Fingbox

welcome to crosstalk solutions my name is Chris and today we're gonna be taking a look at the fing box from the makers of thing now what is thing first of all thing is a network scanning app for iPhone and Android it's been around since 2009 I've had it on my phone for a while albeit I don't use it too often but about 6 months ago I saw that thing was doing an IndieGoGo campaign for this new product the fing box and so I went ahead and purchased one at that time I think it was $80 to buy into this product and it looked interesting I figured I would just try it out as well as support you know a company that is up and coming so through that IndieGoGo campaign fing box raised almost 1.4 million dollars which is a crazy amount of money and now this is an actual product it sells right now for $99 but it looks like they're gonna be raising the price of this device to 119 dollars at the end of the month at the end of September 2017 so what does this do exactly and before I really get into that I do want to say that this is not a paid endorsement of this product I've never spoken with this company I just thought it looked interesting and I figured I would buy one I will give you my honest thoughts and opinions on this device as I set it up and work with it it might be a piece of crap it might be totally amazing I have no idea so we're just gonna try it out together and see how it works this device has parental control it says track who is online limit internet access see device activity in history it can improve network performance so find Wi-Fi sweet spots discover bandwidth hogging devices and test your internet speed and then finally it says protect your home detect Wi-Fi attacks monitor surrounding devices and block intruders so from what I understand this device plugs into your network it's kind of set it and forget it and then you work with the device through the fing app there's no subscription cost to this this is a one I'm purchase you buy this device you plug it in and it works what I'm not sure how it does is how does it control and how does it have the ability to limit and throttle bandwidth for devices when it's just passively plugged into the network so I'm kind of curious about that I'm not sure how that works and that's one of the things that I'm gonna be trying to figure out okay so let's go ahead get this thing unboxed and see what comes with it I'm also curious to see if it requires a power adapter or if it does have some sort of p OE capability okay so there we have the device itself this is a weird box that folds over that way so here's the fing box itself whoa what a weird what weird packaging well this is the device itself then I'll do some close-up shots of this but it comes with this sort of silicon mould but it was sort of sticking out of and they had like this pedestal piece of cardboard in there so I don't know what the purpose of that was but it looks like it just sort of slips right into this silicon mould and it looks like there's four things on the back here we have a little reset hole we have a USB see I think power or micro USB I'm not sure exactly what you call that it has Ethernet and there's a USB port okay so let's go ahead and pop it in let's see what else comes in the box here so we have a fing box set-up guide looks pretty simple one page I will go through that in just a second and then we've got a flat Ethernet cable we've got three different types of power plugs looks like they just have they're covering their bases on the power plugs yeah different international power plugs that come with it and then the one that's actually on here is a us-based power so we'll go ahead and power this thing up and and then I will switch over to my desktop and my phone and we'll try to get it connected okay so I have the fing box plugged in there is no power over ethernet or at least it didn't fire up when I plugged it into a 802 2.3 AF compatible switch so I haven't plugged in power and Ethernet it took a little while to actually turn on so if you have one of these devices and you plug it in and the lights around the edge here don't come on immediately I took about 30 seconds before I saw any lights and then it did a night nice little laser light show and now it's just blue and then sort of pulsating green every so often okay so let's go ahead and switch over to our iPhone from what I understand this is available for both iPhone and Android when you fire up thing you can see that they're really promoting thing box this is now the first screen when you pop into thing talks about the features block devices block Internet bandwidth analysis and shooter detection hacker checks Wi-Fi speed bandwidth hogs digital fence and then you can say get fing box so in the upper right hand corner here there's a little ad fing box icon I'm gonna click on that and we are looking for our fing box this may take a while if you have just booted your fing box up now I booted my fing box up probably five or ten minutes ago and it looks like it has been found although oh there goes my recording is lagging a little bit behind alright so fing box found let's go ahead and say configure okay and we're gonna hit the little map icon in the oh let's see what is your where is your Fingal just say home wait for my mail to get out of the way okay so we'll call this home thing box and let's just see if we can find it allow thing to access your location alright let's see okay so of course I will blur that out but it did find my address or my location we're gonna call this home and we're