How I cracked my neighbor's WiFi password without breaking a sweat • Hacker News Board

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#71

Post by InclinedPlane » Tue, Aug 28, 2012, 7:40 PM UTC

Xurinos wrote: post #45

scott_s wrote: post #33

No doubt, this neighbor should have changed his password long ago, but there is a lot to admire about his security hygiene nonetheless. I think it's taken too much for granted that one should change passwords on a regular basis. If we assume that changing passwords more frequently means that we are more likely to use more rememberable - and, thus, more guessable - passwords, then perhaps this is not a fluke. Perhaps…

One should change passwords on an irregular basis (a regular basis is weaker protection than an irregular basis). This is just an additional layer of security, not a perfection. If the password has ever been compromised, a password change policy removes the key from bad hands. Discovered passwords are not always immediately used; in many situations, they are stored for later use, perhaps even sold/traded.

How often do you rekey your house?

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#72

Post by moxie » Tue, Aug 28, 2012, 7:45 PM UTC

smackfu wrote: post #69

moxie wrote: post #62

Earlier quoted context omitted.

It's a pretty big keyspace, but not quite big enough these days. I haven't noticed any lack of uniformity across it, but I don't really have enough samples yet to be sure. We have a dictionary specifically for those devices, just because they're so common: https://www.cloudcracker.com/dictionaries.html

Very cool. The obvious question I have after looking at that is why the largest 2WIRE dictionary has 4.8 billion entries when the keyspace is 10 billion. Is the keyspace really not all 10 billion, or is there a 50% chance my key won't be in the dictionary?

Yep, 50% chance of success. I'll probably be able to adjust this to 100% in the coming months, but in the current setup that's the maximum space we can cover for our estimate of the maximum price elasticity.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#73

Post by SiVal » Tue, Aug 28, 2012, 7:47 PM UTC

brigade wrote: post #68

ctdonath wrote: post #65

When addressing various physical home security issues, I came to the realization that if a trained team of attackers equipped with body armor and night vision broke into my home, the issue escalated beyond anything I could sensibly prepare for. The article reminded me of that. If someone attacks my home wifi with network sniffing hardware, sophisticated password guessing tools, hours of planning and execution, etc th…

A physical assault carries a high chance of being noticed, and unless carried out by law enforcement, a significant chance of being punished with jail time. So it's not something that has a high chance of happening. Additionally, it's hard to defend against, and you definitely don't want to defend against a SWAT team. Whereas a bored teenage neighbor could attack your wireless network with a very small chance of bein…

I'm no security expert, but after I saw each new wifi password standard cracked within days of its release, I stopped passwording my wifi and used a little script I put on a home linux server to watch the router and if it spotted any unrecognized MAC addresses getting an IP address from DHCP, it would throw them out within a few seconds.

These days, I just turn on the MAC address filter that's built in to most wifi base stations. Now, unless I've manually entered your MAC address into my whitelist, my router won't connect you. My wifi shows up as "open" to any machine that passes by, yet it won't connect.

Many (most?) of you know more about security than I do. How secure is the MAC address whitelist approach compared to a password approach?

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#74

Post by archon » Tue, Aug 28, 2012, 7:52 PM UTC

SiVal wrote: post #73

brigade wrote: post #68

Earlier quoted context omitted.

A physical assault carries a high chance of being noticed, and unless carried out by law enforcement, a significant chance of being punished with jail time. So it's not something that has a high chance of happening. Additionally, it's hard to defend against, and you definitely don't want to defend against a SWAT team. Whereas a bored teenage neighbor could attack your wireless network with a very small chance of bein…

I'm no security expert, but after I saw each new wifi password standard cracked within days of its release, I stopped passwording my wifi and used a little script I put on a home linux server to watch the router and if it spotted any unrecognized MAC addresses getting an IP address from DHCP, it would throw them out within a few seconds. These days, I just turn on the MAC address filter that's built in to most wifi b…

I'm chagrined to admit that this simple approach didn't even occur to me. I'm interested as well; are there any disadvantages to this?

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#75

Post by EvilTerran » Tue, Aug 28, 2012, 7:55 PM UTC

SiVal wrote: post #73

brigade wrote: post #68

Earlier quoted context omitted.

