Stories and content in Weird Darkness can be disturbing for some listeners and is intended for mature audiences only. Parental discretion is strongly advised. Welcome, Weirdos. I'm Darren Marlar and this is Weird Darkness. Here you'll find stories of the paranormal, supernatural, legends, lore, the strange and bizarre, crime, conspiracy, mysterious, macabre, unsolved and unexplained. If you're new here, welcome to the show and while you're listening, be sure to check out WeirdDarkness.com for merchandise, my newsletter, to connect with me on social media, and more. Coming up in this episode, it's Thriller Thursday and The Hunter of the Ring is our story. It was first published in the Pulp Magazine Weird Tales in the June 1934 issue. The author Robert E. Howard earned only $60 for this publication, which is about $1,100 today. The story was set in what was at the time the modern age of 1934. The short story belonged to the universe of the Cthulhu mythos, so while it might not have been written by H.P. Lovecraft himself, it was certainly inspired by him. And bizarrely, at the same time, it is also a part of the Conan the Barbarian universe, as it includes a relic from the Hyborian age of the Conan the Barbarian stories, the ring of Thoth Ammon.  As I enter John Kirwan's study, I was too much engrossed in my own thoughts to notice at first the haggard appearance of his visitor, a big handsome young fellow well-known to me. Hello, Kirwan, I greeted. Hello, Gordon. I haven't seen you for a while. How's Evelyn? And before he could answer, still on the crest of the enthusiasm which had brought me there, I exclaimed, Look here, you fellows, I've got something that'll make you stare. I got it from that robber, Ahmed Mechtem, and I paid high for it, but it's worth it. Look. From under my coat, I drew the jewel-hilted Afghan dagger, which had fascinated me as a collector of rare weapons. Kirwan, familiar with my passion, showed only polite interests, but the effect on Gordon was shocking. With a strangled cry, he sprang up and backward, knocking the chair, clattering to the floor. Sclenched and countenance livid, he faced me crying, Keep back, get away from me or… I was frozen in my tracks. What in the… I began bewilderably when Gordon, with another amazing change of attitude, dropped into a chair and sank his head in his hands. I saw his heavy shoulders quiver. I stared helplessly from him to Kirwan, who seemed equally dumbfounded. Is he drunk? I asked. Kirwan shook his head, and filling a brandy glass offered it to the man. Gordon looked up with haggard eyes, seized the drink and gulped it down like a man half famished. Then he straightened up and looked at us shame-facedly. I'm sorry, I went off my handle, O'Donnell, he said. It was the unexpected shock of you drawing that knife. Well, I retorted, with some disgust. I suppose you thought I was going to stab you with it. Yes, I did. Then, at the utterly blank expression on my face, he added, Oh, I didn't actually think that, at least I didn't reach that conclusion by any process of reasoning. It was just a blind, primitive instinct of a haunted man against whom anyone's hand may be turned. His strange words and the despairing way he said them sent a queer shiver of nameless apprehension down my spine. What are you talking about? I demanded uneasily. Punted? For what? You never committed a crime in your life. Not in this life, perhaps, he muttered. What do you mean? What if retribution for a black crime committed in a previous life were hounding me, he muttered. That's nonsense, I snorted. Oh, is it? He exclaimed, stung. You ever hear of my great-grandfather, Sir Richard Gordon, of Argyle? Sure, but what's that got to do with you've seen his portrait? Doesn't it resemble me? Well, yes, I admitted, except that your expression is frank and wholesome whereas his is crafty and cruel. He murdered his wife, answered Gordon. Suppose the theory of reincarnation were true. Why shouldn't a man suffer in one life for a crime committed in another? You mean you think you are the reincarnation of your great-grandfather? All the fantastic… well, since he killed his wife, I suppose you'll be expecting Evelyn to murder you. This last was delivered in searing sarcasm, as I thought of the sweet, gentle girl Gordon had married. His answer stunned me. My wife, he said slowly, has tried to kill me three times in the past week. There was no reply to that. I glanced helplessly at John Kirowen. He sat in his customary position, chin resting on his strong, slim hands. His white face was immobile, but his dark eyes gleamed with interest. In the silence, I heard a clock ticking like a death watch. Tell us the full story, Gordon, suggested Kirowen, and his calm, even voice was like a knife that cut a strangling, leaving the unreal tension. You know we've been married less than a year, Gordon began. Plunging into the tale as though he were bursting for utterance, his words stumbled and tripped over one another. All couples have spats, of course, but we've never had any real quarrels. Evelyn is the best-natured girl in the world. The first thing out of the ordinary occurred about a week ago. We'd driven up in the mountains, left the car, and were wandering around picking wildflowers. At last we came to a steep slope, some 30 feet in height, and Evelyn called my attention to the flowers, which grew thickly at the foot. I was looking over the edge and wondering if I could climb down without tearing my clothes to ribbons when I felt a violent shove from behind that toppled me over. If it had been a sheer cliff, I'd have broken my neck. As it was, I went tumbling down, rolling and sliding and brought up at the bottom, scratched and bruised with my garments and rags. I looked up and saw Evelyn staring down, apparently frightened half out of her wits. Oh, Jim! she cried. Are you hurt? How came you to fall? It was on the tip of my tongue to tell her that there was such a thing as carrying a joke too far. But these words checked me. I decided she must have stumbled against me unintentionally and actually didn't know that it was she who precipitated me down the slope. So I laughed it off and went home. She made a great fuss over me, insisted on swabbing my scratches with iodine and lectured me for my carelessness. I had in the heart to tell her it was her fault. But four days later, the next thing happened. I was walking along our driveway when I saw her coming up it in the automobile. I stepped out of the grass to let her by as there isn't any curb along the driveway. She was smiling as she approached me and slowed down the car as if to speak to me. Then, just before she reached me, a most horrible change came over her expression. Without warning, the car leaped at me like a living thing as she drove her foot down on the accelerator. Only a frantic leap backwards saved me from being ground under the wheels. The car shot across the lawn and crashed into a tree. I ran to it and found Evelyn dazed and hysterical but unhurt. She babbled of losing control of the machine. I carried her into the house and sent for Dr. Donnelly. He found nothing seriously wrong with her and attributed her dazed condition to just fright and shock. Within half an hour, she regained her normal senses, but she has refused to touch the wheel since. Strange to say, she seemed less frightened on her own account than on mine. She seemed vaguely to know that she'd nearly run me down and grew hysterical again when she spoke of it. Yet she seemed to take it for granted that I knew the machine had got out of her control. But I distinctly saw her wrench the wheel around and I know she deliberately tried to hit me. Why God alone knows. Still, I refused to let my mind follow the channel it was getting into. Evelyn had never given any evidence of any psychological weakness or nerves. She's always been a level-headed girl, wholesome and natural. But I began to think she was subject to crazy impulses. Most of us have felt the impulse to leap from tall buildings and sometimes a person feels a blind, childish and utterly reasonless urge to harm someone. We pick up a pistol and the thought suddenly enters our mind how easy it would be to send our friend to sit smiling and unaware into eternity with a touch of the trigger. Of course we don't do it, but the impulse is there. So I thought perhaps some lack of mental discipline made Evelyn susceptible to these unguided impulses and unable to control them. Nonsense, I broke in. I've known her since she was a baby. If she has any such trait, she's developed it since she married you. It was an unfortunate remark.  That's just it. Since she married me, it's a curse.  I tell you, I was Richard Gordon and she she was Lady Elizabeth, his murdered wife. His voice sank to a blood-freezing whisper. I shuddered. It's an awful thing to look upon the ruin of a keen, clean brain. And such I was certain that I surveyed in James Gordon. Why or how, or by what grisly chance it had come about, I could not say. But I was certain the man was mad. You spoke of three attempts. It was John Carolin's voice again, calm and stable amid the gathering webs of horror and unreality. Look here! Gordon lifted his arm, drew back the sleeve and displayed a bandage, the cryptic significance of which was intolerable. I came into the bathroom this morning, looking for my razor, he said. I found Evelyn just on the point of using my best shaving implement for some feminine purpose, to cut out a pattern or something. Like many women, she can't seem to realize the difference between a razor and a butcher knife or a pair of shears. I was a bit irritated, and I said, Evelyn, how many times have I told you not to use my razors for such things? Bring it here, I'll give you my pocket knife. I'm sorry, Jim, she said. I didn't know it would hurt the razor. Here it is. She was advancing, holding the open razor toward me. I reached for it, then something warned me. It was the same look in her eyes. Just as I had seen it, the day she nearly ran me over.  The blade gashed my arm, as you see, before I caught her wrist. For an instant, she fought me like a wild thing. Her slender body was taut and steel beneath my hands. Then she went limp, and the look in her eyes was replaced by a strange, dazed expression. The razor slipped out of her fingers. I let go of her, and she stood swaying as if about to faint. I went to the lavatory. My wound was bleeding in a beastly fashion, and the next thing I heard her cry out, and she was hovering over me. Jim, she cried, how did you cut yourself so terribly? Gordon shook his head and sighed heavily. I guess I was a bit out of my head. My self-control snapped. Don't keep up this pretense, Evelyn, I said.  