Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

github.com

Post reply on HN
Print view View original

81–90 of 140 posts

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#81

Post by djsumdog »

kees99 wrote: post #71
d33 wrote: post #33

Earlier quoted context omitted.

This is probably a good occasion for a call for WPA3: https://github.com/d33tah/call-for-wpa3

WEP, WPA, WPA2... why keep reinventing the same wheel? Each new iteration inevitable turns out to be less-than-perfect and keep adding more and more complexity and overhead - for one, join/leave times keep increasing, up to a point where we have a separate standard (802.11r) just to get back pre-WPA roaming speeds (at cost of even more protocol complexity overhead). Here's crazy idea: Why not run open network + IPSEC…

Most captive portal routers don't block DNS (because they use iptables rules to handle authentication). That's why you can use iodine to proxy TCP-over-DNS on such APs. So if you just had an open access point, unless you provided no DNS servers except over VPN, people would still be able to use your AP.

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#82

Post by ComputerGuru »

TheAceOfHearts wrote: post #80
throwasehasdwi wrote: post #15

I'm not sure why this is amazing enough to make the first page but W/E it's HN :). Just so less informed are aware, this has been feasible for maybe 7 years (since GPU calculation became possible). Just so nobody freaks out, this is cracking weak passwords, not broken WPA. I have myself cracked countless WiFi passwords when security testing. It's easy if the passwords are bad, which is maybe 90% of the time for home…

In your opinion, is setting up a RADIUS server and using WPA2-Enterprise worth it for a consumer? I'm pretty paranoid, and also think it could be an insightful experience to tinker around with networking tools. Any advice for what constitutes a strong or weak password in this context?

I wanted to do that in my home, but good luck getting IoT devices to connect which may be a good thing..)

You'd probably have to set up a separate network for those devices (again, technically a good thing) which can be a source of some friction.

It used to be only good routers had a guest network option, but now even $20 TP-Links can use Radius for the main network and WPA2 for the guest network; though I'm not sure you can do something like whitelist by MAC on only the guest network.

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#83

Post by quacker »

jaimex2 wrote: post #75
webaholic wrote: post #39

To the script kiddies out there who read this: Do not try this on others wifi. It is a crime in the USA to crack network routers. Although the chance of you getting caught is low, better be safe than sorry.

whats the punishment in the US?

IANAL, but from reading for a little bit, it seems to vary and states have their own laws.

There's some discussion on Wikipedia here[2] of unauthorized piggybacking (which does not even require hacking the network), with a few examples of actual instances.

In St. Petersburg, 2005, Benjamin Smith III was arrested and charged with "unauthorized access to a computer network", a third-degree felony in the state of Florida, after using a resident's wireless network from a car parked outside.

A third-degree felony in Florida seems to be up to 5 years. In some states it is up to 10 years. Another person got "a fine of $250 and one year of court supervision".

If it's unauthorized access to the computer of a government or financial institution (or "which is used in or affecting interstate or foreign commerce or communication", which can be interpreted very broadly), then the Computer Fraud and Abuse Act would apply[2]. From reading about the sections regarding "trespassing", punishment can be a fine and 1-5 years imprisonment (first offense), or up to 10 years (repeated offense).

1: https://en.wikipedia.org/wiki/Legality_of_piggybacking#Unite...

2: https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#84

Post by zeta0134 »

xori wrote: post #52
throwasehasdwi wrote: post #50

Earlier quoted context omitted.

You can't brute force a nonce offline when you don't know if you answer is right unless you ask the AP. Different protocols than sending hashes where you can tell if your hash is correct just by looking at it. You are right that the AP couldn't block you without blocking everyone, but since you need to check your answer with the AP for each guess your attack becomes extremely visible. I guess you could still DDOS the…

But you can capture the first encrypted packet from the router, and you know what the protocol is to test if your decoded version is correct. I still don't see how this helps.

This is a reasonable guess at how encryption works, but it's also flawed. The key you need to crack on a Wireless Router isn't the key that's used for actual encryption of data, but rather the key used to set up that encryption in the first place.

Basically, your keys are used to handshake with the access point, and then exchange a new set of temporary keys for the duration of your connection. These temporary keys (which are exchanged during the handshake, and encrypted by something which involves your original keys) are then used to encrypt user data.