gonna say this is lagging behind there we go we're gonna say done okay so here we go fing box is active right in the upper left-hand corner says add user let's go ahead and do that thing would like to access contacts if you do not agree you will still be able to create a fing box device user even though with some limitations oh I typically don't like apps to be able to access my contact list so I'm gonna not allow that we're just gonna add a we're just can add me as a user and we will say family select the category the user fits in family or say him a pet what do they have pet as an option o select the users devices do I have to select devices uh alright we'll say the desktop is mine iPhone 6s yep there we go okay so we'll do that and we'll say save okay so fing box is active last change two minutes ago we have a user now set up their 21 devices are online no threat detected let's go ahead and go through these icons one at a time so Wi-Fi speed starting okay so right here where I'm standing I'm getting 70 megabits of Wiese Wi-Fi speed connected to Sherwood Forest and it's telling me that my streaming quality is good for standard def high def and 4k streaming let me walk around a little bit and see if this changes ok so walking around my office the speed didn't change too much it dropped down to about 60 mega bits per second off of 70 or 75 max or so and I even went in the bathroom and stuck it into the bathtub area and it still stayed at about 60 megabits per second but I do have a pretty strong you know you ap AC pro powering the house it's not too far away from this device so I guess that's not that's to be expected I'll probably do some more testing walking around with this a little bit later alright let's take a look at bandwidth analysis so my personal bandwidth analysis if I click on iPhone select devices to analyze alright I'll select my two devices I'm going to hit play let me run a speed test on my desktop there we can see my desktop is starting to overtake the iPhone because I'm opening up webpages and I'm now running a speed test here we go just about to start and now it's starting so there you can see the desktop is really hogging up the bandwidth 28 37 megabits let's see if we can change this download speed upload speed download size upload size so here we can see that the speed test downloaded 120 point 3 megabits if I do the upload which the upload test is running right now see we're at nine point four megabits and climbing megabytes excuse me and climbing okay so speed test is done let's go back here and say download speed and so now it's back down but we can see that it looks like my desktop is hogging most of the speed and now we have the iPhone catching up since the desktop has stopped so this is very real time that's cool let me go ahead and stop this stop okay and it looks like it sorts everything into different categories too that's pretty cool so we've got iPhone tablet desktop Apple TV Roku Roku Ultra there's my printer my Philips hue and then we've got a bunch of other stuff so switch crosstalk PBX Samsung television another Apple TV access network speaker access - oh that's offline oh these are all offline devices I was gonna say cuz this is my access network speaker right behind me but I don't even have that plugged in right now so I must have had that plugged in at some point while I was using thing and it remembered it okay let's see what else we can do with this thing internet speed of course internet speed test let's see here yeah there we go so download sixty 1.4 upload five point seven twenty devices are online let's go look at our devices and see what we can do with them so like for instance let me find this tablet alright so this tablet is an iPad pause Internet so how does that work though pause duration okay 30 minutes 1 hour 2 hours 6 hours 1 day ok so if I wanted to pause internet on the tablet like if my kids are watching too much YouTube kids or something I can turn that off like that I can block devices let's see what else do I have here ping scan services wake on lion okay so I'm gonna keep playing around with this device and see if I can't figure out exactly how it's doing this how is it able to block a tablet from this device right here that'll be interesting to find out and once I sort of figure that out I will come back with some additional findings about the faint box okay so I've been playing around with fing for the last couple days on and off and there's definitely some some useful tools but I also want to dig in a little bit deeper to how it does some of the blocking stuff so we'll get to that in a second but let's take a look at the some of these tools real quick so the bandwidth analysis is pretty neat you can select some or all of your devices you hit play and then you basically get their real-time download speed or upload speed or download bytes or upload bytes so you can see here that it's actually shifting around traffic on my network as devices are doing stuff and if I ran a speed test or something you'd see that pop right to the top of the list okay so let's get out of there it's also pretty neat so if you look up here in the upper left hand corner you can see that I've got my wife set up as well as myself right and you see a time stamp underneath there it says 6 hours and 21 hours so when you click on any one that you've set up as a user you can select the user's personal device so basically if you click on iPhone for instance does iPhone mark your presence in the network yes it's always with me or no I may leave it