MoWireless MoProblems: Modular Wireless Survey Sys. & Data Analytics

MoWireless MoProblems: Modular Wireless Survey Sys. & Data Analytics

Speakers: G Horvath, Founder, Alsatian Consulting; W Tam, Software Development, Uplinx LLC

Conference: DEF CON 32

YouTube: https://www.youtube.com/watch?v=jrlvMXfftec

Overview

In the rapidly expanding landscape of wireless technologies, comprehensive data collection and analysis have become increasingly complex. The DEF CON 32 talk "MoWireless MoProblems: Modular Wireless Survey Sys. & Data Analytics" by Jeff Horvath and Winston Tam addresses this challenge head-on. Horvath, a seasoned intelligence officer and cyber security consultant, and Tam, an experienced network engineer and software developer, unveiled their innovative solution: the Signal Processing and Reconnaissance Kit Yellow (SPARKY Yellow). This modular, distributed system is designed to collect vast quantities of wireless data across multiple spectrums, overcoming the limitations of traditional, monolithic collection platforms.

The talk highlights the critical need for scalable and robust wireless reconnaissance capabilities, moving beyond basic Wi-Fi scanning to encompass Bluetooth, cellular, and software-defined radio (SDR) signals. Horvath and Tam demonstrate how their custom-built hardware, powered by Raspberry Pi 5s and an array of specialized wireless adapters, efficiently captures diverse wireless emissions. This raw data is then funneled into a sophisticated analytics platform built on the ELK Stack (Elasticsearch, Logstash, Kibana), enabling powerful visualization and analysis, particularly for geospatial mapping of wireless environments.

The significance of this work lies in its practical approach to a pervasive problem. By modularizing the collection process, the speakers offer a blueprint for security professionals, researchers, and enthusiasts to build scalable systems capable of mapping and understanding the intricate wireless ecosystems around them. This not only aids in identifying potential vulnerabilities and rogue devices but also provides a deeper understanding of the electromagnetic spectrum's operational picture, making it invaluable for both offensive reconnaissance and defensive posture assessment.

Background

▶ Watch: Introduction: Talk title and speakers' backgrounds (0:00)

The genesis of SPARKY Yellow stemmed from Jeff Horvath's personal passion as a "wireless nerd" and his frustration with the limitations of existing wireless data collection methods. His initial ambition was to collect "all of the channels, all the packets, get all the things" using a single, powerful computer. However, this monolithic approach quickly encountered significant hurdles.

The primary challenges revolved around form factor and power consumption. To integrate the necessary number of wireless adapters for comprehensive spectrum coverage (e.g., 13 Alpha NH cards, 13 MediaTek Alpha cards, a Wi-Fi 6 card, and 5 RTL-SDRs) into one machine would result in an impractically large and power-hungry device, severely hindering portability. Furthermore, the sheer number of peripheral devices would overwhelm a single operating system, leading to excessive RAM requirements and a system that, despite its power, could only perform a limited number of tasks efficiently.

Beyond collection, the subsequent analysis of such vast datasets proved equally problematic. Horvath found that the enormous volume of data generated by even a one-hour run, listening to every Wi-Fi channel, would "choke" conventional analytic tools. Software like Google Earth, QGIS, and Wireshark struggled to process these large files, often requiring data stripping (leading to missed information) or resulting in incomplete datasets. This bottleneck in analysis highlighted the need for a completely new approach, not just to collection but also to the processing and visualization of the gathered wireless intelligence. The solution, as discussed in a casual conversation between Horvath and Tam, evolved into a modular collection system paired with a robust, scalable data analytics platform.

