dslreports logo
 story category
The NSA Can Hijack Wi-Fi From Eight Miles Away

Jacob Appelbaum made waves yesterday with a piece over at Der Spiegel highlighting the catalog of 50 different options (some rather amazing) that the NSA has at their disposal when snooping on individuals or organizations.

Click for full size
Speaking at the Chaos Communications Congress in Hamburg, Appelbaum shared a few more nifty details provided by Edward Snowden, including the NSA's use of pre-packaged exploits that allowed control over iOS devices and any phone communicating through GSM.

Der Spiegel has since added this interactive graphic that is worth taking a look at.

Applebaum also highlighted how the NSA's own slides claim the agency has the ability to use Wi-Fi to seed exploits via packet injection from up to eight miles away, purportedly using this tool "under ideal environmental conditions."

Granted the documents revealing this are from 2007, so things have likely evolved since then.
view:
topics flat nest 

battleop
join:2005-09-28
00000

1 recommendation

battleop

Member

Eight miles away?

Maybe under the most perfect of conditions but generally I call bullshit.

tshirt
Premium Member
join:2004-07-11
Snohomish, WA

tshirt

Premium Member

Re: Eight miles away?

If it only needs to insert something, it's possible, doesn't sound very selective, more like an EMP.

morbo
Complete Your Transaction
join:2002-01-22
00000

2 recommendations

morbo to battleop

Member

to battleop
Home made cantennas can fairly easily reach 2 miles. With a budget of more than $50 billion, I'm sure any spy agency can make this work.

tshirt
Premium Member
join:2004-07-11
Snohomish, WA

1 edit

tshirt

Premium Member

Re: Eight miles away?

said by morbo:

With a budget of more than $50 billion,

That's a lot of pringles, might even buy some more sophisticated designs.

battleop
join:2005-09-28
00000

battleop to morbo

Member

to morbo
Put a nice big pine tree in front of that cantenna and it's not going 8 feet. Even the NSA has to obey the laws of physics.

morbo
Complete Your Transaction
join:2002-01-22
00000

morbo

Member

Re: Eight miles away?

True, but unless the pine tree completely (sides and above) surrounds the wifi source, there's a way to get to it.

KrK
Heavy Artillery For The Little Guy
Premium Member
join:2000-01-17
Tulsa, OK

KrK to battleop

Premium Member

to battleop
Guess it's a good thing they have domestic drone program, then.

tshirt
Premium Member
join:2004-07-11
Snohomish, WA

tshirt

Premium Member

Re: Eight miles away?

Beware what the Amazon drone brings for you
intok (banned)
join:2012-03-15

intok (banned) to battleop

Member

to battleop
You have heard of balloon "satellites" and drones right? I'm sure the NSA, with their infinite budget could whip something up. Remember, they aren't bound by FCC regulations or the size constraints of the rinky dink antennas on consumer gear to pick up the signal.

battleop
join:2005-09-28
00000

battleop

Member

Re: Eight miles away?

I've also heard they can control some people's minds with their secret mind ray.

Yea maybe they can do that but again it's not going to go unnoticed. Following FCC regulations would make it more difficult to find than if they are using much higher power than what the FCC allows. Even if they had a million watt 2.4Ghz transmitter that does not mean they can just push a button and infect any PC on a wireless network they wish. There is no universal NSA only exploit that covers every wireless device ever made. If it did exist hackers would have discovered it or someone would have blown a whistle by now.

azzo
@dodo.com.au

azzo to morbo

Anon

to morbo
It got me thinking that a cantenna using a 55 gallon (steel) drum should reach 5 miles easily

Anonymous_
Anonymous
Premium Member
join:2004-06-21
127.0.0.1

Anonymous_

Premium Member

Re: Eight miles away?

Click for full size
said by azzo :

It got me thinking that a cantenna using a 55 gallon (steel) drum should reach 5 miles easily

Bigger is better might as well use one of these guys

I think you can get 30 miles with that

tshirt
Premium Member
join:2004-07-11
Snohomish, WA

tshirt

Premium Member

Re: Eight miles away?

those I think you drive right up to the building and physically disrupt the network
tshirt

tshirt to azzo

Premium Member

to azzo
Go the other direction, a 1"pipe would give better range...aiming might be really hard.
Sort of a shotgun cantenna
intok (banned)
join:2012-03-15

intok (banned) to morbo

Member

to morbo
Yeah, I remember reading about mods to the little TV satellite dishes that could get 10 miles out of any router, this was published when the "Pringtenna" coffee can and wifi sniper stuff was all the rage a few years back.
Crookshanks
join:2008-02-04
Binghamton, NY

Crookshanks to battleop

Member

to battleop
said by battleop:

Maybe under the most perfect of conditions but generally I call bullshit.

You've never played around with high gain antennas, have you?

We used to use these when I worked for the WISP. With one of those on ONE end of the connection it was trivial to get a solid association at 4 or 5 miles distance.

