Skip to main content ↑ ↓
Topic: connman-gtk is not cycling IP addresses. (Read 450 times) previous topic - next topic
0 Members and 3 Guests are viewing this topic.

connman-gtk is not cycling IP addresses.

I'm using public wifi, so I need to cycle my IP's and mac's when people get nosy.
cmst will cycle the ip addresses.
connman-gtk is not cycling the ip's.
I want to break any MITM they have set up and stop their eventual fuzzing of the browser.
I'm not sure how I'm going to deal with them hooking the login gui, but for now I re-install.
They are installing their backdoor that will boot at login, probably before they begin fuzzing the browser.
By the time I see the browser fuzzing they have already dropped their files and cleaned the logs, so I'm dealing with a lost cause at that point.

Typically, when someone is poking around in my system, I change my connection.
I'm not a fan of Capture The Flag: Cafe Edition and I can't afford a VPN right now, TOR is too slow for video scrolling.
I do have a Pi I planned to turn into a 4G router but I haven't programmed AT the modem yet.

Can I do this with connman-gtk?
How do I address cycling my IP and randomizing my Mac when trouble is near?

Re: connman-gtk is not cycling IP addresses.

Reply #2 –
I have macchanger. It causes additional issues and doesn't cycle the IP.

I have disabled autoconnect.
disconnect from network.

Settings: set to DHCP
(In cmst, to cycle the IP's you must set a static IP then change it to DHCP to trigger the IP to cycle. DHCP grabs a new IP.)
The cmst method doesn't work with connman-gtk when I tried it.

macchanger -er wlan0
Code: [Select]
[ERROR] Could not change MAC: interface up or insufficient permissions: Device or resource busy
(Adding the macchanger issue complicated learning how to cycle the IP in DHCP mode.)

To fix the [error], I have to turn off the wifi, then turn wifi back on.
After this step, macchanger works, but IP remains the same.
 

Re: connman-gtk is not cycling IP addresses.

Reply #3 –
Last I checked, macchanger won't work if the interface is up. DHCP servers usually assign new IPs to new MACs, if the latter appear within a short interval; you cannot force a DHCP server you don't control to assign you a different IP. You have to resort to static.

Re: connman-gtk is not cycling IP addresses.

Reply #4 –
In general you do not WANT gtk-connam to change the ip address to a system on a wifi network.  It is leased and convient to hot have systems swapping IP addresses on the local wifi network  allthough static IPs assinged to mac addresses in DHCP is a better solution to that.

It is not a wifi issue, it is a dhcp behavior.   Change your mac address?

Re: connman-gtk is not cycling IP addresses.

Reply #5 –
Quote from: mrbrklyn – on
In general you do not WANT gtk-connam to change the ip address to a system on a wifi network.  It is leased and convient to hot have systems swapping IP addresses on the local wifi network  allthough static IPs assinged to mac addresses in DHCP is a better solution to that.

It is not a wifi issue, it is a dhcp behavior.   Change your mac address?

I am on public wifi near a Uni that teaches wannabe hackers Comp Science. They access my computer, make changes, add scripts to the login. Laugh when I review the logs and wipe and reinstall.

I need the ability to change IP's and Macadresses to make MITM troublesome for techniques I'm not aware of, and set static IP's for those practicing their arp poisoning skills.

Once I understand how Capture The Flag: Cafe Edition works, I can develop alternative strategies.

macchanger is buggy.
connman-gtk doesn't work as I expect.

Code: [Select]
talmudeem_sell_their_children_to_be_whores:[tsedek1]:~$ sudo macchanger -er wlan0
Current MAC:   my real mac address (unknown)
Permanent MAC: my real mac address (unknown)
[ERROR] Could not change MAC: interface up or insufficient permissions: Device or resource busy
talmudeem_sell_their_children_to_be_whores:[tsedek1]:~$ sudo macchanger -er wlan0
Current MAC:   my real mac address (unknown)
Permanent MAC: my real mac address (unknown)
New MAC:       86:5e:cd:3a:b4:c4 (unknown)
talmudeem_sell_their_children_to_be_whores:[tsedek1]:~$ sudo macchanger -er wlan0
Current MAC:   86:5e:cd:3a:b4:c4 (unknown)
Permanent MAC: my real mac address (unknown)
[ERROR] Could not change MAC: interface up or insufficient permissions: Device or resource busy
talmudeem_sell_their_children_to_be_whores:[tsedek1]:~$ sudo macchanger -er wlan0
Current MAC:   86:5e:cd:3a:b4:c4 (unknown)
Permanent MAC: my real mac address (unknown)
New MAC:       8a:50:bf:1a:3d:ac (unknown)
talmudeem_sell_their_children_to_be_whores:[tsedek1]:~$ sudo macchanger -er wlan0
Current MAC:   8a:50:bf:1a:3d:ac (unknown)
Permanent MAC: my real mac address (unknown)
[ERROR] Could not change MAC: interface up or insufficient permissions: Device or resource busy
talmudeem_sell_their_children_to_be_whores:[tsedek1]:~$ sudo macchanger -er wlan0
Current MAC:   8a:50:bf:1a:3d:ac (unknown)
Permanent MAC: my real mac address (unknown)
[ERROR] Could not change MAC: interface up or insufficient permissions: Device or resource busy
talmudeem_sell_their_children_to_be_whores:[tsedek1]:~$ sudo macchanger -er wlan0
Current MAC:   8a:50:bf:1a:3d:ac (unknown)
Permanent MAC: my real mac address (unknown)
New MAC:       c6:b9:77:0a:43:64 (unknown)
talmudeem_sell_their_children_to_be_whores:[tsedek1]:~$

