Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers ship their exploits directly to their target’s mailroom

techcrunch.com

Post reply on HN
Print view View original

11–20 of 172 posts

Re: Hackers ship their exploits directly to their target’s mailroom

#11

Post by TheLastPass »

jason0597 wrote: post #8

>Once the warship locates a Wi-Fi network from the mail room or the recipient’s desk, it listens for wireless data packets it can use to break into the network. The warship listens for a handshake — the process of authorizing a user to log onto the Wi-Fi network — then sends that scrambled data over the cellular network back to the attacker’s servers, which has far more processing power to crack the hash into a reada…

If it's not a strong hash and the protocol doesn't include salting, it's not impossible. Rainbow tables exist. And they really only need to find a collision. Wi-Fi protocols, especially WEP, have had vulnerabilities similar to this before. Similar in the sense that if you sniffed enough traffic you could figure out the password (don't recall the specific mechanisms - but this could be one).

Re: Hackers ship their exploits directly to their target’s mailroom

#12

Post by [deleted] »

jason0597 wrote: post #8

>Once the warship locates a Wi-Fi network from the mail room or the recipient’s desk, it listens for wireless data packets it can use to break into the network. The warship listens for a handshake — the process of authorizing a user to log onto the Wi-Fi network — then sends that scrambled data over the cellular network back to the attacker’s servers, which has far more processing power to crack the hash into a reada…

[deleted]

Re: Hackers ship their exploits directly to their target’s mailroom

#13

Post by scarejunba »

jason0597 wrote: post #8

>Once the warship locates a Wi-Fi network from the mail room or the recipient’s desk, it listens for wireless data packets it can use to break into the network. The warship listens for a handshake — the process of authorizing a user to log onto the Wi-Fi network — then sends that scrambled data over the cellular network back to the attacker’s servers, which has far more processing power to crack the hash into a reada…

Use Aircrack-ng. Doesn't require skill. The broken part is the handshake.

Re: Hackers ship their exploits directly to their target’s mailroom

#14

Post by Fabricio20 »

jason0597 wrote: post #8

>Once the warship locates a Wi-Fi network from the mail room or the recipient’s desk, it listens for wireless data packets it can use to break into the network. The warship listens for a handshake — the process of authorizing a user to log onto the Wi-Fi network — then sends that scrambled data over the cellular network back to the attacker’s servers, which has far more processing power to crack the hash into a reada…

Not really, this is a known "vulnerability" with WPA2 and has been demonstrated to work a lot of times.

https://www.aircrack-ng.org/doku.php?id=cracking_wpa#step_4_...

This is done completely offline once you have the handshake captured and can be easily scaled.

Re: Hackers ship their exploits directly to their target’s mailroom

#15

Post by lallysingh »

slowmotiony wrote: post #3

That seems like a lot of hassle and a pretty big federal crime for only being able to attack Wi-Fi networks. Why not just park your car outside and use a laptop?

You don't even have to be in the same country as your target. You can ship with a fake source and be pretty much invisible.

Using repurposed used hardware, this can also be crazy cheap.

Fun idea: buy junk vendor swag (stuffed animal, glass globe, etc) off of ebay in bulk, then mail it to people you know have recently left the company (say, from scanning LinkedIn). They'll probably keep the package around for a while before disposing of it. Or even better, someone else claims it as 'free swag,' and keeps it in the office.

Maybe it'll stay in there a long time: https://en.wikipedia.org/wiki/The_Thing_(listening_device)

Extra points: make it something powered (like a clock) and make them plug it in. Battery charge for initial scan, and if you get lucky, they'll recharge the battery by plugging in the device.

Re: Hackers ship their exploits directly to their target’s mailroom

#16

Post by justsomeguy1 »

jason0597 wrote: post #8

>Once the warship locates a Wi-Fi network from the mail room or the recipient’s desk, it listens for wireless data packets it can use to break into the network. The warship listens for a handshake — the process of authorizing a user to log onto the Wi-Fi network — then sends that scrambled data over the cellular network back to the attacker’s servers, which has far more processing power to crack the hash into a reada…

My friend did this with his neighbor's wifi (with their permission of course) just to see if he could. He got trial access to some super computers in the Google cloud (sorry I'm not more specific, just recollecting what he told me) and was able to crack with that horsepower in a day or so.

Re: Hackers ship their exploits directly to their target’s mailroom

#17

Post by eswat »

jason0597 wrote: post #8

>Once the warship locates a Wi-Fi network from the mail room or the recipient’s desk, it listens for wireless data packets it can use to break into the network. The warship listens for a handshake — the process of authorizing a user to log onto the Wi-Fi network — then sends that scrambled data over the cellular network back to the attacker’s servers, which has far more processing power to crack the hash into a reada…

If the password is a predictable, low-length alphanumeric password it’s not going to take long for something like a multi-GPU machine with some dictionaries to break it.

Re: Hackers ship their exploits directly to their target’s mailroom

#19

Post by miah_ »

mikece wrote: post #6
slowmotiony wrote: post #3

That seems like a lot of hassle and a pretty big federal crime for only being able to attack Wi-Fi networks. Why not just park your car outside and use a laptop?

How long can you sit outside a company running Kali Linux and a high gain antenna array before you attract attention? If you ship someone on the DevOps team a WiFi-connected plush toy that listens for webhooks from your CI/CD platform to make happy/sad noises when the build passes/fails -- AND THEY PLUG IT IN AND LEAVE IT ON -- then the ability to have passive access to the network for a long period of time will be l…

There was also, The Thing which was a gift from Young Pioneer organization of the Soviet Union to Ambassador Harriman in 1945. It was discovered to be a passive listening device seven years later.

https://en.wikipedia.org/wiki/The_Thing_(listening_device)

Post reply on HN