One time I was in the field doing a site survey, when my laptop automatically connected to my HOME wi-fi network, which was nearly six miles away as the crow flies. I was using an antenna similar to the aforementioned one on my laptop, while the AP at home had the standard rabbit ear antennas on it. There are a clear LOS, except for a row of trees in our backyard, so that was doubtless a factor. Still, I hadn't MEANT to do it, it just connected automatically, which surprised the hell out of me. Connection was solid enough to use and surf the web too....

Put one of those antennas on both ends of the connection and you can go 20+ miles with a clear LOS. Obviously not relevant for the NSA when trying to hack, but it's a great example of how much you can do with very little transmit power if you've got the right antenna.

battleop
join:2005-09-28
00000

battleop

Member

Re: Eight miles away?

I spent 10 years working for a WISP. I've messed with plenty of high gain antennas none of which will fit in the pictured case. Even with the highest gain antennas 2.4 / 5.8 won't do shit when you try and pass through objects.

'Put one of those antennas on both ends of the connection and you can go 20+ miles with a clear LOS"

With clear LOS I've done links out to 35 miles which is really nothing special in the WISP industry. I think the record line of site is beyond 100 miles.
Crookshanks
join:2008-02-04
Binghamton, NY

1 edit

Crookshanks

Member

Re: Eight miles away?

said by battleop:

I spent 10 years working for a WISP. I've messed with plenty of high gain antennas none of which will fit in the pictured case. Even with the highest gain antennas 2.4 / 5.8 won't do shit when you try and pass through objects.

Guess you looked at the pictures without bothering to read the text. Let me help you, I will add emphasis to the key parts so you don't have to read all 29 words:

"Use of external amplifiers and antennas in both experimental and operational scenarios have resulted in successful NIGHTSTAND attacks from as far away as eight miles under ideal environmental conditions."

battleop
join:2005-09-28
00000

battleop

Member

Re: Eight miles away?

Do you have any REAL proof it exists? This entire conversation is hypothetical anyways because no one can prove it even exists.

KrK
Heavy Artillery For The Little Guy
Premium Member
join:2000-01-17
Tulsa, OK

KrK

Premium Member

Re: Eight miles away?

Only the NSA's only words and documents.

Depends on whether you consider them reliable source or not.
If anything, they will understate their capability.

battleop
join:2005-09-28
00000

battleop

Member

Re: Eight miles away?

No one could ever fake documents to drive traffic to their site.
Crookshanks
join:2008-02-04
Binghamton, NY

Crookshanks to battleop

Member

to battleop
Again, READ THE DOCUMENTS.

They aren't claiming to be capable of doing anything that you and I can't do with readily available open source tools. In fact, the document even states that the laptop runs Fedora.

All they've done here is pre-package those tools into a system that was likely designed to be used by field agents who may not be as technically inclined as the geeks back at HQ. Hell, they might even have a cellular and/or satellite uplink, allowing the geeks back at HQ to actually control the thing after the field guys get it into position.

There's nothing outlandish about what they're claiming to do with this system. I don't know why you refuse to see that. Stick your head in the sand if that makes you feel better, it's a moot point anyway. If NSA is still using this it's aimed at foreign actors, not Americans, so it's really irrelevant to our daily concerns.

battleop
join:2005-09-28
00000

battleop

Member

Re: Eight miles away?

I'm not saying none of its true. I don't see the NSA being able to target any network they want at 8 miles. Closer distances sure but not 8 miles.
Crookshanks
join:2008-02-04
Binghamton, NY

Crookshanks

Member

Re: Eight miles away?

You're just clinging to that 8 mile figure, aren't you?

One last time: READ THE DOCUMENTS.

They claim to be able to accomplish this at distances up to eight miles under ideal environmental conditions.

Those are two big caveats. What are ideal conditions? Say the target AP is located near a window (or better yet, it's outdoors) and you have a clear LOS to their building. Eight miles is easily achievable in that scenario, using inexpensive off the shelf hardware.

battleop
join:2005-09-28
00000

battleop

Member

Re: Eight miles away?

So let's revisit my original comment.

"Maybe under the most perfect of conditions but generally I call bullshit."

Kind of sounds like what you are saying.

KrK
Heavy Artillery For The Little Guy
Premium Member
join:2000-01-17
Tulsa, OK

KrK to battleop

Premium Member

to battleop
Well just because you refuse to believe it, then it must not be true, eh?

battleop
join:2005-09-28
00000

battleop

Member

Re: Eight miles away?

Oh yea I forgot. If it's on the internet it's got to be true.
macmouse
Premium Member
join:2002-05-30
Carlsbad, CA

macmouse to battleop

Premium Member

to battleop
The United States record record is 125 miles within part 15 limitations.

Sweden Space agency managed to pull off 260 miles using 6 watt power amplifiers (which is several times unlicensed part 15 use).

I'm sure if they had a receiver on an aircraft (or satellite) pointing at the house from above, it would be fairly easy to achieve Line of Sight.

I'm pretty sure 8 miles is a rather conservative estimate of what can be done, under the right conditions and an enormous budget.

