Laws Of Wardriving

So last week I am stumbling around a server room, knee deep in cables, dead PC's and general techno-trash. I am waiting for the MAIL server to make it's next move. To entertain myself I pop open my iBook and see a few new updates. So I attempt to install them and find that my access is SHOT. It's sooooo slow. Eventually I figure out, I am not connected to my access point at the office, I was on someone elses.

Today I finally made the decision to step onto the access point and check out the network. I have a feeling that thie access point is one I found a week or two earlier named 'linksys'. The name had now been changed to reflect the name of the firm. Yes, a law firm on an unprotected wireless network. Interesting.

The approach: I took my usual first approach with the network. I checked out my IP, and then starting working my was backward pinging for hosts. My IP ended in 8, so I tried 7,6,5,4, 3, and 2. Most answered, and I didnt check out the IP ending in 1, because that was the access point.

Next I ran a nice util called "smbutil" to check out the first target. Here is what it returned.

Ray-Haques-Computer:~ rayhaque$ smbutil view //(removed).4
kextload: extension /System/Library/Extensions/smbfs.kext is already loaded
Password:
Share Type Comment
-------------------------------
IPC$ pipe Remote IPC
print$ disk Printer Drivers
SharedDocs disk
awest printer HP LaserJet 1200 Series PCL
Printer2 printer Canon Bubble-Jet BJC-85
ADMIN$ disk Remote Admin
C$ disk Default share

7 shares listed from 7 available
Ray-Haques-Computer:~ rayhaque$

This was interesting. A SharedDocs folder indicating that it was probably Windows XP. And a couple of printers. Perhaps a Windows 2000 box serving as a print server? I make a couple of bad attempts to connect to the admin share. No dice. Oh well. NEXT!

Ray-Haques-Computer:~ rayhaque$ smbutil view //(removed).2
kextload: extension /System/Library/Extensions/smbfs.kext is already loaded
Password:
Share Type Comment
-------------------------------
E disk
PRIVATE$ disk
SHARED_DRIVE disk
IPC$ pipe Remote Inter Process Communication

4 shares listed from 4 available
Ray-Haques-Computer:~ rayhaque$

I wonder what's on E? It says 'disk', but more likely it's a CD-ROM shared out. Reguardless, I couldn't guess the admin password so we won't know. But did you notice the private share? It's funny how Microsoft hides shares ending with a dollar sign ... but using a *nix SMB client obviously ignores the 'hide me' aspect of it. Neat! - NEXT!

Ray-Haques-Computer:~ rayhaque$ smbutil view //(removed).3
kextload: extension /System/Library/Extensions/smbfs.kext is already loaded
Password:
Share Type Comment
-------------------------------
D disk
HP_DISK disk
IPC$ pipe Remote Inter Process Communication

3 shares listed from 3 available
Ray-Haques-Computer:~ rayhaque$

By now I am getting discouraged ... but I hit the goldmine. This "D" share turns out to be a very open share that is used to dump backups to. Funny how the whole network is nailed down pretty tight. Yet, a shared folder with guest access has everything important put into one place. My initial view is below.



I wonder what's in that backup folder? Click-click!



Two backups to chose from. Neither one is really current. I'll check out the newest one though and see what I can dig up.



Was this really important Tammy? What the hell? Does your employer know you are wasting his drive space for this trash? Let's see what else you are holding onto.



I am wasting my lunch hour on this. I could be out in my car, surfing a real network, in search of interesting tidbits. Still, Ricky made me do a double take. Sad thing is, this is only one about about 20 different stuff animal with penis photos. Finally, I stumble onto something worthwhile.



A law firms complete client database, organized by name. Inside each directory is a couple of MS Word documents. They detail each clients history with the firm, the status of their case, etc. It's a pretty large database. I poke in and out of a few records, and continue onward. This would prove to be the highlight of my search.

Ray-Haques-Computer:~ rayhaque$ smbutil view //(removed).6
kextload: extension /System/Library/Extensions/smbfs.kext is already loaded
Password:
Share Type Comment
-------------------------------
IPC$ pipe Remote IPC
print$ disk Printer Drivers
hpdeskje printer hp deskjet 940c series

3 shares listed from 3 available
Ray-Haques-Computer:~ rayhaque$

What the hell is this, a print server? Everybody in this joint has a printer it seems. The admin shares aren't showing, but I try and access them anyway. My attempts are fruitless, and I am unable to uncover their administrative password.

