Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I cracked my neighbor's WiFi password without breaking a sweat

arstechnica.com

Post reply on HN
Print view View original

61–70 of 144 posts

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#61

Post by moxie »

joshuahedlund wrote: post #3

> To his chagrin, it took CloudCracker just 89 minutes to crack the 10-character, all-numerical password he used... > Remarkably, neither CloudCracker nor 12 hours of heavy-duty crunching by Hashcat were able to crack the passphrase. The secret: a lower-case letter, followed two numbers, followed by five more lower-case letters So an all-number password was easily cracked with this method, but a shorter password with…

I run CloudCracker, so I can add some color. 'English' dictionary jobs use dynamic models built by password compromises from english speaking users, augmented by the results of our own jobs (as well as occasional brute force jobs we run against a sample of handshakes which didn't crack).

The smaller 'English' dictionaries focus tightly on that. The larger 'English' dictionaries include the longer curve of those passwords, but also start to mix in the hot spots from other models, such as valid NANP numbers (which is what got this example).

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#62

Post by moxie »

smackfu wrote: post #48

I would place good money that most AT&T wireless routers (SSID = 2WIREXXX) are using the same 10-digit password that is printed on the sticker on the unit. Yes, it's more secure than the old days of a default password being "default" or "admin" but not so great if 10-digit passcodes are easily broken.

It's a pretty big keyspace, but not quite big enough these days. I haven't noticed any lack of uniformity across it, but I don't really have enough samples yet to be sure. We have a dictionary specifically for those devices, just because they're so common: https://www.cloudcracker.com/dictionaries.html

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#63

Post by moxie »

zerohm wrote: post #59

I found this article to be a bit sensational. It should be titled, "how I paid some experts to crack my neighbor’s Wifi." I’m not trying to dismiss the threat, just put it in perspective. The use of these tools is either expensive ($2500 a year?) or requires a non-trivial amount of expertise (Aircrack-ng). I did find the article linked within to be more interesting and informative. http://arstechnica.com/security/201…

There's also an in-between. Many CloudCracker users employ tools like KisMAC (which are fairly user-friendly) to get a capture, and then simply upload the output to CloudCracker (also fairly user-friendly).

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#64

Post by DanBC »

randomdata wrote: post #29
drzaiusapelord wrote: post #25

Earlier quoted context omitted.

Look at it this way. Lets say I give you 5 characters to create a password. If you use all numbers then each value can be anywhere between 0 to 9. That's only 10 values! So that's 10 to the power of 5. That's only 100,000 permutations. With letters, assuming standard English, you get 26 per value. Or 52 when we include case. That's a big difference. So lets say I only give you 4 lowercase characters. That's 4 to the…

Sounds a lot like my bank. 5 characters of 0-9 is exactly what they validate their passwords on. Luckily that validation is done only in Javascript, so disabling the check allows you to use any password you want. That doesn't help the average person though.

I would ask "Why are they still your bank?" but I know that most online banking is similarly awful.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#65

Post by ctdonath »

When addressing various physical home security issues, I came to the realization that if a trained team of attackers equipped with body armor and night vision broke into my home, the issue escalated beyond anything I could sensibly prepare for.

The article reminded me of that. If someone attacks my home wifi with network sniffing hardware, sophisticated password guessing tools, hours of planning and execution, etc then, well, the issue escalated beyond anything I could sensibly prepare for.

I realize these computing tools are easy to come by and not terribly hard to use. Ditto body armor, night vision, and combat training. And if someone is inclined to apply them against my pathetic existence, I'm screwed. Planning for such events is pretty pointless, I have other things to do.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#66

Post by freshbreath »

chadyj wrote: post #21

What is the command for aircrack-ng to generate the pcap file with the handshake? (For those curious mac users, you can simply type "brew install aircrack-ng")

That will install 'aircrack-ng', which can crack WEP ivs packets or a WPA/2 handshake.

You will need airodump-ng to actually capture the handshake. I don't think the entire aircrack suite has been ported in homebrew.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#67

Post by efraim »

guilhermetk wrote: post #15

>To capture a valid handshake, a targeted network must be monitored while an authorized device is validating itself to the access point. I think it's a really noob question, but how do you monitor a network if you are not connected to it?

The network card sees all packets that go through the air but discards the ones not meant for your computer. Unless you tell the card not to which is called promiscuous mode, then all the packets are available to the OS.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#68

Post by brigade »

ctdonath wrote: post #65

When addressing various physical home security issues, I came to the realization that if a trained team of attackers equipped with body armor and night vision broke into my home, the issue escalated beyond anything I could sensibly prepare for. The article reminded me of that. If someone attacks my home wifi with network sniffing hardware, sophisticated password guessing tools, hours of planning and execution, etc th…

A physical assault carries a high chance of being noticed, and unless carried out by law enforcement, a significant chance of being punished with jail time. So it's not something that has a high chance of happening. Additionally, it's hard to defend against, and you definitely don't want to defend against a SWAT team.

Whereas a bored teenage neighbor could attack your wireless network with a very small chance of being detected. Or with a sensitive directional antenna it doesn't even have to be your neighbor if the goal is just to sniff traffic. Plus, the only cost to you in defending against this attack is entering a more complex password on new devices. Stick a note on the fridge or choose a phrase.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#69

Post by smackfu »

moxie wrote: post #62
smackfu wrote: post #48

I would place good money that most AT&T wireless routers (SSID = 2WIREXXX) are using the same 10-digit password that is printed on the sticker on the unit. Yes, it's more secure than the old days of a default password being "default" or "admin" but not so great if 10-digit passcodes are easily broken.

It's a pretty big keyspace, but not quite big enough these days. I haven't noticed any lack of uniformity across it, but I don't really have enough samples yet to be sure. We have a dictionary specifically for those devices, just because they're so common: https://www.cloudcracker.com/dictionaries.html

Very cool. The obvious question I have after looking at that is why the largest 2WIRE dictionary has 4.8 billion entries when the keyspace is 10 billion. Is the keyspace really not all 10 billion, or is there a 50% chance my key won't be in the dictionary?
Post reply on HN