Ubertooth - building and using

I'm working on a pen test for a client, which includes some bluetooth signal analysis. I decided to go a step above and actually do some ubertooth work--and immediately found myself in over my head. My first step was to buy a HackRF device, hoping I could use it for several purposes but soon discovered that the ubertooth tools aren't built for HackRF platform. After a good week beating on that, I gave up and had the Hak5 folks overnight me an Ubertooth.

I have followed the Ubertooth build guide to a T, but when I plugged in my ubertooth and tried to use the Spectrum Analyzer (as described in the Getting Started Guide), I encountered problems.

FeedGnuPlot

My first problem was:

jo@ubuntubox:~/ubertooth/ubertooth-2014-02-R2/host/ubertooth-tools$ ubertooth-specan -G -q | feedgnuplot --stream 0.5 --domain --3d

The program 'feedgnuplot' is currently not installed. You can install it by typing:

sudo apt-get install feedgnuplot

ubertooth-specan: command not found

Yah, oops - that's an easy fix:

jo@ubuntubox:~$ sudo apt-get install feedgnuplot

Reading package lists... Done

Building dependency tree       

Reading state information... Done

The following extra packages will be installed:

  aglfn gnuplot-qt

Suggested packages:

  gnuplot-doc

The following NEW packages will be installed:

  aglfn feedgnuplot gnuplot-qt

0 upgraded, 3 newly installed, 0 to remove and 0 not upgraded.

Need to get 1,014 kB of archives.

After this operation, 3,354 kB of additional disk space will be used.

Do you want to continue? [Y/n] y

BTBB CMake Error

The next error I got was at the bottom of the first set of command text above, also here:

ubertooth-specan: command not found

Hmm. CD'ing into the tools folder I realized duh - I hadn't build the tools yet. So the timeless march begins:

mkdir build

cd build

cmake ..

make

sudo make install

But wait, error! 

jo@ubuntubox:~/ubertooth/ubertooth-2014-02-R2/host/ubertooth-tools/build$ cmake ..-- The C compiler identification is GNU 4.8.2

-- Check for working C compiler: /usr/bin/cc

-- Check for working C compiler: /usr/bin/cc -- works

-- Detecting C compiler ABI info

-- Detecting C compiler ABI info - done

CMake Error at src/CMakeLists.txt:24 (find_package):

  By not providing "FindBTBB.cmake" in CMAKE_MODULE_PATH this project has

  asked CMake to find a package configuration file provided by "BTBB", but

  CMake did not find one.

  Could not find a package configuration file provided by "BTBB" with any of

  the following names:

    BTBBConfig.cmake

    btbb-config.cmake

  Add the installation prefix of "BTBB" to CMAKE_PREFIX_PATH or set

  "BTBB_DIR" to a directory containing one of the above files.  If "BTBB"

  provides a separate development package or SDK, be sure it has been

  installed.

CMake Warning (dev) in CMakeLists.txt:

  No cmake_minimum_required command is present.  A line of code such as

    cmake_minimum_required(VERSION 2.8)

  should be added at the top of the file.  The version specified may be lower

  if you wish to support older CMake versions for this project.  For more

  information run "cmake --help-policy CMP0000".

This warning is for project developers.  Use -Wno-dev to suppress it.

-- Configuring incomplete, errors occurred!

See also "/home/jo/ubertooth/ubertooth-2014-02-R2/host/ubertooth-tools/build/CMakeFiles/CMakeOutput.log".

What the...? 

