Clear wifi

If you are connected to a Clear wifi hotspot (in my case, one that I own) then go to its IP, which is 192.168.1.1

At this point you can log in as admin / admin (unless someone's changed the defaults)

Or you can go to 192.168.1.1/super and log in as super / super and change the admin password from there. There's no GUI way to change the super password, but if you go into the .htapassword file, you can change it there I believe.

I'm still experimenting... while keeping in mind that there's no "reset" button on this thing and if I screw up then I will have no internet until I go somewhere else...

This idea came from an article about how to hack the Clear iSpot, which only works for apple devices and which is rather cheap per month. Therefore, if it can be hacked to work for non-mac devices... one would get a good return. Since it's all Clear hardware... it seems that it's the same. Sigh.

I'm perfectly content with my current Clear services and I don't intend to hack anything... but I'm concerned that someone could potentially log into my Clear device and change my admin password (which is no longer the default password, of course...)

So, what are the security defects here?

• The informed populace can log into my wifi hotspot and change my admin password
• There's no way (yet) for me to stop them
• Presumably, the "informed populace" can also go in and screw with my security settings, therefore opening a way for them to gather my data, including credit card information if and when I send that over the network.

Why are these security defects not that bad?

• The "informed populace" is so far very small. The wifi hotspot is also small. It's unlikely that anyone within range of it will be able to figure out how to use it... or hack those using it.
• this is probably Clear's way of resetting *lusers' admin passwords when they forget them, which is a necessary task
• With some work, I can probably change the password on the super account.

* luser is a contraction of loser and user and means an uninformed user.

inflight wifi: some network analysis

I am on a plane with wifi. Naturally, I'm trying to explore the network. Here's some raw data. Sorry for the massiveness of it.

Internet provided (for $5/flight) by:

http://www.gogoinflight.com/gogo/splash.do

Screenshot of speedtest: http://picasaweb.google.com/wordymusic/InAirWifi#5521697470990105234

Ideas on things to try (I didn't get to all of them.)

• traceroute to various places, try to figure out if you're behind some sort of transparent proxy, mainly by trying encrypted connections and odd ports.
• nmap the entire subnet to see if there's any other interesting equipment, do indepth probe scans on anything interesting.
• packet sniff the entire plane with kismet.
• see if it asks you to reauth if you steal somebody else's ip address.
• try arp poisoning to make sure you get it

Fast pinger version 2.20

(c) Wouter Dhondt (http://www.kwakkelflap.com)
Pinging 12.130.117.106 with 32 bytes of data every 15 ms:
12.130.117.106: request timed out
12.130.117.106: request timed out
12.130.117.106: request timed out
12.130.117.106: request timed out
12.130.117.106: request timed out
12.130.117.106: request timed out
12.130.117.106: request timed out
12.130.117.106: request timed out
12.130.117.106: request timed out
12.130.117.106: request timed out
Ping statistics for 12.130.117.106:
Packets: Sent = 10, Received = 0, Lost = 10 (100% loss)
Approximate round trip times in milli-seconds:
Minimum = 0.0 ms, Maximum = 0.0 ms, Average = 0.0 ms

http://www.maxnoc.com/support/looking_glass.html

12.130.117.106 is from United States(US) in region North America

TraceRoute to 12.130.117.106

Hop

(ms)

(ms)

(ms)

IP Address

Host name

1

48

46

35

72.249.128.105

-

2

22

27

43

206.123.64.22

-

3

25

59

45

216.52.189.9

border4.te4-4.colo4dallas-5.ext1.dal.pnap.net

4

21

22

27

216.52.191.33

core2.tge5-1-bbnet1.ext1.dal.pnap.net

5

10

13

18

65.208.15.229

0.ge-0-1-0.gw3.dfw13.alter.net

6

9

17

9

152.63.101.53

0.ge-3-0-0.xl3.dfw7.alter.net

7

8

6

6

152.63.96.45

0.ae3.br1.dfw13.alter.net

8

11

16

9

192.205.36.213

-

9

38

30

38

12.122.195.238

cr1.dlstx.ip.att.net

10

39

35

29

12.122.28.86

cr2.kc9mo.ip.att.net

11

34

64

44

12.122.28.90

cr2.sl9mo.ip.att.net

12

37

38

52

12.122.2.21

cr2.cgcil.ip.att.net

13

66

38

30

12.123.7.249

cr84.cgcil.ip.att.net

14

90

49

45

12.122.132.161

gar8.cgcil.ip.att.net

15

62

71

70

12.122.254.18

mdf001c7613r0001-gig-10-1.chi2.attens.net

16

34

36

32

12.130.96.174

mdf001c7613r0004-gig-12-1.chi2.attens.net

17

46

58

49

12.130.100.142

-

18

60

69

55

12.130.115.249

-

19

Timed out

Timed out

Timed out

-

20

Timed out

Timed out

Timed out

-

21

Timed out

Timed out

Timed out

-

Your IP Address Is: 12.130.117.106

Possible Proxy Detected: 1.0 10.240.20.13:8080 (squid/2.6.STABLE12)