Running out of lunch hour, I decide to check out one more thing. The access point. Surely whoever set it up must have changed the password.



Nope! I walk right in. Maybe I should have started here? It occurs to me that I could have gotten some hints for those administrative passwords by seeing the resgitered PC name in the DHCP client table. I bring it up and see some hostnames. I blurred them for 'privacy' if there is such a thing.




I also poke around the other areas of the WAP's settings, and take interest in the WAN connection, which is using PPPoE. That's Point-to-Point-Protocol Over Ethernet. This is more or less what I consider the poor man's VPN connection. Interesting way of keeping connected to what looks like the ISP.



All in all, not a bad days wardriving adventure. And I never even left my desk. I am pleased not only that my new Cantenna rig on my lappy pulls in some serious WiFi signals, it still works just fine without any external attachment. That was a conern I had doing that little operation.

And now if you excuse me, I need to help my son and daughter pass the next level of Odd World (the best Playstation game ever). And in a short while, I will be laying the pipe to my wife. So please, do not message me. KTHX!

Happy Birf'day To Rotary

Tomorrow is actually my wifes birthday. But it's been a crappy day for both of us, so I thought getting her a birthday gift would make us both feel better. It worked!

I went up to Best Buy to look for what they didn't have yesterday. Napster 2.0 'credit cards', and the new Pink CD. I had watched several nights ago as she tried for probably a few hours to download a few songs. Sometimes filsharer's can be real idiots. It's like, if you download a song that's incomplete, or bugged, delete the damn thing. Instead people keep this retarded broken loops, and my wife ends up downloading them. So I thought I would buy her some download credits with the new pay-per-download Napster service. Yet these "credit cards" for Napster aren't out yet ... and probably won't be out until Christmas.

I did have luck getting the Pink CD which turned out to be a good purchase. Along with the CD you get a second DVD disc with a music video, some interviews, and some other perks on it. Looks like she's really happy with the music too. Which was cool. I hate when I buy a lousy gift.

I also did some war-driving today with my freshly modified iBook. Right after pulling out of my driveway, I was all ready picking up new access points. Driving through my neighborhood I was hitting points that I knew were a block or two away, and some that I had never heard of.



Heading along the highway on the way to work I was hitting access points by the dozens. I will have to plan another expedition this weekend to have a longer war-drive with it and see what kind of results I can get. Should be good!

Punting Puters'

I know it's a little immature, but about an hour ago, I about broke my toe kicking a PC. I am on about my fourth or fifth computer trying to make a PC for my son that works. The poor boy asked me for Linux. He liked the fact that he could have an operating system that is *not* Windows. How could I say no? Why have I waited so long to give him something other than windows? What kind of father am I? So I have been trying since Friday to pull together parts from my various scrap piles that will work. I need to dispose of some of this buggy old hardware.

This is actually my first project of the weekend. My second was to add an external Cantenna connector to Audrey (my iBook). I thought I had better first find a BNC connector to use. I am all out of old network cards. I have gone through several of them salvaging the tough BNC mounts off of them. Then I came across something I used to carry around in my bag called an Ether-Pocket. This little device hooked to your parallel port to provide basic SLOW network connectivity. It had a RJ-45 connector AND a BNC. So there was my part. Trouble was, I liked it a little too much. I also found that it would be hard to mount the BNC connector to my iBook sideways, and still allow a BNC connector to attach to it. So I decided to mount the whole damn thing to my iBook, and run a wire to the inside.

It took about 6 screws to take the iBook screen apart. As I suspected, inside the plastic covering were little dangling antenna thingies on either side of the iBook display. One was labeled "MAIN" and the other was labeled "AUX" (Auxilary). I thought attaching to main was my best bet. Doesn't look like it mattered, they both went to the same place.



I ran a cable straight from the "MAIN" on down to a hole I drilled near the bottom of the screen. It was easy running the cable inside of my Ether-Pocket thing and soldering it down. For my next trick, I will take it on a war drive with a cantenna and see if my mod did any good. I certainly hope so. This project was a pain in the ass!