Sleep tight America.

battleop
join:2005-09-28
00000

battleop

Member

Re: Eight miles away?

That's LOS mountain top to mountain top using old TVRO dishes for antennas.
floydb1982
join:2004-08-25
Kent, WA

floydb1982 to battleop

Member

to battleop
The ASUS RT-N66U Router I have uses 2 separate password for 2.4GHz & 5GHz. Also uses 6 separate guest passwords. Let see the NSA hack in to my router now.
floydb1982

floydb1982 to battleop

Member

to battleop
Just switch to a wired router then lets see the NSA try to hack it. Problem solved.
intok (banned)
join:2012-03-15

intok (banned)

Member

Re: Eight miles away?

said by floydb1982:

Just switch to a wired router then lets see the NSA try to hack it. Problem solved.

Too late apparently »slashdot.org/topic/datac ··· shipped/

Yucca Servic
join:2012-11-27
Rio Rancho, NM

Yucca Servic

Member

Reverse it

8 miles away? It's possible but not with the omni antenna in the picture. On the other hand reverse can happen to the attacker.
Maybe the NSA just wants to watch the porn you are watching. Most of what humans do is so boring the person using the device would go insane.

••••••••••••••

Camaro
Question everything
Premium Member
join:2008-04-05
Westfield, MA

Camaro

Premium Member

So what.

Backtrack/Kali Linux can do all that for a hell of a lot cheaper then that box, albeit not 8 mile range, but like people have suggested a few amps tuned right on the 2.4GHZ, 5GHZ frequency range would probably work.

Remember people now matter how smart you think you are their will be always be someone smarter, never underestimate anything.

••••

SimbaSeven
I Void Warranties
join:2003-03-24
Billings, MT
·StarLink

SimbaSeven

Member

Easy fix..

..just use WPA2 along with OpenVPN. If they break through WPA2, it'll take them a bit longer to crack the OpenVPN key.

But, if there is an exploit hole in the driver or stack itself, there could be an issue even with utilizing advanced encryption.
intok (banned)
join:2012-03-15

intok (banned)

Member

Re: Easy fix..

Apparently they don't need to as they have already rooted the firmware »slashdot.org/topic/datac ··· shipped/

TWC_User
join:2013-07-31
Los Angeles
·AT&T U-Verse
·Time Warner Cable
(Software) pfSense
Humax BGW320-500
TP-Link EAP610

TWC_User

Member

Solution, don't use wifi...

If the NSA does hacked into advanced encryptions like WPA2, might as well turn off your router and have a direct connection from your modem to your computer instead. Well this option might anger your rest of your family, but this is the best solution.
Crookshanks
join:2008-02-04
Binghamton, NY

Crookshanks

Member

Re: Solution, don't use wifi...

I hate to break it to you, but you're not important enough to be on NSA's radar, and if you were for some reason you'd have bigger problems than your wi-fi network....

Want me to enhance your paranoia? Wired connections are no guarantee against eavesdropping. Google "TEMPEST" and start reading.

OMGZ, they're coming to get us!

w0g
o.O
join:2001-08-30
Springfield, OR

w0g

Member

Re: Solution, don't use wifi...

True, they could tap a telephone line or Ethernet cable from space or other remote location with nearly limitless range.
w0g

w0g

Member

NSA can hijack WiFi from 22369 miles..

NSA has a ton of ELINT satellites that can intercept WiFi from space.

And they are up in orbit, 22369 miles high...

More info on this here: »www.oregonstatehospital. ··· ebl.html
tmc8080
join:2004-04-24
Brooklyn, NY

tmc8080

Member

have his all wrong..

they do not need to hack the wifi... when they know the location (or user, if mobile device), they're tapping the internet connection at the ISP level and more likely getting at the site's machines that way. so, 8 or 80 miles makes no difference.. you are all looking at the wrong picture in the magic show.

The average person still does not know after all the leaks what the true capabilities are..
downloading a calling "metadata" log is but one needle in a haystack of tools which have been developed since the early 1990s .. barely the infancy for dialup residential internet..
By the mid 1990s, phone systems had well begun conversion of copper wire phone calling to digital multiplexing and fiber optic long hauls while much of the last mile was still copper. That didn't matter.. those systems weren't just designed to save money....
think beyond the infrastructure as equipment and it's macro usage.

w0g
o.O
join:2001-08-30
Springfield, OR

w0g

Member

Re: have his all wrong..

It makes no difference to them whether its dumped or hacked into at ISP level, or by using satellites or other remote sensing device. They as an individual agent may or may not have access to full capability, plus doing so wirelessly or with a WiFi sniffing device means the spying can't be traced as easily. They don't like to leave a trace on people they have targeted, in their system or anothers. That is the point of having all these close range devices that can do it for cheaps on top of official means. Lots of black ops abuses going on out there, too, for no official means. They are just radical spies radically out of control with who they tap and harass.

Parry
@comcast.net

Parry

Anon

No mention of parametric arrays?

It seems that you could avoid a lot of the interference problems with the right infrastructure (or a lot of vans).