Products: Aircapture Wlan 14, Wlan 14+, WFA

Overview

The AIRCAPTURE WLAN 14, 14+ are Linux-based forensics tool, designed for the law enforcement and security officers to collect wifi packet, chat conversation and IP telephony from all 802.11a/b/g channel stealthily. It has 15 wireless cards, a GPS, one external antenna connector and support for host-swappable disks. All the 14 channels are able to capture simultaneously. The captured data is able to recover the key and decapsulate to Ethernet packet for analysis offline. The key features of AC WLAN14  and 14+ include:

• Continuously scanning and visualizing networks in real time
• Capturing 14 channels of 802.11b/g simultaneously and stealthily
• Captured data is stored in standard pcap format
• Key Recovery for WEP, WPA, WPA2-PSK with or without FPGA  acceleration
• Including dictionaries for multiple languages, customer can upload own
• Decapsulation the packet to Ethernet packet by remove the wifi header
• User friendly GUI, Java based – ( Mozilla recommended )
• GPS time and position stamping for each capture file
• Field removable HDDs
• Advanced filtering for 2nd layer to higher layers during capturing
• Remote controllable by separate ethernet port ( xml ) provided
• Wlan 14+ includes one or many FPGA boards mounted into chassis, FPGA accelerates WPA decryption tremendously.

Production specification
Hardware

• Intel Core 2 Dual CPU
• 1GB RAM memory
• 1DVD Burner
• System HDD 250 GB Barracuda 7200.10
• Data discs  1 TB
• Total space up to 2 TB
• External mounting 3 SATA1 HDDs
• 19 inch rack mount chassis
• 15 Radio Modules based on Atheros Chipset ( 14 to record data, one to visualize )
• Power splitter and low noise LNA ( low noise amplifier )
• 2,4 GHz omnidirectional antenna with 6 dBi gain ( customer can mount own antenna )
• Integrated GPS with SIRF III chipset
• FPGA support optional for wep and wpa, wpa2 decryption ( can be multiple cards )
• All cabling and radios nicely secured into chassi, only aggregate antenna outside.

OS

• Linux Fedora Core 6 distribution
• Web server based GUI
• Remote control through XML control

Other:

• 230V AC (12V DC Optional )
• An aluminum case with bumper on all corner to provide shock protection

In the unit control Tab, user can change the IP address, restart or shut down AirCapture unit, view the usage of HDD, system log and also change the date, time and UTC offset vale.

Two gui screenshots from Wlan 14 Networks Tab.

Gui screenshot from Advanced Capturing Tab, filter on one or several mac´s ( targets ) on all channels if you like.

Expert knowledge indicates If network can be decrypted under Retrieve network information tab.

Then recover key tab.

Software decryption in Wlan 14, WPA takes some time, WEP much faster…

With Wlan 14+ and [ 1 ] Fpga performance is minutes/seconds not hours, for WPA/WPA2 Fpga is necessary to have performance to crack. All decryption is performed passive.

AirCapture Wireless Forensics Analyzer ( WFA )

Email reconstruction including attachment.	Http reconstruction is done offline ( not need connect to internet ).
Pic Viewer plays pictures captured from pcap data in your favourite speed.

After file is decrypted, we keep or remove the 802.11 header with the file and analyze it in our Aircapture Wireless Forensics Analyzer. Or any other analyzer understanding pcap files.

WFA is win software, easy to use and handles high layers such as email reconstruction + attachements, http reconstruction and chat. We have Pic-Viewer which is a real advandage for officers saving time anayzing content, picures can be replayed and analyzed and save time when to analyze data. Data captures in for example winpcap or wireshark can be imported to WFA to help forensics specialists save time and simplify the job. Optional lowlayer part is only for those interested in wireless lan data part, Mac and lower, it adds unique forensics wifi expertise to deal with phenomens such as evil twins.

If interested in WFA please send us an email and ask for a 1 week trial license.

Targeted Users Wlan 14, Wlan 14+

• Military and Police agencies in need of Automated Wireless Forensic tools for use in battle field or in other surveillance operations. Wlan is easy to use and cheap as a method of communication by war lords, terrorists and criminals – Wlan is growing and coming available in mobile phones and is used for voice, video and data.

• Stock traders such as banks in need of storing business data must  not only store data on the wired network but also the wireless network to be able to provide evidence if hacked thru the wireless network. Data should be stored for months and when needed detailed logs should be used as evidence. Even if the Stock trader does not allow wireless networks, they can be attacked thru wireless interface on laptops or thru rogue AP´s connected to the wired network without allowance.

• Engineering and quality assurance (QA) teams developing and testing Wlan can use Aircapture Wlan 14 as a method of testning time related issues between radio channels. Wlan 14 monitor simultanously capture data on all 14 channels and provides accurate time stamp on each pcap file produced. Roaming time can be analyzed between channels and the pcap files can be merged and exported to any analyzer.

Targeted User Wireless Forensics Analyzer, WFA

• Any Wlan 14 or Wlan 14+ customer will enjoy working with our WFA that works well in combination with our Wlan 14 chassi.

• IT security professionals that wants a easy to use tool for forensics. Anyone can use for example free wireshark to store data in pcap format on disk directly from the network. Then import the pcap file into WFA to reconstruct web pages still being offline, use our pic-viewer or reconstruct emails with attachements and chats.

• IT security professionals with interest in Wlan layer, will want to look at our automatic features to find evil twins etc from pcap files.

Please contact us at;

Aircapture AB
Upplagsvaegen 1
117 43 Stockholm
Sweden

Email; info@aircapture.net

Phone; +46-8-6189700
Fax; +46-8-54560580

For a more detailed description of AirCapture Wlan 14 please fill out the following form: