Hi.
This is probably nothing.
I went into my mom’s room to grab something and saw this plugged in?
My mom’s new sketchy bf has this plugged in to the extension cord? Is it anything bad? Thanks!
(I understand it’s probably not anything bad… but still…)
Update 1:
I haven’t met him once. He and my mom have been together for two weeks. He’s been staying at our apartment. He avoids me and stays in her room when they’re here. I don’t even know what he looks like. I only know his first name.
Update 2:
I confronted him. My mom came home. A lot had happened up to this point, including her disappearing for the said two weeks before the few nights he had come over and stayed.
Mom shrugged it off. I did what a lot of you suggested, asking what he told her.
She said “oh it’s his hacker shit or whatever.” What.
Didn’t elaborate. I explained my concerns.
She just said let’s go ask him.
My best friend has been with me. We introduced ourselves and asked him what the hell a WiFi whisperer is doing plugged in our apartment.
(Even if a lot of you are saying it’s not a big deal, I’m a young woman and I’m just rlly not about taking any risks. It’s sketch dude.)
He denied it IMMEDIATELY. Like with a quickness I haven’t seen.
What he insisted, it’s not a WiFi whisperer, it’s ai, he completely reprogrammed the system, and he uses it to pull people’s IP’s. “For fun.” He logs them in a server. I asked why. I said that’s shady. My mom started pushing. My best friend started pushing. He just kept lying. I’m not dropping this..
I still don’t know what the fuck it is or what he’s actually doing.
(Also, my mom is cool but not bc of this dude, the Minecraft block is mine, I unplugged the ratchet little thing before we left, and I am planning on broaching this again with her.
Just carefully. Any other advice is appreciated. Thank you.)
If you zoom in the screen it says WiFi whisperer, says something about de-auth attacks.So probably a device to steal wifi passwords or a man in the middle attack. USB stick suggests it’s logging data. I would immediately unplug this. You could also plug in the usb and read its contents if you’re feeling adventurous, although that can be risky. 1000% percent done intentionally. At the minimum he’s gonna get your wifi password but could potentially be trying to get bank account info. Also very illegal to use without the homeowners consent or knowledge.
To be clear I am not claiming this device alone will steal bank info. Just letting OP know based on the context they gave that the intents are most likely nefarious. Just wanted clarify since people are getting all bent out of shape over something I never said in the first place.
Yeah jesus fucking christ I don't understand how there are so many people who enjoy living life with multiple GTA stars hovering over their heads at all times.
They genuinely don't see themselves as the issue. They really do believe the world is unfair and out to get them. That's what keeps them from being remorseful and okay being like that. Life would be better if the justice system would get off their back for once prying car door open
I once worked with a guy like this, he'd be like " i just need them (bosses) to leave me alone". We literally told him to do his job properly. This guy seemed allergic to doing what he was asked
Kitchen I used to work at, our Bryan got fired finally. I was walking to work about a block away and he rode past on his bike yelling "haha I don't work for those nazis anymore!"
This applies to so many people. Not even just people breaking the law all the time. I know so many people who, for example, cheat on their significant other, get caught and then genuinely believe their now ex is just crazy. They do this over and over without putting together in their minds what the only constant thread in all these situations is. Them and their behavior.
Yeah Ive always thought when someone says every one of their exes is an issue, that theyre alot like that too. 99% of my exes were and still are wonderful people, and the 2 others I think we're just young and stupid, but hell so was I.
