McJumpBox Leveraging free corporate Wifi for fun/profit

Wi-Fi Wormhole: Leveraging Free Corporate Wi-Fi for Unattributed Fun and Profit

Speakers: Loaning, Self-Sponsored Weirdo

Conference: RF Village

YouTube: https://www.youtube.com/watch?v=RpkYQDaEKMo

Overview

In this engaging talk, "McJumpBox Leveraging free corporate Wifi for fun/profit," also known as "Wi-Fi Wormhole" to avoid potential trademark disputes, speaker Loaning delves into the fascinating and somewhat rebellious pursuit of creating untraceable, long-range internet connectivity. The core concept revolves around deploying a low-power device onto the roof of a building offering free public Wi-Fi – such as a McDonald's or Starbucks – and then connecting to that device from several miles away using a companion unit. This setup effectively creates a "wormhole" that provides internet access while geographically obfuscating the user's true location, making their online activities unattributable.

The inspiration for this project stems from a legendary, yet ultimately cancelled, Defcon talk years ago that promised to reveal such a device. Driven by the allure of untrackable internet, Loaning embarked on a multi-year journey to bring this concept to life, navigating the complexities of emerging wireless technologies and the frustrating landscape of developer hardware. The talk meticulously chronicles the trials, errors, and eventual triumphs in achieving this goal, culminating in a practical, albeit ethically ambiguous, solution for remote, anonymous network access.

This presentation is highly significant for both offensive and defensive security practitioners. For red teamers and privacy advocates, it outlines a viable method for establishing covert internet access that bypasses traditional attribution. For blue teamers and network defenders, it highlights a critical blind spot: the potential for adversaries to leverage public Wi-Fi infrastructure for long-range, undetectable operations using specialized hardware operating in the sub-gigahertz spectrum. Understanding the underlying technology and the practical implementation details is crucial for both exploiting and defending against such covert communication channels.

Background

▶ Watch: Introducing Wi-Fi Wormhole: Leveraging Free Corporate Wi-Fi (0:00)

The genesis of the Wi-Fi Wormhole project traces back to a captivating, yet ultimately unfulfilled, promise at an old Defcon conference. Years ago, a speaker was slated to present a device capable of being discretely deployed onto the roof of a building with free public Wi-Fi, like a McDonald's, and then accessed remotely from many miles away. The talk's sudden cancellation, shrouded in rumors ranging from speaker illness to intervention by three-letter agencies concerned about untraceable connectivity, left a lasting impression on Loaning. This sparked a long-term personal quest to realize the vision of leveraging low-power, long-range networks to establish significant geographic distance between a user and their internet connection's point of origin.

This aspiration, conceived nearly eight years prior to the talk, faced significant technological hurdles. However, the maturation of certain wireless standards and embedded hardware has now made such a project feasible. The foundational technology enabling this "wormhole" is 802.11ah, commonly known as Wi-Fi HaLow. Published as a full IEEE standard in 2017, HaLow operates in the sub-gigahertz (typically 900 MHz) frequency bands, offering a distinct advantage over traditional 2.4 GHz and 5 GHz Wi-Fi: greatly extended range and improved penetration through obstacles. Conceptually, HaLow is described as a downclocked version of 802.11a or 802.11g, but optimized for range rather than raw speed over short distances. It utilizes 26 channels, with base throughputs of 100 kilobits per second, but can combine channels to achieve data rates up to 347 megabits per second, a substantial speed for a protocol designed to work over "multiples of kilometers." Crucially for security, HaLow incorporates modern encryption standards like WPA3, supporting SHA-256, 384, and 512, which prevents spoofing of management frames.

Loaning, known for a history of ESP32-based projects like the International Wiggle Space Balloon, Wi-Fira, RF field cams, and even a toothbrush botnet, set out with clear "worm goals" for a Minimum Viable Product (MVP). The device needed to be capable of connecting to public 2.4 GHz Wi-Fi networks (e.g., Starbucks, McDonald's), be low-power for extended battery life, and incorporate a HaLow radio. Desirable "nice-to-haves" included solar panel integration for indefinite operation, 5 GHz Wi-Fi support, multi-client capabilities, and an Ethernet port. Critically, Loaning emphasized that the specifics of network topology—whether routing or bridging, DHCP server or requester—were secondary; the sole objective was to achieve end-to-end connectivity. The initial plan, in typical Loaning fashion, involved an ESP32 microcontroller, an 802.11ah radio, and "a bunch of hot glue."