She recoiled as if I'd struck her, catching at her breast and staring at me as if at a ghost. She didn't say a word, and just what I said, I don't remember. But when I finished, I left her standing there white and still as a marble statue. I got my arm bandaged at a drugstore, and then came over here, not knowing what else to do. Kierwin, oh, Donald, it's damnable.  He choked on the word. No, I can't believe it.  He'd beat his fists together in his impotence and agony. But it's insanity. I used to work in a psychopathic ward, and I've seen every form of mental imbalance. My wife is not insane. Then what? I began, but he turned haggard eyes on me. Only one alternative remains, he answered. It's the old curse. From the days when I walked the earth with a heart as black as hell's darkest pits and did evil in the sight of man and of God, she knows, in fleeting snatches of memory. People have seen before, have glimpsed forbidden things in momentary liftings of the veil, which bars life from life. She was Elizabeth Douglas, the ill-fated bride of Richard Gordon, whom he murdered in a jealous frenzy, and the vengeance is hers. I shall die by her hands, as it was meant to be. And she, he bowed his heads in his hands. Just a moment, it was Kiro and again.  What sort of look? Was it a maniacal frenzy? Gordon shook his head. It was another blankness. All the life and intelligence simply vanished, leaving her eyes dark wells of emptiness. Kiro unknotted and asked a seemingly irrelevant question. Have you any enemies? Not that I know of. You forget Joseph Rolock, I said. I can't imagine that elegant sophisticated going to the trouble of doing you actual harm, but I have an idea that if he could discomfort you without any physical effort on his part, he'd do it with a right good will. Kiro turned on me and I that had suddenly become piercing. And who is this Joseph Rolock? A young exquisite who came into Evelyn's life and nearly rushed her off her feet for a while. But in the end, she came back to her first love, Gordon, here. Rolock took it pretty hard. For all of his suave-ness, there's a streak of violence and passion in the man that might have cropped out but for his infernal indolence and blasé indifference. Oh, there's nothing to be said against Rolock, interrupted Gordon impatiently. He must know that Evelyn never really loved him. He merely fascinated her temporarily with his romantic Latin air. Not exactly Latin, Jim, I protested. Rolock does look for him, but it's not Latin. It's almost oriental. I want Rolock to do with this matter. Gordon snarled with his harassability afraid nerves. He's been as friendly a man as he could be since Evelyn and I were married. In fact, only a week ago, he sent her a ring which he said was a peace offering and a belated wedding gift. Sad that after all, her jolting him was a greater misfortune for her than it was for him. The conceited jackass. A ring. Kiroan has suddenly now come to life. It was as if something hard and steely had been sounded in him. What sort of ring? Oh, fantastic thing. Copper.  I gather he picked it up somewhere in Hungary. He has traveled a great deal in Hungary. Gordon looked surprised at this questioning, but answered, Why, apparently the man's traveled everywhere. I put him down as the pampered son of a millionaire. He never did any work so far as I know. He's a great student, I put in. I've been up to his apartment several times and I never saw such a collection of books. Gordon leaped to his feet with an oath. Are we all crazy? He cried. I came up here hoping to get some help and you fellows are talking of Joseph Rolock. I'll go to Dr. Donnelly. Wait, Kiroan stretched out a detaining hand. If you don't mind, we'll go over to your house. I'd like to talk to your wife. Gordon dumbly acquiesced. Herried and haunted by grisly forebodings, he knew not which way to turn and welcomed anything that promised aid. We drove over in his car and scarcely a word was spoken on the way. Gordon was sunk in moody ruminations and Kiroan had withdrawn himself into some strange aloof domain of thought beyond my kin. He sat like a statue, his dark, vital eyes staring into space, not blankly but as one who looks with understanding into some far realm. Though I counted the man as my best friend, I knew but little of his past. He'd come into my life as abruptly and unannounced as Joseph Rolock had come into the life of Evelyn Ash. I'd met him at the Wanderverse Club, which is composed of the drift of the world, travelers, eccentrics, and all manner of men whose paths lie outside the beaten tracks of life. I had been attracted to him and was intrigued by his strange powers and deep knowledge. I vaguely knew that he was the black sheep younger son of a titled Irish family and that he had walked many strange ways. Gordon's mention of Hungary struck a chord in my memory. One phase of his life, Kiroan had once let drop fragmentarily. I only knew that he had once suffered a bitter grief and a savage wrong and it had been in Hungary, but the nature of the episode I did not know. At Gordon's house, Evelyn met us calmly, showing interagitation only by the over-restraint of her manner. I saw the beseeching look she stole at her husband. She was a slender, soft-spoken girl whose dark eyes were always vibrant and a light with emotion. That child tried to murder her adored husband? The idea was monstrous. Again, I was convinced that James Gordon himself was deranged. Following Kiroan's lead, we made a pretense of small talk as if we had casually dropped in, but I felt that Evelyn was not deceived. Our conversation rang false and hollow and presently, Kiroan said, Mrs. Gordon, that is a remarkable ring you're wearing. Do you mind if I look at it? I'll have to give you my hand, she laughed. I've been trying to get it off today and it won't come off.  He did not touch it. I myself was aware of an unaccountable repulsion. There was something almost obscene about that dull, copperish reptile clowned about the girl's white finger. It's evil-looking, isn't it? She involuntarily shivered. At first I liked it, but now I can hardly bear to look at it. If I can get it off, I intend to return it to Joseph, Mr. Rolock. Kiroan was about to make some reply when the doorbell rang. Gordon jumped as if shot, and Evelyn rose quickly. I'll answer it, Jim. I know who it is. She returned an instant later with two more mutual friends, those inseparable cronies, Dr. Donnelly, whose burly body, jovial manner, and booming voice were combined with as keen a brain as any in the profession, and Bill Bain, elderly, lean, wiry, acidly witty, both were old friends of the Ash family. Dr. Donnelly had ushered Evelyn into the world, and Bain was always Uncle Bill to her. Howdy, Jim. Howdy, Mr. Kiroan, roared Donnelly. Hey, old Donald, you got any firearms with you? Last time you nearly blew my head off, showing me an old flintlock pistol that wasn't supposed to be loaded. Dr. Donnelly? We all turned. Evelyn was standing beside a wide table, holding it as if for support. Her face was white. Our bad news ceased instantly, a sudden tension was in the air. Dr. Donnelly, she repeated, holding her voice steady by an effort. I sent for you and Uncle Bill for the same reason for which I know Jim has brought Mr. Kiroan and Michael. There was a matter Jim and I could no longer deal with alone. There's something between us. Something black and ghastly and terrible. What are you talking about, girl? All the levity was gone from Donnelly's great voice. My husband, she choked, then went blindly on. My husband has accused me of trying to murder him. The silence that fell was broken by Bane's sudden and energetic rise.  Ye young pup! He shouted at Gordon. Oh, Dr. Living Daylights, sit down, Bill. Donnelly's huge hand crushed his smaller companion back into his chair. No use going off half-cocked. Go ahead, honey. We need help. We cannot carry this thing alone. A shadow crossed her comely face. This morning, Jim's arm was badly cut. He said I did it. I don't know. I was handing him the razor. Then I must have fainted. At least everything faded away. When I came to myself, he was washing his arm in the lavatory and he accused me of trying to kill him. Why, the young fool! barked the belligerent Bane. Has any sense enough to know that if you did cut him, it was an accident?  Honey, you say you fainted? That didn't like you. I've been having fainting spells, she answered. The first time was when we were in the mountains and Jim fell down a cliff. We were standing on the edge, then everything went black. And when my sight cleared, he was rolling down the slope. She shuddered at the recollection. Then when I lost control of the car and it crashed into the tree, you remember, Jim called you over. Dr. Donnelly nodded his head ponderously. I don't remember you ever having fainted spells before. But Jim says I pushed him over the cliff. She cried hysterically. He says I tried to run him down in the car. He says I purposely slashed him with the razor. Dr. Donnelly turned, perplexed toward the wretched Gordon. How about it, son? God help me. Gordon burst out in agony. It's true.  It was Bane who gave tongue leaping again to his feet. If you want a divorce, why don't you get it in a decent way instead of resorting to these despicable tactics?  Roared Gordon, lunging up and losing control of himself completely. If you say that, I'll tear your jugular out. Evelyn screamed. Donnelly grabbed Bane ponderously and banged him back into his chair with no overtly gentle touch, and Kira when laid a hand lightly on Gordon's shoulder. The man seemed to crumple into himself. He sank back into his chair and held out his hands gropingly toward his wife. Evelyn, he said, his voice thick with laboring emotion. You know I love you. I feel like a dog. But God help me. It's true. If we go on this way, I'll be a dead man. And you don't say it. She screamed. I know you wouldn't lie to me, Jim. If you say I tried to kill you, I know I did. But I swear, Jim, I didn't do it consciously. Oh, I must be going mad. That's why my dreams have been so wild and terrifying lately. Of what have you dreamed, Mrs. Gordon asked Kira when gently. She pressed her hands to her temples and stared dolly at him as if only half comprehending. A black thing, she muttered.  