Because the data are encrypted with new keys for each connection, and those keys aren't based on the original keys in any way, knowing the plain text version of the data you're trying to decrypt doesn't help. You might be able to recover the temporary key, but you can't use this by itself to join the router, and the key is thrown away when that user makes a new connection. (These keys are also usually quite large, random, and very resistant to brute force methods anyway.)

HTTPS works similarly, and it needs to, because many (many!) websites start with the plain text "<html" which would make it trivial to brute force the keys offline otherwise.

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#85

Post by braxxox »

nextstep wrote: post #40

Does this only crack single word passwords? If my password was two common dictionary words or a common word plus a single number, would this try that possibility?

Using a wordlist with aircrack-ng seems to only try the literal passwords in the dictionary. If you use naive-hashcat, a series of dictionary, rule, combination, and brute-force attacks will be used. I recommend reading up on the hashcat wiki (https://hashcat.net/wiki/) to learn how to conduct your own custom hashing attacks.

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#86

Post by djsumdog »

webaholic wrote: post #39

To the script kiddies out there who read this: Do not try this on others wifi. It is a crime in the USA to crack network routers. Although the chance of you getting caught is low, better be safe than sorry.

Technically using iodine to tunnel via DNS on captive portals is also illegal (I think .. although I'm not sure if anyone has been prosecuted for this .. IANAL)

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#87

Post by braxxox »

bobsgame wrote: post #47

I had the idea a long time ago to make a dd-wrt image which would automatically crack the vulnerable routers within distance, detect the model, and install a compatible version of itself in order to spread virally and create a mesh network. I'm not going to pursue it because it probably breaks a lot of laws, but I'm still curious if it would have been possible. Does anyone know if this is actually feasible? Maybe the…

That certainty breaks the Computer Fraud and Abuse Act, and while impractical, I think you could be charged separately for cracking each router. That said, interesting idea. If I were to do it, I wouldn't crack the passwords on the router itself, but rather attach 3G hardware to the router to "phone home" captured handshakes and run your cracking on GPUs in the cloud, sending results back to the router.

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#89

Post by poizan42 »

djsumdog wrote: post #81
kees99 wrote: post #71

Earlier quoted context omitted.

WEP, WPA, WPA2... why keep reinventing the same wheel? Each new iteration inevitable turns out to be less-than-perfect and keep adding more and more complexity and overhead - for one, join/leave times keep increasing, up to a point where we have a separate standard (802.11r) just to get back pre-WPA roaming speeds (at cost of even more protocol complexity overhead). Here's crazy idea: Why not run open network + IPSEC…

Most captive portal routers don't block DNS (because they use iptables rules to handle authentication). That's why you can use iodine to proxy TCP-over-DNS on such APs. So if you just had an open access point, unless you provided no DNS servers except over VPN, people would still be able to use your AP.

Presumably you want to reply to DNS requests for a hostname for your captive portal. You might try to just use a raw ip address, but then you can't use https. So then you have the problem that you can't just reply with a fake answer for other domains due to caching. E.g. Windows caches negative responses for 5 minutes, which would be a pretty bad experience for your customers.

I guess you might be able to just fail to reply to DNS requests for domains outside you captive portal, I have no idea if anyone has tried that or there might be other complications.

Edit: Actually not replying wouldn't work great either because then the user can't be redirected to the captive portal. This might be less of an issue today since most devices have standardized a way to detect captive portals using a small set of hostnames.

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#90

Post by pixl97 »

TheAceOfHearts wrote: post #80
throwasehasdwi wrote: post #15

I'm not sure why this is amazing enough to make the first page but W/E it's HN :). Just so less informed are aware, this has been feasible for maybe 7 years (since GPU calculation became possible). Just so nobody freaks out, this is cracking weak passwords, not broken WPA. I have myself cracked countless WiFi passwords when security testing. It's easy if the passwords are bad, which is maybe 90% of the time for home…

In your opinion, is setting up a RADIUS server and using WPA2-Enterprise worth it for a consumer? I'm pretty paranoid, and also think it could be an insightful experience to tinker around with networking tools. Any advice for what constitutes a strong or weak password in this context?

>In your opinion, is setting up a RADIUS server and using WPA2-Enterprise worth it for a consumer?

It can be a pain in the ass when the consumer device requires a valid SSL certificate. On active directory networks this isn't much of a problem because a CA is pushed out to devices, but automating this at home can be a bigger issue.

Post reply on HN