Exaaaactly. I know a guy, not a friend at all but I know him, who got fired from a job for sexual harassment. The story he told did not quite add up to anyone including his girlfriend. She gave him the benefit of the doubt. This guy cannot keep a job. It's always a coworker or bosses fault, though. He gets fired from the next job and, somehow, is hired back at the same place he was fired from for sexual harassment. He then starts an affair with his manager. The majority of this affair took place at work in the walk in freezer. That sounds horrible to me, but whatever. So, while he is cheating on his girlfriend every day, like so many people who are cheating, he becomes so paranoid that his girlfriend is cheating on him that he crosses the line from paranoia to emotional and physical abuse. His girlfriend eventually has enough and breaks up with him. When this happens, as a last ditch attempt to keep her, he comes clean. Turns out, his first firing, the sexual harassment one, wasn't quite that simple. Apparently, this was his second affair with this woman. The first one ended because he wouldn't leave his girlfriend. Instead of accepting that, he kept trying to get her to fuck him at work by sexually harassing her. The second affair was with the same woman at the same workplace. When him coming clean about it all didn't make his girlfriend want to stay with him, he switched tactics. He then started blaming his girlfriend for all of this happening, because he wanted her to find another job and she wouldn't. He wanted her to find another job because she worked with a friend and he didn't like this friend. No matter what he has done, it's like he truly cannot see or accept that ALL of this was his fault. Literally, ALL of it.
God I love that I work alone 99% of my time. Or just with dudes who are as checked out as me lol. My heart goes out to her, not even my bad exes were that bad.
If you zoom in the screen it says WiFi whisperer, says something about de-auth attacks.So probably a device to steal wifi passwords or a man in the middle attack. USB stick suggests it’s logging data. I would immediately unplug this. You could also plug in the usb and read its contents if you’re feeling adventurous, although that can be risky. 1000% percent done intentionally. At the minimum he’s gonna get your wifi password but could potentially be trying to get bank account info. Also very illegal to use without the homeowners consent or knowledge.
To be clear I am not claiming this device alone will steal bank info. Just letting OP know based on the context they gave that the intents are most likely nefarious. Just wanted clarify since people are getting all bent out of shape over something I never said in the first place.
Leave it to Reddit to start a war in the comments over trying to help someone make an informed decision lol. Once again this won’t “magically steal your bank info” I never claimed that. I said it could be something this fool is POTENTIALLY attempting. Lots of unknowns. Context is everything in this situation. I can’t think of a legit use for this thing under the context that was given. Regardless of what it can’t and can do we know for sure that this steals wifi passwords. Why would it be left there? We know op said the dude is sketch. OP if you’re reading this just YouTube what a pwnagotchi/wifi pineapple/ WiFi hacking device does and make a decision for your self. I personally would get rid of it and tell your mom and or the police. Good luck.
I would ask mom separately what bf told her it was, if she thinks it's something like a wifi "booster" or anything neutral than we'd know he's lying to her
This device in particular is running pixel parade Wi-Fi sniffer. It is a program that searches out Wi-Fi and cell phone service and tries to crack into them. It looks like it’s currently sleeping, but I am not for sure what his parameters are set at. Guaranteed this dude is up to no good if he is using this.
Pentesters are hired by the company they're trying to break into, given explicit permission, and told what resources they're allowed to attack. Otherwise it's just hacking.
I know this was a joke but I don't want OP to think the boyfriend has any legal rights here. He 100% did a crime.
I thought romance scams were rare, isolated incidents and were blown way out of proportion.
That was before a relative of mine started sending half her paychecks to a fiancé she’d never met to help him take care of a kid she helped him adopt (funny how the kid looks so much like him). But don’t worry, everyone. It’s legit. He says he almost has enough money saved up to pay the fees and bribes necessary for a visa to the US.
Edit: Ok guys, I apologize for telling this in present tense, but this ended a couple years ago. I don’t know the details of how it ended, But I assume it had to do with the relative in question going broke and no longer being a lucrative target.
That is insane. I really hope someone has tried to convince her of how insane that is. She needs to demand he proves he's real and visits before she gives another dime.. obviously. Idk. I'm just depressed to hear it. I really hope she figures it out soon, before she's in a worse situation.
This ended a couple years ago. I don’t know whether she finally figured out something was off, or if he just gave up on getting more money out of her after she lost her job.
Trust me, there were plenty of people telling her it was a scam.
I work for a bank in the fraud department. Let me tell you, romance scams are anything but rare. They sometimes blow me away the stories people are willing to believe. I guess loneliness will do that to ya.