I dream of it every night and in the daytime, I try to kill the only man I ever loved. I'm going mad. Maybe I'm already crazy and don't know it. Calm yourself, honey. To Dr. Donnelly with all his science, it was only another case of feminine hysteria. As a matter of fact, voice seemed to soothe her, and she sighed and drew a weary hand through her damp locks. We'll talk this all over and everything's gonna be okay, he said, drawing a thick cigar from his vest pocket. Give me a match, honey. She began mechanically to feel about the table and, just as mechanically, Gordon said, there are matches in the drawer, Evelyn. She opened the drawer and began groping at it, when suddenly, as if struck by recollection and intuition, Gordon sprang up, white-faced, and shouted, No, no, don't open that drawer, don't! Even as he voiced that urgent cry, she stiffened, as if at the feel of something in the drawer. Her change of expression held us all frozen, even Kirillin. The vital intelligence vanished from her eyes like a blown-out flame, and into them came the look Gordon had described as blank. The term was descriptive. Her beautiful eyes were dark wells of emptiness, as if the soul had been withdrawn from behind them. Her hand came out of the drawer, holding a pistol, and she fired point-blank. Gordon reeled with a groan and went down, blood starting from his head. For a flashing instant, she looked down stupidly at the smoking gun in her hand, like one suddenly waking from a nightmare. Then her wild scream of agony smote our ears. Oh, God! I've killed him! Jim! Jim!  The emptiness was gone from her eyes. They were alive and dilated with grief and terror. I was making toward my prostrate friend with Donnelly and Bane, but Kirillin cut my arm. His face was no longer immobile, his eyes glittered with a controlled savagery. Leave him to them, he snarled. We are hunters, not healers. Lead me to the house of Joseph Roelach. I did not question him. We drove there, in Gordon's car. I had the wheel and something about the grim face of my companion caused me to hurl the machine recklessly through traffic. I had the sensation of being part of a tragic drama which was hurtling with headlong speed toward a terrible climax. I wrenched the car to a grinding halt at the curb before the building where Roelach lived in a bizarre apartment high above the city. The very elevator that shot us skyward seemed imbued with something of Kirillin's driving urge for haste. I pointed out Roelach's door and he cast it open without knocking and shouldered his way in. I was close to his heels. Roelach in a dressing gown of Chinese silk worked with dragons, was lounging on a divan, puffing quickly at a cigarette. He sat up, overturning a wine glass which stood with a half-filled bottle at his elbow. Before Kirillin could speak, I burst out with our news. James Gordon has been shot. He sprang to his feet. Shot? When did she kill him? She? I glared in bewilderment. How did you know? With a steely hand, Kirillin thrust me aside and as the men faced each other I saw recognition flare up in Roelach's face. They made a strong contrast. Kirillin, tall, pale, with some white, hot passion.  I realized that whatever else occurred, it lay between those two men. They were not strangers. I could sense like a terrible thing the hate that lay between them. Jean Kirillin softly whispered, Roelach. You remember me, Josef, Roelach. Only in iron control kept Kirillin's voice steady. The other merely stared at him without speaking. Years ago, said Kirillin more deliberately, when we delved in the dark mysteries together in Budapest, I saw wither you were drifting. I drew back. I would not descend to the foul depths of forbidden occultism and diabolism to which you sank. And because I would not, you despised me, and you robbed me of the only woman I ever loved.   Kirillin's voice rose in fierce exaltation. All his cultured restraint had been swept away from him, leaving a primitive elemental man, raging and gloating over a hated foe.  You, Roelach shrugged his shoulders and laughed, you are mad, I have not seen the Gordon's for weeks.  Kirillin snarled, liar as always. What did you say just now when O'Donnell told you Gordon had been shot? When did she kill him? You were expecting to hear that the girl had killed her husband. Your psychic powers had told you that a climax was close at hand. You were nervously awaiting news of the success of your devilish scheme. But I did not need a slip of your tongue to recognize your handiwork. I knew as soon as I saw the ring on Evelyn Gordon's finger, the ring she could not remove, the ancient and accursed ring of Thothamon, handed down by foul cults of sorcerers since the days of Forgotten Stygia. I knew that ring was yours and I knew by what ghastly rites you came to possess it, and I knew its power. Once she put it on her finger in her innocence and ignorance, she was in your power. By your black magic you summoned the black elemental spirit, the haunter of the ring, out of the guiles of night and the ages. Here in your accursed chamber, you performed unspeakable rituals to drive Evelyn Gordon's soul from her body and to cause that body to be possessed by that godless sprite from outside the human universe. She was too clean and wholesome, her love for her husband, too strong for the fiend to gain complete and permanent possession of her body. Only for brief instance could it drive her own spirit into the void and animate her form.  Heroine's voice rose to a feline screech. What was the price demanded by the fiend you drew from the pits? Ha! You blench! Joseph Rolock is not the only man to have learned forbidden secrets.  I explored the ruins of Zimbabwe, the lost mountains of Inner Mongolia, and the forgotten jungle islands of the southern seas. I learned what sickened my soul so that I foreswore occultism forever. But I learned of the black spirit that deals death by the hand of a beloved one and is controlled by a master of magic. But, Joseph Rolock, you are not an adept. You have not the power to control the fiends you have invoked and you have sold your soul. The Hungarian Taurus collar, as if it were a strangling noose, his face had changed as if a mask had dropped away. He looked much older. You lie, he panted. I did not promise him my soul. I do not lie. Heroine Shriek was shocking in its wild exultation. I know the price a man must pay for calling forth the nameless shape that roams the gulfs of darkness. Look! There in the corner behind you, a nameless, sightless thing is laughing, it's mocking you. It has fulfilled its bargain and has come for you, Joseph Rolock. No, no! Shrieked Rolock, tearing his limp collar away from his sweating throat. His composure had crumpled and his demoralization was sickening to see. I tell you, it was not my soul. I promised it a soul, but not my soul. He must take the soul of the girl or of James Gordon. Fool! roared Heroine. Do you think you could take the souls of innocents that he would not know they were beyond his reach? The girl and the youth he could kill. Their souls were not his to take or yours to give. But your black soul is not beyond his reach, and he will have his wage. Look! He is materializing behind you. He is growing out of thin air. Was it the hypnosis inspired by Carolyn's burning words that caused me to shudder and grow cold? To feel an icy chill that was not of earth pervade the room? Was it a trick of light and shadow that seemed to produce the effect of a black anthropomorphic shadow on the wall behind the Hungarian? No. By heaven, it grew. It swelled. Rolock had not turned.  Carolyn's cry started shutters down my spine.  I see him. He has come. He is here. His grisly mouth gapes in awful laughter. His misshapen paws reach for you. And then at last, Rolock wheeled with an awful shriek, throwing his arms above his head in a gesture of wild despair. And for one, brain-shattering instant, he was blotted out by a great black shadow. Carolyn grasped my arm and we fled from that accursed chamber, blind with horror. The same paper, which bore a brief item telling of James Gordon having a slight scalp wound by the accidental discharge of a pistol in his home, headlined the sudden death of Joseph Rolock, wealthy and eccentric club man in his sumptuous apartments apparently from heart failure. I read it at breakfast, while I drank cup after cup of black coffee, from a hand that was not too steady, even after the lapse of a night. Across the table from me, Cureland likewise seemed to lack appetite. He brooded as if he roamed again through bygone years. Gordon's fantastic theory of reincarnation was wild enough, I said at last, but the actual facts were still more incredible. It told me, Cureland, was that last scene the result of hypnosis? Was it the power of your words that made me seem to see a black horror grow out of the air and rip Joseph Rolock's soul from his living body? He shook his head. No human hypnotism would strike that black-hearted devil dead on the floor. No. There are beings outside the can of common humanity, foul shapes of trans-cosmic evil, such a one it was with which Rolock dealt. But how could it claim his soul, I persisted? If indeed such an awful bargain had been struck, it had not fulfilled its part, for James Gordon was not dead, but merely not senseless. Rolock did not know it, answered Cureland. He thought that Gordon was dead, and I convinced him that he himself had been trapped and was doomed. In his demoralization he fell easy prey to the thing he called forth. It of course was always watching for a moment of weakness on his part. The powers of darkness never deal fairly with human beings. He who traffics with them is always cheated in the end. It is a mad nightmare, I muttered. But it seems to me then that you as much as anything else brought about Rolock's death. It is gratifying to think so, Cureland answered. Evelyn Gordon is safe now, and it is a small repayment for what he did to another girl years ago and in a far country. Thanks for listening. If you like the show, please share it with someone you know who loves the paranormal or strange stories, true crime, monsters or unsolved mysteries like you do. And please leave a rating and review of the show and the podcast app you listen from. Doing so helps the show to get noticed. You can also email me anytime with your questions or comments through the website at WeirdDarkness.com. That's also where you can find all of my social media, listen to free audiobooks, shop the Weird Darkness store, find my other podcast, Church of the Undead and more. Plus, if you have a true paranormal or creepy tale to tell, you can click on Tell Your Story. Stories on Thriller Thursday episodes are works of fiction, and links to the stories or the authors can be found in the show notes. The original short story, The Haunter of the Ring, was written by Robert E. Howard. Weird Darkness is a production and trademark of Marlar House Productions. Copyright, Weird Darkness. And now that we're coming out of the dark, I'll leave you with a little light. Romans 14 verse 19, let us therefore make every effort to do what leads to peace and to mutual edification. And a final thought from Victor Hugo. There are thoughts which are prayers. There are moments when, whatever the posture of the body, the soul is on its knees. I'm Darren Marlar. Thanks for joining me in the Weird Darkness. Hey Weirdos, be sure to click the like button and subscribe to this channel, and click the notification bell so you don't miss future videos. I post videos seven days a week. And while you're at it, spread the darkness by sharing this video with someone you know who loves all things strange and macabre. If you want to listen to the podcast, you can find it at WeirdDarkness.com.


