Wireless Reconnaissance in Penetration Testing This page is intentionally left blank Wireless Reconnaissance in Penetration Testing Matthew Neely Alex Hamerstone Chris Sanyk AMSTERDAM • BOSTON • HEIDELBERG • LONDON NEW YORK • OXFORD • PARIS • SAN DIEGO SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO Syngress is an Imprint of Elsevier Acquiring Editor: Chris Katsaropoulos Development Editor: Meagan White Project Manager: Mohanambal Natarajan Designer: Russell Purdy Syngress is an imprint of Elsevier 225 Wyman Street, Waltham, MA 02451, USA Copyright © 2013 Elsevier, Inc. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publisher’s permissions policies and our arrange- ments with organizations such as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions. This book and the individual contributions contained in it are protected under copyright by the Publisher (other than as may be noted herein). Notices Knowledge and best practice in this field are constantly changing. As new research and experi- ence broaden our understanding, changes in research methods or professional practices, may become necessary. Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information or methods described herein. In using such information or methods they should be mindful of their own safety and the safety of others, including parties for whom they have a professional responsibility. To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any liability for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in the material herein. Library of Congress Cataloging-in-Publication Data Application submitted British Library Cataloguing-in-Publication Data A catalogue record for this book is available from the British Library. For information on all Syngress publications visit our website at www.syngress.com ISBN: 978-1-59749-731-2 Printed in the United States of America 13 14 15 10 9 8 7 6 5 4 3 2 1 Dedication I’d like to start out by thanking Joan Amaratti for believing I could write a book all those years ago. I’d also like to thank Ken Stasiak and the SecureState family for supporting me throughout the entire writing process. Finally I dedicate this book to Meagan Call for being a wonderfully supportive wife through this and all my projects. --Matt I dedicate this book to BNH, ELH, and JAH. --Alex v This page is intentionally left blank Contents DEDICATION .............................................................................................. v AUTHOR BIOGRAPHY ..............................................................................xi PREFACE ..............................................................................................xiii Chapter 1 Why Radio Profiling? ............................................................. 1 Guard Radios, Wireless Headsets, Cordless Phones, Wireless Cameras, Building Control Systems ................................ 3 Case Study ........................................................................................ 5 Chapter 2 Basic Radio Theory and Introduction to Radio Systems .... 7 The Electromagnetic Spectrum ....................................................... 7 Terminology .................................................................................. 8 Wavelength/Frequency Characteristics ................................... 11 How Materials Affect Radio Waves .......................................... 13 Regulatory Agencies ...................................................................... 14 Applying the Science: Radio Technology Basics ......................... 15 Filters .......................................................................................... 20 Antennas ......................................................................................... 22 Antenna Theory ......................................................................... 23 Signal Strength ........................................................................... 25 Antenna Diagrams ..................................................................... 25 Popular Types of Antennas ....................................................... 26 Modulation ...................................................................................... 29 Analog Modulation .................................................................... 30 Digital Modulation ..................................................................... 31 Common Types of Spread Spectrum Modulation .................... 33 Radio Systems ................................................................................ 34 Simplex and Duplex ................................................................... 34 Repeaters .................................................................................... 35 Media Access Control in Radio ................................................. 36 Trunking ..................................................................................... 38 Summary ......................................................................................... 42 vii viii Contents Further Learning ............................................................................ 43 Chapter 3 Targets .................................................................................. 45 Two-Way Radios Used for Verbal Communication...................... 45 Devices that Use Radio Frequencies ............................................ 46 Chapter 4 Offsite Profiling .................................................................... 49 What is Offsite Profiling? ............................................................... 49 What to Look For ........................................................................ 49 Using RadioReference.com for Offsite Profiling ...................... 53 Case Study: Offsite Profiling ......................................................... 55 Remediation and Lessons Learned .......................................... 62 Chapter 5 Onsite Radio Profiling ......................................................... 65 Initial Onsite Reconnaissance ....................................................... 65 The Guard Force ............................................................................. 66 Using a Frequency Counter ........................................................... 67 Visual Recon ................................................................................... 73 Antennas .................................................................................... 75 Search Common Frequency Ranges ............................................. 76 Family Radio Service (FRS)........................................................ 76 General Mobile Radio Service (GMRS) ..................................... 77 Multi Use Radio Service (MURS) ............................................... 78 Dot Frequencies ......................................................................... 78 Common Ranges ............................................................................ 79 Common Business Ranges ........................................................ 79 Common Cordless Phone and Headset Ranges ...................... 80 Scanner Tips ................................................................................... 80 Finding Trunked Systems.............................................................. 80 Case Study: Onsite Profiling ......................................................... 81 Remediation and Lessons Learned .......................................... 85 Chapter 6 How to Use the Information You Gather ........................... 87 Who is Guarding the Guards? ....................................................... 87 Monitoring Phone Calls ................................................................. 88 Wireless Cameras ........................................................................... 89 Pan Tilt Zoom (PTZ) Cameras ................................................... 89 Chapter 7 Basic Overview of Equipment and How it Works............. 91 Common Scanner Controls and Features ..................................... 91 Channels and Banks .................................................................. 91 Squelch ........................................................................................ 92 Scan Button................................................................................. 92 Hold Button................................................................................. 92 Contents ix Manual Button ............................................................................ 93 Program ....................................................................................... 93 Lockout Button ........................................................................... 93 Search .......................................................................................... 93 Priority........................................................................................