Everyone knows to check for unauthorized wireless access points within the business. What about unauthorized client access, though? What I’m talking about here is your employees connecting to other open wireless networks from their office!
It turns out that there are some really simple things you can do to discover if there are hosts from your network connecting to unprotected networks nearby and to figure out which hosts are the rogues. To do this testing we need just a few tools.
Wireless Sniffer
Any wireless sniffer will do provided it creates PCap based output files. Tools like Kismet, TCPDump and Airodump produce exactly what we’re looking for. Start out by simply looking for open wireless networks and configure your tool to store a packet capture file. You don’t need any encryption keys, you don’t need any special configurations, just turn it on and store the file!
Extracting Strings
NetBIOS broadcasts the workstation and domain names every minute or so on the network. The NetBIOS information is encoded, so you can’t read it directly, but they’re pretty easy to spot; they’re always 32 characters long and in upper case. To find them we can just use the “strings” tool to extract printable strings:
David-Hoelzers-iMac:class dhoelzer$ strings wireless.cap | more 809056 3 ipp://appleserver-1.private:631/printers/LaserJet2200 _tcp _tcp local EEEBFGEJEECNEIEJECDBFDFFEEEGDCAA FHEPFCELEHFCEPFFFACACACACACACABN
Notice the long strings of uppercase letters? These are exactly what we’re looking for! With a little bit of easy magic we can narrow these down to just what we need. Here’s an example one line script that can do this for us:
#!/bin/sh
strings -n 32 $1 | awk "/[A-Z]{32}/ { print \$1;}" | sort | uniq | ./netbios.pl
We may still get some additional “junk” but what we have now is in a condition that it’s super easy to extract the NetBIOS names and decode them!
Decoding Names
Now that we’ve got the strings we need to decode them. We’re not going to get into how the encoding scheme works, but we will point you at a script that can very quickly and easily decode them for you! You can download the script here.
Putting our extraction script together with our decoding script gives us the following result:
David-Hoelzers-iMac:class dhoelzer$ cat wireless.cap | ./extract_strings Wide character in print at ./netbios.pl line 16, <STDIN> line 21. Wide character in print at ./netbios.pl line 16, <STDIN> line 21. �????????????????? APPLESERVER-1 DAVID-HIB1SUDF2 ENCLAVEFORENSIC ENCLAVEFORENSIC IMAC MACINTOSH-6 NEVADA-TIME-CA WORKGROUP WORKGROUP WORKGROUP David-Hoelzers-iMac:class dhoelzer$
Looking at this output and considering our corporate network we can see that our domain name is in fact being broadcast out onto some other wireless network which means that we have some naughty users! Going further we could track down which packets these names came from and then extract the MAC addresses of the hosts involved. If we have a good hardware inventory we can then use this to identify the offenders.
For a comprehensive course on how to identify critical controls, validate that the correct controls are in place and validate processes, consider the SANS 6 day course, “Advanced System & Network Auditing“. David Hoelzer is the SANS IT Audit Curriculum Lead and the author of several SANS IT Audit related courses.
