Description as a Tweet:

Our project aims to test the security of a given locations networking by attempting to extract data from publicly transmitted signals. This project will hopefully raise awareness about device security and privacy protections.

Inspiration:

All of our team members have background in cyber security related fields. We wanted to show the world how easy it was to intercept information without the supposed "hacking". Through this project, we hope to raise awareness about the security of our trusted devices and hopefully make a change in how WiFi should be implemented in the future.

What it does:

In a single sentence, our project has the potential of finding out where someone lives, works, their income levels and their relatives or close relations just by walking past them on the street.
Our project will first intercept and collect access point hardware addresses from a device that is not connected to wifi. It will then leverage multiple online public databases and API's to collect and gather information. This project can be scaled up to the api limit, which can be paid to be increased. There are a lot more things that can be achieved with this amount of data, but due to the nature of this project, we decided to leave it as is since we are confident this amount of data has already conveyed our goal to raise awareness. If we decide to mine more data it can potentially become a dangerous tool.

How we built it:

Google's API can be cleverly used to pinpoint single access point location by manipulating the signal strength of the target access point. Afterwards, Ekata and WiGLE will attempt to find the physical location that the WiFi capable device has attempted to connect to. Google's API can then inform us the top three possibilities about whether the location is a house, resturant, or workplace etc. With this information, Zillow will then look up the address and respond with the housing information, and name. Naturally, Zillow can also provide us with the neighborhood housing prices, and the prices these houses were sold for in the past. This, combined with workplace information if accessed, can give us an idea of the individual's financial ability. Finally, we can use Google's API to figure out the individual's relationship with others, and using a public phone-book we can also find out about this individual's relatives, past lived locations (which can be looked up by zillow to get a feel of their financial ability over time).

Technologies we used:

• Python
• Misc

Challenges we ran into:

The WiGLE, Zillow API is poorly documented, in addition, our concurrent golang server had issues since our database was not as good as the ones WiGLE provides. We decided to ditch the golang server for the WiGLE API as there is simply just more data on the WiGLE API. However, our team is confident if we go on WiFi "drive-by" collection runs we can rival these databases. Finally, as this revolves around WiFi requests, there is no guarantee that we can target any individual, but that should hopefully be a good thing as the goal of our project is to reveal the security setup of a location, not to target individuals specifically.

Accomplishments we're proud of:

Our team's goal is to encourage a future where we can communicate in a more secure way. We are proud that we are able to leverage many different information providers to automate and demonstrate the process of opsec. We are also proud that our framework has shown the dangers of forgotten potential attack vectors when it comes to cyber security.

What we've learned:

Sending API requests through python, concurrent processing with golang by using goroutines and waitgroups. WiFi security and the amount of information our devices transmit when it's actively looking for connections, and the failure to assume an "always-compromised" state from our critical communication devices. In the beginning, we knew that WiFi access points had all sorts of issues within them, and we wanted to find a way to show the issues our devices have today. In the first few hours, we were able to surprisingly find one of our teammates address, their parents and other information just from their disconnected phone. At the end of this hackathon, we are quite proud of the data we are able to collect based off of something that people think is minor. These set of automation lookups perfectly demonstrated the flaws within our security infrastructure, and the potential data loss that can happen without us even realizing it. In conclusion, we find that people may be too concerned about security in established WiFi connections that we forget small clues can reveal huge amounts of compromising data.

What's next:

Next for our project will be to make the interface more usable and format the output better. There are some ideas that could be implemented which we ultimately decided not to do. These ideas include plotting an individual's financial power over time, assessing the economic performance of a given location, checking online data leaks for an individual's passwords and online aliases through frameworks like sherlock. As this project is an automation of opsec procedures, analyzing the data should only be done to prove a point, rather than making it a viable tool.

Built with:

Python, Golang

Prizes we're going for:

• Best Documentation
• Best Security Hack

Best Security Hack

Baiqing Lyu
Mathew Han
Edward Guo

Table 24