Tuesday, October 9, 2007

Cool New Tools in Windows Mobile 6

icrosoft has recently announced the release of Windows Mobile 6 to device manufacturers. While it will be sometime before you can get your hands on a Windows Mobile 6 device, Microsoft has since released the Windows Mobile 6 SDK so that developers can have an early look at it and prepare for the impending launch of these newer devices. A good portion of the features of the newer platform is for native developers (using Embedded Visual C++), and it will take some time for these new features to be supported on the .NET Compact Framework, making them available to managed developers. Nevertheless, the release of Windows Mobile 6 contains some cool new tools and utilities for managed developers.

With the launch of Windows Mobile 6, Microsoft has yet again introduced a new naming convention for Windows Mobile devices. Table 1 shows the new names for each device category.

Previously known as

Now known as

Windows Mobile 5.0 Pocket PC

Windows Mobile 6 Classic

Windows Mobile 5.0 Pocket PC Phone Edition

Windows Mobile 6 Professional

Windows Mobile 5.0 Smartphone

Windows Mobile 6 Standard


Table 1. New Naming for Windows Mobile devices

The previous version of Windows Mobile has a point release number, which is Windows Mobile 5.0. But in this latest version, Microsoft has decided to do away with the point and simply calls it Windows Mobile 6 (and not Windows Mobile 6.0).

Downloading the SDKs
To develop for the Windows Mobile 6 platforms, you need to download two SDKs, depending on the platform you are targeting:

  • Windows Mobile 6 Classic/Professional: Windows Mobile 6 Professional SDK (Standard and Professional)
  • Windows Mobile 6 Standard: Windows Mobile 6 Standard SDK
Both SDKs can be downloaded here.

Note that installing the new Windows Mobile 6 SDKs requires the following:

  • Visual Studio 2005 SP1 or later
  • ActiveSync 4.5
  • .NET Compact Framework 2.0 SP1
If you don't have the prereq before installations, a dialog will appear during the installation process. Simply click on the Prerequisites button to download the appropriate components you are missing.

Monday, October 8, 2007

Secure Your Wireless Networks with Scapy Packet Manipulation

ith wireless networks beginning to dominate both home and corporate networking, new challenges on the security front are inevitable. The first step in securing a wireless network is determining the state of the network (without any prior knowledge) and then providing a defense against intrusions. Enter Scapy, an excellent packet-crafting tool written in Python by Philippe Biondi. Unlike other sniffers such as Kismet and Airodump-ng, Scapy is scriptable and extremely easy to use.

This article outlines a methodology for wireless network assessment and intrusion detection using proven techniques with tools such as Scapy.

The Methodology: Passive Sniffing
A wireless network consists of several stations, which can be divided into two categories: access points and NICs (network interface cards). These stations communicate using IEEE 802.11 standards. The 802.11 packets that the stations transmit consist of three types of frames: management, control, and data. Each of these frames contains critical information that can help in establishing and managing communication channels between stations.

A wireless network assessment methodology can employ one of two techniques:

  • Passive sniffing – This is done by sniffing wireless traffic in RF monitor mode to capture frames. By analyzing frames one can enumerate networks, harvest information, determine weak areas, and map possible attack vectors.
  • Active packet injection – You can build an attack plan on this type of passive data collection. The plan would involve performing raw packet injection in the air at Layer 2 (Data Link) of the Open System Interconnection and observing the resulting network or product behavior. This can lead to detecting vulnerabilities such as types of buffer overflow or authentication bypass.

This article discusses a passive-sniffing methodology. The following are the steps for this approach:

  1. Set up a station for RF monitor mode
  2. Sniff packets and discover network access points
  3. Discover hidden access points and SSID (service set identifier)
  4. Harvest MAC and IP addresses
  5. Perform ongoing intrusion detection with sniffing

Setting Up the Station for RF Monitor Mode
When you set up a station for RF monitor mode, its NIC should be able to sniff the 2.4 GHz spectrum to capture 802.11 packets. Most 802.11a/b/g NICs have this capacity. For example, this article uses Linux to set up the NIC and the Linux kernel contains a driver to handle this capability.

Here is the command to put the interface in monitor mode:


root@bluelinux:/home/shreeraj/wifi# iwconfig eth1 mode monitor
root@bluelinux:/home/shreeraj/wifi# iwconfig eth1
eth1 IEEE 802.11b ESSID:"" Nickname:"Prism I"
Mode:Monitor Frequency:2.462 GHz Access Point: Not-Associated
Bit Rate:11 Mb/s Sensitivity:1/3
Retry min limit:8 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:off
Link Quality=76/92 Signal level=-26 dBm Noise level=-149 dBm
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:0 Invalid misc:0 Missed beacon:0

Note: For madwifi, you may need to use the wlanconfig command to set it up.

Next, you need to define a channel or frequency on which to perform the packet sniffing. Use the following command (example for channel 11):


root@bluelinux:/home/shreeraj/wifi# iwconfig eth1 channel 11

You also can channel-hop to sniff different channels by assigning a slice of time to each of them.

Creating a Windows Mobile Wireless Remote PowerPoint Clicker

Imagine giving a presentation from your cellphone! Learn how to write a PowerPoint clicker application for your Bluetooth-enabled Windows Mobile device.

f you've got a Windows Mobile device with Bluetooth connectivity, why not write your own PowerPoint clicker application so that you can use it in your next company presentation and impress your colleagues and boss? This is the project that I recently set to do when I wanted to buy a wireless remote clicker that I can use for my presentations. Rather spend the money on an additional gadget, I decided that it would be more fun to write my own application. This is what you will learn to do in this article.