By the way, if you have been calling my house asking for Doddie, the bitch doesn't live here. Stop bothering me when I am trying to drink!

Campus Wardriving

We had a plan for the night. Try out some new war-driving innovations. I had a few new new tricks to try out. One was a long magnetic CB antenna. I had changed the end from an N-type to a BNC to fit my mod'd WiFi cards. Further fun could be had with what we have been calling 'the bazooka'. This is four soup cans duct taped together which gives roughly a 43 decibal gain to your WiFi card.

The magnetic mount antenna failed to give us anything. Perhaps because the cable was too long, and it was in no way focused to the range we needed. The bazooka was just too damn big. It probably wouldn't have even fit into DM's truck cab. So we left it all behind. The weapon of choice for the evening would turn out to be the "Kaluha-tenna", and the first WiFi mod we did with a D-Link card.

Before leaving out, we got drivers loaded onto Discount Mans VAIO, and loaded up his truck with our lappys, the inverter, and our winter caps. It was damn cold. We headed out to the OSU campus area, picking up access points all the way. DM offered to purchase me a fine coffee brew, so it was onto Stauffs the coffee shop. We could barely get in the door. It was packed. After a few minutes we scored a table with an outlet. Which was good, because I have no battery in my lappy, and DM's is on it's way out.

DM played some UO games, and sent many instant messages. Sometime looking around, seeming confused, and then going back into his deep state of concentration. All the while I attempted to access file shares on neighboring yuppy coffee drinkers. The banter around me made me sick. I got a guy behind me talking about heat sinks. For about 40 minutes. Heat sinks. This other fat idiot plopped himself down and broke his coffee mug. It was this hideus looking vase thing that he probably made himself. I wanted to pick up the larger of the two pieces and beat him with it.



I also played with DM's QuickCam and took some fun pictures, which you are seeing decorated my Blog nicely. The coffee ran right through DM and he hopped up to piss. There was a guy sitting behind him with a chick who really seemed happy to the fact that a camera was pointed at him. I thought this shot of him "cheesing" for the camera is priceless. His date looks real amused with him too.



So we took a drive through campus. And all I can say is "wow". It was a goldmine of activity. In many ways. It was Saturday night, and you couldn't swing a dead cat without striking a drunken college student. Heading through some alleys with the Kaluha-tenna at hand we got some strange looks, and some nasty comments. DM heard one guy call us "the fuzz", indicating that we might be the undercover campus cops. We got mooned. Nothing like staring down 5 or 6 hairy asses. At which point we moved on.

We headed up and down the sorority and dorm areas and were finding mass amounts of access points. Sometimes as many as 8 at a time that were all serving handfuls of active computers. The bad news was there was absolutely nowhere to park. When DM was finally able to find a parking spot, it was hard to reach the WAP's. The trouble with using a cantenna is that your receive strength is always much greater than your send.



I found a few open shares and some stuff I really wanted. Like "I'm fixin' to die rag - By Country Joe and the Fish". It's a great song about Vietnam, and a tough MP3 to acquire. Yet ... it was *just* out of reach. It irritated me. And everyone in the dorm was running Windows XP. Most of them were sharing nothing. Jerks. We'll teach them. We'll rename their access point.



As the WAP rebooted there was a long pause before it started advertising again. But it came back. Here is us reconnecting to it under it's nice new name.



Discount Man then drove me through his neck of the woods to explore some University owned areas. Naturally, they were all WEP encrypted. Boring.

We went by DM's house so he could let his dog out. And I was also able to attach to his access point. He has his set to hand out IP addresses on a 192 network. Yet, he runs a 10. network. Other than that little gag, it was wide open. So we decided to make some security changes on it, and also rename it. The name is based on a Flash show someone made about Papa Smurf having his ass licked. Inspiring.



Driving through the 'dirty dorms' we came across a residential network. It's referred to as 'ResNet'. DM says his students are always talking about "haxx0ring res-net" like it puts you right up there with Kevin Mitnick. So we thought we might try and get into the WAP. It was simple. Default passwords. We contemplated changing the name of the point to the full name of one of the students. Just to incriminate them. I know ... not nice. But we decided to try and use a question instead. Complete with a question mark which I wasn't entirely sure would work.


