Question about a potentially malware infection

[kmcferrin]

I had an interesting situation come up this morning while at work. I was trying to get a laptop's wireless connection working when I noticed a new SSID being broadcast in my area. The SSID was "Free Public WiFi". Now we have 15 APs at my company, and all of them were broadcasting the correct SSID. So figured that someone had installed a rogue access point. It was then that I noticed that the AP for the "Free Public WiFi" SSID was actually showing up in Windows as a Peer-to-Peer wireless network, rather than a true AP. This obviously concerned me.

So I loaded NetStumbler onto my laptop and did a brief tour of the campus to see where the signal was strongest, and I traced it to the laptop of a user that isn't in the office today, though the laptop was running and the user was logged in. Netstumbler showed that the MAC associated with the "AP" began with the "02-15-00" sequence, which according to the IEEE is not an assigned sequence. NetStumbler identifies the manufacturer as "user-defined". Apparently this "AP" is being generated in software, and it seems like it is trying to hide details of it's existance.

I wanted to make sure that I did have the correct culprit, so I hit the button to disable the WiFi card on that user's laptop. Netstumbler showed the AP disappearing. When I re-enabled the WiFi card it immediately showed up again, only the MAC address had changed (though it still started with the "02-15-00" manufacturer code. So I definitely know what device is responsible.

I was able to unlock the user's PC without logging them out, and I didn't see anything out of the ordinary. The only programs that were installed that aren't part of our standard were MSN and Windows Desktop Search. I couldn't see anything fishy about the way that WiFi was configured (no connection bridging, etc). So I decided to reboot and log in as admin to see if I could find anything else. However, when I rebooted the "AP" disappeared, and didn't come back when I logged in. So I logged out and logged in as the user who the laptop belongs to, and it still didn't show up. I tried enabling/disabling WiFi several times but it didn't show back up again.

I have two working theories. The first is that the user (or some piece of malware unknowingly installed by the user) has created this peer-to-peer wireless hotspot and is allowing anyone who stops by unsecured wireless access to my LAN and/or the Internet. The second theory is that the user (or the malware) has created a fake hotspot, possibly proxying true web requests, in order to capture passwords, credit card numbers, etc. Either way, it's bad. I just can't find any details about what it might actually be, and how to remove it. Googling "Free Public WiFi" results in thousands of hits pointing to articles about cities that are implementing Free Public WiFi. McAfee and Symantec don't have anything referring to that phrase in their databases. Does anyone have any idea what it is that I am seeing?

 

[2ffat]

I've read articles describing this situation. Supposedly it is very common in airports to have someone hijack your wireless this way. I'll see if I can track one of the articles down.


James P. Cottingham
-----------------------------------------
[sup]I'm number 1,229!
I'm number 1,229![/sup]

 

[kmcferrin]

I did see a reference to this in an article on Lockergnome once, but other than mentioning that he saw an AP with teh same name while at an airport, the author provided no details.

I did get the fake AP to show up again, all I had to do was launch IE on the potentially compromised system, and it was back up. This makes me think that it is most likely proxying requests to steal passwords and such. Since it is actually a software-based AP it would be pretty easy for it to play man-in-the-middle with any encryption (not just WEP/WPA, but also with SSL sessions that it proxies).

 

[sidmickmol]

Have you done anymore with this user's system? Sounds like an interesting scenario.

 

[kmcferrin]

I sent the IT director to have a word with their boss about the situation, and it turned out that it was something that the user had installed themselves so that they could supposedly get free WiFi wherever they went. They obviously didn't realize that they were also opening up our systems in the process. Once this was pointed out, they uninstalled it.

I heard all of that from the IT director, and nobody has been able to tell me what the program was called. But I haven't seen the AP ever since. I'm thinking that it was "FON" or something similar.

 

[sidmickmol]

Interesting. Good to know about. Thanks for sharing.

 

[pafischer]

We saw this at our company too. An admin who should know better gave himself more permissions than he should have. His laptop started broadcasting the SSID "Free Public WiFi" with in Ad-Hoc mode with a MAC address different from the one burned on his card.

After power cycling his machine, "Free Public WiFi" came back again, with a different MAC address. We were using a WiFi sniffer with a power meter, so we know that it was his machine.

When he started running Task Manager and other admin tools his machine stopped broadcasting the SSID. Sometime after lunch we saw the SSID something like "OASIS WiFi (Free)" coming from his laptop. I know I have the name wrong, but it included OASIS and Free and something was in parenthesis.

If I get a chance I'm going to bring a stock Win XP laptop to that site again, and let it connect to his machine. I'll monitor the wifi connection with a 3rd laptop running a packet sniffer so we can see what, if anything, the "Free Public WiFi" system is doing to him.

I personally believe this is a WiFi worm. I will continue searching the AV sites to see if anyone has tagged it as such.