Key Findings

▶ Watch: Project inspiration: Untrackable internet from a cancelled Defcon talk (2:41)

The journey to build the Wi-Fi Wormhole was fraught with hardware frustrations before reaching a successful, off-the-shelf solution and then a more cost-effective DIY alternative. Loaning's initial foray into commercial 802.11ah development boards revealed significant limitations:

1. Seed Studio Zho Board: This device, featuring a Quicktail-based HaLow chip and an ESP32 module, was physically small and seemed ideal for discreet deployment. However, it quickly became a source of "discontent." The primary issue was the lack of AP mode support within its ESP32 library, meaning it couldn't act as an access point, a critical requirement for the wormhole's client-side connection. Furthermore, it exclusively supported an outdated Expressif IDF from June 2023, hindering development and denying access to newer features and security updates. This rendered the Zho board unusable for the project's core functionality.

1. LilyGO T-Halo: Offering an ESP32, HaLow radio, Ethernet port, and an 18650 battery holder, the T-Halo initially appeared to be the perfect solution, even supporting both AP and station modes. However, its internal design proved "phenomenally unsensical." The device had two modes, switched by physically swapping tiny flash ROM chips. In "Mode 1," the HaLow radio connected to the ESP32 via a slow serial UART interface (9600 baud), severely bottlenecking the high-speed capabilities of 802.11ah. In "Mode 2," the Ethernet port connected directly to the HaLow radio, leaving the ESP32 "just riding along for fun" and completely disconnected from the network path. These design choices made the T-Halo practically useless for achieving high-throughput, long-range connectivity.

Undeterred, Loaning attempted a DIY workaround by adding more ESP32s and hot glue, connecting ESP32 Ethernet dev boards to the T-Halo's Ethernet port. While this "inception-level" approach did eventually achieve some end-to-end connectivity, the observed throughput was even worse than the serial UART bottleneck of the T-Halo's Mode 1, proving the DIY effort largely futile in terms of performance. The lack of 802.11ah monitor mode tools further complicated troubleshooting, making it difficult to diagnose issues in the RF environment versus code or library errors.

The turning point came with the discovery of the Heltec Halo dongle, hailed as "our lord and savior." This commercial product integrated a 2.4 GHz Wi-Fi radio, a 900 MHz HaLow radio, an Ethernet port, and a USB-C port that also functioned as an Ethernet gadget. Crucially, it "just works" out of the box, requiring minimal configuration rather than custom firmware development. Loaning successfully established a Wi-Fi wormhole using two Heltec dongles, achieving a maximum range of 1.67 miles over the Mississippi River, limited only by the available line of sight, not the radio's capability.

Performance testing with a custom Android app revealed that while antenna orientation doesn't significantly affect throughput once a link is established, it is critical for maintaining the link at longer distances. It acts as a binary factor: either you have a connection or you don't, rather than a gradual degradation of speed.

Finally, driven by the $70 cost of the Heltec dongle, Loaning identified a cheaper DIY alternative. By combining an MT7628 MCU (which runs OpenWrt and costs around $15) with the same HC11390 HaLow module found in the Heltec device (approximately $25), a functional wormhole device could be built for roughly $40. This significantly reduces the cost of "network throwies," making them more disposable and appealing for covert deployment. The use of OpenWrt also provides substantial benefits, including flexible configuration without recompilation and access to powerful packages like TravelMate for captive portal bypass and iPerf for network testing.