This took some research, but I finally found the following comment from Govind-mukundan on the GreatScott Github issues discussion:

Thanks a lot for your information (I'm a bluetooth noob so have lots of reading up to do). I'll try to do some more tests tomorrow and add the capture. I also have some BLE devices and I'm curious to see them in action.
To add on the build requirements - in the setup guide it's mentioned that to install the wireshark plugin you should run:
$ cmake -DCMAKE_INSTALL_LIBDIR=/usr/lib/wireshark/libwireshark1/plugins ..
But this didn't work for me (I couldn't find the btbb inside the wireshark filters). I tried both libwireshark1 and libwireshark3 folders. However the instructions inside the README at libbtbb/wireshark/plugins/btbb/ says that you should run
$ cmake .
That did work for me, perhaps this should be updated in the guide too? It's all quite confusing :)

This actually works!

ubertooth-specan

The Getting Started says to run "ubertooth-specan" as explained in the readme. When I tried the read-me's command line, I kept getting errors:

jo@ubuntubox:~/ubertooth/ubertooth-2014-02-R2/host/ubertooth-tools$ ubertooth-specan -G -q | feedgnuplot --stream 0.5 --domain --3d

ubertooth-specan: command not found

After building and rebuilding I realized - there is no ubertooth-specan. The tool is ubertooth-specan-ui! So I modified the command and voila - another error!

jo@ubuntubox:~/ubertooth/ubertooth-2014-02-R2/host/ubertooth-tools$ ubertooth-specan-ui -G -q | feedgnuplot --stream 0.5 --domain --3d 

Traceback (most recent call last):

  File "/usr/local/bin/ubertooth-specan-ui", line 260, in <module>

    window = Window()

  File "/usr/local/bin/ubertooth-specan-ui", line 227, in __init__

    self._device = self._open_device()

  File "/usr/local/bin/ubertooth-specan-ui", line 250, in _open_device

    return Ubertooth(device)

  File "/usr/local/lib/python2.7/dist-packages/specan/Ubertooth.py", line 38, in __init__

    self._device.set_configuration()

  File "/usr/local/lib/python2.7/dist-packages/usb/core.py", line 559, in set_configuration

    self._ctx.managed_set_configuration(self, configuration)

  File "/usr/local/lib/python2.7/dist-packages/usb/core.py", line 91, in managed_set_configuration

    self.managed_open()

  File "/usr/local/lib/python2.7/dist-packages/usb/core.py", line 70, in managed_open

    self.handle = self.backend.open_device(self.dev)

  File "/usr/local/lib/python2.7/dist-packages/usb/backend/libusb1.py", line 733, in open_device

    return _DeviceHandle(dev)

  File "/usr/local/lib/python2.7/dist-packages/usb/backend/libusb1.py", line 618, in __init__

    _check(_lib.libusb_open(self.devid, byref(self.handle)))

  File "/usr/local/lib/python2.7/dist-packages/usb/backend/libusb1.py", line 571, in _check

    raise USBError(_str_error[ret], ret, _libusb_errno[ret])

usb.core.USBError: [Errno 13] Access denied (insufficient permissions)

Well, alright, this one is easy - USB permissions. The readme talks about a few fixes that I haven't implemented yet - I simply ran the same command as sudo and voila for real - introducing "Ubertooth Spectrum Analyzer"

I am happily seeing 2.4 gHz spectrum.

WiFi Pineapple Radios

I've been slowly poking away trying to figure out definitively which antenna/radio corresponds (by default) to which WLAN. The support forums don't have much information, so I spent an hour or so today searching the web for info. I finally have it figured it, I believe.

Looking at front w/antennas on bottom:

Light Radio radio   wlan# Location
Blue AR9331 radio0  wlan0 Lower right by SD card
Red RTL8187 radio1  wlan1 Lower left near dip switches

Some of this info came from https://forums.hak5.org/index.php?/topic/33485-physically-what-is-the-wlan0wlan1-antenna/?hl=%2Bwhich+%2Bantenna

Typically WLAN0 is the access point clients connect to (the access point) and WLAN1 is the NIC used to connect to another wireless network. Why is this important?

1. If you're trying to lure users to connect to your pineapple, having a high-gain antenna connected to WLAN0 would be helpful. That's the blue antenna, AR9331 radio, lower right by the SD card.
2. If you're trying to connect/assess remote wireless networks (say with a Yagi directional antenna) connecting your antenna to WLAN1 would be helpful. That's the red antenna, lower left near the dip switches.

There was apparently at some point a problem with radios switching, but it seems that problem has been addressed (it was back in Sept 2013).

