Ever wondered what that mysterious “WiFi Pineapple” device from hacker movies actually does? Today we’re unboxing the Hak5 WiFi Pineapple Mark 7 - the real penetration testing tool that’s been featured in countless TV shows and movies!
Episode Highlights
Listen Now
Tune in to watch us unbox a Hak5 WiFi Pineapple and discuss its use.
Key Takeaways
- Complete unboxing of the WiFi Pineapple Mark 7
- How hackers use this for man-in-the-middle attacks
- Why you should be worried about fake WiFi hotspots
- Real-world scenarios where this could be deployed
- Ethical penetration testing applications
Full Transcript
[0:00] [Music]
[0:02] [Applause]
Joe [0:05]: Welcome to the Security Cocktail Hour. I’m Joe Patti.
Adam [0:08]: I’m Adam Roth.
Joe [0:10]: Adam, it looks like today we are doing another unboxing. One of our favorite things to do. You know how I like to eat healthy with some grapes.
Adam [0:20]: Yeah, maybe some cherries, various fruits and whatnot.
Joe [0:25]: Yeah. Yeah, but this is a WiFi pineapple.
Adam [0:30]: Oh, what a segue. You’re getting good at this. Awesome.
Joe [0:33]: I’m a certified professional segueist.
Adam [0:36]: Well done. GPS.
Joe [0:38]: Okay, so the Wi-Fi pineapple. Now, this is something that at one time was very obscure, but a lot of people got to know about it because of TV. Something on TV that was actually real for a change, right?
Adam [0:52]: Yeah. I mean, a lot of these James Bondish, Jason Bourne, you know, hacker movies, they use a lot of Hack Five devices and they’re actually really good for pen testing.
Joe [1:08]: That’s the company that makes this Hack Five.
Adam [1:10]: Yes. So, I apologize for not identifying who they are, but Hack Five has come out with a lot of different technology that’s used like Spider-Man, you know, using it for good, you know.
Joe [1:25]: That’s right. For good, not evil. These things are all good. We did an episode on that, on how to use these ethically. Now, I see on the box, because I can read, what does it say? Mark 7 or something.
Adam [1:37]: So, these have been around for a while. This is not anything new, right? And they’ve had a lot of iterations. I mean, they use a lot of really playful, good marketing names, rubber ducky and, you know, turtle and things of that nature. And this one is called the pineapple. Not sure why it doesn’t look like a pineapple, but they do use colorful graphics and marketing to market everything. And this is the pineapple.
Joe [2:08]: I don’t know. I guess I’m outing myself as a dad. When I see that little pineapple, I think of Spongebob, not hacking, but whatever.
Adam [2:16]: So, I’m going to do my best. I really haven’t done a lot of use of the hacking Hack 5 devices, but the pineapple is supposed to be basically kind of a pentest device. It’s used to create hotspots. People you hope people connect to them. You identify the information, you use it as a man-in-the-middle attack. It can be used for a lot of different things with Wi-Fi and this is their premier number one Wi-Fi device. They have books on it. This is the box. They discuss how to place it, I believe.
Adam [3:02]: More than the pineapple itself. It’s just this is the back of the box with the antennas. There’s more you can add to this. They have these high pickup antennas you can buy. It says triple discrete MT radios power over USB-C integrated USB Ethernet host port dual eMMC and SPI flash. Basically what it’s saying is it’s basically a high performance device and it’s capable of doing a lot of different things. The standards are 802.11bgn. The interfaces are Ethernet over USB USB 2.0 host wireless AP and the antennas are RPS SMAs. So it’s really nice USB 5V 2 amp and 2.4 gigahertz.
Joe [3:50]: Oh, I always try to go for the five-fold two amp. That’s very cool. But, as you open as you start to open that up, you know, we’re always talking about when you go to a public place and you got to be careful that someone might do a man-in-the-middle attack, you might connect to an untrusted network. This might be what the bad guys are using that you should be worried about.
Adam [4:13]: This is not the only thing. And this is kind of the more accessible I don’t want to say consumery version because it’s not really consumer, but this isn’t super spy stuff. And if you really think about it, right, if there’s a high gain antenna in here and you’re using the SSID of the airport, like you’re walking around and somebody turns around and puts it says the sticker, it says the kiosk says use airport open or open airport and then you do open airport on this and people connect to it, but you’re also connected to the internet. You’re creating a man-in-the-middle attack and people think it’s a regular device.
Adam [4:52]: Or if you go into like a T-Mobile or an AT&T or something like that and they have and there really isn’t a connectivity for there but your Mac your Windows machine already knows to pick up this device and you emulate what normally those carriers would do. How you going to know the difference, right? And you got to be clear to this thing we’re going to see how big it is. It’s not big. You hide it or you put in a knapsack or a bag or something. It’s not like you’re going to actually see this. You just see the name of the network. It pops up on your phone or your laptop or whatever it is.
