Chellam: A Wi-Fi IDS and Firewall for Windows
Vivek Ramachandran introduces Chellam, a driverless Wi-Fi intrusion detection system and host firewall designed to detect Evil Twins, honeypots, and hosted network backdoors on Windows.
Summary
Evolving Client-Side Wireless Threats
End-user workstations frequently fall prey to rogue access points, Evil Twin networks, and malicious Wi-Fi honeypots that intercept network traffic and inject payloads without user awareness.
Driverless Intrusion Detection Architecture
Vivek Ramachandran introduces Chellam, an open-source Wi-Fi IDS and firewall designed to operate natively on Windows without requiring third-party drivers or specialized monitoring hardware.
Detecting Rogue APs and Honeypots
Ramachandran details Chellam's heuristic inspection mechanisms, demonstrating how it identifies honeypots, mis-association attempts, karma attacks, and unauthorized Windows Hosted Network backdoors.
Automated Defense and Client Isolation
The presentation showcases Chellam's automated response capabilities, terminating rogue associations and blocking untrusted network interfaces before credential harvesting occurs.
Related talks
Main Stage·44 min
Vivek Ramachandran
Vivek Ramachandran presents Chigula, an extensible open-source Python framework for 802.11 wireless intrusion detection, packet forensics, and automated attack fingerprinting.
Black Hat·1 hr 25 min
Macy Bergoon
Engineers explore architecture and security mechanisms for Windows 2001 - Host Based Intrusion Detection Using W2K Auditing Features.
Black Hat·1 hr 46 min
JD Glaser
Presenters detail vulnerability discovery and exploitation in Windows 2002 - One-Way SQL Hacking: Futility of Firewalls in Web Hacking.