Chumby Wifi Sniffer

April 7th, 2008

For ETech08, I built the “Chumby Tower” and one of the hacks featured in the tower is a version of the chumby that sniffs wifi and renders captured packets onto the display. The chumby is a great device for passively monitoring wifi signals, because it has a screen for rendering the data real-time, sufficient CPU power to do the data processing, and it’s cheap enough that you don’t mind dedicating it to that application. It’s handy, for example, to see if your neighbors are stealing your wifi link to surf the web; at a glance you can see what URLs are going by over the air.


Someone has their RSS feed reader set to wowinsider.com… ;-)

The sniffer application sets the wifi radio in the chumby to monitor mode, so it picks up any and all packets on the selected channel. The application then relies on a cross-compiled version of tshark and dumpcap to capture 802.11 packets in raw form. The dumps are processed with a perl script that identifies certain headers and keywords that delimit strings of interest. These strings are then output in an XML container, which is then read by a Flash movie and rendered to the screen. You can adjust what interesting strings are selected by modifying the perl script. Currently, the script just extracts http link strings, To/From/Subject of unencrypted POP mail, and HTML page titles and headers. However, it’s fairly easy to extend the script to do things like capture plaintext username/password pairs that are transmitted over wifi, which happens surprisingly often.

For those who just want to use the sniffer, you can download this zipfile and extract it to a blank USB drive, plug it into a chumby, reboot, and when the chumby comes back it should be running the application. At the point where the screen goes dark, it will take up to a minute for data to start appearing, as it takes about 20-30 seconds for the huge tshark executable to load (depending upon the performance of your USB drive), and then the script pools data over a few sampling periods before reporting summary information. For those who wish to hack the program a bit, here is a link to the Flash movie—it’s the only piece of code in the zipfile that isn’t available in source form some other way.

The default frequency of the radio will be the last frequency used, but you can add a line to the “userhook2” perl script right after monitor mode is set to configure the channel explicitly:

iwconfig rausb0 channel 3   # set channel number to desired number

The script is a little bit fragile, in that every time the firmware is updated something seems to break. I just repaired the script to work with firmware version 1.5, but let me know if you use the script and it doesn’t seem to work. Unfortunately, the only way to debug the script is via the serial port, because setting the wifi card in monitor mode makes it unable to transmit packets — although if you’re really clever you can hack the script to load drivers for a wired ethernet USB dongle and connect to the chumby via that interface.

For what it’s worth, cross-compiling tshark is a total pain in the butt. The make scripts really weren’t very friendly to the task, I had to do a lot of manual operations to facilitate the build. For example, it doesn’t differentiate between binaries that run on the host versus binaries that run on the target, so some helper programs meant to run on the x86 host would get complied to ARM (doh!); those cases had to be tweaked manually to get the whole thing to build right.

Name that Ware March 2008

April 7th, 2008

The Ware for March 2008 is shown below. Click on the photo for a much larger version.

Sorry about the tardiness of this months’ competition — spent the last 3 weeks hopping around Asia on chumby business, and still trying to catch up! Thanks for your patience.

Winner of Name that Ware February 2008!

April 7th, 2008

The solution to the Ware from last month is shown below. Below is the schematic overlaid on the transistors, and then the schematic redrawn in a more recognizable form, highlighting the cross-coupled inverter pair that forms the core of a typical static CMOS storage element.

In this circuit, P1/N4 form the output driver/buffer. P2/P3 form the storage pair.

A more detailed analysis including a breakout of the connectivity in the context photo can be found in this PDF file.

The basic functionality of the device is probably a pulse stretcher, depending on how it’s connected to the rest of the circuit. The device is transparent while the enable is high, and in a memory state when D is low and enable is low. If the D is driven high while the enable is driven low, the device always goes to a 1 state, and stays in that state until the enable is high again while D is low, thus stretching out the pulse.

This device is part of an array that spans a spot between the random logic array and the RF section of a MIFARE RFID reader chip, specifically the MFRC530 by NXP. My best guess is that it’s part of an array that stores/processes baseband information coming back from the RF section of the IC. Shouts to Chris and Karsten for their help at looking at this device, and especially to Flylogic for providing the awesome photos! If you like looking at chipshots and silicon security, you seriously need to check out the Flylogic blog.

The quality of the entries for last months’ contest are all very high. Unfortunately, I can’t quite declare a winner yet, because I don’t have Sii’s plaintext or sto’s plaintext. Sto’s schematics are correct, and it does call out the memory function of the device, but Sii looks like the answer might be correct, and the post is earlier than sto’s. pablot could also have a correct schematic, but since an answer wasn’t specifically named, it’s currently down to who has the correct answer between Sii and sto; if Sii’s answer is correct, Sii wins; otherwise, sto wins because of the correct schematics posted.

Thanks for playing! Post your plaintext in the comments, and the winner will be named in the comments.

Name that Ware February 2008

March 9th, 2008

The ware for February 2008 is shown below. Click on any of the images for a larger version.

The past two Name that Wares were fairly easy, so I thought I’d make this one a little more challenging — and yes, this month I can offer again a dent-and-scratch chumby as the prize! This one involves silicon reading — for those unfamiliar with the art of reading silicon, check out May 2006’s name that ware and the primer post (has this competition really been going on for that long? I should make a picture calendar of past Name that Wares).

In the above photos, there is a single unit cell, replicated a few times, and the objective is to correctly name the function of the unit cell. There is sufficient information in the above micrographs to derive an exact schematic of the unit cell. The top photo is a zoomed-in version with all layers intact; the middle photo is a confocal image of the unit cells with all metal stripped back, revealing just the polysilicon gates. The bottom photos is an all-metal intact context photo for the unit cells. The photos are, as usual, decaped, delayered, and imaged by the skilled hands at Flylogic!

RSS Issues?

March 9th, 2008

I got a note today from a reader that my WordPress blog’s RSS feed outputs XML with invalid syntax. I’ve been unable to reproduce this bug; has anyone else encountered this?