behind so when you set your phone usually it's going to be your phone when you set your phone to your personal device then your user list will actually gray people out when they're not connected to the network or when their device is not connected to the network so the notion is you know if my wife's got our iPhone on her all the time when she leaves the house I'll be able to see the and I believe there's a way to also notify when someone leaves or comes back but I have not found that yet and that might be one of the extra features that's enabled when you allow thing to see your entire contact list when you allow it access to your contact list which I did not I said no I don't need a thing to have access to my contact list okay so then digital fence is also pretty interesting a digital fence shows wireless devices that aren't connected to your network so for instance this raspberry pie right here that you see on the screen this is a device that has a wireless NIC inside of it but I have it hardwired into the network so the wireless NIC has its own MAC address but it's not connected to my wireless network and so it's being reported as a device that fing sees but it's not actually in use on the network so that's where you can do different things with devices you can watch devices monitor them etc for stuff that's not connected to your network but is near your network okay so all of that is cool and that's you know that's pretty neat to also look down here you can see you do get notifications when new devices connect up to your network so I can say got it this is a sip 23 G phone that I see 23 G phone that I added earlier today so I'm just gonna say got it basically you can you know approve or or block new devices that connect to the network and you do get notifications I haven't found out how to get notifications on the phone itself although I think I turned that on I just haven't applied any new devices yet but I definitely get notifications in email so whenever a new device is connected I get an email from thing that says hey you've got a new device connected ok really though let's get into what I think is the most interesting part about fing box and that's the device blocking so keep in mind that this is a device that I literally just plugged into the network I didn't do any configuration whatsoever it grabbed an IP address and the Gateway and the subnet information all from DHCP and just started working ok so now if I go to my main device list and let's see I've got my laptop my desktop here I can do this pause internet so let me pull up let me switch over my view real quickly I'm gonna pull up a ping I'm gonna do a ping - T 4.2.2 - okay so we can see that my computer is pinging out to the Internet no problem now on this device I will now say pause the internet on my computer for 30 minutes now within about five seconds you're gonna see these pings stop responding and it's gonna say request timed out there we go it just stopped let's go ahead and resume Internet one more time once I click resume Internet again about five seconds later it's gonna start pinging out to the Internet one more time and there we go okay so I'm connected back to the Internet once again so I mentioned this in the first part of the video but I was really curious how does this device do that if this isn't a router on the network cuz I could understand if it was a router and all traffic was passing through this device that's one thing but this is not a router this is a device that I just plugged in to the network right so how does it do that well let's take a look let's take a closer look if I go back to my command prompt and I do ARP - a I want to see my ARP table for the IP address of the gateway which is where Internet traffic goes out so the gateway on my network is 192 168 200 dot 1 okay so we see that my ARP address let me bring up another command prompt window okay so persistent ping going on the left-hand side and then here is my window where I just checked the ARP address so my computer sees physical address 24 a43 Co 5d to be II as the MAC address for the gateway 192 168 200 dot 1 okay and that MAC address is the F 1 interface of my edge router light okay because it says all traffic for the network goes to out the edge router now let's block our internet one more time I'm gonna pause the internet for 30 minutes we're gonna wait five seconds as soon as this starts timing out on my pings let's take a look at our ARP again okay so we're timing out now let's run that same command again ARP - a 1 on a few 168 201 and look the MAC address has changed f0 23 b9 EB 4 6 3 C so what the heck is that well that is the MAC address of the fing box okay so what the fing box is doing it reminds me of you know the movie captain Phillips where Tom Hanks gets his ship taken over by the Somali pirates I don't know if they were Somali pirates some sort of pirates well you know the guy comes onboard the ship and he's like he's like listen listen I'm your captain now I'm the captain now right that's basically what this device is doing alright it comes into the network and when I block a device it's saying you know my computer in this case is Tom Hanks and the fing box is the Somali pirate and it's saying look I'm your gateway now ok you don't go out to the ubiquity I'm your gateway now and how does it do that right so to find out we had to start digging a little bit deeper and I had to jump into Wireshark so let me resume internet on my machine here ok so here we are I have my persistent ping going once more and if I look