There was a LONG pause there. Something didn't seem right. Just as we're driving off, it showed up with it's new name.




Whew! We wouldn't want to leave college students without connectivity. DM was more than ready to move on. There were about 3 security vehicles patrolling a very small area. And we were getting some odd looks. DM was ready to head home. I was too. It was about 2:15AM.

On the drive home I continued to review our results on DM's lappy in Netstumbler. It was awe inspiring. I just *have* to get a cantenna rig going on Audrey (my iBook). As it was, DM's VAIO had all the fun this time. Poking around DM's hard drive I come across that awful "Magic Stick" song and begin playing it. He's rolling his eyes saying "when did you download that?". I sware it was on his hard drive. So I play it full blast. He had his bass booster plugged in to his VAIO's accessory bay. So it sounded real nice.



All in all, it was a great adventure. DM headed back to the place he is house-sitting. And I ran up to bed with Audrey to begin this blog. But it was 3:00AM at this point and I was tired. So I put Audrey down and watched some TV with Rotary who I had woken up a few times being so noisy. Sorry. :-( The coffee was keeping me up. And Rotary seemed to be kept up with a cold. I eventually passed out.

Now, its the following morning and I need to get my son's computer going. I promised him Linux, and his computer is just hosed. Locking up, losing the CD rom. It's just broke. I think I need to start over with different parts.

See you later.

It's Alive

I finally got the mail server running again. Just a little more over 27 hours after taking it down. What a project that was.

I started Tuesday morning by checking backup logs. And it was good that I did. A backup had not been performed in a few weeks. I reach behind the removable drive that our data gets backed up to, and it had never been turned on (or was turned off at some point), Woops. After running a full backup, I kicked over to the Mail server itself, stopped the Information Store, and ran a copy of the MTBDATA and MDBDATA folders off to the removable drive (which took another hour).

After all that madness I had blown half the day (it was around 3PM). Down the mail server went, and out came the drives. Installing new drives was a piece of cake, and even configuring the RAID wasn't too bad. This old DPT RAID controller had a pretty good BIOS in it which allowed you to configure the RAID without a boot disk. Adding a HotSpare was a little strange. So after a few tries I got it how I wanted it, and began to "prepare the array". If you have never built a RAID-5 array before, I recommend you have something else to do. It takes hours.

Later I was able to start the Windows 2000 installation. Which naturally then wanted to to format the 'drive' as NTFS. It was right around 70 gigs worth of space. So I got to wait another hour or so for that. After some running around, dropping off the wife and kids, and returning to work, Windows 2000 was just beginning it's graphical installation mode. Hooray. Little did I know that I would be reinstalling later after have some horrible failures.

By the time it was rolling around to be midnight, I had learned some valuable new lessons.

• Starting over may not be the best option (when you have to format a huge array of space)
  
• Windows 2000 might suck a little bit, but Exchange 2003 sucks in a major way
  
• When you can't open events in your event log, you may be in trouble
  
• Ntdsutil.exe is a resource kit tool for repairing active directory
  
• You won't need ntdsutil if you name another controller a FSMO (woops)
  
• When in doubt, go to bed

I arrived home about 2:00AM after I had started installing Exchange Server 2003 (again) using /distasterrecovery mode. Once home, I kicked off my shoes, flexed my back (it hurts) and then sat back down to remotely connect and continue. Low and behold, I had gotten errors again. Although I couldn't read them. Because event log was hosed. To bed I went!!

After my 3 hour nap, I arose to drive out to Athens Ohio to teach a Linux Administration class. I was strangely awake. Must have been all the coffee I drank. About half way there, the boss calls. "It doesn't work, right?". "Nope!", I tell him. I go on to explain that I did indeed try. I REALLY tried to get it up and running. But quite literally, there are not enough hours in the day. I tell him about all the problems I was having, and how it might be wise to reapply Service Pack 4, along with other Windows Updates. He agrees to take care of that for me so I can go about my day and maybe connect later to have a look.

Work was a breeze. I had 9 students for class and they were all a lot of fun, and very willing to learn. Only problem was connecting back to the office. Nothing seemed to be working. I confirmed my suspicions by asking an employee "you guys aren't filtering outbound connections through your firewall, are you?". "Oh yeah!", he proudly replied. That answered that question. No ssh, no VNC, no nothin'!