Gold contract up $17.50, traded at $1985.80 an ounce, we have Silver down $0.05, $23.04 an ounce, Light Sweet crude up $1.90, $90.22 a barrel, notes and bonds, a 10-year note trading down 14 ticks, $105.14, the 30-year for full point, plus 13 ticks at $107.28, that's some big numbers out here folks because we've got the 10-year right now, it hit $4.981 and we're at the high of the, we're at the high period and $king dollar, $king dollar right now down $321 ticks, trading $106.244, the euros at $105, the ends trading at $149, the British pounds at $121 to $1 US dollar. So we get over and take a look at this spy here, what you're doing, you're going into the October 6th, basically strength, you know, what you had out here yesterday, you came down with volume, you have an expansion of volume, we did $91 million, $93 million, you're going to do probably $100 today, now you're coming into this $113 million. Now the top of that range, however though, is much higher, meaning that once you're into this bar so much, we're into the bar, I've got to open that thing up more, the bottom line is that that bar is a long bar and you're about halfway down on the bar, so that is saying that it can test the bottom of that bar. We got to take a look at the 10-year, so the 10-year keeps breaking lows, you don't have any buyers in the 10-year right now, you know, bottom line is that you have 2 million, 2.09 million contracts, let's see what we had out here yesterday, it's kind of the same as yesterday, and gold, so gold is on its own, bottom line is that what's really intriguing about the gold market right now is that, you know, higher interest rates normally wax gold, and just the opposite's actually happened, you know, gold's taken out of swing point today, we're at 1896, this baby's on the way up to 2038, you know, it's been strength after strength after strength, and then if we go to the doll, the doll is done, so we'll see the correlation, you know, today you get the market down and the doll is down, which is unusual, but the bottom line is that what the doll had done is that it broke its channel line, got back above it for a day, and then gave it up again, stay right there folks, come right back.


I'm Sebastian Kinnah. I'm Darren Kitchin. And to reverse that together, we form the power of Wi-Fi panel. Goodness, hack five. Hack five just turned 10 years old on the 5th of August. That was pretty insane. So if anybody can tell me the name of the original theme music, they get Freeland Turtle. Yeah, I didn't think so. So what we're going to talk about today, we do a little pineapple primer. For those of you who aren't familiar, we're going to quickly recap the changes in the Wi-Fi landscape as this is a game of cat and mouse that we're continuously enjoying. Going to talk a little bit about Pine AP, the success of that, what we've done to make it better, some of the new features. We're going to get into a little analysis of some of the captures that we've done with that. And we're going to talk about security. And then we're going to talk about the future of the fruit. So what is the Wi-Fi pineapple? It's a rogue access point. It's so many things. It's a Pentes pivot box, obviously. It's most known for its intuitive web interface. You know, the way that we just basically package up these tools and make it simple, because like, OK, sure, you may know all of the esoteric, tac, tac, p, colon, underscore. That's cool. Don't get me wrong, I love that. Sometimes I just want to make it do the thing. With that, what it does best is it's kind of most known as its first rogue access point feature, again, the Pine AP Suite. And that what that provides is, being a rogue access point, says like, hey, I'm really interested in collecting clients, but why? Because that's only one step of the game. And the idea is to poise yourself on the network as the man in the middle, much like Comcast is at home for you. We also do really well remote management out of band, which is a lot of times fun, especially if you're using this as like a pentest pivot box. Drop it on an organization. Get a 3G signal out that leads in with pentest pivot. And of course, the extensible platform that we've built that a lot of people have contributed to in the way of infusions and whatnot. So really trying to build a platform that's as easy as possible to develop for. And we're constantly amazed when we come to DEF CON and we hear the stories of the esoteric things that the Wi-Fi pineapple is being used for. So I love that stuff. It's not space, dude. He's used to more, not less. Sorry. Yeah. So anyway, our mission is to create simple, affordable, and effective tools for the penetration testers, the systems administrators, the geek meteroids. And quite simply, our philosophy is make it do the thing. Those are turtles. Seb, you want to walk us through the Wi-Fi landscape and how it's evolved? So hopefully most people here are familiar with the karma attack that used to exist before. Yeah? No? Wow, two people? That's three people? Four people? All right, okay, that's better. Right, so there used to be this thing called, or there still is, but there used to be this thing called karma. And the way it worked is basically that your wireless devices would search for a certain network and say, is my ACME Wi-Fi around? And all that karma would say, or the pineapple in that case would say, is yes, I am. And then the connection would be made. So that obviously doesn't work well anymore. Well, it worked really well for its time. It worked the same way that, say, the mirror in Harry Potter worked, which was you look it in and you see what you want to see. So if what you're looking for is linksys, you're going to see linksys. And what you're looking for is coffee shop wireless. You're going to see coffee shop wireless. But that doesn't necessarily the way that devices work anymore. Before we go any further, of course we need to real quick touch on some real basics of Wi-Fi. Mainly the management frames those are the things that we're most interested in.  So beacon frames, there's only one type. They're just beacons. They're just little advertisements. They're like billboards on the side of the road. So that everybody can see them and say like, hey, come over to here to this place. Probes come in two forms, probe requests. Again, I'm looking for linksys. I'm looking for that coffee shop. And of course the subsequent probe response, which would be I am that linksys or I am that coffee shop. And the probe response is actually very similar to a beacon. I think there's only a few hex values that are even different in the packet. It just basically says like, here's the modes that I support. Here's my encryption standard. Here's all the ways that I like to do things. And then there's either creating the relationship or destroying the relationship. The association and the authentication and likewise the disassociation and the deauthentication. And those are just packets that say, let's be friends or GTFO. Okay, so Karma worked as I said before because it's convenient. You want your device to turn on. You wanna open your laptop lid and you want to automatically connect. And before that was done because you were probing for your PNL, your preferred network list. Most devices or a lot of devices, surprisingly some have reverted what they were doing but we'll get into that later. So a lot of devices they probe to broadcast now versus for probing for a specific SSID. So they won't ask for Acme Corp anymore. They will ask for broadcast and then every access point responds and then they can pick from the access points that they want. So that pretty much thoughts the entire Karma attack, the way it used to work. And it's because of Karma and Karma success that this whole landscape has changed and vendor implementations have changed as such. And it changes the convenience. I mean, as we know, like, convenience and security are constantly at odds. It's obviously faster if you know the access point you want to directly query it and say, like, let's be friends instead of like saying, is anyone out there? And waiting around. And so what it does is it means that the landscape is more like a game of go fish now. Where it's like, hey, are you still there? And then of course that varies by the vendor's implementation but you kind of have to know ahead of time what may possibly be in that device's preferred network list. Right. And not only that, the variation in terms of how these things are implemented is so different from vendor to vendor. So for example, some devices will still probe for the network they want but if they do not see the actual beacons but only see probe responses or association responses, the requests or responses in that matter, the access point will notice it's not a real access point and it'll actually blacklist that. So it'll not connect even though it's probed, it got a response, it'll say, okay, well, you're not a real access point. So there's that. Then we have devices that just probe to broadcast as we were saying. Then there's devices that have both of that. Some devices we'll get into that a little bit later again but huge range in the implementations and some are more vulnerable than others and some are very locked down. I don't know, black phone, if you guys know that, you should. They changed a few things lately and it's awesome and it protects you against these type of attacks. So in this ever-changing Wi-Fi landscape would of course as a Wi-Fi pineapple to do which led us to introduce the PineAP suite which extends on karma because karma was great at just saying yes. Anybody here recall the code name for the project before just Wi-Fi pineapple? Like guys fight over the land turtle, totally missed. You can't throw. Okay, right, so. So that led to building an entire suite because there's lots of other ways that we can basically make the honey pot sweeter.  