Xfinity Pineapple

Notice: LogRhythm nor the author of this blog post are liable for any illegal activities conducted with this information. LogRhythm does not condone or support such activity. This post is simply a proof-of-concept to explore the risks of open wireless access points.

Open wireless access points have always been a hot topic within the security community. Due to their nature, there are a plethora of attacks that allow hackers to breach these networks, mirror legitimate access points, man-in-the-middle traffic and much more. These attacks are conducted every day on many networks all over the planet.

Hackers will leverage anything from the Wireless network at your local Starbucks, the airport, airplanes, hotel chains, personal guest networks and more to steal personal information. You name it, someone out there has found a new way to exploit it. Still trust those pay-as-you-go WiFi hot spots that ask you to supply credit card information?

Which brings us to Comcast. They have been steadily implementing their plan to leverage their customers Comcast access points (only those owned by Comcast, not personal equipment) to distribute wireless access to any Comcast subscriber that happens to be in the vicinity.

“Comcast’s newest Wireless Gateway broadcasts two WiFi signals. By default, one is securely configured for the private use of the home subscriber. The second is a neighborhood “xfinitywifi” network signal that can be shared. This creates an extension of the Xfinity WiFi network and will allow visiting Xfinity Internet subscribers to sign in and connect using their own usernames and passwords.” Comcast

All you need to do is locate a nearby access point, log in using your Comcast credentials and start browsing the net through someone’s home router. There is a bit of controversy over this feature—however, this is beside the point. What I’d like to talk about today is how hackers can leverage this vulnerability feature for evil and why consumers should be wary of using open wireless access points in general.

To help illustrate this risk, I’ll be using the WiFi Pineapple—a great little device by the folks at Hak5 that most security professionals are familiar with.

The pineapple comes equipped with a myriad of tools to help trick clients into passing their traffic through this access point so that it can be sniffed, altered, modified or worse. For our specific attack, we’ll be imitating an Xfinity WiFi access point and using this to steal users Comcast account credentials among other nefarious activities.

First, we need to obtain the code served up by one of these access points, learn how it works, and build our own version. Xfinity access points are popping up everywhere, so finding one is incredibly easy.

Figure
Figure 1: Xfinity Hot Spot Map (Click on images to view larger.)

Upon finding an access point without even leaving my neighborhood, I cloned the code from the landing page, modified the HTML and added my own form processors to create two identical versions of the Comcast (standard and web) splash pages.

From here, this code can either be uploaded to the Pineapple or stored on a separate (internet-accessible) server if you’ve run out of free space on the Pineapple. For this walk through, we will host the code on the Pineapple itself. To keep this separate from the other Pineapple tools, SSH into the Pineapple and make a new directory in the /www/ folder, we’ll call this folder ‘x’.

Figure
Figure 2: New Folder (Click on images to view larger.)

Within the GitHub repository, there are two landing page options. One is the default web landing page (login-page-option1) and the other is the default mobile landing page (login-page-option2). Either one will work or you can get creative and adjust the page displayed based on User Agent Strings.

Figure
Figure 3: Landing Page Options (Click on images to view larger.)

With the folder in place, SCP the code from the xfinity-pineapple/login-page-option(1|2)/ directory to the new folder.

Figure
Figure 4: Upload the Code (Click on images to view larger.)

With the authentication page in place, we need to change the name of our access point to ‘xfinitywifi’ to mimic the legitimate Xfinity access point. This can be accomplished under the Karma Configuration menu.

Figure
Figure 5: Karma Configuration (Click on images to view larger.)

Next, you will need to configure a redirect and force the user to log in. There are multiple ways to do this. The simplest option is to use the Pineapple DNSSpoof Infusion. This method will look for common keywords entered by the victim in the URI and redirect them to the Xfinity landing page. Going this route, they are more likely to catch on that something is up, especially when attempting to visit Google and it keeps redirecting them back to the Xfinity landing page…

Figure
Figure 6: DNSSpoof (Click on images to view larger.)

The second and more believable option is to go with a captive portal. This allows you to pass the users through a splash page that you configure and force them to ‘authenticate’ before accessing the Internet. Once the victim has ‘logged in’ successfully, they may now browse the Internet. To accomplish this, you will need to install and enable the Evil Portal Pineapple Infusion.

Figure
Figure 7: Evil Portal Install (Click on images to view larger.)

Once the Evil Portal has been installed, open the module configuration page and follow the steps exactly as they are listed. Once you have installed the dependencies, made configuration changes, and tested to be sure that the splash page works, modify the /etc/nodogsplash/htdocs/splash.html page to reflect a false Xfinity portal.

An example configuration page has been included within the Xfinity Pineapple GitHub repositoryand the splash page can be updated either through the Pineapple interface or via SSH. You may want to back up the original splash.html page at this point.

Figure
Figure 8: Evil Splash Page (Click on images to view larger.)

With the evil splash page configured to push users to the ‘authentication portal’ upon joining the access point, launch NodogSplash from the Pineapple interface and be sure to click ‘Start Once’ as this interface does have a tendency to hang. If it does hang, SSH to the Pineapple and run: killall nodogsplash.

Figure
Figure 9: NodogSplash Configuration (Click on images to view larger.)

With the configuration up and ready for users to connect through your access point, enable the wireless service on the Pineapple and verify that you show a newly available access point, ‘xfinitysifi’.

Now sit back and watch as users join your access point and enter their Xfinity account credentials, which will be stored in the auth.log file. With these credentials, someone of lesser morals could use these to conduct illegal activities and have them traced back to the owner of the Comcast account. Not only that, but once the victim is browsing through the Pineapple, this is only the beginning…

Figure
Figure 10: Tail auth.log (Click on images to view larger.)

You’ll notice that this file logs two password attempts, this is because the landing pages are configured to always fail the first attempt and act as though the second attempt was valid and pass them through to the Internet. This was done on purpose to catch multiple authentication attempts in the event they miss-type them during one of the entries.

For bonus points, try setting up an evil Kali Linux access point using a Raspberry Pi for an even greater range of attacks when users connect. Depending on your home router’s configuration, you may even be able to set up a separate guest network as a false ‘xfinitywifi’ hotspot.

Figure
Figure 11: False xfinitywifi DDWRT Guest Network Configuration (Click on images to view larger.)

None of what we talked about here applies explicitly to Comcast, this can be done on any public access point, though stealing Comcast credentials does have the added advantage of providing attackers with credentials they can later use to mask their online activity. For this reason, users should take steps to protect themselves and be cautious when using these networks.

  • First and foremost, Comcast customers can disable this feature if they are so inclined.
  • If you have connected to an Xfinity access point in the past, you will pre-authenticate to any Xfinity access point going forward, this includes a masquerading Pineapple. This will not expose your credentials, but all your traffic will be passed through a potentially hostile access point.
  • When not using WiFi on your phone / laptop / tablet, disable it, especially when in crowded areas such as an airport.
  • When joining one of these access points, try to verify that one really does exist in this area using the Xfinity WiFi app on iOS/Android or by reviewing their Access Point Map.
  • Real Xfinity access points will redirect you to (https://wifilogin.comcast.net) to authenticate, though this could also be fudged by an attacker using DNS Spoofing so it is not a dead giveaway. The real identifier here is that the legitimate landing page is using SSL and has a valid certificate. This can be spoofed as well, but is much harder.
  • When connecting to any open Wireless network, use a VPN service to encrypt your traffic.

Then again, you can always just ask someone for their Comcast credentials…

Figure
Figure 12: I can haz ur password?! (Click on images to view larger.)