geeklinda@cyberpunk-geeklinda:~$ traceroute 12.130.117.106

traceroute to 12.130.117.106 (12.130.117.106), 30 hops max, 60 byte packets

1 172.19.131.2 (172.19.131.2) 1.129 ms 1.162 ms 1.433 ms

2 * * *

3 * * *

4 * * *

5 * * *

6 * * *

7 * * *

8 * * *

9 * * *

10 * * *

11 * * *

12 * * *

13 * * *

14 * * *

15 * * *

16 * * *

17 * * *

18 * * *

19 * * *

20 * * *

21 * * *

22 * * *

23 * * *

24 * * *

25 * * *

26 * * *

27 * * *

28 * * *

29 * * *

30 * * *

geeklinda@cyberpunk-geeklinda:~$ nmap 12.130.117.106

Starting Nmap 5.00 ( http://nmap.org ) at 2010-09-27 16:22 CDT

Interesting ports on 12.130.117.106:

Not shown: 997 filtered ports

PORT STATE SERVICE

80/tcp open http

82/tcp open xfer

8080/tcp open http-proxy

Nmap done: 1 IP address (1 host up) scanned in 7.38 seconds

geeklinda@cyberpunk-geeklinda:~$ nmap 12.130.117.106 -p0-5000

Starting Nmap 5.00 ( http://nmap.org ) at 2010-09-27 16:23 CDT

Interesting ports on 12.130.117.106:

Not shown: 5000 filtered ports

PORT STATE SERVICE

80/tcp open http

Nmap done: 1 IP address (1 host up) scanned in 15.70 seconds

Your IP address is:

Overwhelmed with spam? Protect your contact forms

Your Proxy IP: 12.130.117.106 Browser : Chrome 6.0.472.53 OS : Ubuntu Linux 10.04

	Delay	Host		Delay ( ms )				Success Rate
	Packet Loss			min	avg	max
1		svcacis-04-ge30.conxion.net 206.204.4.1		0.274	0.327	0.378		3 /	3	100%
2		ge2-1-brc2-sjca.us.conxion.net 206.204.250.145		0.306	0.331	0.345		3 /	3	100%
3		so-0-3-2-brj1-paca.us.conxion.net 206.204.250.25		1.232	1.235	1.239		3 /	3	100%
4		ge-6-9.car1.SanJose2.Level3.net 65.57.244.13		1.264	1.283	1.313		3 /	3	100%
5		ae-33-89.car3.SanJose1.Level3.net 4.68.18.133		2.172	2.285	2.395		3 /	3	100%
6		level3-gw.sffca.ip.att.net 192.205.33.81		4.178	4.221	4.257		3 /	3	100%
7		cr1.sffca.ip.att.net 12.122.137.18		54.245	70.505	87.754		3 /	3	100%
8		No name for this address 12.122.4.122		53.625	53.773	54.005		3 /	3	100%
9		No name for this address 12.123.7.109		53.023	53.290	53.507		3 /	3	100%
10		No name for this address 12.122.133.157		52.967	53.010	53.043		3 /	3	100%
11		mdf001c7613r0001-gig-10-1.chi2.attens.net 12.122.254.18		53.757	53.812	53.874		3 /	3	100%
12		mdf001c7613r0003-gig-10-1.chi2.attens.net 12.130.96.170		53.814	53.872	53.942		3 /	3	100%
13		No name for this address 12.130.100.142		53.659	53.675	53.706		3 /	3	100%
14		No name for this address 12.130.115.245		53.791	53.799	53.812		3 /	3	100%
15		NO RESPONSE		0.000	0.000	0.000		0 /	3	0%
16		NO RESPONSE		0.000	0.000	0.000		0 /	3	0%
17		NO RESPONSE		0.000	0.000	0.000		0 /	3	0%
18		NO RESPONSE		0.000	0.000	0.000		0 /	3	0%
19		NO RESPONSE		0.000	0.000	0.000		0 /	3	0%
20		NO RESPONSE		0.000	0.000	0.000		0 /	3	0%

Trace from

What I've learned: have a plan for analyzing a network! Don't just do it "on the fly" especially if you're only going to be in the air for two hours, and only allowed to have electronics on for ~half of that! (I spent some time googling... and installing...)