There are two components that you will build:

  1. A desktop windows application that controls the PowerPoint slides
  2. A Windows Mobile application that sends commands to the desktop application

Bluetooth drives wireless appliances

As a specification for small form factor, low-cost, short-range radio links between mobile voice communications and computing devices, Bluetooth is anticipated to create a $500 million chip market by 2004, according to market research firm Strategies Unlimited. Philsar Semiconductor, now a member of the Wireless Communications Division of Conexant, defines the Bluetooth market according to personal wireless connectivity (PWC) segments. PWC is a new paradigm that allows for the network to be intuitively based on the end user, providing an unparalleled degree of personal connectivity via wireless communications. Accessories such as cellular headsets, notebook computers and personal digital assistants are just a few of the applications that Bluetooth will integrate in piconets of PWC.

The universal standard of connectivity that Bluetooth provides will drive the development and broad market acceptance of these and other PWC applications. Philsar's position is that one key success factor of PWC is a high degree of robust performance.

Robustness refers to the ability of a system to operate in a non-ideal environment consisting of potentially many other signals (blockers) and experiencing rapidly changing received signal levels. Difficulties associated with these issues are addressed in the following sections.

Tricky proposition

Dealing with the power spectral density of a Bluetooth signal can be tricky. For example, a typical waveform for an FSK pager's Bluetooth signal could be a large modulation index FSK spectrum of 15dB in power spectral density at its center, while the low modulation index Gaussian FSK has its peak power spectral density at its center.

This peak in the signal power for the Bluetooth signal occurs exactly at dc for receiver architectures based on direct downconversion. Consequently, direct downconversion architectures have to deal with on-chip dc offset problems. The most severe source of dc offset arises from the second-order distortion products from any blocker (jammer) falling in-band.

As a result of the Bluetooth spectral shape, it is not possible to simply use blocking capacitors in the receiver path without greatly disturbing the received signal. It is possible to provide dc compensation circuits to adaptively tune out any dc offsets due to a blocker, before the start of a receive packet. However, this is extremely difficult to do in circumstances where a blocker appears midway through a receive packet. Note that the blocker need not be even in the adjacent channel to completely disturb the received information.

Spectral congestion is another issue to consider. Whereas the pager environment enjoys large guard bands between channels, the Bluetooth environment is extremely crowded, with channel spacing equal to the modulation rate. This crowding results in overlapping power spectral densities, which requires extremely difficult filtering to achieve robust performance.

In addition to having a crowded spectrum, the blockers (jammers) with which a Bluetooth transceiver must operate can have powers of 0dB, 30dB and 40dB stronger than the desired signal, at frequency offsets of 1MHz, 2MHz and 3MHz, respectively. Further, the Bluetooth receiver must operate satisfactorily in the presence of a co-channel blocker having a signal strength of -11dB with respect to that of the desired signal.

Packet-by-packet response

The Bluetooth receiver must not only be able to respond to fading channel levels for each individual received signal, it must also respond, packet by packet, to different received signals. These different signals may have received power levels anywhere within a 50dB dynamic range. As a result, the receiver must have a rapid AGC response time.

Philsar's PH2401 addresses these issues with a highly integrated radio architecture. It incorporates a highly flexible receiver architecture with interleaved filter and AGC stages, rapid AGC, excess gain availability and gain-location management. It also eliminates the use of high 1dB compression point circuits such as the image-reject downconverter, back-end filter stages and ADCs in the receiver, and the traditional upconverter/filter chain in the transmitter.

The interleaved filters and AGC stages progressively attenuate adjacent-channel blockers while boosting the desired on-channel signal, without hitting the 1dB compression point of any of the stages. The AGC allows operation through a rapidly changing received-signal strength, while the excess gain available allows operation within a fade. The gain-location management allows gain to be increased at the front-end stages to establish noise-figure when no blockers are present, or to be decreased to avoid compression when blockers are present.

The relaxed 1dB compression-point requirement for the receiver image-reject down-converter, back-end filter stages, and ADCs is a consequence of the use of complex filter/rapid AGC stages feeding a complex pll demodulator. The complex filter stages possess a pass-band at the positive component of the center frequency of the IF, but strong attenuation at the negative component of the center frequency. This greatly relaxes the image-rejection requirement on the preceding downconverter. Further, since the filter stages are complex, the required number of cascaded filter stages is reduced by a factor of two. As a result, the back-end stages are not required to handle as high a level of signals as a receiver using twice as many stages of real filters does.

Finally, the rapid AGC stages compensate for signal fluctuations resulting in a reduced dynamic range requirement for the ADCs, which also saves current.

The complex PLL demodulator allows the PH2401 receiver to operate robustly with remote transmitters that are operating off-frequency, or with an incorrect modulation index. In comparison, the PH2401 transmitter will never operate off-frequency or with an incorrect modulation frequency, since it is based on a delta-sigma fractional-N frequency synthesizer.

The elimination of the transmitter upconverter/filter is a consequence of the use of a delta-sigma fractional-N frequency synthesizer in place of a traditional modulator upconverter. By using two-point modulation with this synthesizer, 1Mbps Gaussian FSK modulation is achieved with a 10kHz loop bandwidth. This improves system performance by achieving superior phase-noise and spur levels.

The result of the various architectural realizations is a Bluetooth transceiver that can operate in both a highly jammed and a rapidly changing received-signal strength environment. In particular, the PH2401 will operate reliably in the presence not of just one other blocker, but in the presence of many other simultaneous IMS emissions.

The promise of Bluetooth and PWC will be realized through the delivery of real-world performance parameters that consumers have come to expect in existing point-to-point wireless communications. By their very nature, applications such as mobile handsets and headsets, as well as mobile computing, will require a high degree of robust performance. Central to the achievement of Bluetooth-based piconets is the delivery of this attribute at the silicon level.