Tools for Android: WiGLE

Hi! I hope you're having a good weekend. Here's some more wireless and Android for you!

If you've ever started to even think about hacking WiFi, then you may have heard of wardriving and warchalking. If not, you've probably at least thought of the concept before. Warchalking is the practice of identifying wireless networks and marking areas around where the signal was found (be it on the side of a building, on the ground, you name it) and letting hackers or otherwise know about its existence and whether or not there's any security to it. Wardriving on the other hand, is driving around and identifying networks with high power antennas, collecting data such as channel, average signal strength, security type, or if it's an open network. This data can then be used to identify targets.

Today, there's an amazing place called WiGLE. Here, tons of people have gone around, collected information about networks, and uploaded it to a database on the site. You can even host your own local database. Now you may be thinking, how is this allowed? I'll be honest. I don't know all the details or legalities when it comes to the collection of this data. However, I can tell you it does have its ethical uses. I'll give you a scenario. Say you have a known malicious actor, you've successfully exploited their mobile device or laptop, and have a program feeding you some data. Some of that data is MAC addresses of access points or BSSID. As I mentioned before, WiGLE has a database full of wireless networks and information about them. All you have to do is plug in that MAC/BSSID and if it's ever been scanned and uploaded, you'll be able to identify an area your target is located in.

Another idea for you, say you want to identify what channels your neighbors are operating on so you can configure yours to eliminate interference. Or, you want to be proactive and identify which neighbors have weak security on their APs so that you can educate them. Sounds great, right? Well, as the new age saying goes, there's an app for that. So pull out your Android device and download WiGLE from your preferred app store.

Usage

As you may already be able to tell, WiGLE has many useful features, and their mobile app is no different. Once you've got it installed, go ahead and launch it. You should see something like this:

Lot's of useful information here! First, at the top, notice you have a latitude, longitude, and altitude. Then go down to the networks, the green lock signifies WPA2 is being utilized (it's also stated underneath the hardware name). Under the lock, you'll see signal strength, then the MAC/BSSID, channel, and technologies in use. This app has also been updated in the past few years to identify Bluetooth and BLE signals as well as mobile cell towers!

Alright, now tap the bar menu at the top left, go to settings and sign in/register for an account. Once that's done you can search their database. From here, you can search for all access points with the name "walmart" or anything else you can think of.

From here you can even get a location where the networks are identified, try it out!

You may have also noticed that you can search by BSSID, I've identified a network with the BSSID of 00:13:10:d3:f5:be that is probably trying to trick people into connecting to it. Take a look:

Notice the typo here. Now it could be as simple as that, but I'm going to air on the side of caution and say it's not.

WiGLE's website is also an incredible resource for CTF's! Anyways, I hope you've enjoyed this little review. Be responsible, have fun!