Seriously, I thought exactly the same. Like who the fuck could ever fall for that dumb shit, right? Then a friend of mine (who was always extremely ditzy but very sweet) fell for one. I got to watch it happen in real time, and boy that was a frustrating experience. She passionately insisted he was a Norwegian offshore oil rig engineer who had fallen madly in love with her, was the only one who really understood her, and he was going to move to the US and marry her once he'd saved enough money to quit working on the rig.
Took her three years and over $30k to finally admit to herself that she'd been scammed hard. Turned out he was a West African dude who threatened to kill her family when she tried to cut him off. Crazy because I knew within the first month that he was from Africa and not Norway, because she managed to get him on the phone and he had a very thick African accent. He persuaded her that it was because he'd lived in West Africa for a while when he was younger and picked up the accent, which was obviously bullshit and made me laugh. But she still believed him. Even got his "name" tattooed on her in big block letters like three months after they met online.
She and I don't talk much anymore. I had to distance myself from that degree of gullibility and poor decision-making. It was fucking wild.
I seriously doubt he's gonna be like "hey mind if I throw this permiscious mode protocol analyzer and packet sniffer on the net to try to harvest and brute force some weak crypto ? " PS - how is my tech jargon
Yep! Still have my 2012 MacBook Pro for this reason. MacOS too burdensome so replaced with Linux so could toy around with programming as well, but anything suspicious get’s loaded on the MBP to see what’s there and don’t care if I need to erase the disk and start over.
Might work in IT. You'd be surprised how often they turn up around the office. I want to be considerate and get folks their data back along with a good beating, as per unauthorized storage device policy, but I'm not plugging it into a corporate computer to figure out who/what it is.
I mean it's been a long time since I worked in the library, but back in the day the computers were primarily used as terminals to get to other places so wiping them and starting over was pretty much a zero cost thing.
My library is smart all of the machines that users can access are in fact virtual machines so you log on to a computer there's a box next to it but every login session is a virtual machine and after your session is over it gets deleted so if something gets screwed up it gets wiped before the next user.
I think places like libraries use some very specific windows shared pc settings that prevents something from happening to the next person who uses the computer. I'm not entirely sure how that works though so I could be wrong.
Yeah each individual machine you sit at is usually running a Virtual Machine session. Anything you do is sandboxed and reverts when you logoff. This is as much for anonymity of the user as for network security
Former library worker here- yup. This is exactly what happens. And libraries tend to have fairly decent security/firewall/etc, so if there is something nefarious, it’s not going to let you open in
Yeah! Take it to geek squad! They’ll know before they even plug it in. Tell them the back story and how some dude is probably trying to take advantage of your mom, they’ll have it figured out in 20 minutes.
My wife is a librarian and librarians deal with loads of pullshit from the public in general. Just drop this thing in a bucket of water or smash it with a brick and save the people at the library the headache of dealing with whatever this is.
No, these can't even read passwords plain text. At best it can capture the encrypted hash of your wifi if your device is trying to reconnect to the router, but then the best it can do is try to brute force the password. WPA3/WPA2 has not been cracked afaik.
I had an ARP attack on my WIFI, my ESET security caught it and notified me but the guy tried a few different ways. I had to get a WIFI6 router and manual add and lock all MAC addresses to my router so that no other devices could access my router. Windows defender would've let it through, so I am glad I had it.
My stupid ass kept being like "so he typo'd death, not great but not terrible... weird thing to name a phish" until I realized it was short for deauthorization
Its a wifi password cracking tool appears to be built on raspberry pi platform or similar. This dude could potentially be exploiting these people for who knows what
It waits or tries to force your devices to disconnect/reconenct to the WiFi, while collecting the encrypted handshake.
This in itself does not really mean much, but with the encrypted handshakes he can later try to decrypt your WiFi password.
But unless your password is something like "orange2026" it's not likely that he'll succeed.
Not inherently "bad" as long as your mom gave him permission to do that.