at arc - hey now that I've resumed internet we're back to the MAC address of 24 a 4 blah blah blah the ubiquity now originally when I was looking at Wireshark I was only looking at my local address my local Ethernet card on my machine here and I wasn't finding everything that I wanted to see so I actually did a port mirror if you guys are interested in learning how to do port marrying let me know but I took the port that the fing box is plugged into on my unify switch and I mirrored that to a different port and then I plugged a second network card into my box here it's a just a USB 3 network card I plugged that in and plug that into the mirrored port so that way I was able to use Wireshark to see absolutely everything every little bit of traffic that this fing box was sending and receiving on the network so let's take a look at that first real quick it's actually Ethernet for now if you look here this is very a little tough to seasons it's so small but you see these Peaks right here this happens about every 30 seconds and what that is if we open this up so this is all of the traffic coming out of the fing box or that the fing box sees coming to or from the fing box let's sort like this and what you're gonna see is every so often boom there it is right there now you saw that so here's demotes so you see doumitt so let me pause this because it's going way too fast stop this thing puts a lot of noise onto the network first of all but if we scroll back up to where that huge string of art requests went in fact let's filter on art we're just gonna say ARP enter so we're filtering out everything except we're filtering only on ARP stuff so if you look here doe motes right so doe motes underscore and then the last six digits of the MAC address so doe motes is the manufacturer ID so in a MAC address you have two pieces you have the first six digits and you have the last six digits the first six digits are always the manufacturer ID the last six digits are the unique identifier for that specific interface okay so doe motes is a company that makes very similar network type monitoring software I hadn't heard of them before this but they must be oh you mean this fing box for fing box so that's why we see doe motes as the MAC address of the fiend box or the manufacturer of the fiend box fing box okay so what this is doing is every 30 seconds or so it blasts an arp out to the entire network that's saying hey who has this IP address 9 10 11 12 13 14 through my entire class see okay so it goes through my entire class c network every 30 seconds and says everyone tell me where you are and then of course devices respond to it and say hey I'm over here I'm over here I'm over here okay so now let's take a look instead let me move this off to the side so that's just an example of the amount of trap coming off of the fing box let's run Wireshark again but this time I'm going to look at the interface on my local machine here which is Ethernet 5 ok so I'm gonna pop open Ethernet 5 and we're gonna see normal traffic coming to and from the network there's that doe motes ARP requests again look how much spam this thing throws on to the network and so let's take a look at just normal ARP traffic first ok so if I say what do I want it what filter do I want to apply so basically I need to take a look in Wireshark at the source address of the fing box and the destination address of my computer ok so we're gonna put a filter in here we're gonna say eath dot source equals equals and then it's going to be I have these MAC addresses written down so it's the fing box first the source address of the fing box and eath dot d st for destination equals equals the MAC address of my computer and then we're gonna say and art ok because we're gonna filter down to just the ARP protocol ok so run that and we might see occasional Arps here and there just standard stuff you know ARP requests coming from the fing box out to the whole network like said it doesn't paying about every 30 seconds so we should pick that up in this filter but what I really want to show you is what happens when we block using the application ok so that's our next trick oh there we go so there was a just a regular arc request ARP request source was blah and it was just saying it was just telling my computer one on 81 6200 to 10 which is the fing box is at and then this MAC address ok so that that's just something it's broadcasting out device is broadcast out there are their MAC addresses on a fairly consistent basis so no big deal there now let's turn off Internet to my machine again pause Internet 30 minutes now let's wait five seconds and watch what happens boom-boom-boom-boom so what is happening now it's so this is exactly what we're seeing so you're gonna see these they're gonna see about three or four are per quests from the fing box to my computer every three seconds okay so we're gonna stop that now and let's take a look at one of these packets what's it doing here so this is the fing box telling my computer 192 168 201 my gateway is at this MAC address which is the MAC address of the fing box I'm your captain now right so it's basically flooding my computer or whichever device I decide to block wired Wireless whatever it floods that computer with ARP requests and says hey listen I'm your captain now don't listen to what anyone else is saying right and so it floods this the device so much with this ARP traffic that when my gateway my actual gateway does it are its ARP every so often I don't know once a minute or however how often however often it