Right, so as I was just saying, basically devices don't start probing for their PNL anymore. They are probing to broadcast and it's hard to now know what they're probing for. There's different methods of getting the PNL of devices or getting the best guess that we know. The way we do it is we do it over something called SSID harvesting where we take all the probe requests and all the beacons that we see and we memorize them. We consort them, we have a database for them and we can then see what devices would probably respond to what SSIDs. And we reinforce that by doing beacon injections which is basically just we're beaconing out that we're at this access point. So we're actively saying we are this access point because we've seen other devices probe. The reason why that works is normally in a certain location, you or a certain site that you're working on is going to have devices that are differentiating in terms of who, sorry, the manufacturers, the policies that they have implemented. So you're going to be getting some overlap in terms of what SSIDs they're looking for, what APs they're looking for. So that's what beacon injection is. And then beacon response is actually something quite odd. It's kind of an anomaly here. You can send beacons, normally beacons are sent to broadcast. You can target a specific MAC address with them. You just switch out the MAC. And what happens is most devices will just ignore that frame because it's not meant for them, right? So they don't care, they ignore the packet and they won't show it.  So I was saying the vendor implementation where the vendor requires beacons to be visible before it will actually associate. So you have to be actively beaconing what they're looking for. The way we do that is we actually send them targeted so that when you look on your phone or at least when the normal clients that are around, when they then look at their devices, it doesn't seem obvious. Obviously the packets are there. So if you use Wireshark or wireless IDS, this is going to throw up a lot of red flags and we'll talk about that a little bit too. But yeah, what do you want to add? Right, and then recon mode, which is basically a, and we're going to expand on that more in a bit, but basically it's part of the suite that allows you to visualize the wifi landscape, which aids considerably in targeting and filtering and making sure that you are auditing just the access points and just the clients that you're particularly interested in. And so it's kind of like a front end to a lot of the features of the Pineapy suite. Right, and that's a quick overview of what we implemented. We gave a poll talk on that last year. And then the idea there is building the recon mode. The idea was to give you a landscape so that you're not just turning on the pineapple and turning on karma, which was pretty much, I mean, this is the revolution we're in like the fifth iteration, the mark five, you know, the original is just like on and off, right? You turn on karma and like, well, there goes the neighborhood. And now we don't think that's really the best way to use the tool. So we've set it up in such a way where you can actually specify filters. So there's allow lists and deny lists and you can do that based on SSID. If you're only interested in a particular access point, say everybody in the company associates with this set access point or the company is across the street from a coffee shop where they use that set access point, you can filter by that or by the MAC address. So if you're contracted to just target the CFO, you can get the CFO's MAC address and make sure that only he can connect to or he or she can connect to your device and allow you to do that man in the middle attack. What's also really interesting here about the Pineapy suite is that not only are we able to set targets, as opposed to just broadcast, meaning everyone, we can actually also set the source, which is kind of novel. Right, so again, this is something that we can do because we're just injecting frames. We can take any type of pineapple, so say you have multiple pineapple set up in a certain vicinity and they're connected in one shape or form or even if they're not, you'll be able to set the source to one pineapple. So say you want to use five pineapples around a certain site to tell clients to connect to one pineapple, you can do this by changing your source, making it seem like it's coming from the original, the one pineapple you're using as a collection and as the actual access point, which might be providing internet. So you can actually couple pineapples that way. And then we can of course set it to use different intervals and we'll take more about that later, but basically it's speeding up the attacks and being more just saturating the airways more with these kinds of attacks. And actually on the interval thing, 802.11 is expressed in things called time units and it has to do with the maths, but really when it comes to 802.11 are really a lot of wireless protocols. Timing is everything and with Wi-Fi everything's done in microseconds, but we learned this in particular while we were hanging out in San Francisco at three in the morning, camped outside of T-Mobile to be the first in line for some god awful reason to buy the Nexus 6. I don't recommend hanging out on Third and Market in San Francisco at three in the morning, but we did learn that there's security that patrols this one particular building that had scaffolding all around it. They were doing some construction. Security guard comes out on a set interval and then this random tweaker shows up and in our hoodies we literally have mason tasers ready to go and he's like, hey, will you watch my bag? So we didn't really wanna watch this random guy's bag and we're like, well, we'd prefer not to and he just drops his bag and says, all right, cool.  What? So climbs in and on his way out, well, at some point, spends five, 10 minutes gone. We're thinking what the hell is going on, but just focus on just ignoring this. And security guards know where to be seen and then he climbs back down, doesn't seem to have done anything, but he climbs back down and grabs his bag and comes up to us and just goes, dude. And we're like, okay, I guess I have to fist bump because I don't know what he's gonna do next. And he goes, timing is everything. And at that exact moment, the security guard shows up. Okay, so with 8 or 2.11 time units, they're roughly 10, 24 microseconds. It has to do with clock cycles. There's roughly 976 of them per second. And what that means is beacon frames are typically addressed as an interval, right? So how many time units are we going to wait in between each chirp? And that chirp just says, hey, I'm Linkless, connect me. So typically most routers will wait 100 time units or they do it nine times per second. And with that, what you end up doing is you end up chirping out about 108 possible ESS IDs per second. Right, and that's if you go with a standard time unit that's recommended. We don't really do that. We want it to go faster. So we do about twice as many. Nope, that's not true. Almost, almost? Yeah, many. Three, almost, many. We go faster. And that's the default interval. And the reason why we do for the normal interval, the reason why we go at this speed is just because we can go faster. We don't have to wait on certain other activities that another AP would have to. But it's also very CPU intensive if we go much faster than that as in between packets. So we have aggressive mode. We implemented that and it is a lot faster. We're down to about 600 microseconds between beacons. And so what that means is we can basically beacon out, not just Linkless over and over and over again nine times, but we have the opportunity to do hundreds of times per second. And the way that devices, channel hop, looking for devices, so they'll come online and they'll listen on channel one, anything around. Okay, move to channel two and do that. And they'll loop over and over and over. So they may only see one and that may be good enough for it to just show up in the network list. Which means that at these intervals, we're able to handle thousands of SSIDs in the SSID pool if you will and successfully transmit those out. And I know what you're thinking. Yeah, we can go faster. So while developing this, we decide to go a lot faster, put powerful hardware behind the i7, fast wireless cards and just, you know, thought let's blow that out and see what happens. And if you ever wanna learn how to turn an Android phone into a turtle, that is how you do it. Hey, hey, hey, I take offense to that. The turtle's pretty rad, turn it into a... No, I meant more in terms of speed, but you know. Let's say snail, it's another thing with a shell. Okay, well anyway, to slug your Android, all you have to do is beacon out how many time unit intervals? None, none, just do them all. All right, well, yeah, kind of. There's one in here, problem with that of course, if you keep saying, hey, connect to me on channel one, hey, connect me on channel one, hey, connect to me on channel one. Because unlike all of the other, like datagram frames that use the control frames, which use things like clear to send and request to send and things of that nature, these are like ADS-B or any other dumb protocol that doesn't know what's around and it's basically a really bad time division multiplexing or something, it's just like, it's just gonna squash anything. Inherently knowing that, well, you know, it's TCP that we're gonna be squashing, so they'll resend and everything will be cool. So yeah, if you do that, you just f over the entire spectrum, so don't do that. That's no good. All right, so we covered harvesting a little bit before. Basically, we harvest pro requests, we harvest beacons using recon mode. You could use wiggle to do a bit of recon on your sense and we actually, the talk we did at B-Sides, we were told that we have to implement wiggle onto the Pineapple or at least an API for it. If you're not familiar with wiggle, wiggle.net, wiggle.net with 1G, by the way, is kind of like a open source version of Skyhook or some of those other geolocation services that collect the locations of access points, which is great as augmentation to GPS and things like that. And this kind of spawned out of the whole early 2000s war-driving movement, and it's really cool because people still today are dumping Kismet logs full of SSIDs and GPS, which are pretty fantastic too, because if you wanted to know, hey, what are all the access points around 1600 Pennsylvania Avenue, you can just go on wiggle and find out. And then you can download those and