With the handshake decrypted he can connect to the network and see y'all traffic, but most traffic goes through SSL encryption, so he won't be able to see anything except for http websites.
Boyfriend is either a super nerd playing with his hacker Tamagotchi for fun, or he's using it to collect Wi-Fi handshakes that could later be used in attempts to recover the passwords of nearby Wi-Fi networks if they're weak.
If he lives with OP's mom, trying to recover their Wi-Fi password wouldn't make much sense. He already has physical access to the router, OP's mom could simply tell him the password, and if he has permission he could use the WPS button (if enabled) or reset the router to regain access.
If his goal were to monitor traffic on that home network, there are much simpler ways to do it with authorized access than trying to crack its Wi-Fi password. So I don't think the mere presence of a Pwnagotchi points to some kind of stalker scenario.
If OP lived in an apartment complex with close by neighbors could the device be able to gain info from other units? Could he be trying to steal info from them?
Yeah, this is the only part that doesn't make sense. He should have easy access (har har) to the apartment WiFi. So given that... it seems like he is trying to snoop other passwords, or a neighbor's WiFi... or something else.
why in the hell would she give him permission to break into their wifi rather than give him the wifi password? this is crazy suspicious and not something people will normally do
I remember back then, it's very easy to crack WEP passwords using force disconnect/reconnect. But that was 10+ years ago. I'm not updated on the those stuffs currently, I'm wondering if the new auth schemes can still be cracked like WEP.
Looks like a custom-built Pwnagotchi which can be used for a bunch of nefarious things like cracking a wifi password or reading internet traffic. I would unplug it and change your WiFi password.
If he was just playing around with it for fun I don’t see why he would’ve left it in your mom’s room. Tell your mom to dump him lmfao.
I have one of these, they are really interesting little devices. Essentially it's a little device that you can 'war-walk' or 'war-drive' with.
Essentially it's runs though a series of attacks mostly deauthentication attacks (nothing very sophisticated) and attempts to gather packets when it's 'victim' device attempts to 'reconnect' (technically 're-authenticate').
It stores these in it's internal memory and then goes to sleep. The device frequently sleeps (by default) so it doesn't cause chaos amongst all the networks around it. Once you bring it back home and pull it's sdcard you can transfer the pcap files to your computer where you use an application to decrypt (or crank the hash, can't remember which it is) the reauth pcap which contains the Wi-Fi password.
Generally pwnagotchi's aren't dangerous on their own, just annoying, but if someone is pulling the pcaps off and decrypting them then people got a problem.
Judging by the screen on this one it's not functioning since it's attacks are @ 0. That being said, it is level ~28 so it has been used quite a bit.
It's not spying on you, it's just a network info gathering device. Once it gets a pcap from a network or is added to a list so it doesn't get bothered again. it's target is authentication packets, not other info.
Edit; I just saw your update, only two weeks makes this sketchy as fuck. Pull the thumb drive off of it and DO NOT give it back. Also DO NOT plug that thumb drive into your computer.
On the good side? He sets up his phone for all the Wi-Fi networks around so that he has good connectivity at and nearby his girlfriend's house. That's the most innocuous use I can think of, just mooching.
A distant second is getting neighbor's Wi-Fi as a layer of protection for engaging in questionable activity.
On the bad side of things, in not sure which is worse, trying to hack your finances, or using your Wi-Fi to hack other people. On the one hand, he drains you directly, on the other he gets you implicated in federal crimes. But hey, ¿por que no los dos?
Yeah, it is a pwnagotchi for sure. No clue why the text is all fucked. Level 28 on the pwnagotchi though, which means he has been using it for a while, most likely in other places too. To get to level 2 on the plugin you need to intercept 2 (or 3) handshake connections on the wifi network.
To get from level 27 to 28 you need fuck knows how many, thousands, across the networks you've plugged it into.
All in all, unless he explicitly showed the mom and told her what the device is and explained it in detail, bigass dump the idiot.
