Skip to content

sloth v1.7 — Wi-Fi attack-detection suite

Choose a tag to compare

View all tags
@SpaceTrucker2196 SpaceTrucker2196 released this 05 Jul 13:47
· 1097 commits to main since this release
v1.7.0
f083f19

Passive by charter. sloth still never injects, scans, cracks, or modifies kernel state. Two narrow, operator-authorised, opt-in/opt-out carve-outs exist (MISSION §2): --hop retunes sloth's own monitor receiver (no frame sent), and — new this release — mDNS discovery advertises the data socket via a separate daemon when the operator has bound it to a routable address.

This release lands the passive Wi-Fi attack-detection batch (issues #29–#34) on top of v1.6.0. Every detection signal is covered by hand-crafted RFC-byte and seeded-state tests — 3604 assertions, warning-clean.

New detectors (alerts)

  • SSID_CONFUSION (CRIT, T1557.004) — the on-air fingerprint for CVE-2023-52424: the same SSID on a second BSSID with a downgraded RSN posture (WPA3→WPA2, MFP required→off, GCMP→CCMP), or an 802.1X-Enterprise SSID cloned as PSK. (#32, #31)
  • MGMT_FUZZ (WARN/CRIT, T1499) — malformed beacon IEs (length overrun, oversize SSID, truncated RSN) from mdk4 mode m / crafted aireplay frames. The beacon parser now counts anomalies instead of silently dropping them. (#33)
  • ROGUE_RADIUS (WARN/CRIT, T1557.004) — a new EAP inner-frame parser (RFC 3748) decodes the 802.1X EAP conversation: CRIT when a weak inner method (EAP-MD5/GTC) is offered, WARN on a real-identity leak with no anonymous outer identity — the eaphammer / hostapd-wpe lure. (#31)

KARMA / PineAP (#30)

A dedicated VIEW_KARMA on key [y] — one ranked row per BSSID beaconing an abnormal SSID set, scoring:

  • PNL overlap + Jaccard % — how closely the advertised SSIDs mirror what nearby clients actually probe for (the PineAP beacon-response tell).
  • deauth-then-lure — a concurrent deauth flood (knock clients off, then answer their reconnection probes).
  • IE-uniformity — one identical IE fingerprint across every spoofed SSID (legit multi-VAP APs vary per VAP).

High-score lures also get a deep-red badge on the dashboard Beacons panel, the way THREAT_IP flags a hostile host.

Discovery (#29)

When --data-socket is bound to a routable address, sloth drops an Avahi service file so the sloth-ios client discovers _sloth._tcp by name. sloth transmits nothing itself (avahi-daemon announces); loopback/UNIX sockets never advertise; disable with --no-discovery.

Also

  • Passive sensor abstraction + factory converge loop groundwork (#28, #34).
  • New JSONL records / fields: sensor, wifi_merged, beacon fuzz_* counters.

Full per-alert reference in docs/views/alerts.md; KARMA view in docs/views/karma.md.

Assets 2
Loading