Technical Deep Dive

▶ Watch: Defining 'Worm Goals': MVP and desirable features (4:08)

The technical foundation of the Wi-Fi Wormhole project lies in the 802.11ah (Wi-Fi HaLow) standard. This IEEE standard, published in 2017, operates in the unlicensed sub-gigahertz spectrum (typically 900 MHz in regions like the US). Unlike conventional Wi-Fi, HaLow is optimized for extended range and lower power consumption, making it ideal for IoT applications and, as demonstrated, long-range covert communication. It employs a downclocked version of 802.11a/g signaling, offering 26 channels. While a single channel might offer a modest 100 kilobits per second, channel bonding allows for a theoretical maximum throughput of 347 megabits per second over distances of "multiples of kilometers." Security is robust, incorporating WPA3 encryption with support for SHA-256, SHA-384, and SHA-512, which protects against management frame spoofing.

Loaning's initial hardware explorations highlighted the challenges of working with nascent technology. The Seed Studio Zho board, a compact device featuring a Quicktail-based HaLow chip designed to integrate with an ESP32 module, was conceptually promising. However, its critical flaw was the lack of AP mode support within its provided ESP32 library, which is essential for creating an access point on the client side of the wormhole. Furthermore, it mandated the use of an outdated Expressif IDF (specifically, the June 2023 version), complicating development and precluding the use of modern firmware features.

The LilyGO T-Halo represented another attempt, incorporating an ESP32, HaLow radio, Ethernet, and an 18650 battery holder. While it supported both AP and station modes, its internal architecture was severely flawed. The device operated in two distinct modes, requiring a physical swap of a flash ROM chip to switch between them. In "Mode 1," the HaLow radio communicated with the ESP32 solely via serial UART at a paltry 9600 baud. This serial link created an egregious bottleneck, rendering the HaLow radio's multi-megabit capabilities useless. In "Mode 2," the Ethernet port was connected directly to the HaLow radio, bypassing the ESP32 entirely, which was then effectively an inert component.

Faced with these design deficiencies, Loaning conceived a multi-ESP32 DIY solution. This involved integrating external ESP32 Ethernet dev boards with the LilyGO T-Halo. The "local" ESP32 (on the user's side) was programmed to stand up its own access point, handle DHCP for its clients, request an IP from the upstream Ethernet port, and bridge/route traffic between its Wi-Fi and Ethernet interfaces. The "remote" ESP32 (on the McDonald's roof) was tasked with connecting to the public Wi-Fi network, requesting an IP, and forwarding traffic to the HaLow radio via the Ethernet connection. The ESP32 on the T-Halo board itself, however, remained functionally disconnected in this setup. This "integration hell" was complicated by the lack of readily available 802.11ah monitor mode tools, making it nearly impossible to debug RF-layer issues. Despite the effort, the achieved throughput was even lower than the T-Halo's serial UART bottleneck. Loaning also noted that the HaLow module's flash chip dictates its subnet and AP/client behavior, a component the speaker was unwilling to learn to program.

The breakthrough arrived with the Heltec Halo dongle. This device masterfully integrates a 2.4 GHz Wi-Fi radio, a 900 MHz HaLow radio, an Ethernet port, and a USB-C interface that functions as both power and an Ethernet gadget. Crucially, it comes pre-loaded with OpenWrt firmware, a Linux-based operating system for embedded devices. This immediately solved the software complexity, as OpenWrt provides a robust, configurable networking stack.

Inspired by the Heltec's success and aiming for a more disposable, cheaper solution, Loaning identified a DIY path using an MT7628 MCU. This $15 chip is a powerful embedded processor capable of running OpenWrt and offers extensive GPIO capabilities, including four Ethernet ports, SPI, PCM, two UARTs, USB host/device, I2C, PWM, and crucially, PCI Express. The same HC11390 HaLow module found in the Heltec dongle (costing approximately $25) can be connected to the MT7628 via its SDIO interface. This combination allows for a DIY wormhole device at roughly $40, significantly cheaper than the $70 Heltec unit.

The use of OpenWrt on the MT7628 provides immense flexibility. It allows for network configuration via a Lua interface, eliminating the need to recompile the entire firmware for every change. Furthermore, it grants access to a rich ecosystem of OpenWrt packages:

• TravelMate: This package, originally designed for hotel Wi-Fi bypass, can be configured to execute specific scripts based on the connected Wi-Fi SSID or MAC address. This enables automated bypass of captive portals (e.g., sending a cURL request to acknowledge a EULA), making the remote device truly autonomous.
• iPerf: For performance characterization, iPerf can be installed directly on the OpenWrt-powered HaLow AP device, allowing for precise measurement of network throughput across the wormhole.
• Kismet: Loaning highlighted the exciting possibility of running Kismet on these OpenWrt modules, potentially creating a "Wi-Fi Coconut" or "My Wi-Fi device" equivalent for advanced wireless monitoring. The MT7628's PCI Express interface also opens the door to using modern Wi-Fi cards (e.g., Wi-Fi 7) that are incompatible with ESP32-based microcontrollers, significantly expanding the capabilities for embedded wireless analysis.