A physical assault carries a high chance of being noticed, and unless carried out by law enforcement, a significant chance of being punished with jail time. So it's not something that has a high chance of happening. Additionally, it's hard to defend against, and you definitely don't want to defend against a SWAT team. Whereas a bored teenage neighbor could attack your wireless network with a very small chance of bein…

I'm no security expert, but after I saw each new wifi password standard cracked within days of its release, I stopped passwording my wifi and used a little script I put on a home linux server to watch the router and if it spotted any unrecognized MAC addresses getting an IP address from DHCP, it would throw them out within a few seconds. These days, I just turn on the MAC address filter that's built in to most wifi b…

Someone's said in the Ars Technica comments that MAC addresses are freely available in the packets-in-flight, and MACs are spoofable, so MAC filtering will only deter the casual, passing wifi-borrower, not anyone actually determined to gain access.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#76

Post by lotharbot » Tue, Aug 28, 2012, 7:56 PM UTC

commandar wrote: post #54

ryanmolden wrote: post #6

>What's more, WPA and WPA2 passwords require a minimum of eight characters, eliminating the possibility users will pick shorter passphrases that could be brute forced in more manageable timeframes Should I point out that 'password' is 8 characters :) Have there been studies done that attempt to test the hypothesis that when forced to pick passwords that meet some arbitrary complexity threshold most common users pick…

One of the things I try very hard to drive home to people is that WPA2 uses a pass phrase and not a password. I highly encourage people to use something like a favorite movie quote or a line from a book. Something like "Alas, poor Yorick! I knew him Horatio;" is both harder to crack and easier for a human to remember than something like "v3$bk:j". You're essentially taking natural language, which is something humans…

The problem with movie quotes and lines from books is that they're out there in a database somewhere. That means they're not nearly as hard for a computer to guess as you might think.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#77

Post by pilom » Tue, Aug 28, 2012, 7:58 PM UTC

SiVal wrote: post #73

brigade wrote: post #68

Earlier quoted context omitted.

A physical assault carries a high chance of being noticed, and unless carried out by law enforcement, a significant chance of being punished with jail time. So it's not something that has a high chance of happening. Additionally, it's hard to defend against, and you definitely don't want to defend against a SWAT team. Whereas a bored teenage neighbor could attack your wireless network with a very small chance of bein…

I'm no security expert, but after I saw each new wifi password standard cracked within days of its release, I stopped passwording my wifi and used a little script I put on a home linux server to watch the router and if it spotted any unrecognized MAC addresses getting an IP address from DHCP, it would throw them out within a few seconds. These days, I just turn on the MAC address filter that's built in to most wifi b…

Unfortunately, MAC addresses can be spoofed by a dedicated attacker. It prevents your neighbor from using your connection without paying, until they decide to listen to what your address is and then just use your address when you go to bed.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#78

Post by ctdonath » Tue, Aug 28, 2012, 8:02 PM UTC

archon wrote: post #74

SiVal wrote: post #73

Earlier quoted context omitted.

I'm no security expert, but after I saw each new wifi password standard cracked within days of its release, I stopped passwording my wifi and used a little script I put on a home linux server to watch the router and if it spotted any unrecognized MAC addresses getting an IP address from DHCP, it would throw them out within a few seconds. These days, I just turn on the MAC address filter that's built in to most wifi b…

I'm chagrined to admit that this simple approach didn't even occur to me. I'm interested as well; are there any disadvantages to this?

Convenience. Easier to give a visitor a password than get the device's MAC address and enter it into the router's whitelist.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#79

Post by [deleted] » Tue, Aug 28, 2012, 8:12 PM UTC

SiVal wrote: post #73

brigade wrote: post #68

Earlier quoted context omitted.

A physical assault carries a high chance of being noticed, and unless carried out by law enforcement, a significant chance of being punished with jail time. So it's not something that has a high chance of happening. Additionally, it's hard to defend against, and you definitely don't want to defend against a SWAT team. Whereas a bored teenage neighbor could attack your wireless network with a very small chance of bein…

I'm no security expert, but after I saw each new wifi password standard cracked within days of its release, I stopped passwording my wifi and used a little script I put on a home linux server to watch the router and if it spotted any unrecognized MAC addresses getting an IP address from DHCP, it would throw them out within a few seconds. These days, I just turn on the MAC address filter that's built in to most wifi b…

[deleted]

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#80

Post by jdthomas » Tue, Aug 28, 2012, 8:14 PM UTC

mgualt wrote: post #44

A couple of naive questions about the design of the security system: 1. Why is it possible to do the password tests remotely? Why would the key on the router be allowed to be transmitted? Even a 6 character password should be safe if you don't allow multiple tries. 2. Why isn't the handshake protocol encrypted?

1. The attack is to brute force the shared secret (password). This can be done offline because by capturing the exchange you have the ANonce and SNonce and all other information required to generate the same key -- except the shared secret. Try lots of passwords and check if you generate the same PTK as the two stations do.

2. Encrypted with what? This is the key exchange stage that is attacked here.

802.11w adds signing to management frames which eliminates the deauth attack -- makes it harder to capture the EAPOL frames. Also, IIRC, WPA2-enterprise would not be susceptible to this sort of attack; you've pre-shared a key rather than a (short) password for generating one.

edit: spelling