Re: connman-gtk is not cycling IP addresses.

Reply #6 –
Quote from: tsedek1 – on
Quote from: mrbrklyn – on
In general you do not WANT gtk-connam to change the ip address to a system on a wifi network.  It is leased and convient to hot have systems swapping IP addresses on the local wifi network  allthough static IPs assinged to mac addresses in DHCP is a better solution to that.

It is not a wifi issue, it is a dhcp behavior.   Change your mac address?

I am on public wifi near a Uni that teaches wannabe hackers Comp Science. They access my computer, make changes, add scripts to the login. Laugh when I review the logs and wipe and reinstall.

I need the ability to change IP's and Macadresses to make MITM troublesome for techniques I'm not aware of, and set static IP's for those practicing their arp poisoning skills.

Once I understand how Capture The Flag: Cafe Edition works, I can develop alternative strategies.

macchanger is buggy.
connman-gtk doesn't work as I expect.

Code: [Select]
talmudeem_sell_their_children_to_be_whores:[tsedek1]:~$ sudo macchanger -er wlan0
Current MAC:   my real mac address (unknown)
Permanent MAC: my real mac address (unknown)
[ERROR] Could not change MAC: interface up or insufficient permissions: Device or resource busy
talmudeem_sell_their_children_to_be_whores:[tsedek1]:~$ sudo macchanger -er wlan0
Current MAC:   my real mac address (unknown)
Permanent MAC: my real mac address (unknown)
New MAC:       86:5e:cd:3a:b4:c4 (unknown)
talmudeem_sell_their_children_to_be_whores:[tsedek1]:~$ sudo macchanger -er wlan0
Current MAC:   86:5e:cd:3a:b4:c4 (unknown)
Permanent MAC: my real mac address (unknown)
[ERROR] Could not change MAC: interface up or insufficient permissions: Device or resource busy
talmudeem_sell_their_children_to_be_whores:[tsedek1]:~$ sudo macchanger -er wlan0
Current MAC:   86:5e:cd:3a:b4:c4 (unknown)
Permanent MAC: my real mac address (unknown)
New MAC:       8a:50:bf:1a:3d:ac (unknown)
talmudeem_sell_their_children_to_be_whores:[tsedek1]:~$ sudo macchanger -er wlan0
Current MAC:   8a:50:bf:1a:3d:ac (unknown)
Permanent MAC: my real mac address (unknown)
[ERROR] Could not change MAC: interface up or insufficient permissions: Device or resource busy
talmudeem_sell_their_children_to_be_whores:[tsedek1]:~$ sudo macchanger -er wlan0
Current MAC:   8a:50:bf:1a:3d:ac (unknown)
Permanent MAC: my real mac address (unknown)
[ERROR] Could not change MAC: interface up or insufficient permissions: Device or resource busy
talmudeem_sell_their_children_to_be_whores:[tsedek1]:~$ sudo macchanger -er wlan0
Current MAC:   8a:50:bf:1a:3d:ac (unknown)
Permanent MAC: my real mac address (unknown)
New MAC:       c6:b9:77:0a:43:64 (unknown)
talmudeem_sell_their_children_to_be_whores:[tsedek1]:~$


Changing the IP address doesn't secure your box. 

Are you familiar with the ss command?

Re: connman-gtk is not cycling IP addresses.

Reply #7 –
Quote from: mrbrklyn – on
Quote from: tsedek1 – on


I am on public wifi near a Uni that teaches wannabe hackers Comp Science. They access my computer, make changes, add scripts to the login. Laugh when I review the logs and wipe and reinstall.

I need the ability to change IP's and Macadresses to make MITM troublesome for techniques I'm not aware of, and set static IP's for those practicing their arp poisoning skills.

Once I understand how Capture The Flag: Cafe Edition works, I can develop alternative strategies.

macchanger is buggy.
connman-gtk doesn't work as I expect.

