This post was originally published in French only. We translated it in 2026 so the archive reads the same in both languages. Read the original →

A few weeks ago, the Hackfest team made a round trip from Quebec City to Montreal, and to make the trip more interesting we took the opportunity to mount a 13dbi antenna on the trunk and a 5dbi one on the front of the car, and fired up Kismet to analyze the network traffic! The route was Highway 20 from Quebec City to Montreal and Highway 40 from Montreal back to Quebec City.

Setup



[caption id="attachment_3942" align="aligncenter" width="150"]5dbi inside[/caption]
 [caption id="attachment_3938" align="aligncenter" width="150"]Kismet - 13dbi on the car[/caption]
 [caption id="attachment_3938" align="aligncenter" width="150"]Kismet - At destination[/caption]

Log analysis


Several interesting results came out of this wardriving run, and I present them below in the "Results" section.

First, before discussing the results, here's how we went about it. To get WiFi security statistics, I needed a tool to count the number of WEP/WPA/OPEN/etc. networks. After a bit of searching, no interesting tool turned up. So I wrote a small (very basic) tool to analyze a kismet .netxml file. The code is available on our Github: Kismet-Quick-Stats.py. The code simply parses the XML file using the lxml module (http://lxml.de/).

[python title="Main function of Kismet-quick-stats.py"]
def parseXML(xmlFile):
f = open(xmlFile)
xml = f.read()
f.close()

#lxml parsing tree
tree = etree.parse(StringIO(xml))

#INFRASTRUCTURE
data = parseNetwork('//wireless-network[@type="infrastructure"]/SSID','.//encryption/text()',tree)
dataC = parseChannels('//wireless-network[@type="infrastructure"]/channel','text()',tree)
#print the stats
printResults("Access Points",data)
printChannels("Channels for Access Points",dataC)
print "\n"

#MOBILE
data = parseNetwork('//wireless-network[@type="ad-hoc" or @type="fromds" or @type="probes" or @type="tods"]','.//SSID/encryption/text()',tree)
dataC = parseChannels('//wireless-network[@type="ad-hoc" or @type="fromds" or @type="probes" or @type="tods"]/channel','text()',tree)
#print the stats
printResults("Ad-Hoc (cellulaire)",data)
printChannels("Channels for Ad-Hoc (cellulaire)",dataC)
print "\n"

#CLIENTS
data = parseNetwork('//wireless-client[@type="ad-hoc" or @type="fromds" or @type="probes" or @type="tods"]','.//SSID/encryption/text()',tree)
dataC = parseChannels('//wireless-client[@type="ad-hoc" or @type="fromds" or @type="probes" or @type="tods"]/channel','text()',tree)
print "\n"

#print the stats
printResults("Wifi-Clients",data)
printChannels("Channels for Wifi-Clients",dataC)
print "\n"
[/python]

Results


After the round trip, more than 14,000 wireless networks of all kinds were detected (including access points, clients and point-to-point). Below are the statistics for each type of network, as well as the channel distribution.

Channel distribution


The following image shows the share of channels used by the 14,000 wireless networks. Note that 2 networks were using channel #13, a network band not used in North America.
[caption id="attachment_3885" align="alignnone" width="605"]Kismet - Channels[/caption]

The most used channels are the following:

Access Point security


The question everyone was asking before leaving on our round trip was what percentage of networks would be WEP and OPEN, to get a sense of the security of Quebec's networks. Our estimates ranged between 5 and 25%.

We called it!


So 25% of the wireless networks in our sample of 14,000 networks spread over more than 250km are easily accessible or hackable!

Although many of the OPEN networks were "Guest" networks, many seemed to be default configurations with default SSIDs. Likewise for the WEP networks, many were set up with defaults, either routers bought at a retail store or modems or routers supplied by ISPs (Internet Service Providers) such as Bell, Vidéotron and others, to name just a few.

Although 25% may seem reasonable, we believe there's still a long way to go to make our wireless networks more secure, and without much effort! Simply making WPA the default setting would help a lot.

[caption id="attachment_3882" align="alignnone" width="605"]Kismet - Access Points[/caption]

WiFi client security


What was really interesting during the trip was that a huge number of networks were "beacons" (network discovery packets) belonging to cell phones. So the WiFi Clients section, with more than 8000 networks, includes thousands of cell phones . Of these phones, the vast majority were iPhones trying to find wireless networks they knew.

Indeed, when a mobile device (phone or tablet) connects to a wireless network, it usually saves that network in its system. Afterwards, when it's out of range, the device sends packets to detect whether the network exists, and if so, it authenticates to it. So with kismet, many phones and mobile devices could be detected thanks to this type of packet.

Among the WiFi Clients detected, here's the security breakdown of those networks:


This statistic is skewed, because most clients surely connect to a secured network, but the packets we captured didn't contain that information.

[caption id="attachment_3884" align="alignnone" width="605"]Kismet - Wifi-Clients[/caption]

Ad-Hoc network security

A few point-to-point networks were also detected (about a hundred). These mainly came from companies linking several of their buildings with big antennas; we could see a strong signal over several kilometres.

Conclusion


As with many other "embedded" technologies such as modems, GPS trackers, etc., I think the takeaway is that their security is rarely optimal by default, on top of the fact that these products are often aimed at the general public, who don't have the knowledge needed to secure them.

So we still have a lot of work to do to raise awareness among the general public and the companies developing these products, since they rarely care about security, because it's "complicated" to find the problems in these modules... Security by obscurity all over again!

Patrick