61–70 of 172 posts
Earlier quoted context omitted.
It's unfair to say that there is no salting. The PMK is derived from the WiFi network name (SSID) as well as the password [1]. The SSID acts as a salt here. Not perfect as SSIDs are often not unique, but it's certainly better than no salting at all. [1]: https://www.ins1gn1a.com/understanding-wpa-psk-cracking/
This is why we have rainbow tables.
Why an attacker should spend 100$ , sending hardware to the target that could be potentially tracked following the path between the resellers, could transport evidences like fingerprints or DNA, using a telephone connection that could also be tracked when the same thing could be done with a good radio equipment and more discretion ? Anyway, I am the kind of guy that inspects the ATM praying to find out a skimmer to d…
Think about the distance factor. Sure, you could get good radio stuff set up so that you don't have to be in the parking lot to break in and can avoid appearing suspicious on any surveillance cameras, but you still have to be within a few kilometers at most. With warshipping you can be across the planet.
Earlier quoted context omitted.
You get a week's worth of typing; you cluster the sounds; then based on statistical frequency analysis you decode which cluster maps to the spacebar and which to the letter 'x'; then you can transcribe the whole typing history and decide which of all that is a password.
Great plan, but we have to test it. Can you upload a sample dataset of you typing for 1 week so we can try this approach?
This makes me think of an even more straightforward attack. How hard would it be to actually just ship them computer hardware and hope it makes it into the system? I mean, if a package that looks like it came from NewEgg containing a router shows up, especially if it matches the type the company usually uses, which wouldn't be too hard to figure out, what are the chances it just gets tossed on a shelf to be used next…
Maybe if you shipped it at the same time someone was expecting it, you could get it to someone who knew what to do with it. Or ship it to the newegg/amazon warehouse to get mixed in with regular deliveries.
>Once the warship locates a Wi-Fi network from the mail room or the recipient’s desk, it listens for wireless data packets it can use to break into the network. The warship listens for a handshake — the process of authorizing a user to log onto the Wi-Fi network — then sends that scrambled data over the cellular network back to the attacker’s servers, which has far more processing power to crack the hash into a reada…
Not really, this is a known "vulnerability" with WPA2 and has been demonstrated to work a lot of times. https://www.aircrack-ng.org/doku.php?id=cracking_wpa#step_4_... This is done completely offline once you have the handshake captured and can be easily scaled.
Classy hackers hack modern protocols like WPA 3.
https://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#Dragonb...
Earlier quoted context omitted.
It's unfair to say that there is no salting. The PMK is derived from the WiFi network name (SSID) as well as the password [1]. The SSID acts as a salt here. Not perfect as SSIDs are often not unique, but it's certainly better than no salting at all. [1]: https://www.ins1gn1a.com/understanding-wpa-psk-cracking/
I said "IF" there's no salting. In any case, I'd be less concerned about SSID's not being unique as I am about the fact that the SSID of a specific target is trivial to obtain and almost never changed.
Salts don't need to be secret, only unique. In fact, in this case the unauthenticated client needs to be able to compute the PMK from the password alone, so you can't keep it on the AP.
Why an attacker should spend 100$ , sending hardware to the target that could be potentially tracked following the path between the resellers, could transport evidences like fingerprints or DNA, using a telephone connection that could also be tracked when the same thing could be done with a good radio equipment and more discretion ? Anyway, I am the kind of guy that inspects the ATM praying to find out a skimmer to d…
Find someone who's out on leave for a while (just look for who's having a baby on IG) and ship the package to him/her! They won't discover it for weeks and you'll have plenty of time for your package to sit in the mailroom or on someone's desk. The danger is when the package is opened, the company may realize they've been hacked. Or have it there permanently: Ship an executive a fancy illuminated globe or desk clock…
All the old TEMPEST stuff probably works great when you're _inside_ the target's building.
Oh, and in those rooms bringing your own stuff from the outside is not encouraged - to the extent that I was asked to leave my disposable coffee cup outside on one occasion.
Didn’t matter much - there was an approved and vetted Moccamaster inside.
When I started the article the first it came to me was that, once that package actually arrived at someone's desk, the main goal of the attackers would be to exploit Bluetooth attack vectors, where you can actually snoop at user/passwords, take control of devices or event plug the warship as a keyboard and deploy malicious code into the internal PCs.
For some of the bluetooth attack vectors, the warship wouldn't even need the cell network access and a call home, just a powerful bluetooth antenna should suffice.