endellion.me.uk The Wireless Honeypot Undergoes a Major Refit!
I have this awful tendency to browse eBay for stuff to get greedy over. And sometimes I look at these things often enough for it to become imprinted in my (badly wired) brain that I don't just want them, I need them. So it happened with this 21 dBi omni-directional antenna. I don't know anything much about stuff like this, except that 21 sounds more than 3. And also that I live in a well-built-up area so that "line of sight" doesn't really apply here to translate into 2 km reach, but hmm never mind, ordering it was.
A few weeks later a parcel turned up from Poland, containing the promised tube with 10m cable attached. A test set-up in the attic was established, and the antenna hooked up to the only wireless card I have that lets you change this. This showed a significant improvement in the number of access points within reach. We weren't totally happy with the attic though, and thought up ways to get the thing higher up, and outside. "Real" antenna posts seemed to cost an absolute arm&leg, so we were on the lookout for an alternative. This was found when visiting the army surplus store, where they had tiny little interlocking aluminium tubes for sale at 20 pence a piece. Here's a picture of some.
We got over 8 metres' worth for about £ 6. Then we got a normal areal bracket affixed to the back of the house, with a piece of drainpipe in it. The completed antenna post sits within.
This way it is possible to change the overall length of the post from the ground without any fussing about. In case of high weather, as we've been having lately.
On the left: the post at full height; on the right: storm-induced reduction.
The next issue was which router to connect this up to. The Thomson Speedtouch kindly supplied by Be* has no facility for changing/adding antennas, so the little Asus router had to be taken off our network to do this job. Poor thing has to be in a room by itself because the 10m cable connected to the antenna is not long enough to reach the study/server room. Here's a picture of the poor thing, all lonesome among the carpet remnants, brooms, badly painted floor boards and stepladders.
And here's where the other end goes (it's the grey cable somewhere on the right):
Apart from changing the IP address of the Asus, nothing was changed. The BeBox was pressed into action on our own network, and is so far holding out with WPA which didn't seem to be its strong point. It has only needed one reboot in about a fortnight, and in retrospect even that might have been avoidable.
After having everything in place, it was a matter of waiting for connections to be made to the Access Point. This didn't take long, and they are coming from a lot further away now. I plan to walk the area with the PDA, but so far have been too lazy to do any exhaustive plotting.
More people connecting means more interesting packets. Unfortunately the vast majority of connecters are student types who want to "work" i.e. vomit on their myspace page and who think email and hotmail are synonyms. The most interesting addition so far has been a VoIP user. I had banned all UDP packets since they were mainly sent to establish connections with other P2P applications for the benefit of illegal filesharing (if only they downloaded interesting stuff but students nowadays only like horrible music by the looks of things...). But when I noticed someone connecting and sending SIP packets which went unanswered, I removed the UDP block to see what these were, never even having heard of SIP. A bit of web-searching later I knew what it was, and how to capture them using Cain. In retrospect Wireshark alone would have sufficed, but Cain adds a lot of features to the automatic interception, like all clear-text passwords, so I'm sticking with it. Slowly a folder is filling with intercepted telephone conversations that can easily be played with VLC media player, for instance. Wireshark will also produce nice little graphs and whatnot.
The most amazing thing about this person with with X-Lite softphone on their Laptop using someone else's AP is that they are actually in the market for selling hardware PBX machines. I would have thought that this, of all people, would be someone who is familiar with the insecurities of the protocol and hence either use a secure channel (but I am working on mitm) or buy your own bloody internet! Anyway, I get his VoIP calls. He was burgled, apparently. I know who he is insured with. I know where he lives. I know where he works. And I even know the admin password for his PBX system he is trying the sell to the public. What a loser. They are hoping to gain a big contract soon with a major national organization (~3000 extensions), and they log in to the PBX admin in clear text over someone else's line they haven't got permission to use. Un-real.