1) Joe’s WAP is beaconing. Based on the contents of the packet capture, what are the SSID and BSSID of his access point?
SSID: Ment0rNet
BSSID: 00:23:69:61:00:d0
2) How long is the packet capture, from beginning to end (in SECONDS – please round to the nearest full second)?
414s
3) How many WEP-encrypted data frames are there total in the packet capture?
59274
4) How many *unique* WEP initialization vectors (IVs) are there TOTAL in the packet capture relating to Joe’s access point?
29719
5) What was the MAC address of the station executing the Layer 2 attacks?
1c:4b:d6:69:cd:07
6) How many *unique* IVs were generated (relating to Joe’s access point):
a) By the attacker station?
14133
(We also accept 14132, as one of the IVs was *generated* by another station, and only *replayed* by the attacker’s station. See my comment #4 below.)
b) By all *other* stations combined?
15587
7) What was the WEP key of Joe’s WAP?
D0:E5:9E:B9:04
8.) What were the administrative username and password of the targeted wireless access point?
admin:admin
9) What was the WAP administrative passphrase changed to?
hahp0wnedJ00
August 2, 2011 at 2:20 pm
Related to the solution of 6a I would like to point out that there is a distinct difference between the number of unique IV’s GENERATED and the number of unique IV’s SENT by the attacker’s station. Because the first IV (5987fd) sent by the attacker is actually a replay of a packet that was sent (and generated) earlier by the base station. Therefore, I would suggest the correct answer to 6a would be 14132 instead of the number of uniquely SENT IV’s by the attacker’s station which is 14133.
August 4, 2011 at 5:00 pm
When is the next challenge and is it being announced via twitter?
August 8, 2011 at 8:27 pm
I agree with stefan. Additionally, the answer to question 4 (total unique IVs) is 29719.
When we add 14133 and 15587, we get 29720, which is one off from question 4.
August 10, 2011 at 4:02 pm
@stefan: Three of the most common types of programmatic errors are “infinite loops” and “off by one.” 🙂
You’re surely correct in that exactly one of the IV’s sent by the attacking station was the replay. I counted it twice. My bad. And I’ll prove it too:
$ tshark -r evidence08.pcap -R '(wlan.bssid == 00:23:69:61:00:d0) && (wlan.sa == 1c:4b:d6:69:cd:07) && wlan.wep.iv' -T fields -e wlan.wep.iv|sort -u >unique_IVs_sorted_attacker.txt
$ tshark -r evidence08.pcap -R '(wlan.bssid == 00:23:69:61:00:d0) && (wlan.sa != 1c:4b:d6:69:cd:07) && wlan.wep.iv' -T fields -e wlan.wep.iv|sort -u >unique_IVs_sorted_not_attacker.txt
$ wc -l unique_IVs_sorted*
14133 unique_IVs_sorted_attacker.txt
15587 unique_IVs_sorted_not_attacker.txt
29720 total
$ comm -12 unique_IVs_sorted_*
0x5987fd
Oops.
Obviously we’ll be accepting either answer. 🙂
August 10, 2011 at 4:15 pm
@baganon: Contest #9 was at Defcon 19 exclusively, much like last year. It’s been fought and won. We’ll try to get to posting the puzzle for everyone who couldn’t make it to Vegas, and also come up with #10 as soon as we can. We don’t currently tweet, but may consider it. If we decided to, we’d announce it here, so stay tuned to this RSS feed, right?
/j
September 1, 2011 at 6:39 am
When will the winners of contest 8 be announced?
September 2, 2011 at 5:54 am
For question 4:
Am I using the correct display filter?
wlan.wep.iv && wlan.fc.retry == 0 && wlan.bssid == 00:23:69:61:00:d0
It shows me the output as: 57009 frames
Below is the reason for using each of those display filters:
wlan.wep.iv -> displays the frames with IVs
wlan.fc.retry == 0 -> don’t display retransmitted frames. IV value is the same for retransmitted frames or when the R flag is set
wlan.bssid == 00:23:69:61:00:d0 -> Joe’s WAP BSSID
Regards,
NeonFlash
September 3, 2011 at 1:24 pm
Have you announced the winners of this puzzle?