does it it's just lost in this wave of ARP requests okay so interesting thing and what led me to this conclusion was that while I was doing pinging and you can see one got one snuck through here every so often I would get a reply from the Internet so what that means is that in between the three seconds that the fing box was sending out its flood of ARP requests one our request from the Gateway got through and it set the gateway address correctly I got one ping and then we were back to the flooded ARP request where my computer thinks that the fing box is now the Gateway or it thinks thinks the fing box is 180 168 200 dot one my gateway address okay so let's go ahead and resume that again okay so I presume my traffic and once again we should be able to see the pings start coming through here again boom there we go okay so now I'm pinging again and if we look at art - a we can see that the ubiquity is set back to the gateway address okay so really interesting now I understand why they did it okay that's an interesting way of you know being able to give users the ability to block devices on their network but when you really think about it you're basically hacking the network right so this is it's doing spoofed ARP requests it does ARP spoofing and it floods whatever device is being blocked with spoofed arc ARP requests that tells it the incorrect MAC address for the gateway address of the network okay so that's all well and good and that works for perhaps a home user you know this type of thing that you have set up if you're gonna be doing parental you know blocking and monitoring of devices and that sort of stuff but how do you prevent this device okay so let me pose a scenario to you let's say you work for your IT administrator for a company maybe you've got a hundred employees and one of your employees one day decides well I got this fing box thing at home and I want to be a smartass I'm gonna take this fing box I'm gonna plug it in at work and I'm gonna start blocking services I'm gonna start blocking the email server I'm gonna start blocking the web server I'm gonna start blocking Joe's computer from having internet access because I don't like Joe he looks at me funny right you know you can be very malicious with this thing and there's no security in place how many of you can honestly say that you are a prepared for something like this and B would know how to detect it if it started happening on your network like where would you even begin so that's the question that I want to put out to you guys so there are ways to authenticate faint devices that are plugged into ports right there's port security such as 802 One X however what about for Y devices right port security works when you get bring your plug and stuff into ports but I'm not I have I've been out of the network administration game long enough that I don't know how I would solve this problem so I'm leaving it to you guys most of my viewers are a lot smarter than I am so you guys tell me how would you prepare for this how would you proactively prevent someone from sticking a finger on your network and flooding your network with our / quests and being able to use their iphone to block whatever devices they wanted to on that network what if you have a hotel and someone brought this to the hotel room and they thought it would be funny to block Internet access for everyone else in the hotel right there's a thousand different ways you can think of to exploit this thing to really cause some malicious damage to networks out there it's a it's a big security concern and I don't know I I reached out to fing box on Twitter just to see if they had anything to say about this if they could have someone talk to me about it I did not hear back yet but if I do hear back from them I will absolutely update this video and yeah I'm very curious what you guys think about this device and it's also interesting that like this started out as kind of just like a fun like you know little cool device that I found unboxing video and it really turned into an in-depth network discovery session like we're going we're going into Wireshark here to figure out exactly what this thing is doing so again also if you guys want to see more stuff about Wireshark let me know I'm happy to do some videos on that but that's about it for the fing box overall again if it's something that you think you're going to use something that you think would be beneficial in your own home network it definitely works right and it does its job well it does what it's supposed to do I just am personally concerned about the security implications of something like this especially when you're talking about dragging one of these into a corporate network and just plugging it in and then having control over which devices on that network can see the internet and which can't ok so that's that's very concerning to me alright well I hope you guys enjoyed this video if you did enjoy this video please give me a thumbs up and if you'd like to see more videos like this please click Subscribe my name is Chris crosstalk Solutions and thank you so much for watching [Music] you you if you did enjoy this video please give me a thumbs up and if you'd like to see more videos like this please click subscribe my name is Chris crosstalk Solutions and thank you so much for watching

Channel: Crosstalk Solutions

Views: 77,315

Keywords: fing, fing app, fingbox, fing box, network monitoring, 802.1x, arp, arp spoof, arp spoofing

Id: 4Hc3YGsaW8U

Length: 32min 20sec (1940 seconds)

Published: Fri Sep 15 2017