Later he was nice enough to open up port 3389 so I was able to sneak into my home network to get some work done under remote desktop. The MAIL server was staring back at me, still a ton of errors. Yet ... I could read them all in the event log! The updates fixed that. Great.

Next I moved over the Exchange database which had been sitting on the root of the drive, and then attempted to mount the store. ERROR! What's the problem? It's looking for the database on the D: drive. There is no longer a D: drive. Hrm. Aside from that, certain elements of the mail database just are not there. I had gotten some errors running Exchange Server 2003 with the /disasterrecovery switch. So I pulled a trick. I went into command prompt and ran "subst d: c:\" which basically says, 'mount a d: drive to the root of c:'. The result is a bogus d: drive letter. That seemed to satisfy 'some' of the errors.

By this time it was 4:30 and I needed to get out of there. Before I leave, I go in and start installing Exchange again. This time, normally. So I went home, ate, played with my daughter a bit. And then sat down, and went onto the mail server. The installation has finished, without any errors. I right click on the Store, and mount it. What? It mounted? Thank God. That was an uneventful end to a VERY long day. I was so happy. 6:20PM. I could enjoy the rest of my evening and actually sleep better tonight. I call the boss who is in law class at the time and leave him a cheery voicemail message.

It was a good night. I enjoyed some private time with my wife, and slept very well. As did she. Apparently her new drug prescription has gotten her away from a drug that left her rest-less and in pain. Thanks doctor!

Now I am sitting outside the building I teach this class in. It's about 7:45 in sunny Athens Ohio. I am very early for class. My students didn't want to start class until 8:30. I am in no hurry to get inside seeing how I can only get out on port 80. Maybe I could connect back home with remote desktop, and map a secure shell to port 80. That would work. ;-)

See you all later. Thats enough blog for now.

Country Roads

So here I am! Headed down Route 33 through Lancaster. We are headed into Athens Ohio for another class setup. We consists of me, and Karen who is at the wheel. I have picked up a few access points passing through Lancaster (farm country) most of which are encrypted. Strange. You would expect these 'backwoods' types to leave all the defaults alone on their wireless devices.

Behind me is the rattling and bumping around of all the hardware we need to setup. This is like deja' vu all over again! I just had to say that. There is some odd hatred toward Kevin Rose (and the broken in general) that stems from some southern guy calling himself "lineman". In trying to get some clues as to what the hell this little war is over, I checked out his webpage which didn't give me much insight. What I did find is a bunch of 'articles' which he proudly displays as fresh content. And also some bitches and moans that were suitable for Martin's blog readings on unscrewed. Namely, "why do reporters keep saying deja vu all over again? It's stupid!". Or something like that. He also has a few pages of "shame" which has pages about Kevin Rose, and Gethsemane. They are documented proof of why these two guys should be ashamed of themselves. And where is my page? I need to email him and request my own. I have said far more snotty things than Geth and Kevin combined. I guess to get on his list, you have to insult one of his 'people'.

Not having much luck in farm country now. Karen had just called the boss a few cars ahead of us to ask 'how much further is it' and got disconnected. Not many cell towers out here I gather. We are now 34 miles away. Not too bad a drive considering.

I can't wait until I'm done! I get to go back to work and rebuild the dead mail server. I have 6 brand new 18 gig Seagate Cheetahs waiting for me back at the office. I know ... you are going to ask "why only 18 GB drives?". My boss is cheap. That's why. If I hadn't found 18GB Ultra160's at the same price as the 9GB we currently have, he would have bought 9GB drives again! Anyhow, that rebuild ought to be fun. I am going to replace our Windows 2000 server with a 2003 server, and try to move our Exchange mail store over at the same time.

Cross your fingers for me.

Home Again

I have seriously neglected my Blog. I keep taking snapshots of various things and planning what I will put in this Blog and then I never get around to it. I really wish I had a cheap digital camera with me on my trip. There were many things I would like to have take a quick snapshot of. I had a conversation with Kevin Rose last night who has just about talked me into getting one of those picture phones. When they first hit the market I thought "what the hell would you photograph with them?". But now I have been looking for a cheap Pen-Cam that will work with OS-X for Blog purposes. And I hate my phone. HATE IT. Perhaps I should be looking for a phone I can upgrade to on my crappy Verizon plan. Hrm.

