How I cracked my neighbor's WiFi password without breaking a sweat
1–10 of 144 posts
Re: How I cracked my neighbor's WiFi password without breaking a sweat
#2You know, at the cost of $2,500 per year, (although I can't actually find where to purchase the software) you'd probably be better to just YouTube some kid's backtrack tutorial.
Re: How I cracked my neighbor's WiFi password without breaking a sweat
#3> To his chagrin, it took CloudCracker just 89 minutes to crack the 10-character, all-numerical password he used...
> Remarkably, neither CloudCracker nor 12 hours of heavy-duty crunching by Hashcat were able to crack the passphrase. The secret: a lower-case letter, followed two numbers, followed by five more lower-case letters
So an all-number password was easily cracked with this method, but a shorter password with letters was untouchable?
Edit: I get that 10^10 is less than 36^8. I was more wondering how the cracker assumes, without knowing already if it's all-numeric or not, that it should try longer numerics before shorter alphanumerics and when it decides to give up on the numbers. I guess it's just known to be more likely for a good number of characters.
Re: How I cracked my neighbor's WiFi password without breaking a sweat
#4> To his chagrin, it took CloudCracker just 89 minutes to crack the 10-character, all-numerical password he used... > Remarkably, neither CloudCracker nor 12 hours of heavy-duty crunching by Hashcat were able to crack the passphrase. The secret: a lower-case letter, followed two numbers, followed by five more lower-case letters So an all-number password was easily cracked with this method, but a shorter password with…
Surprising considering that the latter has less than 2 bits more entropy.
Re: How I cracked my neighbor's WiFi password without breaking a sweat
#5People are still really surprised when I offer to crack their neighbors' wifi passwords for them - "You can do that?". We've only been at it for over 10 years now.
Re: How I cracked my neighbor's WiFi password without breaking a sweat
#6>What's more, WPA and WPA2 passwords require a minimum of eight characters, eliminating the possibility users will pick shorter passphrases that could be brute forced in more manageable timeframes
Should I point out that 'password' is 8 characters :) Have there been studies done that attempt to test the hypothesis that when forced to pick passwords that meet some arbitrary complexity threshold most common users pick things like "password1"? I have a hard time believing most non-techies (heck, even a lot of techies) pick secure passwords.
Re: How I cracked my neighbor's WiFi password without breaking a sweat
#7> To his chagrin, it took CloudCracker just 89 minutes to crack the 10-character, all-numerical password he used... > Remarkably, neither CloudCracker nor 12 hours of heavy-duty crunching by Hashcat were able to crack the passphrase. The secret: a lower-case letter, followed two numbers, followed by five more lower-case letters So an all-number password was easily cracked with this method, but a shorter password with…
Most likely all the numbers up to 10 digits long were in the dictionary.
tl;dr of this article: don't use stupid passwords.
Edit: the article mentions it was a phone number, so that narrows it down a lot.
Re: How I cracked my neighbor's WiFi password without breaking a sweat
#8> To his chagrin, it took CloudCracker just 89 minutes to crack the 10-character, all-numerical password he used... > Remarkably, neither CloudCracker nor 12 hours of heavy-duty crunching by Hashcat were able to crack the passphrase. The secret: a lower-case letter, followed two numbers, followed by five more lower-case letters So an all-number password was easily cracked with this method, but a shorter password with…
Surprising considering that the latter has less than 2 bits more entropy.
All-number passwords are default on several ISPs so they're much more likely to succeed than a full keyspace search.
Re: How I cracked my neighbor's WiFi password without breaking a sweat
#9You know, at the cost of $2,500 per year, (although I can't actually find where to purchase the software) you'd probably be better to just YouTube some kid's backtrack tutorial.
Or get better at social engineering.
Re: How I cracked my neighbor's WiFi password without breaking a sweat
#10> To his chagrin, it took CloudCracker just 89 minutes to crack the 10-character, all-numerical password he used... > Remarkably, neither CloudCracker nor 12 hours of heavy-duty crunching by Hashcat were able to crack the passphrase. The secret: a lower-case letter, followed two numbers, followed by five more lower-case letters So an all-number password was easily cracked with this method, but a shorter password with…
Surprising considering that the latter has less than 2 bits more entropy.
By my math, a 10 byte sequence of decimal numbers has 33.2 bits of entropy, while a 8 byte sequence of lower case numerals and decimals has 41.3 bits. That's almost 300x as hard to crack.
There's also the issue of pattern heuristics. Number-only passwords seem like they'd be common, and thus a reasonable pattern to try out to ~35 bits or so (something that corresponds roughtly to "can be tried in a perceptively short time"), but it's not as clear that there's a significant fraction of passwords in the wild that use alphanumerics but no capitals. So they wouldn't try the passwords from the 36-character alphabet, more likely using a slower heuristic like things where the leading alpha character might be capital, or there might be punctuation between "words", etc...