Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I cracked my neighbor's WiFi password without breaking a sweat

arstechnica.com

Post reply on HN
Print view View original

91–100 of 144 posts

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#91

Post by rcxdude »

archon wrote: post #74
SiVal wrote: post #73

Earlier quoted context omitted.

I'm no security expert, but after I saw each new wifi password standard cracked within days of its release, I stopped passwording my wifi and used a little script I put on a home linux server to watch the router and if it spotted any unrecognized MAC addresses getting an IP address from DHCP, it would throw them out within a few seconds. These days, I just turn on the MAC address filter that's built in to most wifi b…

I'm chagrined to admit that this simple approach didn't even occur to me. I'm interested as well; are there any disadvantages to this?

It's a terrible way to secure a network. MAC addresses are easily spoofed, and without encryption anyone can sniff your traffic anyway. Even using WEP is better since then there's (usually) a requirement to see a connected client for longer than a few seconds in order to break the encryption. The only reasonable approach for a home network imo in practice is WPA2 PSK with a decent password.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#92

Post by soperj »

gjulianm wrote: post #36
nickpresta wrote: post #30

So what do I run now instead of Kismac, since it doesn't support anything > 10.7.2? Aircrack with some GUI frontend?

A Linux distro. Don't get me wrong, this isn't an anti-apple rant: I've myself tried to my Macbook laptop to learn aircrack and finally desisted. The most important tools, airodump and aireplay, don't work in Mac, even if you have an injection-capable card. Your best option is try with Linux either in your Mac (I think Backtrack has a Live CD so you don't have to install anything) or in a non-Apple PC.

Or just use a virtual machine instead of running off the live cd.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#93

Post by rcxdude »

nollidge wrote: post #82
EvilTerran wrote: post #75

Earlier quoted context omitted.

Someone's said in the Ars Technica comments that MAC addresses are freely available in the packets-in-flight, and MACs are spoofable, so MAC filtering will only deter the casual, passing wifi-borrower, not anyone actually determined to gain access.

> MAC filtering will only deter the casual, passing wifi-borrower, not anyone actually determined to gain access. Isn't that true of WPA and WPA2 though also?

WPA2 is as strong as the password used on it, so it can easily be strong enough to deter any attacker from that perspective.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#94

Post by debacle »

X-Istence wrote: post #89

That is why a passphrase is so important. No longer it is a dictionary word, now it is multiple dictionary words together.

Was it correct battery horse staple or battery horse correct staple?

I use passphrases almost exclusively. The key is picking words at random - phrases are easy to guess, though sometimes I pick them because, to me, they're easy to remember.

"Areyouopposingshadowmoon?" is an incredibly secure password, and it's very likely that no one would ever 'guess' that phrase, but it's also highly easy to remember (because 1997 engrained it into my head).

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#95

Post by tedunangst »

SiVal wrote: post #73
brigade wrote: post #68

Earlier quoted context omitted.

A physical assault carries a high chance of being noticed, and unless carried out by law enforcement, a significant chance of being punished with jail time. So it's not something that has a high chance of happening. Additionally, it's hard to defend against, and you definitely don't want to defend against a SWAT team. Whereas a bored teenage neighbor could attack your wireless network with a very small chance of bein…

I'm no security expert, but after I saw each new wifi password standard cracked within days of its release, I stopped passwording my wifi and used a little script I put on a home linux server to watch the router and if it spotted any unrecognized MAC addresses getting an IP address from DHCP, it would throw them out within a few seconds. These days, I just turn on the MAC address filter that's built in to most wifi b…

This works great until someone comes along and spoofs the MAC address of your base station. Then the real fun begins.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#96

Post by ghayes »

commandar wrote: post #85
lotharbot wrote: post #76

Earlier quoted context omitted.

The problem with movie quotes and lines from books is that they're out there in a database somewhere. That means they're not nearly as hard for a computer to guess as you might think.

WPA2 keys hash the passphrase and the SSID. The precomputed tables that make cracking WPA2 feasible have to not only target passwords, but password+SSID combinations as a result. I think you're grossly overstating the relative weakness of a longer passphrase. The more obscure, the better, obviously, but the chances of any given quote or phrase of any length appearing in a precomputed table are relatively minimal. Mor…

> More importantly, any variations in punctuation, capitalization, spacing

Alternatively, exact spacing, punctuation, etc. limits the human advantage of remembering phrases ("Wait, was that a capital A before the comma? Do you use two spaces between the sentences?").