Key Findings

▶ Watch: Introducing 'SPARK Y': The modular wireless survey system (3:10)

The central innovation presented in this talk is the Signal Processing and Reconnaissance Kit Yellow (SPARKY Yellow), a modular and distributed wireless data collection system designed to overcome the limitations of single-device setups. The key findings and contributions can be summarized as follows:

1. Modular Collection Architecture: SPARKY Yellow employs multiple Raspberry Pi 5s, each dedicated to collecting data from specific wireless bands or technologies. This distributed approach significantly reduces the memory and processing requirements on any single device, enabling comprehensive, wide-spectrum collection that is both portable and robust.
2. Comprehensive Spectrum Coverage: The system is engineered to capture a wide array of wireless signals, including various Wi-Fi bands (2.4 GHz, 5 GHz, and Wi-Fi 6), Bluetooth Low Energy (BLE), and cellular parameters. The inclusion of Software-Defined Radios (SDRs) further extends its capability to monitor other RTL 433 compatible devices, providing an expansive view of the electromagnetic environment.
3. Enhanced Robustness and Scalability: By distributing collection across multiple Raspberry Pis, SPARKY Yellow gains inherent robustness. If one collection device or file encounters an issue, the overall mission continues, minimizing data loss. Moreover, the modular design facilitates easy scalability; new Pis can be added with new adapters to integrate additional wireless technologies as interests or requirements evolve.
4. Efficient Data Handling: The modular design naturally results in smaller, more manageable individual data files from each Raspberry Pi. This addresses the critical problem of large data volumes that previously overwhelmed conventional analytic tools, paving the way for more efficient backend processing.
5. Powerful Data Analytics with ELK Stack: The talk introduces the ELK Stack (Elasticsearch, Logstash, Kibana) as the chosen analytics platform for processing, visualizing, and mapping the collected wireless data. This open-source-ish solution provides a flexible and scalable framework for transforming raw wireless captures into actionable intelligence, particularly for geospatial visualization, allowing users to "put dots on maps."

These findings collectively demonstrate a practical and effective methodology for large-scale wireless reconnaissance, moving beyond mere scanning to comprehensive, multi-modal signal intelligence gathering and analysis.

Technical Deep Dive

▶ Watch: SPARK Y hardware and software components breakdown (3:50)

The technical core of "MoWireless MoProblems" lies in two distinct yet interconnected components: the SPARKY Yellow collection rig and the ELK Stack analytics platform.

SPARKY Yellow: The Modular Collection System

SPARKY Yellow is built on the principle of distributed processing to overcome the physical and computational limitations of single-device wireless collection. The hardware comprises:

• Compute Units: Three individual Raspberry Pi 5s serve as the brains for data collection. The speakers note that Raspberry Pi 2s could handle 13 wireless cards simultaneously, so the Raspberry Pi 5 provides more than ample power.
• Wi-Fi Adapters:
• Thirteen Alpha NH cards: These are likely high-power, versatile Wi-Fi adapters known for their monitor mode capabilities.
• Thirteen MediaTek Alpha cards: Another set of robust Wi-Fi adapters.
• One Wi-Fi 6 card: Included to capture newer Wi-Fi standards, though the speakers noted its limited prevalence in current environments.
• SDRs: Five RTL-SDRs are integrated to scan for RTL 433 compatible devices, expanding the collection capabilities beyond standard Wi-Fi and Bluetooth to various Internet of Things (IoT) and other low-power wireless protocols (e.g., garage door openers, weather stations).
• Bluetooth and Cellular Collection: Four Android phones are utilized, running specialized applications:
• Wigle: A popular tool for mapping wireless networks (Wi-Fi and cellular).
• GNet Track Pro: Used specifically for gathering detailed cellular parameters, including the connected cell tower, active frequencies, signal strength, and estimated distance from the tower.
• Physical Housing: All components are neatly organized within REI tailgate gear cubes, which are then stored in a portable REI tailgate gear bin, emphasizing the system's intended portability and field deployment.

The modular design provides several critical advantages:

• Reduced RAM Requirements: By distributing devices across multiple Raspberry Pis, the RAM strain on any single unit is significantly lessened.
• Robustness: Failure of one collection unit does not compromise the entire mission, as other units continue to collect data. This redundancy enhances operational reliability.
• Smaller Files: Each Pi generates smaller, more manageable data files, which are easier to transfer and process compared to a single, massive aggregate file.
• Scalability: As new wireless technologies emerge, additional Raspberry Pis and specialized adapters can be seamlessly integrated into the system, ensuring future-proofing.
• Headless Operation: The system is designed for "fire and forget" headless collection, meaning it operates without a graphical user interface (GUI) or live processing requirements, focusing solely on efficient data capture.

