In brainstorming for ways to exploit Internet of Things (IoT) security, we envisioned the following premise: an attack which compromises the security of multiple wireless interfaces. In this project, we attempt to reveal information about a region of networks; this data includes each network’s location, security, signal strength, and user activity. In exposing such data, we hope to shed light on the security problems associated with wireless networks.

1. S. J. B INSTITUTE OF TECHNOLOGY
M-TECH TECHNICAL SEMINAR REVIEW
On
UNDER THE GUIDANCE OF:
Dr. D N CHANDRAPPA
PRESENTED BY :
KAVYASHREE B R
EXPLOITATIONS OF WIRELESS INTERFACES VIA
NETWORK SCANNING

2. CONTENTS
 INTRODUCTION
 OBJECTIVES
 STATE OF ART
 INITIAL ATTEMPTS
 IMPLEMENTATION
 EXPERIMENTAL RESULTS
 CONCULSION
 REFERENCE

3.  Our long-term goal was to build something that would affect a large number
of users and emphasize the importance of securing wireless networks.
 The current state of wireless networks and related applications.
 Initial attempts in creating this device.
 The implementation of our final device .
 The result from the test of the device is discussed in .
INTRODUCTION

4. OBJECTIVES
 In brainstorming for ways to exploit Internet of Things (IoT) security, we
foresee the following premise.
 An attack which compromises the security of multiple wireless interfaces.
 In this project, we attempt to reveal information about a region of networks.
 This data includes each network’s location, security, signal strength, and user
activity.
 In exposing such data, we sort out on the security problems associated with
wireless networks.

5. STATE OF THE ART
 To standardize WiFi security, which has led to WEP, WPA, and RSN standard
protocols used to encrypt data.
 Wireless Equivalent Privacy (WEP) was created so that wireless networks
would have the same security as wired networks.
 Wi-Fi Protected Access (WPA) serves as an improvement over WEP in terms of
data encryption, user authentication, and error detection.
 The final wireless security solution is Robust Security Networks (RSN), or
WPA2.
 The main improvement over WPA is to ease communication between wireless
access points and wireless devices through a new encryption and authentication
scheme .

6.  To collect network information , various applications available which mostly rely
on using mobile device.
 Two applications in this category are Wi-Fi Collector and OpenWebGIS.
 WiFi Collector is an Android app that collects various information about the
available wireless networks.
 The information collected includes the network name, the signal level, and the
location and time ,all of which is exportable to external mapping applications.
 OpenWebGIS used to collect and map any type of data.
 As of 2016, OpenWebGIS has a detected WiFi access points option which collects
various information and then maps it.
 The information collected includes the SSID, the coordinate point ,the address of
the access point, the authentication and encryption schemes, and the data and time.

7.  Wireless networks have become more popular as they have many advantages over
wired networks, but with the advantages also come new security problems.
 The main difference between wireless and wired networks is the way information is
transmitted.
 The main focus of securing wireless networks is on preventing unauthorized access,
eavesdropping, and tampering of transmitted messages

8. ADVANTAGES AND DISADVANTAGES OF WIRELESS
NETWORK OVER WIRED NETWORK.
ADVANTAGES
 Users/clients’ move around freely or independently within the area/section
of network with their laptops, & get or access the internet connection.
 Users can share the files, data, & other resources with other devices that are
connected to the network.
 It is easy to set up a WAP & configure a WNIC by using a wireless connection
utility.
DISADVANTAGES
 Wireless network can be a ‘security risk’ if it is not installed & maintained
properly. It does not need any physical component to be connected such as wires.
 The general speed of wireless connection is slower than a wired one & they are
generally less secure.

9. INITIAL ATTEMPTS
 To access the Raspberry Pi ,turn the Pi into an AP (access point).Since there is no
available network to secure shell in Pi.
 When turning the Raspberry Pi into an AP, the main issue is to maintain the Pi’s
built in functions, such as WiFi and Ethernet.
 The 1st attempt ,WiFi using the data collection script was ignored and hence AP on
built in WiFi is removed.
 Additionally, we receive problems with communicating with the GPS module.
 The GPS module was connected to the Pi via UART, since a newer Pi was utilized
for this project, there was a lack of documentation on which port match to the
serial port.
 An essential component in this project, is to figure out the correct serial port to in
order to communicate with the GPS

10. IMPLEMENTATION
 A Raspberry Pi 3 model B running the Raspbian Jessie kernel version 4.4 and an
Adafruit Ultimate GPS Breakout module is implemented.
 Raspberry Pi used to communicate with the GPS and to collect data about the
available APs.
 GPS used to determine where the data point was collected. External antenna is
used to amplify GPS.
 1ST ,Raspberry Pi accessed via the AP through WiFi dongle attached to the Pi.
 To run a Python script that collects all the data on the available networks and
writes it to a CSV file.
 2ND , Python script must be ran that converts the outputted CSV file to a KML file
which can be viewed on a map.

11. PI AND GPS SETUP
 Using WiFi dongle, the Raspberry Pi act as an
AP, which can then be connected to by any
computer,
 Allows for access to the Raspberry Pi through
SSH /tightVNC viewer.
 Raspberry Pi has a built-in WiFi module, WiFi
dongle affect wlan1, instead of wlan0.
 1st step is to setup DHCP server which allows
WiFi connections to get IP addresses.
 Next, wlan1 must be given a static IP, and the
AP credentials must be created through the
hostapd program.
 Lastly, ensure that the AP will be available
automatically when the Pi boots up, a setup that
enables both hostapd and DHCP server.