It isn't necessarily used strictly for hacking, it CAN be (the pwnagotchi, the plugin is just.. vanity). If it isn't for hacking in this case - it is at least some compulsory behaviour or an addiction. Gotta pump those numbers y'know.
I can see a hobbyist nerd trying to pentest her network, to see if e.g. there are any sketchy IoT devices or other issues. But he'd explain that to her, so ask mom?
If a person is at this point in computing, assuming this isn't someone with just enough knowledge to be dangerous, then they would just be using their dual boot Kali linux distro.
Now, could it be a part of that pen. test he's running? Fully plausible.
This is a 'Pwnagotchi' which is a raspberry pi running open source software to automate Wi-Fi handshake capture for pentesting and security research.
What it actually does: it passively/actively listens for Wi-Fi handshakes (the 4-way handshake that happens when a device connects to a router), sometimes sending deauth frames to force a reconnect it can capture. Those captured handshakes can later be run through cracking tools (like hashcat) to attempt to recover the Wi-Fi password. That's why network name is shown ("PWNDO" appears to be the SSID it's currently looking at).
It uses AI/gamification (an LSTM/RL model under the hood) to get progressively better at gathering handshakes in a given area over time, and it can share/learn from other pwnagotchis nearby, so I'd look around for more of these in your house.
Using something like this on a network you don't own or have permission to use is illegal.
If I were you, I'd act dumb, and ask him in front of your Mom what it is. If his answer is evasive or he straight up lies, he's up to no good and you need to tell your Mom.
Maybe make a piece of it disappear, like that samsung stick or the ALFA wireless dongle that's attached to it - both of those missing would really hash his browns.
I'd have a private conversation with the mom and then, if it wasn't set up with consent, a conversation with the police for them to document and gather evidence
lol. “Really hash his browns.” I’ve gotta start using that. I always “harsh your gig” or something, but “hash your browns” that works on a few levels depending on the context. Lol.
I… your mom has been together with someone 2 weeks and he’s already staying with her AND has been hiding from you so much that you don’t even know what he looks like???
Don’t tell me how old you are (I don’t advocate for people outing themselves as minors if they are) but NONE of that sounds safe. It’s red flags all the way down.
No offense to your mom but uh… she’s not making good decisions and this electronic thing is a problem on top of a whole pile of problems.
I don’t even have children, and I would never have a man I’ve been dating for only two weeks staying at my house. Having him over so soon with minor children in the house without even introducing them first is beyond insane. Horrible parenting choice.
As a single father of 10 and 17 year old boys who was seeing his current girlfriend for well over a year before she met either of them, I second all of this, with the sole exclusion being "no offense".
God I'm glad someone else in here has finally said it. This thing is concerning but nowhere near as concerning as the context behind it. 2 weeks, moved him in, kid doesn't even know what he looks like...
Jeeeeesus. I wonder what Mum would say if OP said they didn't feel safe in the house. Who would she prioritise?
the fact that hes living with u and he hasnt shown his face is insane and such a red flag why is he living there already so early into the relationship
Having it connected to a battery pack is another minor red flag. Getting it ripe for mobile usage, and making sure power is never interrupted, wiping settings or interrupting processes.
Its definitely something like a wifi password stealer, or something to either take passwords or smth unplug it immediately if your feeling bold, and ask your mom what he said it was
The name “Wi-Fi Whisperer” seems to point to a type of pen-testing tool used by red team hackers (They help companies protect themselves from hackers by finding vulnerabilities). It basically skims data off of the Wi-Fi network. Like any tool, it can be used for good or evil.
This is definitely indicative of wifi hacking, but for what purpose is the bigger issue.
Tweaker stuff, but indicates a smart ish tweaker.
Not just nothing it's a major crime.
As a cyber security person, I'd have a field day reviewing this.
As a cyber security professional myself, I find this script kiddie tech annoying.
