Hacking the "Captivate" Network
by Darlok


  No doubt many of you have seen those fancy computer screens mounted in
elevators in office buildings in major cities like New York, Chicago, and
Boston.  They provide news, sports, weather, advertising, and other information
to the occupants as they enjoy the ride.  Well, I was recently able to do some
poking around with the Captivate network in my building.  Once I figured out
that they were actually wireless devices residing on an 802.11b network I broke
out my wireless hacking tools and went to work.

  In my case, the wireless network did not have Wired Equivalent Privacy (WEP)
enabled, so it was open.  However, I couldn't obtain an IP address, so I
figured either DHCP wasn't running or the network was configured to disallow
new clients from associating with an access point and getting on the network.
It turned out that the latter was true.  How did I know?  After using Kismet to
capture IP and MAC addresses, I did some MAC spoofing.  Once on, I typed the IP
addresses of one o the AP's into my browser and got the administration page for
a Cisco Aironet 4800E.  To by (mild) surprise, it was not password-protected,
so I was able to basically do whatever I wanted.

  The main thing I wanted to do was configure it to allow my machine to
associate.  I accomplished this by navigating tot he "Association" page and
changin the "Allow automatic table additions" option from "off" to "on."  I was
now able to freely associate with this access point without having to spoof a
MAC addy.  I then performed some network discovery and OS fingerprinting to see
what I could see.

  I discovered that the screens mounted in the elevators are actually wireless
PDA-type devices running WindowsCE and that they have Telnet open.  I also
found a long Windows 2000 server which, according to my packet sniffer, was
broadcasting the images to the elevator screens every few seconds.  As much as
I wanted to, I suppressed the urge to attempt to inject my own images.  And
yes, I also set the "Allow automatic table additions" option back to "off."
Anyhow, I hope this proves interesting for some of you wireless hackers out
there.