Code: [Select]
talmudeem_sell_their_children_to_be_whores:[tsedek1]:~$ sudo macchanger -er wlan0
Current MAC:   my real mac address (unknown)
Permanent MAC: my real mac address (unknown)
[ERROR] Could not change MAC: interface up or insufficient permissions: Device or resource busy
talmudeem_sell_their_children_to_be_whores:[tsedek1]:~$ sudo macchanger -er wlan0
Current MAC:   my real mac address (unknown)
Permanent MAC: my real mac address (unknown)
New MAC:       86:5e:cd:3a:b4:c4 (unknown)
talmudeem_sell_their_children_to_be_whores:[tsedek1]:~$ sudo macchanger -er wlan0
Current MAC:   86:5e:cd:3a:b4:c4 (unknown)
Permanent MAC: my real mac address (unknown)
[ERROR] Could not change MAC: interface up or insufficient permissions: Device or resource busy
talmudeem_sell_their_children_to_be_whores:[tsedek1]:~$ sudo macchanger -er wlan0
Current MAC:   86:5e:cd:3a:b4:c4 (unknown)
Permanent MAC: my real mac address (unknown)
New MAC:       8a:50:bf:1a:3d:ac (unknown)
talmudeem_sell_their_children_to_be_whores:[tsedek1]:~$ sudo macchanger -er wlan0
Current MAC:   8a:50:bf:1a:3d:ac (unknown)
Permanent MAC: my real mac address (unknown)
[ERROR] Could not change MAC: interface up or insufficient permissions: Device or resource busy
talmudeem_sell_their_children_to_be_whores:[tsedek1]:~$ sudo macchanger -er wlan0
Current MAC:   8a:50:bf:1a:3d:ac (unknown)
Permanent MAC: my real mac address (unknown)
[ERROR] Could not change MAC: interface up or insufficient permissions: Device or resource busy
talmudeem_sell_their_children_to_be_whores:[tsedek1]:~$ sudo macchanger -er wlan0
Current MAC:   8a:50:bf:1a:3d:ac (unknown)
Permanent MAC: my real mac address (unknown)
New MAC:       c6:b9:77:0a:43:64 (unknown)
talmudeem_sell_their_children_to_be_whores:[tsedek1]:~$


Changing the IP address doesn't secure your box. 

Are you familiar with the ss command?

I didn't say it would secure my computer.
As long as there aren't any dropped remote access tools, or files in memory only tools, and it is just IP shenanigans, then switching IP's is good enough.
When it is one of the 1st 2 then IP switching can't help.
The first one requires finding the offending files, while the second one can be fixed with a reboot.
When worms...well, who can beat them?

What good is the ss command if you're not using it when someone gains access? It isn't an automatic tool sending you updated information. You have to run the tool. Do I run it every 10 minutes to see when someone is middling me?

TCPDump stream piped into Scapy, which has certain parameters set, will tell you when someone is accessing your system in realtime, but I don't know how to set that up.

Re: connman-gtk is not cycling IP addresses.

Reply #8 –
Quote from: nous – on
Last I checked, macchanger won't work if the interface is up. DHCP servers usually assign new IPs to new MACs, if the latter appear within a short interval; you cannot force a DHCP server you don't control to assign you a different IP. You have to resort to static.
CMST changes IP's without issues. Connman-GTK does not.

I'm trying to work with connman-gtk because it is part of the Artix limited application set. But it doesn't work as I would expect from my experience with CMST.
Maybe I can learn how to compile CMST for myself, instead of relying on AUR files, and set a self hosted repo on my HDD.

CMST:
Disable Network
machanger -er wlan0 gives me a new mac address.
Enable Network
I have to set a [manual] IP Address.
Then, when I switch to [DHCP] I am given a new IP.
Then, I set that IP as my new [manual] entry.
Disable Network.
macchanger -er wlan0 to get another new mac address.
Enable network.
When I want to change IP's I repeat the above.

A few steps, but it works. Connman-gtk...not so much.

Re: connman-gtk is not cycling IP addresses.

Reply #9 –
Quote from: tsedek1 – on


What good is the ss command if you're not using it when someone gains access? It isn't an automatic tool sending you updated information. You have to run the tool. Do I run it every 10 minutes to see when someone is middling me?

TCPDump stream piped into Scapy, which has certain parameters set, will tell you when someone is accessing your system in realtime, but I don't know how to set that up.


Nobody is gaining control of my laptop when it is on a public wifi, even at the hope convention or a 2600 meeting.  It is just not happening.  You need to secure your laptop.  And ss will tell you all the services you have running.  If your system is already rooted, you need to fix that.

Re: connman-gtk is not cycling IP addresses.

Reply #10 –
I admit to being a bit confused. How often do you change your local IP and if there is no set pattern to it what is your prompt ?