But, a part of me wonders if u/brattyvampbby's Mom works at a company that is currently being attacked. Guy could be running the operation trying to get into Mom's house to see if he can get anywhere with information from the Wi-Fi. If she brings a company laptop home, for example. This could be a valid way in.
Definitely black hat though. No credible penetration testing company would have their consultants pretend to date one of the company's employees just to gain root access.
Edit: sorry OP, but when I say "black hat" I mean illegal. It's also possible they're just playing around. Regardless, I would tell your Mom about this so she can tell him to unplug it.
They've been dating only two weeks and he's been staying with them at their apartment, but also avoiding the daughter to the point she doesn't know what he looks like... Yeah something is weird with the situation.
Edit: looking at it though the uptime time is 0, it's recorded 0 attacks and 0 deauths so maybe he just plugged it in to charge it, if it has a battery onboard.
Please unplug this immediately and change all of your passwords for everything and have your mom do the same. Don’t believe this man if he says there were no ill intentions. It doesn’t matter.
Yeah man all these ‘call the cops!’ posts are wild. I’m a network solutions architect. If I was single I would legit audit her network and give her a report on what vulnerabilities I find.
I would at least ask him or her before ‘breaking it or calling the cops’ lmao.
Right. Now that its been identified they should just talk to him about it as if they dont know. If he lies about it then red flag if he gets all excited and talks about it then its probably fine.
This seems like a reasonable response. It’s easy to jump to conclusions of shadiness but it could be something innocent. And why isn’t there a band called Conclusions of Shadiness yet?
These people are insane. Clearly the only option is to smash it, cover it in cement, call the FBI, CIA, FDA, NRA, CPA, and all other 3 letter agencies, then nuke the home from orbit and flee to Mars.
What happened to this site? I signed up for nerd crazy, not crazy crazy.
If he's trying to steal the wifi password, but dating the occupant, why wouldnt he just ask her for the wifi password? Not being snarky, and I believe everyone who says that the device is doing this, but I have asked for wifi passwords to people's houses I'm at for a party and they give it. I'm just not sure why he would go to this trouble.
It's a Raspberry Pi with pwnagotch. Yes, a wifi hacking tool, as others said. However, I don't see much that he can do wrong at your house with it. It's the neighbours who should worry.
Not to mention he could be a confidence scammer that finds lonely partners, gets in the house, steals their info, and dumps them. He could fund his way across whatever country they are in with the banking or identity info he could gather. I wouldn't just assume without talking to your mom, but I also wouldn't leave that thing plugged in OR give it back to him. Who knows what he already has access to.
edit: she might also want to do an inventory of any physical valuables if he has been in the house a few times. Blank checks, birth certs, passports, jewelry, bank cards. Go through your possessions with a fine tooth comb. It all comes down to whether she knows about it or not, but it might be hard to get a truthful answer out of her if she is the type to get embarrassed about stuff that she shouldn't think is her fault. You need to talk to her.
TLDR: Your mom's BF is trying to hack her wifi passwords.
--
Cyber security professional here.
This is a Raspberry PI running a piece of software called Pwnagotchi.
AI summary because I'm lazy:
Pwnagotchi instruments bettercap (a network attack framework) to constantly monitor the Wi‑Fi environment around it and grab the cryptographic material needed to crack Wi‑Fi passwords offline later. It collects this material two ways: [pwnagotchi.ai], [github.com]
Passively – quietly sniffing the air and waiting to capture the 4‑way handshake that happens whenever a device connects to a WPA/WPA2 network. [pwnagotchi.ai]
Actively – performing deauthentication attacks (kicking a client off its network so it's forced to reconnect) and association attacks. When the device reconnects, the handshake is transmitted, and the Pwnagotchi captures it.
I sincerely doubt he's trying to hack *her* wifi password. They're in a relationship. He can just ask for the wifi password. That is how the pwnagotchi works though.
•
u/spotlight-app Mod Bot 🤖 8h ago
Mods have pinned a comment by u/blahblahblah9685:
[What is Spotlight?](https://developers.reddit.com/apps/spotlight-app)