pop them into your management list and now Dogmo would start making it look like you're in downtown DC, which is fun. Yeah, exactly. Yeah, and there's a lot of things you could do with that. So if you know you have a site and you know that there's information on wiggle, you might as well plug it into PineAP and you'll be able to use that again, that way you can ensure that you get the most out of it. So while it's not as easy as karma used to be, it is the best there is for the current situation right now. Of course, the situation that you're most likely gonna be in is if you come into audit and organization, you may be given a scope of engagement, in which case it would probably behoove you to fire up recon mode, see what the landscape is around there. And then right from within recon mode, you can go ahead and add to that SSID list based on the access points in the area, what you want to clone. Oh, and we have a tractor. Okay. You wanna do that one? Yeah. So if PineAP is the ammunition and then recon mode is the battlefield, it provides that situational awareness where you have like a good sense of what's around you and we've seen site surveys before, you can pull up a site survey on your phone or whatever have you, but that typically only shows you the nearby access points and that's only like half the picture. In fact, it's probably even less than that because what we're truly interested in are clients and specifically the intelligence we can gather from which clients are connected to which access points. So the way that recon mode works is it displays to you all of the access points nearby, but then underneath them, it displays all of the MAC addresses of the access points or sorry, the stations connected to that base station, the clients connected to that AP. And with that, you know, okay, so I'm here to target ACME, now I know here's the MAC addresses that are connected to that ACME access point, regardless of whether it's WPA, enterprise or whatever have you. And so with that, you can go ahead and set your filters so that you can limit the scope of your engagement. And likewise, you can also see not just clients that are connected to access points, but you can also see unassociated clients. And so what that means is these are clients that have Wi-Fi on and particularly that are sending out probe requests. So they're like the lowest hanging fruit. These are the clients that just want to connect to an access point. It just so happens that the access point that they're looking for isn't in the vicinity, otherwise they'd be on one of the other ones in the list. So the last one is a bit of a weird one. It's out of range clients and most people get really confused by that. What that means is we are able to, we have two radius on the pineapple and one is a bit stronger than the other and there's a few differences between them. But basically what this comes down to is that we have the WLAN zero which is the one that we get all the clients to connect to. It's a little bit weaker than WLAN one which is what we use to scan for clients which is what we use to gather this data this on the site. And then we match the two up. So there are some clients that you're not able to actually currently get onto your pineapple because you're too far away or because the access point at least that they're connected to is too far away. So they might be connected to something or they are connected to an access point. However, we can't see that access point using WLAN zero. So we're probably out of effective range of if we do kick it off from the access point to bring it back to us. So it's something to be aware of because if that's one of your targets that you're meant to test for or find, then you might have to move closer. You might have to change locations or you might have to just, you know, know. Rika Naoud also provides a really convenient interface to a lot of the other plan AP, stuff like being able to de-authenticate a client. So you're like, okay, great. So I was brought into Target just the CFO. I've got his MAC address. There he is connected to the ACME Wi-Fi and I can see him. Fantastic. Click on him, say de-auth. He drops off, do that maybe a few times and eventually the device may just get tired of trying to reconnect to that network, start looking at other networks in their PNL and then, you know, connect to you. That's the hope. This also allows you to do that said filtering. So, you know, add him to or your filter list so that only the CFO will connect to you. Likewise, if you're brought into it or audit the entire organization, you may just de-auth the entire organization by clicking on the SSID of ACME Co and then, you know, kick off all of those clients. And then, of course, adding those SSIDs to your pools. So, you know, I want to go ahead and clone that. So I know that they work here and I want to clone that so that I can then go elsewhere. So I'm like, oh, hey, you're on corporate-guest and it's an open Wi-Fi and you've connected to there before because there's some IT issues and you know you weren't supposed to but you did it anyway because it was open. You didn't even need a password. It's fun.  And then that also leads into reporting which we'll touch on more in just a bit. So we've added a lot of new features to Pineapple. Actually, we've added a lot of features to the Wi-Fi Pineapple, marked five over the last almost two years now anyway, now in version 2.4. And so two of the really big ones are reporting and tracking. Do you want to speak to you through this? Yeah, sure. So the first one we have is reporting. It wasn't very easy before to get a good report on what's actually going on with your Pineapple. You could deploy it somewhere and then pull the logs off at some later point. You could log it to the SD card but you need physical access. So we implemented reporting which will basically gather your Karma or PineAP log. It'll take a command line version of the site survey or the recon mode and it's going to implement the tracking which I'll talk about at the next point. But basically, it'll take all the information that we gathered. Sorry, and this CSV of Max and the SSIDs they've probed for. So you get a nice clean view of that which you can import and actually analyze. And that can be emailed to you. It can be stored to the SD card in, you know, is histographical? Yeah, is that the word? Sure, let's go. Dates, dates, thank you. So a date stamped format, right? So you have those options down. Yeah. This is a really interesting one too because we can just set up a Pineapple, say, in a completely passive mode. Actually, we're skipping on some of these things that were added in 2.3 but a lot of passive logging capabilities were added in that version which makes reporting all the more useful if you drop it at a site and you have it powered, say, in an ominous box or something like that. And it's doing just this reconnaissance and emailing you those reports or saving those reports to SD card. And that site survey can be really useful if you can now map where your clients of interest happen to go and when they go there. So if it's the corporate guest Wi-Fi network and it sees these clients on these certain days, you can kind of come up with patterns and this is something that might have been useful for our tweaker friend to know when the security guard was coming around which leads really into tracking. Right, and then we added tracking and tracking is not completely new concept to the Pineapple. So what it does is it takes all the information we get about clients when you have logging turned on at least. So probe requests or in general if we see data in the air and you're scanning for it if a client or a MAC address that you've specified is seen in the air, it will fire off a user configurable script. So you can say when that event happens you want it to blink an LED or you want it to send you an email or something along those lines, right? So it's totally user customizable but it means that there's a hook to every time you see a certain MAC, it'll do a certain, it'll fire off a certain event. And again with the reporting it ties in with that and can actually then fire off an email to you or be added to a list. So there's a timestamp list of when an SSID was seen, what it was doing, or sorry, when a MAC address was seen, what it was doing or what it was currently looking for and if it's got an SSID associated with it'll list the SSID and it'll email you that again in a report, no. Those are ducks. So what we're trying to do is make it easier to make sense of the PineAP log and to really get some interesting, just get some value from that because there's a lot happening even if you're not running Karma and also accepting those clients to connect to the Wi-Fi pineapple. There's a lot of interesting information that you can glean that can be useful for you on your pen test. So kind of going forward, that's a lot of the emphasis, especially right now with the reporting, gathering that data and getting it to you in a convenient means, means that you'll be able to run it through some sort of analysis and see if there's something interesting there. So we'll just do that now. Let's step this up. Yeah, sure. So we visited this place in Mountain View, California. Just, you know, we're there to visit and we had a pineapple with us. Obviously passive logging, totally legal. And we got some really interesting results as we were talking about, you know, how devices stop probing. I think this is a really good place to, you know, test this on. So these were the results. And I'll be going ahead and publishing the script file on the hack file forms but essentially what this does is it takes your pineapple log and it processes it in conjunction with the IEEE OUI list, the list of manufacturers. And so just from this little short engagement in the cafeteria where the food is all free and amazing, we were able to find out that there were about 255 unique probes and of those they were from 334 devices. Those devices spanned 154 OUIs. But of course, lots of manufacturers have various OUIs, those being the first three octets of a MAC address. So really when you just take it down to the manufacturers, it's really only 30 manufacturers. We were also able to say, okay, well here are the top 10 manufacturers, which I was really surprised at this place in Mountain View. You used so many Apple products. Motorola's kind of good too, I guess. Yeah. Yeah. But what surprised us more, I think was the probes we received or saw. Just take a look. I like the one because they're unique. I like that 16 devices were probing for that one thing. Yeah, that's not 16 probes, that's 