Time Synchronization: A crucial aspect of merging data from multiple sources is accurate time synchronization. The Raspberry Pis obtain their initial time from an NTP server upon connection. An RTC battery (Real-Time Clock) then maintains timekeeping, ensuring that even with minor deviations of a few seconds, the data remains sufficiently synchronized for the intended analytical purposes, which do not require exact one-to-one correlation down to the millisecond.

ELK Stack: The Analytics Platform

Winston Tam's contribution focuses on the analytics platform, primarily leveraging the ELK Stack, an "open-source-ish" suite of tools for real-time data collection, search, and visualization.

• Logstash (L): This is the ingestion pipeline, responsible for collecting data from various sources (Kismet, Wigle, Airdump, and other formats), processing it, and forwarding it to Elasticsearch. Logstash's role is critical for converting raw capture files into a structured format suitable for analysis.
• Elasticsearch (E): A distributed, RESTful search and analytics engine. Logstash pushes the processed data into Elasticsearch indexes, where it is stored and tagged. This allows for rapid searching, filtering, and aggregation of vast datasets.
• Kibana (K): The visualization layer of the ELK Stack. Kibana connects to Elasticsearch to create interactive dashboards, charts, and, crucially for this project, geospatial maps. The primary objective is to make it easy to "put dots on maps" and provide flexible visualization options.

The data analytics workflow involves five key steps:

1. Stand up a copy of ELK: Deploying the Elasticsearch, Logstash, and Kibana services, often in a Dockerized environment (as hinted by the mention of "Elk Ninja for the work on the dockerized version of elastic").
2. Convert the files: Transforming raw data formats from tools like Kismet, Wigle, and Airdump into a format digestible by Logstash.
3. Normalize the data fields: Ensuring consistency in data types and field names across different sources to facilitate unified analysis.
4. Tell ELK how to use that data: Configuring Elasticsearch mappings and Logstash pipelines to correctly interpret and index the normalized data.
5. Provide a mapping background: Integrating a geographical map layer within Kibana to visualize the collected wireless data points in a spatial context.

This integrated system of modular collection and powerful analytics provides a robust framework for understanding complex wireless environments at scale.

Demo / Proof of Concept

▶ Watch: Benefits of modular design: memory, robustness, scalability (4:30)

While the talk did not describe a live, real-time demonstration of the SPARKY Yellow system in action, the speakers clearly articulated its functional capabilities and the intended output. The objective of the analytics platform, as stated by Winston Tam, is to "put dots on maps" and enable various visualizations. The presentation likely included static images or pre-recorded demonstrations of Kibana dashboards displaying the geospatial mapping of collected wireless data, showing how different access points, Bluetooth devices, or cellular towers appear on a geographical interface.

The emphasis was on the result of the data processing – the ability to easily render a visual representation of wireless activity in a given area. This conceptual demonstration would have showcased the power of the ELK Stack in transforming raw, complex wireless data into intuitive, actionable intelligence, fulfilling the goal of providing a clear operational picture of the wireless spectrum. The speakers also acknowledged borrowing "a lot of his pictures for this amazing presentation" from "Monkey User," further suggesting that the visual proof of concept relied on pre-prepared imagery rather than a live, on-stage system interaction.

Defensive Implications

▶ Watch: Transition to Winston Tam: Data analytics and processing (6:00)

The modular wireless survey system and data analytics platform presented by Horvath and Tam offer significant defensive implications for organizations and security professionals. Understanding an organization's wireless footprint is a critical component of a robust security posture, and SPARKY Yellow provides an unparalleled capability to achieve this.