You can confirm this by connecting to your Wifi Pineapple over SSH:

root@Pineapple:/# cat /etc/config/wireless

config wifi-device 'radio0'

option type 'mac80211'

option channel '11'

option hwmode '11ng'

option macaddr '00:13:37:##:##:##'

option htmode 'HT20'

list ht_capab 'SHORT-GI-20'

list ht_capab 'SHORT-GI-40'

list ht_capab 'RX-STBC1'

list ht_capab 'DSSS_CCK-40'

config wifi-iface

option device 'radio0'

option network 'lan'

option mode 'ap'

option ssid 'Pineapple5_2342'

option encryption 'none'

config wifi-device 'radio1'

option type 'mac80211'

option hwmode '11g'

option macaddr '00:13:37:93:58:d2'

option channel '5'

config wifi-iface

option device 'radio1'

option mode 'sta'

option network 'wan'

option ssid 'HOME-8858'

option key 'Sn1ckers'

option encryption 'psk2+ccmp'

Note on MAC addresses: 

• 00:11:37 is associated with "Orient Power Home Network Ltd (this is radio0, the AR9331)
• 00:13:37 is also associated with "Orient Power Home Network Ltd" (this is radio1, the RTL8187)

Mak5 WifiPineapple - the basics

I've been breaking out my Hak5 Wifi Pineapple of late, and figured since I'm messing around in it, I ought to share what I've learned.

First Steps - Setting Up

The first thing I did with my Pineapple was get an open wireless LAN going. Something kinda sticky, honeypot-like... First, I logged into my Pineapple (follow the included directions to get that far), by connecting to it with my Air over wifi. This is the homescreen:

Next, I went into the "Network" bar and moved to the "Access Point" tab and gave my WLAN a better name:

Think anyone will nibble?

Network Access

A Wifi Pineapple is more fun when it is connected to the webz and can proxy unsuspecti--er, generous volunteers. So next, I connected my Pineapple to my internal network:

OK this is awesome, because now I'm proxying my communications through my WLAN to the Internet. 

Shall We Play A Game?

NOTE: there are legal ramifications to interrupting folks' wireless connectivity. I do this only when 1) I'm at home, connected to my own WLAN, and testing or 2) when clients pay me to do a wireless assessment AND I HAVE A SIGNED DOCUMENT STATING I AM AUTHORIZED.

The Pineapple is, simply put, an awesome and powerful wireless network assessment tool. What you can do is almost unlimited. For this test, though, I'm going to use the "Karma" infusion to capture open networks. Karma is basically a tool which will mimic an open network--it's a very promiscuous access point. The background on Karma is that it's a simple tool to attack any wifi-capable device.

Karma takes advantage of the completely backwards concept that your computer continuously searches for networks its previously connected to. Instead of the Starbucks wireless AP calling out "Hey I'm Starbucks - anyone wanna connect?," your device (laptop, tablet, etc.) calls out "Is anyone here the Starbucks AP?" and connecting when someone answers yes. These are called "probe requests" and they're one of a couple really stupid implementation fails on wireless. Karma... Well, Karma responds "Yes" to every request. Every request...

Want to understand how "probe requests" work? Try these sources:

• https://scotthelme.co.uk/wifi-pineapple-karma-dnsspoof/
• https://www.youtube.com/watch?v=avJfT9JyiiM

So 30 seconds into running Karma, here's what I have:

Somewhere within reach of my Pineapple (running the long gain antenna), devices are looking for 5 different networks. Ten minutes later, this count jumped to 12 different networks. Eventually, I even captured an association (meaning a device which had formerly connected to an open network and which was happen to get another open connection to the same network - served up by me).

Things to Know

A few things to keep in mind:

1. Most of the tutorials say it's easier to tether over a network cable. None of my current laptops have network cables, but I'm able to tether just fine over WiFi. Don't be afraid to do it that way.
2. USB... To do any serious logging, you need to have a USB drive connected. I do not, yet, so that'll probably be the next blog.

Happy Pineapples!