Demo / Proof of Concept

▶ Watch: The core plan: ESP32 with 802.11ah HaLow radio (6:00)

While the talk didn't feature a live, real-time hack, Loaning provided compelling evidence and a robust demonstration of the Wi-Fi Wormhole's capabilities through extensive testing and a custom-built performance characterization app. The core proof of concept was the successful deployment and operation of two Heltec Halo dongles. One dongle was configured as the remote access point (AP), capable of connecting to a standard 2.4 GHz Wi-Fi network. The other was used as the client device, connecting to the remote AP via the long-range 802.11ah link.

The most striking aspect of the demonstration was the achieved range. Loaning reported successfully maintaining a stable connection over 1.67 miles (approximately 2.69 kilometers). This impressive distance was limited not by the capabilities of the HaLow radio itself, but by the physical terrain and the speaker's ability to find an unbroken line of sight, specifically utilizing the expansive, flat line of sight offered by the Mississippi River. This clearly validated the "multiples of kilometers" range claimed for 802.11ah.

To systematically characterize the network's performance, Loaning developed a dedicated Android application. This app allowed for:

1. AP Location Marking: Users could precisely mark the GPS coordinates of the remote HaLow access point.
2. iPerf Server Definition: The app could be configured to connect to a specified iPerf server, which, during Loaning's tests, was often a server located in their home, bridging traffic all the way from the remote HaLow device.
3. On-Demand iPerf Testing: As the user moved around with the client device, they could manually initiate iPerf tests. The app would then record the throughput data along with the client's GPS coordinates at the moment of the test.
4. Antenna Orientation Logging: Crucially, the app leveraged the Android phone's gyroscopic data. By holding the HaLow client dongle against the back of the phone, the app could record the antenna's orientation during each test. This allowed Loaning to investigate the impact of antenna alignment on link performance.

The findings from this extensive testing revealed that while antenna orientation did not significantly impact the speed of the connection once established, it was a binary factor for maintaining the link at longer distances. In other words, at extreme ranges, if the antennas were not sufficiently aligned, the connection would drop entirely rather than simply experiencing a slower throughput. This highlights the importance of careful physical deployment and orientation for maximizing the range and reliability of a HaLow wormhole. The data, though somewhat "messy" due to external factors like a tree falling on Loaning's house, unequivocally proved the practical viability of the Wi-Fi Wormhole concept.

Defensive Implications

▶ Watch: Understanding 802.11ah (Wi-Fi HaLow): Long range, low power (6:30)

The Wi-Fi Wormhole project, while presented with a touch of humor and a focus on technical exploration, carries significant defensive implications for network security. The core threat it highlights is the ability to establish untraceable and geographically distant internet connectivity, leveraging existing public Wi-Fi infrastructure. This capability presents a novel and challenging vector for adversaries.

Here are the key defensive implications:

1. Geographic Attribution Bypass: The primary function of the wormhole is to place significant physical distance between an attacker and their point of internet egress. An attacker could be operating miles away from the McDonald's or Starbucks providing the actual internet connection, making traditional physical tracking or IP address-based attribution extremely difficult. This effectively creates an anonymous "jump box" in the physical world.

1. Blind Spot in RF Monitoring: A critical challenge for defenders is the current lack of readily available tools for putting 802.11ah (Wi-Fi HaLow) devices into monitor mode. Loaning explicitly called for contributions to projects like the "enzyme network defense project" to enable tracking, locating, and triaging 900 MHz devices. Without this capability, network defenders are essentially blind to HaLow traffic, unable to detect the presence of a wormhole device or monitor its communications. This creates a significant gap compared to the mature tooling available for 2.4/5 GHz Wi-Fi monitoring.