This is the exact reason I've had a hard time with long pass-phrases and often generate a unique string and rely on physical protection.

It's worth noting that if we stripped whitespaces (and possibly some other common "could go both ways" features), we may be able to encourage people to choose higher entropy passwords.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#97

Post by lotharbot »

commandar wrote: post #85
lotharbot wrote: post #76

Earlier quoted context omitted.

The problem with movie quotes and lines from books is that they're out there in a database somewhere. That means they're not nearly as hard for a computer to guess as you might think.

WPA2 keys hash the passphrase and the SSID. The precomputed tables that make cracking WPA2 feasible have to not only target passwords, but password+SSID combinations as a result. I think you're grossly overstating the relative weakness of a longer passphrase. The more obscure, the better, obviously, but the chances of any given quote or phrase of any length appearing in a precomputed table are relatively minimal. Mor…

> "variations in punctuation, capitalization, spacing"

... have the same problem as a random string of characters. You have to remember which letter it was you capitalized, where you put the semicolon in place of the comma, and so on.

From a human-memorable standpoint, that's no better than using an actually randomly generated passphrase. It's no better from a computer-guessable standpoint, either. So instead of trying to create a new scheme for generating passwords like "mangle a movie quote", you're better off just using the xkcd method / passphra.se

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#98

Post by commandar »

ghayes wrote: post #96
commandar wrote: post #85

Earlier quoted context omitted.

WPA2 keys hash the passphrase and the SSID. The precomputed tables that make cracking WPA2 feasible have to not only target passwords, but password+SSID combinations as a result. I think you're grossly overstating the relative weakness of a longer passphrase. The more obscure, the better, obviously, but the chances of any given quote or phrase of any length appearing in a precomputed table are relatively minimal. Mor…

> More importantly, any variations in punctuation, capitalization, spacing Alternatively, exact spacing, punctuation, etc. limits the human advantage of remembering phrases ("Wait, was that a capital A before the comma? Do you use two spaces between the sentences?"). This is the exact reason I've had a hard time with long pass-phrases and often generate a unique string and rely on physical protection. It's worth noti…

>Alternatively, exact spacing, punctuation, etc. limits the human advantage of remembering phrases ("Wait, was that a capital A before the comma? Do you use two spaces between the sentences?").

Then append a random character at the end.

The point is that any variation whatsoever from what's included in the precomputed table renders the table useless while being easier to remember than a purely random string of characters.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#99

Post by EvilTerran »

nollidge wrote: post #82
EvilTerran wrote: post #75

Earlier quoted context omitted.

Someone's said in the Ars Technica comments that MAC addresses are freely available in the packets-in-flight, and MACs are spoofable, so MAC filtering will only deter the casual, passing wifi-borrower, not anyone actually determined to gain access.

> MAC filtering will only deter the casual, passing wifi-borrower, not anyone actually determined to gain access. Isn't that true of WPA and WPA2 though also?

WPA2 with good password, at least, would put up a non-negligable barrier in terms of the number crunching required; in contrast, getting around MAC filtering would take effectively no time at all.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#100

Post by commandar »

lotharbot wrote: post #97
commandar wrote: post #85

Earlier quoted context omitted.

WPA2 keys hash the passphrase and the SSID. The precomputed tables that make cracking WPA2 feasible have to not only target passwords, but password+SSID combinations as a result. I think you're grossly overstating the relative weakness of a longer passphrase. The more obscure, the better, obviously, but the chances of any given quote or phrase of any length appearing in a precomputed table are relatively minimal. Mor…

> "variations in punctuation, capitalization, spacing" ... have the same problem as a random string of characters. You have to remember which letter it was you capitalized, where you put the semicolon in place of the comma, and so on. From a human-memorable standpoint, that's no better than using an actually randomly generated passphrase. It's no better from a computer-guessable standpoint, either. So instead of tryi…

>From a human-memorable standpoint, that's no better than using an actually randomly generated passphrase.

Are you seriously arguing that "The quick brown fox Jumps over the lazy dog!" is less human-memorable than "dlLejs$sAgkCnzklS%9sxckAAnvk"?

Any variation from what a precomputed table expects renders the table useless.

>It's no better from a computer-guessable standpoint, either.

Besides the increased key space that has to be attacked?

Post reply on HN