So I am so pleased to be home. It feels really good to be back with my family and go to bed with my wife (in clean sheets). Friday was such a long day. I got up the morning feeling hung over from going right to sleep after downing several dark stout brews. My hotel trashcan was overflowing with beer bottles and fast food bags. I never even put my laptop away. I must have hunched over and blanked out watching horror movies. It was actually a good day for class. I was rolling off material like nobody's business. And my students were wanting to get the hell out of there just as much as I was (but not until after the free catared lunch).

I wrapped class right around noon. And timing was good, because lunch arrived about 10 minutes earlier. But there was a man from School Net (who arranged for the class) and wanted to say a few words about registering for more classes, etc. So I instructed everyone to stay put, and he went over some things on my projector. The moment I anounced "lunch" the room cleared out in a stampede fashion. I continued to answer questions, and clean things up.

I couldn't seem to find the woman who works the front desk in the building. I went around the whole building twice and couldn't find her. So I told the School-Net guy to tell her I was taking off, and someone would be by later to pack up the room. The boss has called me the night before and said to take off once class was done because they wouldn't be able to get to Cleveland with the van until much later. So I darted.

I must have been driving about 80 miles an hour back to Columbus. About 20 miles from home I get a phone call from the boss. He is pissed off. He says he called me dozens of times trying to catch me. Aparently his wife (the co-owner) was on her way to Cleveland by herself to pack up. She was supposed to have help from her son who could not get off work and blew her off. To make matters worse, they wanted her to pack it up and get out of the building in 40 minutes time (so they could go home). Woops. :-/

So now I get to go back to work on Monday and drive a few hours with my employers who hate me. The boss was pissed that I hadn't really packed anything up. But he told me I could leave when I was done. So I did. I guess I was supposed to be nice and unplug everything to pack it up before leaving. Oh, and I checked my voicemail. Sure enough I had two messages from my angry boss trying to track me down. Yet, I had no voicemail warnings and my phone never rang. Whatever. So I look like an asshole. Maybe they will fire me and I can start a new career as a sports comentator. Anyone know anything about sports? I don't.

None of that crap really mattered once I was home. It was so good seeing my family again. And that night we went to a halloween party for some drinking and fun. It was a nice little party with some interesting people there. I had an hour long conversation with a woman about Linux, Unix, and the like. She is a member of a local Linux users group and urged me to join the mailing list. It's not often you randomly run into intelligent IT people at non-IT related functions. She was a character. And I couldn't figure out if she was genuinly strange, or just keeping in her character as a member of a coven (her sister was also wearing coven garb).

I wanted to get all kinds of snapshots for my war-driving efforts in Cleveland, but I have nothing to share really. Cleveland is a black hole of activity. It makes Columbus look like New York in terms of size and use of technology. Yet, I was able to find a few things of interest. Coming into Cleveland I found very little. But then as I drove by Cisco Headquarters somewhere on route 77, the alarms went off. There I watched as my lappy started logging hundreds of access points. After the first 10 or 12 you start to get suspicious. :-) What a neat trap. I was impressed with the trick, and it made me wonder if anything I was picking up was a real access point (versus EVERYTHING being fabricated). Here is a snapshot. Check out the times to the far right (I still have no battery, hence the year 1969). But look closely at the seconds placeholder.



Otherwise Cleveland offered nothing in the way of connectivity. I found myself driving up and down the local streets trying to find any kind of signals. Here is a look at what I found in a path between my hotel and where I was teaching. Yes, this is the ENTIRE thing. Sad.



I was able to find a Chiropracter who had a small office in a "historic" little community about 3 miles from my hotel. It was also next to a small church that was still open and active even late at night. So I was able to sit in their parking lot without drawing suspicion. Yet, nobody was around to talk to. My access speed was pathetic (they must have been on a 64k pipe). And it just made me more home sick. So after reading e-mails and picking my nose, it was back to the hotel to mope.

Well it's Sunday, my last day of freedom before returning to do this damned Linux class all over again with another group of people. Lucky me. So I am going to go wash up now and try to enjoy myself.