Adam [5:29]: The first thing we’re going to look at, we’re going to look at the beautiful I’m going to try to do my best to pick it to the camera, but it’s you know, for clarity, I might just go a little lower, but it’s a it’s a little kind of like business card that folds. And I’m going to take it to myself and read it. It basically tells you how to connect it to the power source, what network you can join, and how to configure it. And then it has a little bit of information here about what each of the lights do. There’s a blinking blue means it’s starting up. And a solid blue, it’s ready. And a solid red means invalid USB files and alternating blue and red. Flashing firmware. Do not unplug power. So, you don’t want to brick the device.
Joe [6:14]: No. Does it have the FCC compliance on there? I always check that.
Adam [6:17]: Oh, that’s really important. So, I’m sure it’s somewhere located here, but yeah.
Joe [6:22]: And I’ll bet you can probably put illegal firmware on it to actually break that, like some people who stuff who like siloed it, right? So, now we’re going to be ready to take it out of the bag.
Adam [6:36]: Yes. Let’s see it. It’s like Christmas morning. I’m dying here.
Joe [6:39]: I’m Jewish.
Adam [6:44]: Okay. All right. It’s like I don’t know what night do you get your presents?
Joe [6:46]: It’s like holiday night that is. It’s like the holidays.
Adam [6:49]: So, it has locations for the antennas. Mhm. It has a USB C and USBA port.
Joe [6:58]: The antennas are in the box. It comes with antennas, right?
Adam [7:00]: Yes, sir. Of course.
Joe [7:02]: So, let’s start putting them on, right?
Adam [7:05]: All right.
Joe [7:09]: And we can’t tell on screen, but is it heavy? I mean, is this something you can like velcro to the underside of a table or something?
Adam [7:16]: Absolutely.
Joe [7:17]: Really? Wow, that’s nasty.
Adam [7:19]: And then for these devices these days, these battery packs are so small that you don’t even need to connect it to, you know, live power. You just connect it to a battery pack.
Joe [7:29]: Oh, that’s right.
Adam [7:31]: Yeah. It could run for quite a while. Then someone goes and picks it up.
Adam [7:37]: A lot of people who do pentests, what they end up doing is they end up putting this close in proximity to where you would normally log in. Maybe they’ll shut out the other SSID. Maybe they’ll overpower it with this device because it’s closer. And that’s what you’re going to log into. And then we have the USB itself, the cable.
Joe [8:09]: Oh, USB cable. That’s cool.
Adam [8:12]: USBC. And I believe there’s nothing else in the box.
Joe [8:17]: That’s it. That’s pretty straightforward, actually.
Adam [8:19]: Yeah.
Joe [8:20]: Now, I think what we’re going to do, right, is we’re going to I have an abundance of Hack Five devices. And I think what we’re going to do here is the next go around and actually I’m going to travel soon. So I’m going to see if I can use this possibly as a travel router. I haven’t tried that yet. But we’ll try that out. And then the next episode that we’ll come out with eventually will be how to use it to the command and control that Hack 5 gives you and you can pay yearly for to manage your devices. So, if you took this device, this pineapple, and you put it at one location, and then you took another pineapple and you were able to connect it to the internet as well in another location, you can manage these devices remotely using the command and control.
Adam [9:08]: Uh, that’s scary if you’re not using it for good. But got to understand what people can do with this stuff. You know what would be cool if when you’re traveling if you take that travel router we looked at and see if you can use this to like break the travel router and like get on the cool if you’re in the hotel room and got nothing to do, right?
Joe [9:31]: Yeah, definitely. Or I and I’m joking. I was going to say I’m going to see if the people next door will connect, but I’m joking. I’m joking.
Adam [9:37]: Yeah, test it on them. Right.
Joe [9:41]: All right. Well, that’s pretty cool. That’s interesting. I have heard about these for years. Obviously, they’ve been around, but I’ve never actually seen one. And that new one is pretty slick and pretty discreet. You know, I don’t think it’s accidental that they make this so it could really look like anything. People just say, “Oh, it’s just some box or whatever hanging around.” Crazy.
Adam [10:04]: Yes, sir.
Joe [10:05]: Yeah. I’m excited. I’m excited to try it out and I’m excited to do the next episode. But hey, if anybody’s used a pineapple before or if anybody has any questions or if anybody wants to ask questions about what it’s capable of, we can definitely do a follow-up episode to some comments under the episode and we’ll definitely respond to you.
Adam [10:29]: Yeah, send us some comments. We can have some fun with this stuff. All right, Adam. Very good. This has been fun. Another interesting little toy you got.
Joe [10:38]: Yes, thank you. And looking forward to continuing this series.
Adam [10:43]: That’s right. Okay, everyone. Thanks for watching. Thanks, Adam.
Joe [10:47]: Thank you. Bye. Bye, guys