The Signal Owl is a simple payload-based signals intelligence platform with a unique design for discreet planting or mobile operations on any engagement.
Many popular tools, such as Kismet, Nmap, MDK4 and the Aircrack-ng suite as well as bash and Python 3 are included. Using these and the Owl framework, the pentester may execute payloads loaded from an ordinary USB flash disk.
The Signal Owl features a unique form-factor and is designed to function as a long-term wireless implant, or mobile operations in conjunction with a standard USB battery.
During long term wireless engagements, the Signal Owl may be planted inline between any typical 5V USB power source. This may be useful in situations where ports are occupied, or to deter the unit from being unplugged.
The Signal Owl is powered from the USB-A Male pigtail, while data and power are passed through to its USB 2.0 port closest to the pigtail. For example, with a keyboard or mouse plugged inline between this USB pass-through port and the pigtail connected to the target computer, the Signal Owl will not enumerate as a device on the operating system - only the keyboard or mouse will.
The Signal Owl features a low power consumption profile, with a typical power draw averaging 100-200 mAh. Additionally, it is thermally optimized for long term deployments in many indoor environments. One can expect a large 20,000 mAh USB battery bank to operate the unit for up to 4 days.
Modes of Operation
It has two basic modes of operation: Arming Mode and Attack Mode. By default when powered on the Signal Owl will boot into Attack Mode. To access Arming Mode, momentarily press the button on the bottom of the unit using a paperclip or similar instrument during the 3 second mode selection phase at bootup as indicated by the rapidly blinking LED.
In Arming Mode, the Signal Owl will present the user with an open access point named Owl_xxxx (where xxxx is the last two octets of the devices MAC address) and will be accessible via SSH.
The open access point may be configured with WPA security by editing the /etc/config/wireless file and adding the following options to the config 'wifi-iface' section:
option 'encryption' 'psk2'
option 'key' 'secret passphrase'
In Attack Mode, the Signal Owl will execute the following operations:
- If a payload is present on the root of a connected USB flash disk, it will be copied to the Signal Owl's internal storage at /root/payload
- Similarly if an extension folder is present on the root of a USB flash disk, the contents of this folder will be copied to the Signal Owl's internal storage at /root/payload/extensions
- The extensions will be sourced, and the payload on the Signal Owl's internal storage will execute
- If no payload is found (on internal or external storage) the LED will indicate the FAIL status
While in attack mode, if the button is momentarily pressed (for under 1 second), the payload will stop and any loot captured to /root/loot will be copied to a connected USB flash disk. After the loot is copied, the payload run will start again.