12.  Additionally, to allow access to the Pi’s Internet connection via the AP, the
network address translation must be configured.
 AP is configured and connecting to the network created, the Pi’s command line
is available via SSH and the desktop through a tightVNC viewer.
 To see the GUI through a tightVNC viewer, a set up on the Raspberry Pi.
Placed by the necessary commands in the Pi’s / etc/ rc. local file.
 To map out the network information, enable coordinates of where the network
data was collected. An Adafruit Ultimate GPS Breakout was used.
 Every time data was collected, the coordinates of the Pi were taken from the
GPS module.
 By connecting the GPS to the correct pins in the Pi’s UART header and then
setting up communications between the two.
 Communication was set up by enabling UART communication and starting the
GPS daemon, gpsd, on the correct serial port, which in this case was
/dev/serial0 or /dev/ttyS0.

13.  After creating the CSV file with all of the
data, it is converted into a KML file
through a Python script.
 Script first parses the CSV file produced,
 Sorts the data based on the network.
 Two dictionaries are kept, to track various
information, which sorts network.
 The first dictionary keeps track of all the
coordinates, belong to same signal category.
 The signal categories are created to map
that resembles a contour map.
 All coordinates belonging to the same
category, either poor, weak, good, or strong,
 Connected and colored to create a polygon
based on the signal strength
Fig. 2: The process the data collection script
goes through

14. TABLE I: A chart showing the signal categories and
their corresponding signal strength range and color
 Table I is a chart with the signal categories
and their corresponding signal strength
ranges and polygon colors.
 This is done to be able to differentiate where
the signal is the best.
 To get the closest representation of where the
access point originates, where the signal is
the strongest.
 Additionally, the same dictionary keeps track
of the network’s average information.
 That includes the most number of users,
least number of users, average number of
users, encryption, and the time stamp of
when the last data point was taken.
SIGNAL
CATEGORY
dBm RANGE COLOR
Very strong > = -50 Dark Green
Good < -50 and > = -65 Light Green
Weak < -65 and > = -80 Yellow
Poor < -80 Red

15. Fig. 3: The process the CSV to KML script goes
through
 Lastly, a text box pop up when
the polygon is clicked on, the
text style and the actual text
description is specified.
 KML file can then be read by
Google Maps and Google
Earth.
 The best viewing platform for
the number of layers that are
most likely will be created is
Google Earth.
 Each layer can be individually
viewed and overlapping points
can be viewed independently
on the map.

16. EXPERIMENTAL RESULTS
Fig. 4: First 18 lines of the CSV file produced from the data collection script

17.  Took a shuttle that went around the perimeter of the campus and collected 322
data entries.
 Each consist of network ESSID, the encryption, the signal strength, latitude,
longitude, user count, and the time.
 When collecting data, ran into problems,causing the user count of the network.
 Specifically, the script would pause for a very long time, causing not able to
collect data and have a huge gap between the consecutive coordinates.
 Result not having a very representative map, so we removed the user count
method and simply have the user count for every network be 0.
 Figure 4 shows an excerpt of the CSV file produced from the data collection
script.

18.  Since the campus shuttle moved slowly, able to collect multiple coordinates for
each network with varying signal strengths, allowing for quite a few data
polygons.
 Additionally, most of the coordinate points were not overlapping, which is ideal
when looking at multiple networks on the same map.
 Although the data polygons cover most of the UCF campus, it is not an accurate
depiction of available access points within the campus.
 Data was only taken along the perimeter, and thus these maps are not a good
representation of the entire campus.
 Overall, the results were as we expected and serve as an initial test of the
capability of the device created.

19. FIG. 5: ALL THE LAYERS OF THE DATA
COLLECTED SHOWN IN GOOGLE EARTH
 After mapping the collected data to Google Earth, the experimental results are
shown in Figures 5, 6, and 7.

20. FIG. 6: ONE LAYER ISOLATED IN GOOGLE
EARTH AND TYPICAL TEXT BOX

21. FIG. 7: ONE LAYER ISOLATED IN GOOGLE EARTH
AND INDIVIDUAL DATA POINT TEXT BOX

22. CONCULSION
 In this paper we have described a project that should be treated as a first step in
a much larger attack.
 The project involves collecting informative data about the available networks
and displaying that information in an easily viewed platform.
 The data collected includes the network names, the encryption status, and
ideally, the number of users.
 A contour-like map is created to display the signal strength, along with the
network data collected, by utilizing a GPS breakout board.
 Used to figure out the best network to attack, something that is important when
creating and deploying an attack that will affect the most users.

23. REFERENCES
 M.-k. Choi, R. J. Robles, C.-h. Hong, and T.-h. Kim, “Wireless network security:
Vulnerabilities, threats and countermeasures,” International Journal of Multimedia and
Ubiquitous Engineering, vol. 3, no. 3, pp. 77–86, 2008.
 H. I. Bulbul, I. Batmaz, and M. Ozel, “Wireless network security: comparison of wep
(wired equivalent privacy) mechanism, wpa (wi-fi protected access) and rsn (robust
security network) security protocols,” in Proceedings of the 1st international conference
on Forensic applications and techniques in telecommunications, information, and
multimedia and workshop. ICST (Institute for Computer Sciences, Social-Informatics
and Telecommunications Engineering), 2008, p. 9.
 H. Boland and H. Mousavi, “Security issues of the ieee 802.11 b wireless lan,” in
Electrical and Computer Engineering, 2004. Canadian Conference on, vol. 1. IEEE,
2004, pp. 333–336.
 Http://www.nirsoft.net/android/wifi collector.html.
 Http://openwebgisystem.blogspot.com/2016/01creating wi-fi map and monitoring
access.html.

24. THANK YOU