awesome-pentest-gadgets/skyliftWiFi Geolocation Spoofing with the ESP8266
Will be posted June 15
SkyLift is a low-cost geolocation spoofing device. It currently uses the ESP8266 to broadcast WiFi Beacon Frames to exploit a longstanding (2008) vulnerability in WiFi geolocation services.
This 3rd prototype version of SkyLift was further developed during a web residency with Akademie Schloss Solitude & ZKM. Read an interview about the project. Or build your own with the instructions below for less than $5.
SkyLift was originally developed in collaboration with Surya Mattu for !Mediengruppe Bitnik's Assange room Welcome to Ecuador!" show at Zoo Galerie in Nantes in 2016. Development for this updated version, V0.3, began in November 2016 and was finally released in May 2017 with support from a web residency at Schloss Solitude. This version makes several improvements over the initial system (SkyLift V0.1), including:
For information on the original SkyLift (V0.1), see https://ahprojects.com/notebook/2016/skylift-geolocation/
SkyLift is open source project maintained by Adam Harvey that investigates security vulnerabilities and creative opportunities in consumer-facing smartphone geolocation services.
If you're interested in obtaining a completed and ready-to-use device add yourself to my mailing list at https://undisclosed.cc/.
git clone https://github.com/adamhrv/skylift/arduino/skylift_v03_embassy" upload the sketch "skylift_v03_embassy.ino"What you'll need:
With OLED display (optional):
Both the OLED display and ESP8266 NodeMCU can be purchased for about half-price on ebay if you're willing to wait 1-2 weeks for delivery. ESP8266 can be as low as $3.
Arduino/test_single_beacon_frame sketchArduino/test_oled_screenArduino/skylift_v03_embassy sketchTips for improving performance:
If you're in a indoor location with no other WiFi routers and SkyLift does not work, please file an issue report and include as many details as you can:
You can create your own SkyLift location data using iOS, OSX, or Wigle.net API. (Android and Linux processes not yet documented).
1A) Scan for WiFi networks on OSX
python utils/osx_scan_to_json.py -o data/json/my_osx_scan.json
1B) Scan for WiFi networks on iOS
Use the free AirPort Utility app and enable "Wi-Fi Scanner" in Settings > AirPort Utility. Make a WiFi scan and save it to your synced Notes or email it to yourself. Be sure there are 2 lines before the CSV data. Example:
# Make your notes or add title her (saved as your_scan.txt))
SSID, BSS, RSSI, Channel, Time
"", "11:11:11:11:11:11", "-61", "44", "13:17:34"
"", "11:11:11:11:11:11", "-61", "44", "13:17:44"
"freewificonnect", "22:22:22:22:22:22", "-80", "11", "13:17:32"
"freewificonnect", "22:22:22:22:22:22", "-80", "11", "13:17:41"
Save your file to "data/ios/your_scan.txt" and then run:
python utils/ios_to_json.py -i data/ios/your_scan.txt -o data/json/your_scan.json
1C) Use Wigle API
Register at https://wigle.net to obtain an API Key and API Token (it's currently free). Results with Wigle will vary or may not work. Their data is crowdsourced and not verified or may be outdated. For the best results create your own WiFi scan on site.
python utils/wigle_to_json.py --lat 37.484581 --lon -122.147921 --radius 3 -o data/json/wigle_test.json
2) Convert iOS (csv) to JSON
python utils/ios_to_json.py -i data/ios/your_scan.txt -o data/json/your_scan.json
3) Convert (any) JSON for Arduino sketch
python utils/json_to_arduino.py -i data/ios/your_scan.json -o data/ino/your_scan.txt
The output text will look something like:
#define nn 2
char* ssids_str[nn] = {
"74:46:A0:33:00:01",
"74:46:A0:33:00:02"
};
byte bssids[nn][6] = {
{0x74, 0x46, 0xA0, 0x33, 0x00, 0x12},
{0x74, 0x46, 0xA0, 0x33, 0x00, 0x12}
};
char* ssids[nn] = {
"wifi_ssid",
"another_wifi_ssid"
};
#ifdef USE_SCREEN
byte channels[nn] = {6, 6};
#else
byte channels[nn] = {10, 11};
#endif
Then, make of a copy of "skylift_v03_embassy" and replace the existing WiFi data with your custom data.
Experimental: notice the two options for the channels. If you're using the sketch in standalone mode (w/o a screen) you may want to change the channels. For using SkyLift in a large room, it seems to work better to use multiple repeater units on random channels and the screen version on channels 1, 6, and 11. If you're only using one device stick using channels 1,6, and 11 all together has provided the best results so far.
Geolocation Services is broad term for the collection of technologies used to determine a smartphone's geographic location. The four primary technologies used for geolocation services are (1) GPS, (2) cellular triangulation, (3) Bluetooth, and (4) WiFi positioning. Depending on which of these 4 signals are available, a smartphone will attempt to determine its geographic location with the highest accuracy and shortest wait time.
SkyLift makes use of an exploit with WiFi geolocation services that was first discovered in 2008 by Swiss researcher Srdjan Capkun at ETH Zurich showing. Despite their early warning in 2008, all major smartphone companies have continued to integrate WiFi as a core geolocation technology. The vulnerability still existed in 2012 when Bengt Sjölen and Gordan Savicic creatively exploited it for their 2012 project Packetbridge (<- good documentation).
The vulnerability is difficult to deal with because WiFi geolocation companies assume everyone's WiFi router, including the one inside your home, is part of a their commercial geolocation product. Whether or not this is legal or ethical should be more openly debated.
What is certain, and was already proven in 2008, is that smartphone geolocation data can be easily falsified and should not be trusted. Yet we rely on this technology for an increasing number of critical applications. For example, the image below shows how easily I was able to trick Apple's Find my Phone service into thinking my device was at the Ecuadorian Embassy in London. (Image made with device actually in Berlin, works with Desktop or mobile device).
