The document describes a proof of concept for a hacking token that can perform various WiFi attacks. It discusses implementing hardware including a microcontroller and wireless capabilities into a power bank form factor. The software is designed as modular attacks that can store data, perform WiFi scans, create fake captive portals to intercept credentials, and retrieve stored data over encrypted connections. The proof of concept was able to successfully capture credentials through a fake captive portal and estimate locations through Google APIs based on nearby WiFi access points.

1. Hacking Tokens:
A Massive PoC
Ismael Benito | Arnau Gàmez

2. Agenda
2
● About us
● Hacking Token Concept
● Hardware
● Software
● Results
● Conclusions
● Questions

3. About us
3

4. ● Founded in late 2016
● Faculty of Mats & CS @ UB
● Ethical and social aspects of
infosec
● Use and creation of FLOSS
● Technical workshops and talks
in wireless security, IoT, RE,
stego, etc.
4
https://hackinglliure.org
info@hackinglliure.org
@HackingLliure
Arnau Gàmez i Montolio | @arnaugamez
● 20yo. From Benigànim, València
● President of Hacking Lliure
● Maths & CS student @ UB
● Worked as software developer in
research groups @ UB
● Participated in many CONs
● r2 evangelist
● Also interested in music: pianist

5. ● Founded in 2011
● Faculty of Physics @ UB
● Aims to promote electronics &
robotics among students.
● Several activities during the
course such as courses,
workshops
5
http://fisitronica.net
fisitronica@gmail.com
@Fisitronica
Ismael Benito Altamirano | @ismansiete
● 26yo. From Nou Barris, Barcelona
● Former president of Fisitrónica
● B. Physics & Electronics Eng. @ UB
● MSc. in Photonics @ UPC
● Predoctoral researcher @ UB
● Assistant professor @ UB
● Also interest in politics, magic tricks,
photography, all sci-fi Netflix series...

6. Hacking Token Concept
6

7. Hacking Token: from RootedCON 2017
7
Sweet Tools O’Mine by Hugo Teso: https://youtu.be/G8bccS3wla0

8. Hacking Token: candidates
8

9. Hacking Token as a PowerBank
9
General specs of PowerBanks:
● Portables
● Charging & discharging
circuits integrated
● LiPo Bat. up to >20000 mAh
● Charger current up to >2A
● USB and Micro-USB ports
● At least a ON/OFF Button
● LEDs (Interface & linter)
● Not yet idIoTized
○ Battery pack for charging smartphones and other USB
charge-capable devices.
○ Extra powerful 20000 mAh charge capacity.
○ Uses quality battery cells from well-known
manufacturers.
○ Dual USB ports, including one 2.4 A port for quick
charging tablets and similar devices.
○ Battery status indicator.

10. Hardware
10

11. Hardware
11
● Learn about PowerBank
internal circuits
● Charge and discharge a LiPo
battery
● Protection circuit
● Typical schematics
Reversing a PowerBank

12. Hardware: reversing a PowerBank
12

13. Hardware: reversing a PowerBank
13
Block diagram
Protection
GNDBAT
VBAT
= 3.6 V - 4.2 VCharge
VmUSB
= 5V
VUSB
= 5V
Step-Up
GND
GND
GND
VBAT

14. Hardware: reversing a PowerBank
14from several datasheets
Charge circuit:
○ Models: LTC4056, TP4056...
○ Battery detection
○ Match the correct Icharge
for LiPo/Li-Ion Batteries
Protection circuit:
○ Models: AP9101C, BQ2970,
FS312F-G, S820A
○ Overcharge voltage detection
○ Overdischarge current detection
○ Disconnects GNDBAT
from GND
when needed

15. Hardware: Microcontrollers
15
Block diagram
Protection
GNDBAT
VBAT
= 3.6 V - 4.7 VCharge
VmUSB
= 5V
VUSB
= 5V
Step-Up
GND
GND
GND
VBAT
Microcontroller
Wi-Fi
?
?

16. Hardware
16
● State of the art
● Choose low-power uC
● uC placement inside a
PowerBank
Microcontrollers (uC)

17. Hardware: Microcontrollers
17

18. Hardware: Microcontrollers
18
Arduino (Pro) Micro (Atmega32u4):
○ Arduino-compatible
○ Several factor forms: Micro, Leonardo, Esplora...
○ Works with 5V and 3.3V logic
○ USB stack
NodeMCU v3 (ESP8266):
○ Arduino-compatible
○ Several factor forms: NodeMCU, Weedemos,
Adafruit Huzzah...
○ Works only with 3.3V logic
○ WiFi + TCP/IP stack

19. Hardware: Microcontrollers
19
Block diagram
Protection
GNDBAT
VBAT
= 3.6 V - 4.7 VCharge
VmUSB
= 5V
VUSB
= 5V
Arduino Micro
GND
GND
GND
VBAT
Step-Up
NodeMCU