1. Low-Cost and Disposable "Network Throwies": The ability to construct a functional wormhole device for approximately $40 using an MT7628 and HC11390 module makes these devices highly disposable. Attackers can deploy them as "network throwies" on rooftops or other elevated points, accepting the risk of loss or discovery without significant financial impact. This lowers the barrier to entry for establishing covert, long-term access points.

1. Bypass of Captive Portals: The integration of OpenWrt and packages like TravelMate allows the remote device to automatically bypass captive portals. This means that even if a public Wi-Fi network requires a user to click through a EULA or provide credentials, the wormhole device can automate this process, ensuring persistent, unattributed access without manual intervention.

1. Stealthy Data Exfiltration and C2: Once established, a HaLow wormhole provides a high-bandwidth (up to 347 Mbps) channel for various malicious activities. This could include exfiltrating large volumes of data from an compromised internal network (if the public Wi-Fi is sufficiently close to offer a bridge), establishing command and control (C2) channels, or using the remote connection as a staging point for further attacks against other targets.

1. Physical Security Considerations: The deployment of these devices necessitates physical access to elevated points on buildings, such as rooftops. Defenders need to reassess the physical security of these often-overlooked areas, not just for direct intrusion but also for the placement of external network devices.

Actionable Advice for Defenders:

• Develop 802.11ah Monitor Mode Tools: This is the most pressing need. Security researchers and vendors should prioritize the development of software and hardware solutions capable of passively monitoring and analyzing 802.11ah traffic. This would enable detection, localization, and analysis of HaLow wormholes.
• Physical Security Review: Conduct physical security assessments of building exteriors, especially rooftops and other elevated points that offer a clear line of sight. Implement measures to deter unauthorized access and placement of devices.
• RF Spectrum Analysis: Incorporate 900 MHz spectrum analysis into regular RF surveys, looking for unusual or persistent signals that do not correspond to known authorized devices.
• Public Wi-Fi Policy Review: Re-evaluate policies regarding corporate use of public Wi-Fi. While internal networks should be segmented, the existence of such wormholes means public Wi-Fi can be a vector for unattributed external operations.
• Awareness and Training: Educate security teams about the capabilities of 802.11ah and the potential for its misuse in covert communication channels.

Key Takeaways

• 802.11ah (Wi-Fi HaLow) is a powerful enabler for long-range, low-power wireless links, offering significant geographic separation between a user and their internet source, with theoretical speeds up to 347 Mbps over several kilometers.
• Commercial off-the-shelf devices like the Heltec Halo dongle provide an easy-to-deploy, functional "Wi-Fi wormhole" solution by integrating 2.4 GHz Wi-Fi, 900 MHz HaLow, and an OpenWrt-based firmware.
• Cost-effective DIY alternatives are feasible using OpenWrt-capable MT7628 MCUs and HC11390 HaLow modules, significantly reducing the cost to approximately $40 per device, making them ideal for disposable "network throwies."
• OpenWrt's flexibility, combined with packages like TravelMate, allows for automated captive portal bypass and remote configuration, enhancing the stealth and autonomy of deployed wormhole devices.
• The current lack of readily available 802.11ah monitor mode tools creates a significant blind spot for network defenders, making detection and attribution of HaLow-based covert channels extremely challenging.
• Antenna orientation is crucial for maintaining stable HaLow links at extended distances, acting as a binary factor for connection stability rather than merely influencing throughput.

About the Speaker(s)

Le Xanning (they/them pronouns) is a self-sponsored individual whose passion for radio frequency technology and unconventional projects shines through. They are widely recognized as the creator of the International Wiggle Space Balloon and the Wi-Fira, and as a manufacturer of RF field cams. Loaning also famously gave a talk at Defcon on what they believe to be the first-ever toothbrush botnet, ingeniously crafted from ESP32-based Wi-Fi-enabled toothbrushes. A visibly queer person, Loaning is a vocal advocate for inclusivity in the RF community, affirming that "radio is for everyone" and that all who are interested belong. Their work consistently pushes the boundaries of embedded systems and wireless communication, often with a creative and humorous flair.