1. Rogue Device Detection: By continuously surveying Wi-Fi, Bluetooth, and SDR spectrums across a physical area, defenders can readily identify unauthorized access points, rogue Bluetooth beacons, or unapproved IoT devices operating within their environment. This is crucial for preventing unauthorized network access or data exfiltration.
2. Wireless Attack Surface Mapping: The system allows for a detailed mapping of all wireless emissions originating from or entering an organization's premises. This helps in understanding the true wireless attack surface, identifying potential vulnerabilities, and assessing the effectiveness of existing wireless security controls.
3. Cellular Threat Monitoring: The ability to collect cellular parameters (tower IDs, frequencies, signal strength) can aid in detecting anomalies such as rogue cell towers (IMSI catchers/Stingrays) or localized cellular jamming attempts, which could be used to disrupt communications or facilitate other attacks.
4. IoT Device Inventory and Security: With SDR capabilities, organizations can identify unknown or unmanaged IoT devices communicating on common frequencies (like 433 MHz). This is vital for maintaining a comprehensive asset inventory and ensuring that all wireless-enabled devices comply with security policies.
5. Baseline Establishment and Anomaly Detection: By collecting large datasets over time, organizations can establish a baseline of normal wireless activity. Deviations from this baseline—such as new Wi-Fi SSIDs, unusual Bluetooth device activity, or changes in signal patterns—can trigger alerts for further investigation, indicating potential security incidents or policy violations.
6. Physical Security Enhancement: Understanding the density and reach of wireless signals around sensitive areas can inform physical security measures. For instance, knowing how far Wi-Fi signals extend beyond a building's perimeter can highlight potential eavesdropping risks.
7. Incident Response and Forensics: In the event of a wireless security incident, historical data collected by SPARKY Yellow can provide crucial forensic evidence, helping to reconstruct events, identify the source of an attack, and understand its scope. The geospatial mapping capabilities are particularly useful for pinpointing the physical location of malicious activity.

In essence, SPARKY Yellow, combined with the ELK Stack, empowers defenders with a panoramic view of their wireless environment, transforming an often-invisible attack vector into a transparent and manageable domain for proactive security management.

Key Takeaways

• Modular Design Overcomes Traditional Limitations: SPARKY Yellow's distributed architecture, utilizing multiple Raspberry Pi 5s, effectively resolves issues of form factor, power consumption, OS overhead, and data volume that plague monolithic wireless collection systems.
• Comprehensive Multi-Spectrum Collection: The system captures a wide array of wireless data, including Wi-Fi (multiple bands, Wi-Fi 6), Bluetooth BLE, cellular parameters (via Android phones with Wigle/GNet Track Pro), and various IoT/RTL 433 devices (via SDRs).
• Enhanced Robustness and Scalability: Distributing collection across multiple devices increases system resilience against single-point failures and allows for easy expansion to incorporate new wireless technologies.
• ELK Stack for Powerful Analytics: The Elasticsearch, Logstash, Kibana (ELK) platform provides a robust, scalable solution for ingesting, processing, searching, and geospatially visualizing vast amounts of collected wireless data.
• Actionable Geospatial Intelligence: The primary objective of the analytics platform is to transform raw wireless data into clear, map-based visualizations, enabling security professionals to understand and act upon the physical distribution of wireless signals and devices.
• Proactive Defensive Capabilities: This system offers significant value for defenders by enabling comprehensive wireless footprint mapping, detection of rogue devices, monitoring for cellular threats, and establishing baselines for anomaly detection.

About the Speaker(s)

Jeff Horvath is a highly experienced security professional and the founder of Alsatian Consulting. He brings a strong background in intelligence, having served 13 years in the Army as an intelligence officer, with 10 of those years dedicated to special operations units. After his military career, he established Alsatian Consulting, which focuses on cybersecurity, digital signature reduction, and personal data protection for both private and public sector clients. Academically, Jeff holds a BA in Political Science from Drexel University and a Master's in Information Security Engineering from the SANS Institute, complemented by 10 GIAC certifications. He is also a self-proclaimed "huge wireless enthusiast."

Winston Tam is a software development expert with Uplinx LLC. His professional experience includes eight years in the Navy, where he specialized in network engineering, penetration testing, and red teaming, with four years in special operations. Following his military service, Winston spent three concurrent years as a commercial penetration tester for diverse clients, including banks, ISPs, and an Indian reservation with a .gov domain. He is also an avid DIY tinkerer, enjoys 3D printing, and describes himself as a "decent rock climber."