20. Hardware: Microcontrollers
20
Block diagram (Power)
Protection
GNDBAT
VBAT
= 3.6 V - 4.7 VCharge
VmUSB
= 5V
VUSB
= 5V
Arduino Micro
GND
GND
GND
VBAT
Step-Up
NodeMCU
Sense

21. Hardware: Microcontrollers
21
Block diagram (Communications)
Arduino Micro
NodeMCU
Sense
mUSB Data +
mUSB Data -
USB Data +
USB Data -
SCASCL

22. Hardware: demo
22

23. Software
23

24. Software
24
● Reprogram hardware
● Store data
● Retrieve data
● Modular/plugineable attacks
Basic Needs

25. Software: Designing a general Wifi Attack
25
IDLE
SAVE
LOOP
ATTACK 0
ATTACK N

26. Software: Designing an attack for our Hacking Token
26
IDLE
PUSH
DATA
WIFI
SCAN
CAPTIVE
COMM

27. Software: Designing an attack for our Hacking Token
27
IDLE
PUSH
DATA
WIFI
SCAN
CAPTIVE
COMM

28. Loop state
28
● Hacking Token as wifi client
● Scan for available wifi
● Will get ESSID, BSSID and
PWR
● Use SPIFFS to store data
Wifi Scan

29. SPIFFS
● File system stored on the same flash as the program
● Store sketch data, config files, web server content...
● FS size depends on the flash chip size
● Uploading a new sketch does not modify FS
● Same access modes as fopen in C: r, r+, w, w+, a, a+
● Some limitations: 31 chrs per file path, mandatory /data folder...
29
https://github.com/esp8266/Arduino/blob/master/doc/filesystem.rst
|--------------|-------|---------------|--|--|--|--|--|
^ ^ ^ ^ ^
Sketch OTA update File system EEPROM WiFi config (SDK)
Flash layout

30. Software: Designing an attack for our Hacking Token
30
IDLE
PUSH
DATA
WIFI
SCAN
CAPTIVE
COMM

31. Attack module
31
● Hacking Token as AP
● Captive files on SPIFFS
● DNS serverCaptive

32. DNS server
● Serve fake captive files on AP’s gateway IP
● Resolve all requests to gateway
● WiFi sign in notification appears
● Captive portal handlers don’t care about HTTPS
32
NodeMCUClient
Where is *.* ?
It is here: xx.xx.xx.xx (gateway IP)

33. Software: Designing an attack for our Hacking Token
33
IDLE
PUSH
DATA
WIFI
SCAN
CAPTIVE
COMM

34. Retrieve Data
34
● Hacking Token as client
● Connect to a reliable AP
● Send stored file
● Empty log file
-
● Server overview:
○ Built over python’s
BaseHTTPRequestHandler
○ Encrypted traffic
○ Unique id. with BasicAuth
○ Creds hased with PBKDF2
Push Data

35. Fork us!
35
- PlatformIO core (CLI utility)
- Official IDEs over Atom and VS
- Serial port monitor
- Library management system
- Multi-project
- Theme support
- Cross-platform support
- CI & Remote unit testing
“An Open Source ecosystem
for IoT development”
@HackingTokens
PlatformIO

36. Results
36

37. Results
37
● Fake UB’s captive portal
● Able to capture and log
credentials data
● No real users data has been
storedEvil twin (fake captive portal)

38. Results: Evil twin (fake captive portal)
38

39. Results: Evil twin (fake captive portal)
39

40. Results
40
● Google API
● Trace route based on WiFi APs
● Compare with real routes
Geolocation

41. Results: Geolocation
41

42. Results: Geolocation
42

43. Results: Geolocation
43

44. Results
44
Bonus: Open AP (BadUSB)
● Simple BadUSB
● Focused on Android devices
● Some limitations/requirements
● Funny AP

45. Bonus: Open AP (BadUSB)
45

46. Conclusions
46

47. Conclusions
47
○ Successful PoC study
○ Hardware viability
○ Dedicated and isolated vector
attacks
○ Two direct attacks proved
○ One post-processed attack

48. TODO
48
○ Atmega32u4 @ 3.3V 8MHz
○ Better current sensing
○ Internal SPI/I2C protocol
○ LED/LCD/TFT output
-
○ OTA Firmware updates
○ Wi-Fi Monitor mode
○ USB Host (MAX3421E)
○ Bluetooth (ESP32)

49. Acknowledgments
49
● Paul Charbonneau | PCB design
● Alejandro Codina | IT support
● Gerard Finol | WifiScan module and data
processing
● Enric Florit | Server development and
management
● Isaac Godoy | Hardware development
and integration
● David Martínez | Modules integration
and project refactor
-
● Universitat de Barcelona | Subsidized
some of the materials and allowed us to
perform PoCs on its network

50. Questions
50

51. @ismansiete
ibenito@el.ub.edu
isman7
@arnaugamez
arnau@hackinglliure.org
arnaugamez
Hacking Tokens: A Massive PoC
Ismael Benito | Arnau Gàmez
Thank you!