Is it possible to easily broadcast fake Wi-Fi beacon frames?

Installing and Using OpenWrt
1

Hello!

Long story short, I want to duplicate what these guys did to enable hearing aid feature for Apple AirPods Pro 2: https://lagrangepoint.substack.com/p/airpods-hearing-aid-hacking

I'm using an iPad with no GPS or cellular capabilities, OpenWRT router is running a VPN client and I get needed response from https://gspe1-ssl.ls.apple.com/pep/gcc (I get "US" which is where my VPN server is), but the feature doesn't work and in Maps I see my true location.

To spoof location they used SkyLift: https://github.com/adamhrv/skylift

It runs on ESP32 which I don't have, so I wanted to ask you guys first, is it possible to do something similar using OpenWRT?
Ideally I'd get data from wigle.net from the same location where my VPN server is and send fake/spoofed beacons in a loop (10 times a second as I understand it).

I don't have skills needed to change OpenWRT code and compile it, but if there is a ready to use tool that can send such beacons so I could use it in a simple bash script - that would be perfect.

Thanks.

2

Does random mac luci/nwtwork/wireless/edit an ap/lower advanced tab/ mac address -> set random fill the gap?

1 Like
3

The aircrack-ng suite is available in OpenWrt. I think one of its programs will replay a file of arbitrary packets.

1 Like
4

I'm pretty sure it uses all APs it can detect and use this information to get location data, that's why in the article they say "We also bumped the number of SSIDs to cycle up through to 100 from 10."

But I'll give it a shot, just need to somehow block WiFi signal of my neighbors first. Thanks!

5

populate the /etc/config/wireless file for each ssid and mac with

config wifi-iface 'wifinet<number>'                                  
                  option device '<radio_name/wifi_device_name>'                
                  option mode 'ap'                                                       
                  option ssid '<ssid>'                                       
                  option encryption 'sae-mixed'                                                                
                  option macaddr '<mac>'                                                              
                  option key '<any_valid_password>'                                
                  option network 'lan'

replace the text in <>
save and restart

2 Likes
6

Thanks! I started learning how to forge and play packets with aircrack-ng that @mk24 suggested, but this is a much simpler solution for my problem. Created 15 APs as a test and they are visible when searching for WiFi on my devices :+1:

I actually did try to just create multiple APs (in LuCI), but it failed on Xiaomi Mi WiFi Mini after just a couple additional APs, they weren't starting. This time I'm using ASUS RT-AX53U and it has no issues it seems.

7

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.