and relevant tools Any 2.4 GHz antenna [Figure 6] You would need to disassemble your laptop using required tools and locate the auxiliary antenna connector on the motherboard [Figure 12]. The U.FL side of the cable would fit into this auxiliary connector, and the other side should be fixed along the laptop’s edges such that you can attach your 2.4 GHz external antenna to this SMA (SubMiniature version A) end. Detriments to Wireless Signals Even with the right type of antenna, you may experience weak connections characterized by frequent packet drops and delays. In these situations, one or more of these factors may be the cause: Distance: The most obvious reason is that you are too far from the transmitter. Signals get attenuated over long distances, especially when omnidirectional transmitters are being used, such as those used by common wireless routers. Weather: If an efficient transmitting antenna is being used at the right frequency, weather would have little effect on wireless signals. However, rain can absorb radio signals and enervate Wi-Fi signals at 2.4 GHz. Objects in path: Signals at 2.4 GHz frequency need a clear ‘line-of-sight’ for efficient propagation. This means that trees and walls act as obstructions to the wireless signal. Other access points – If there are other APs in the vicinity that are working on the same channel in crowded areas, this would cause substantial disturbance. Conclusion Wardriving is not illegal as long as you are aware of your limits and avoid nefarious activities such as cracking encryption, retrieving access point passwords, and accessing the Internet for free—known as Piggybacking. For wardriving, you can use a 7 dBi omnidirectional antenna placed on top of your vehicle using a magnetic-mount. For wireless penetration testing scenarios in which you want to breach the security of a particular establishment, it is best to use parabolic reflectors pointed towards the target. Depending on the conditions, these parabolic antennas would allow you carry out wireless penetration tests from a long distance which would lower the risk of being noticed by security personnel. Furthermore, using high gain directional antennas, you are able to ascertain how close to the target perimeter would the potential attackers need to be in order to intrude on wireless communications. A 5 or 7 dBi omnidirectional antenna can be used while testing premises for the presence of rogue access points. References [1] M. Erskine. (2002-2003) www.freeantennas.com. [Online]. Parabolic Templat [2] Tim Pozar. Late Night Software. [Online]. Slide 1 [3] R. Dean Straw, L. B. Cebik, and Dave Hallidy, Eds., ARRL Antenna Book, 22nd ed.: The American Radio Relay League, Inc., October 2011. [4] Frank Thornton Russ Rogers, “Understanding Antennas and Antenna Theory,” in WarDriving and Wireless Penetration Testing.: Syngress, 2007, ch. 2, pp. 31-59. Source