16 unique devices. They're weird. Maybe it's a hacker space. Some other improvements in version 2.4 added to the, no, not. So some of them added in 2.4 include the ability to de-auth all of the clients off of a specific access point. Again, I'm brought in to audit this network. Here's Acme, Gas, Acme, Corporate Wi-Fi, whatever have you. I just want to be able to click it and say, you know, kick them all because previously it was just a matter of clicking all of them. I know it's a convenience thing, but it's important and you want to speak to that, don't you? Yes. So you guys all know tools like MDK3, right? You know. AirDropNG. AirDropNG. You're able to kick off clients from access points and that's all fun. And MDK3 has that thing called AMOCK mode where you can kick off everything from every access point unless it's in your allow list or just Apple devices. Or just Apple or Google Glass or what have you, right? But that's, well, fun, oftentimes not really what you want in a proper test. So what we added is de-authentication from recon mode, which allows you to, once you have a client scan done, you're able to see the clients. You can click on a single client and you can kick that client off. That by itself isn't fun. So we added kick all clients from AP because you might have to do that for some scenarios. We did not want to though do a proper de-auth where we scan and look for everything that is currently on the access point for the duration of the de-authentication attack and kick off everything that we might have not seen. So what we do is we actually send targeted de-auths to only the client devices you just saw and that you approve for the kicking off. So only those devices will be disassociated or de-authenticated and not devices that might have connected in the meantime just because you want to keep it clean and you want to limit collateral damage as much as possible. Right. And likewise, the tool isn't built to also do any sort of continuous de-authing and that kind of leads into the de-auth multiplier.  And then it decides, okay, well, this access point doesn't want to be friends with me anymore. That's cool, I'll disconnect. What is the most vendor implementations immediately want to now become friends again? Like, wait, what? Lost Wi-Fi? Oh, woo, Wi-Fi. And they'll do that so many times until they finally eventually give up. What we didn't want to do though was just have it be continuous. So we set up multipliers where you could get that like say three attempts before they stopped trying and then go on to the next one in their PNL. And so it just seemed like the most obvious choice was to set a multiplier. So if you set it to two, that's gonna be twice as many. If you set it to 10, that's gonna be a lot. CLI? Yeah, and moreover, going in with the reporting and tracking functionality, spawned the ability to then also do the recon mode from the CLI. If that's where you're more comfortable, the command is? Site, underscore, survey. Yes, and so you basically get the same output, but of course now you don't get that contextual thing where you can click on an SSID or a MAC address and add them to lists and filters and de-auth them. And we made it more prettier. So now we're gonna talk about security, some of the things that worked and some of the things that didn't, and I want to take the first one. Who here uses pineapple or yummy as your password on your pineapple? Okay, you probably have a mark for. That didn't work out so well. Who's using Tor as their password on Cali? Yeah, okay, so you guys, everybody but Mubix is smart. So yeah, that didn't work obviously. And yeah, so hard-coded passwords are bad. Not doing that. So another thing, oh, do the shuffle, okay. So anyway, that was the mark four days. On the mark five, we went through a lot of different things. One of the first things we did to kind of try to secure the tester a lot more from potential attacks was to implement the WPA2 management interface which meant that your packets can't just be sniffed out. You can't just get your session ID. You can't get your session ID out of the air which made it really easy to compromise the pineapple. Don't really like that. So we added the WPA2 management interface. We added- Oh, and it's forced, it's the default. Right, yeah. So to set it up- The initial setup, you have to configure this management interface. We also protect against cross-out request forgery now which is something we just didn't really do before and it's important that we do. Yeah, yeah, I know. You can give me trouble for that, it's okay. But the scenario of where you're on a test and you're on a website that's targeting pineapples is something that we didn't really consider much. And then we did presence verification. We previously did this with LEDs and this is actually something that's gonna lead into the point underneath. But we said, okay, your pineapple has got four LEDs. One of them is fixed, it's a power LED.  That's- Well, the importance of that and our thinking there was, well, let's make sure that only the user of the Wi-Fi pineapple is setting up their own pineapple and that it's not somebody else accidentally connecting to theirs and trying to set it up because previously they were all set up with pineapple five underscore, you know, last two octets of the MAC address. Of course, now we force them to create a really creative management interface, SSID and all of that. But, yeah, so that didn't really work out so well though because it turns out there's how many combinations? Not enough so that when we locked ourselves out at some point because we broke the LEDs we just brute-forced it by saying on, on, on, on, on and just hitting enter 10 times when we were in. So that did not work. So what we do now is to make the initial setup which was the most dangerous portion of the pineapple because somebody can race you to it and set it up and brute force his way in or his or her way in. But so what we do now is we require you to flip a dip switch. Now that sounds scary because some people do over-the-air updates or they might not have access to their pineapple because it's in an ominous box and plugged into all something they don't wanna have to undo the screws. Talk about that in a second but basically what we did is we included the possibility to by flipping down the dip switches it tells you to flip down, it'll disable the radios and then let you proceed with a setup by re-flipping them up. So that means the radios are disabled during the initial setup. So it really is just you over ethernet connected to the device so you can set it up safely you've got the time to do so and you can't proceed with it. Unless your ethernet cable is made in the middle. Right, yes. And then on the other one is you just flip one of the dip switches that tells you to flip and it's gonna just leave wifi on and let you proceed because you might be at home setting up your pineapple for a test and you don't really need to be that safe there. Of course there's a workaround to that or not a workaround but there's a convenience thing. Right, yeah, exactly. So this is convenience. It's always convenience versus security. And for this, if you wanna skip this entire dip switch up totally you just on the SD card add a file that's listed in our changelog skip dips or skip dip setup and if you have that file on there it'll just skip that portion entirely so you can actually deploy it like that. Because if you have physical access to the device anyway it's owned, so. The next point is the reason why you should just stay in this room for the next talk. I know that we will be because this sounds really interesting. Because Kenny's standing right there. He's got a black hat on. I don't know what that's supposed to mean. Where's Brown? Okay, you wanna speak to the CVE? Yes, sure. CVE 2015 4624. That is a really fun vulnerability on the pineapple that was basically a way to, first of all, you brute force the initials. We don't wanna take away from the talk too much. No, do you want me to explain anything or skip it? Okay. Yeah. I figured. All right, to give you a really quick rundown though. There you are. All right, so to give you a really quick rundown, basically you were able to skip because of the LED setup. You were able to get past that quite quickly by brute forcing it. And then you were able to, by having the default password, being pineapples are yummy. You know, because you're meant to change it. But you could skip that part, go directly to the login interface, log in and then change the password and execute commands and so on and so forth. Yay. Yay. Yay. So actually quite a while ago or I guess at least a year ago, we started looking into like, yo dog, we should just use SSL. That was even before the WPA management interface, which was really just like, SSL is hard, let's do WPA. But there's some inherent problems with doing SSL in this kind of embedded device nature. Who here really enjoys installing certificates in your browser? Okay, McGrew really likes installing certificates in his browser. It used to be like what, file import or something. It used to be that easy.  So we're... It's worse on Android. Yeah, a lot worse on Android. And so it's again balancing the convenience and the usability and the security.  