This game, AP-Hunt, is an access point game inspired by the famous pasttime of war driving. AP-Hunt simply requires basic wireless hardware and software and a means of transportation. The objective is to accumulate the most number of points. Generally, the more access points discovered, the more points awarded.

Points are awarded based on a specific scoring system weighted towards awarding unique and hard-to-discover access points.To help prevent cheating, only access points with associated GPS coordinates will score points.

To reduce the chance of cheating, the game coordinator may seed the area before the game. This entails setting up a number of access points with a unique SSID in the playing area beforehand, and switching them to another SSID during game play. If a team’s results include the “before” SSID, they are submitting a log from before the contest timeframe. Also, a team must discover one of the seeds during game play to ensure the data is not from days or weeks prior to the contest. The team with the highest number of points wins.

The essence of a contest is in determining a winner.To make things interesting, an AP-Hunt game should have some sort of scoring system beyond simply finding “the most.” This scoring system here was inspired by the DefCon Wardriving Contest of 2003. The DefCon contest is a type of access point game with a set of rules created to distinguish hardcore participants from the casual wardriver and encourage unusual war driving techniques. A basic AP-Hunt scoring would look like this:

One point for each AP discovered

One extra point for each AP with the default SSID

Two extra points for each AP with WEP enabled

Three extra points for each unique AP (your team is the only team that detected the AP). This score is optional and implementing it will make sense only with a high number of participants

Variations: Add points for local wireless landmarks such as schools, stores, coffee shops, and so on. Add points for furthest AP from the contest starting line. Or possibly, add points for off-road APs.

There are some factors that can affect your game play and ultimately your overall success while AP-Hunting: hardware, antenna, software, and vehicle selection.

Hardware selection is a vital issue. It can mean the difference between detecting an access point or not, and thus winning or losing. There are two basic types of supplemental hardware involved with hunting: a wireless adapter and an external antenna.To be amongst the top ranks

of competitors, a wireless adapter has two essential elements: power output (and, therefore, receiver sensitivity) and the ability to accept an external antenna. A standard wireless adapter has a power output of about 30 mW, while an enterprise adapter will usually have 100 mW. And carrier-grade adapters boast an output of 200 mW. In general, the higher powered adapter will also have a more sensitive receiver, which directly relates to how well the adapter can “pull in” a weak signal and log the access point.

Once you’ve selected a suitable wireless adapter, the next step is to choose an external antenna. If at all possible it is best to have both an omnidirectional and a highly-directional antenna for all foreseeable scenarios. You should have at least an external, vehicle-mounted omnidirectional antenna.

Figure 11-6 shows an example of an AP-Hunt setup including wireless adapter, omnidirectional, and highly directional patch panel antenna.

Oftentimes, sheer numbers may be the pivotal factor between winning and losing. Transportation plays a great role in AP-Hunt.Traditionally, automobiles are used in conjunction with GPS mapping software to sweep the area as it approaches, detecting access points along the way. Although this is still the most widely accepted method of transportation, several  

nonconventional methods have proven to provide much broader coverage than an automobile could hope to achieve. Recently, helicopters and private airplanes have been used to scan large swaths of the landscape to pick up dozens more access points outside the range of ground-based vehicles.

Using airborne vehicles while scanning for access points is known as “warflying.” Perform a Web search for warflying, and among the usual combat aircraft Web sites will appear many sites on war driving with aircraft.

For the past eleven years at the beginning of August, thousands of the world’s most fervent hackers, security professionals, and even government officials have converged on the city of Las Vegas to participate in what has become one of the largest underground security and technology conferences in existence, fondly named “DefCon.”

Although DefCon began simply as an underground hacking conference, it has evolved into something much greater. In the past few years emerging wireless technologies have made their way into the conference, spawning entirely new facets such as the DefCon Wardriving Contest. The DefCon Wardriving Contest has grown to become a cutthroat battle royale of wireless network detection, pushing war driving and access point gaming in an ever-improving direction.

In recent years, participants armed with laptops, wireless adapters, and external antennas have used everything from standing still on top of a building, to vans, cars, and motorcycles in order to claim the title of DefCon Wardriving Contest champions. DefCon Wardriving contest participants have even gone to the extent of renting a private helicopter, allowing them to detect access points typically unreachable through traditional AP-Hunting methods.Who knows what strategies and tactics will be used at the next contest?

Treasure Hunt is an access point game in which teams search for access points based on clues discovered in the SSID. As the game unfolds, each access point discovered leads the team to the next access point, and so on until the trail ends. There are two main categories of play in the Treasure Hunt access point game.

Treasure Hunt is one of the most rewarding access point games but it also requires much setup and planning.When organizing a treasure hunt, several access points are required to be spread out over a relatively large area. It is best to organize the field of play based on several maps

sliced into grids. Often a local paper-based street map will have a grid coordinate and a wellknown page numbering system.

If the game participants do not have a local map publication, create a simple map layout using mapping software to generate the map, and an image editing program to divide the map into squares covering about one-half mile each. Print these out for each participant. Each access point should be spread apart by a significant distance and each access point SSID will contain the clue necessary to determine the location of the next access point. Each access point should contain a similarly formatted SSID in order to provide clues.

A sample SSID might be:

The first section, “TH0504” is a unique game name (TH) and date (May 2004). The second section, “P5” means page 5 in a pre-determined map handout, booklet, or publication. “J-4” represents the grid coordinates on that map (see Figure 11-7). And the final section “03” means this is clue number three (numbering is optional, but it’s nice to have).

This SSID points to where the next access point can be found on the map. Each access point is a link pointing to the next site to discover and proceed from there. Figure 11-8 shows a diagram of how this contest works. Plan the path of travel to help avoid participants finding clues out of order

To begin with, each team is given the rough grid coordinates and a specific map in order to determine the location of the first access point and using the clues located in the SSID’s of the access points, each team must then locate each additional access point until the course is completed.

A treasure hunt can be so many things. The SSID pointer is probably the most basic: pointing you to the next link in the chain. But with some imagination, you can develop a truly unique game.

Some ideas to consider are: Have the SSID provide a clue, instead of a directional pointer. For example, “boardwalk canals and musclemen” could mean Venice Beach. Or, make the SSID a phone number (that is, “TH0504-555-1212”) with an answering machine message, “Get to the payphone by the stadium and find the access point to the East.”

Another fun, though even more painstaking alternative, is to make each access point forward the user to a Web site holding the next clue. A team member would need to associate with the access point, obtain a dynamically assigned TCP/IP address, and surf to a Web site unique to that access point. Once at the Web site, any type of clue or challenge could be presented.

Imagine a treasure hunt where participants had to solve a riddle, puzzle, or pass a quiz before being given the next clue. With these few variations, the Treasure Hunt AP game can be a potentially challenging event for participants and game coordinators!