As for AUR. If you don't want to use an AUR helper type program it's easy to set get hold of  the PKGBUILD and just build the package locally. As CMST is in maintenance mode, and only getting translation based commits, updates are unlikely to be an issue and a self hosted repo unnecessary. The actual PKGBUILD is a nice and simple one and thus easy to review.

I would have thought any attacker on public wifi would be scanning the whole subnet so if you change your local IP then they'll soon find the new one and would also imagine you can often be fingerprinted by more than just your mac address?

Quote
can't afford a VPN right now
Do you have not have a home connection under your control? If you do just setup a vpn on your home router, which any decent router can do, or on a device which runs all the time.
Cost shouldn't be the concern about using public vpns's rather trust.

Re: connman-gtk is not cycling IP addresses.

Reply #11 –
I am beginning to understand why public wifis are always running out of leasable addresses.

I want to make this plain and simple...

CHANGING IP ADDRESSES DOES NOT MAKE YOUR SYSTEM SECURE.

and it sounds like you are already rooted.

Re: connman-gtk is not cycling IP addresses.

Reply #12 –
Quote from: gripped – on
I admit to being a bit confused. How often do you change your local IP and if there is no set pattern to it what is your prompt ?

Depends on how often retards like to play games. I might change my IP and mac on login and never again, or I might change my IP and mac 10 times in a day.
I have wiped and reinstalled as many as 4 times in a day. By the time they begin fuzzing Firefox they've already dropped their boot with login scripts, cleaned the logs, modified the firewall, set up cron jobs, modified PAM, and other stuff I'm not familiar with.
They're fuzzing the Firefox tab that has web login session cookies, like Youtube, Facebook, etc. to complete their monitoring infrastructure.

Quote from: gripped – on
As for AUR. If you don't want to use an AUR helper type program it's easy to set get hold of  the PKGBUILD and just build the package locally. As CMST is in maintenance mode, and only getting translation based commits, updates are unlikely to be an issue and a self hosted repo unnecessary. The actual PKGBUILD is a nice and simple one and thus easy to review.
On the other Arch Distro I used, I learned to compile packages for my self, but I never learned how to write a PKGBUILD file. It is on my todo list.
Is there a guide that teaches how to write a PKGBUILD file?

Quote from: gripped – on
I would have thought any attacker on public wifi would be scanning the whole subnet so if you change your local IP then they'll soon find the new one and would also imagine you can often be fingerprinted by more than just your mac address?
In a large institution like a University Library where there could be litteraly hundreds to thousands of connected systems, and you have a specific target you want to compromise, scanning the entire LAN is looking for a needle in a haystack.
Have a friend run aircrack-ng with remotedesktop and sit near your target, then you only need to review 5-10 systems instead of thousands.

Quote
can't afford a VPN right now
Quote from: gripped – on
Do you have not have a home connection under your control? If you do just setup a vpn on your home router, which any decent router can do, or on a device which runs all the time.
Cost shouldn't be the concern about using public vpns's rather trust.
No, I do not have a home.
Like I said, I have a solution, but I have to build it. Are you familiar with programming modems with AT commands?

Re: connman-gtk is not cycling IP addresses.

Reply #13 –
Quote from: mrbrklyn – on
I am beginning to understand why public wifis are always running out of leasable addresses.

I want to make this plain and simple...

CHANGING IP ADDRESSES DOES NOT MAKE YOUR SYSTEM SECURE.
Instead of SHOUTING you should probably read my reply to you.

Quote from: mrbrklyn – on
and it sounds like you are already rooted.
Not after I wipe and reinstall, and at least not in the first 10 minutes of connecting to the network.
After that it's a game of Cat and Mouse. Who is faster, the Cat or the Mouse?

Re: connman-gtk is not cycling IP addresses.

Reply #14 –
Quote from: tsedek1 – on
Depends on how often retards like to play games. I might change my IP and mac on login and never again, or I might change my IP and mac 10 times in a day.
I have wiped and reinstalled as many as 4 times in a day. By the time they begin fuzzing Firefox they've already dropped their boot with login scripts, cleaned the logs, modified the firewall, set up cron jobs, modified PAM, and other stuff I'm not familiar with.
They're fuzzing the Firefox tab that has web login session cookies, like Youtube, Facebook, etc. to complete their monitoring infrastructure.
I've got to be honest, it sounds like you are suffering from paranoia.
I don't say that in an attempt at a personal attack but with genuine concern.

If it was as easy to get hacked as you suggest then we would all be hacked.
The only way I can see that what you state is possible is that every time you wipe and reinstall you then do something yourself which leaves your system wide open. Or maybe if you are forced to install some program by an institution, university or whatever, which the attackers know has vulnerabilities.
 
Artix forum uses a single cookie to remember youOK