So it's built in actually, and there's a wiki page on how to set it up. So you can do this. We're just trying to find a way to like automate that process and make it more simpler-er. Yes. Right, and then we have things like today's y'all hunt pineapples right there. No, so we fixed the things that are on this list mostly. But the inherent flaw on the network is that you can be our cash poisoned. So if you're connected to the same network and you have to be the way that pineapples currently set up, say you're connected to over ethernet, you're using yourself as the default gateway, the victims have to have a connection through to you, which means an attacker can use that and he can get in between you and the actual pineapple and now you're getting your sessions stolen again. Right. There are a couple of ways to go about this. I guess one of the most simplest would be to implement client isolation. But again, that creates a problem in that I want to be able to actually see my targets, not just their traffic, because I want to scan them for any potential volans and exploit them. So that's another one that we're just kind of still working on. And we've mocked up some stuff that works in certain scenarios, but not in others. And it really has to come down to like, well, what's the usability aspect here? And how do we find a way to put something together that's secure that's not also hindering a lot of your abilities? And if it's just a checkbox that you're gonna uncheck because you need to be able to access those, then that's not gonna work either. So that's still one that we're toying with. And then of course, the bug reporting aspect of it. I'm fine with any method of disclosure, but I should point out that we also do accept bug reports at bugs.hack5.org, as well as wifipineapple.com slash security. And we have a bug tracker there as well. And actually, Kenneth, who's gonna speak after us, came directly to us at Pentus with Hack 5, which was pretty cool. And we're both standing there looking over his code going, oh, that is so rad. So I can absolutely respect that. So going forward, I could probably list like 50 esoteric features that I want implemented that are in the Trello doc, you know, the list of all of the things that we want to add the... He means what I need to do. Yeah, yeah. I really like that one where you can just punch in a cross-section of a street and then it will download all the SSIDs from wiggle.net and then put them in your SSID pool, which is gonna be epic. Because I don't have to code it. Or I could, but it would look like the script that I'm about to show you. Anyway. But the two biggest pillars though the paths that we're going down in the future is both abstracting the engine and working on the Pentest workflow. So I'll let you talk about abstracting the engine because PineAP, the engine itself is really well-built and there's a lot of awesome functionality there. But it's also in some ways tied to the interface and what we want to do is get out of the way so that you can do what you do best. Right, so we would like to differentiate between what is the pineapple or the pineapple's engine and what is the way to manage it? What is the way to hook into it? What are the tools you can run in it? Because we simply have this device and the device, the Mark V right now is great at doing wireless. That is what it excels in, at least what I think or what we think. What we're not so great with is it's a 400 megahertz processor. So you're not gonna be running your Metasploit suite on it. You're not gonna be running full I don't know, all the man in the middle tools that are written in Python or Ruby that are ginormous and have giant dependencies and require four gigabytes of RAM to run properly. Or you could get them to work slowly. But then- In my next year. Exactly, well no, you could get them to work slowly, but not with many clients. We can handle like 200 clients is no big deal. Wi-Fi side, yes. Yes. So the issue isn't the Wi-Fi. It's what you do after you have the clients. So we're working on a way that you can basically take the clients and get them to a location where, so they abstract the engine. The thing that does the thing, keep doing the Wi-Fi and then offload tools and so on to other devices, be it your ARM devices or your laptop or a device in the cloud which ones your tools. But basically, we're going in that direction with this engine so that you run a pineapple. It does the pulling of the clients and- Right. Because you've done a fantastic job already with the API of making it really easy to write those infusions for say the web interface and all of those tools. But it would be really better if in addition to that, we could also take those same clients and just kind of like run them through what we're already used to doing. We don't need to reinvent the wheel here if you have a workflow, if you have tools that you're using. And so that's the other thing that we're working on is workflow and that looking back at the 1.0 version of the Mark 5, it's really grown a lot and there's like so many features now. And so if you've been with the project for a long time, you're probably very familiar with where all of those options are. And when you get a new version, you're clicking around and realizing that we've done a lot to make it easier. There's no help bubbles next to most of the big features that kind of explain what they do and how they work. But our next emphasis in addition to abstracting the engine would also be on creating like what is the pentest workflow and it may differ dramatically depending on who the client is and what kind of audit they're looking for. So what we're hoping to do is make it clearer. Like, okay, here is the recipe for success. And if you're doing this kind of, you know, select a profile, if you're doing this kind of an audit, then these are the steps you may wanna go through. And if you're doing that kind of, then these are the steps and this is the report that you're gonna get at the end of that. And if you've then done that and you're like, well, this works great, charged a bunch of money, did an audit, got them the report, they're happy, they call me again next year and want the same thing. I want you to be able to more easily do that again without having to, you know, find all the things again. Before we do that, do you wanna speak on this? So there's also things you should not do with a pineapple. One of those things is this, don't do that. You look, you'll get arrested. It's just slightly obvious. Yeah. But you've got the interesting information. Yeah, there's lots of fun things you can do passively but then like trying to explain it to the NPS is always interesting too. Wi-Fi geocaching, just go with that. There is, find us off camera. And with that, let's do some ASCII Q&A. Yes. What we've found is that we get the best throughput when we use a third radio and we recommend of course the Alpha NEH, which we supply, yes? That's okay. Well, I guess we should address that in saying that initially from the onset of the Wi-Fi pineapple, I mean that you're looking at it, the two of us, launching the Mark V, big dreams of Pine AP and of course, some things get finished before others. So when we launched the device, we really went with the software-wise, there were a lot of improvements but it was also the best that we had had on the previous generation. But of course we built the custom hardware, dreaming of what is possible when we have a dedicated interface for that constant sniffing and packet injection and there was the sketch on the board of like this is what the Pine AP future is going to look like. So let's make hardware for that. So we put the cart a little bit before the horse there and in that case we're like, okay well, what are we doing with WLAN 1? So we threw in client mode, which turned out to be like a huge feature that everybody loved. So then later when we came out with Pine AP, which requires WLAN 1, it then got a little trick here where it's like, okay well, okay well we want to make it optional because some people are using this but really we want it to be the dedicated interface that you use to support that first interface. We don't want to tie up WLAN 0, the atheros doing karma with too many other tasks because then we're going to start dropping clients and that's what we want. And yes we did also run into throughput issues and so we did dev another board and solved one issue and broke several others and I wish it was as easy as it is because Seb's got it easy, he just has to do code. He just hits F5 and it says warning or doesn't compile and then he like put, does the, he's hit something called, this is what you do, so you just like that and then like the code happens and so he just hits F5 and compiles again. Like we've got to like do, yes. So it's much more difficult to do raves and I can show you boards that like, hey this is fixed and now we totally screwed over storage. So yeah, maybe we'll put those in the museum. We've got like all these shadow boxes of all of the various prototype boards that for some reason or another are derpy. Working on new things because there are clearly things that we can improve, we could add more process and we could add five gigahertz, we could add an SSD, you never know, right? So I'm not saying there's not going to be a Mark 6 but it is definitely one of those things where with this abstraction of the engine it wouldn't impact that either because the engine would be abstracted from the device and from the tools that would be running on your computer or on your Android phone or on your, where have you, right? So we want to kind of be able to, you pull out your Android phone, you connect to your pineapple, manage it from there, might be through an Android app because it's agnostic, right? It wouldn't care what you're doing for management which also means that anyone can write apps for it, anyone can hook into it, you can have big integrations into entire other systems and so on. So working on that, we want to go get hooks into Cali that just make that totally painless. We want to get hooks or like modules for Metasploit out and just kind of make ourselves more integrated. Yes, but no, I mean, that's like asking Apple if there's going to be an iPhone 7. So, I think they're stopping though. Yeah, no, 802.11 AC, we could go on and on and on. In fact, I love hearing people shout out, like we had people at B-side sell us they wanted BTLE. Okay, maybe we can also work better with things like Ubertooth or something like that. But yes, there was another question over here. No, completely original. All right, thank you so much for letting us do this.


Another clever way to do regularization that doesn't quite feel like regularization is by augmenting the data with synthetic changes to it. We never have enough data, so often one can do some changes to the data that makes it look like new data. And this has been perfected by the people who do image recognition. If you have something like a picture of a cat, of course it's the web, there's lots of pictures of cats, you can put a little image and make sure that the part that you're training on is a little piece of it, you can take that image and rotate it 90 degrees, but usually not flip it upside down because cats usually are not upside down. You can shift it over a couple pixels right, a couple pixels left, a couple pixels down, generating new images. Note that in the original space a picture shifted by three pixels looks quite different for a cat, right? Every whisker has shifted. You've got a new labeled image that's different from the original ones. You can also add a small amount of noise. Add Gaussian noise to the picture, add, take a small fraction, 10% of the pixels and zero them out. These are in many ways similar mathematically, surprisingly perhaps to L2 regularization. All of these allow you to build models that are not quite so overfit to the small number of images, even if it's 100 million images, the small number of images that you have labeled. Give it a try.