Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I cracked my neighbor's WiFi password without breaking a sweat

arstechnica.com

Post reply on HN
Print view View original

101–110 of 144 posts

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#101

Post by Dylan16807 »

ctdonath wrote: post #65

When addressing various physical home security issues, I came to the realization that if a trained team of attackers equipped with body armor and night vision broke into my home, the issue escalated beyond anything I could sensibly prepare for. The article reminded me of that. If someone attacks my home wifi with network sniffing hardware, sophisticated password guessing tools, hours of planning and execution, etc th…

>network sniffing hardware

a large fraction of normal wifi devices that can be set into a proper receiving mode

>sophisticated password guessing tools

some password cracker they downloaded in minutes

>hours of planning

pressing a button or typing a couple commands

>and execution

taking a nap

It's not hard to secure a network from extremely simple attacks. At least for now.

And that analogy is nonsense. Body armor, night vision, combat training don't help them break into a house. At best it'll get them past the armed guards you don't even have.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#102

Post by lotharbot »

commandar wrote: post #100
lotharbot wrote: post #97

Earlier quoted context omitted.

> "variations in punctuation, capitalization, spacing" ... have the same problem as a random string of characters. You have to remember which letter it was you capitalized, where you put the semicolon in place of the comma, and so on. From a human-memorable standpoint, that's no better than using an actually randomly generated passphrase. It's no better from a computer-guessable standpoint, either. So instead of tryi…

>From a human-memorable standpoint, that's no better than using an actually randomly generated passphrase. Are you seriously arguing that "The quick brown fox Jumps over the lazy dog!" is less human-memorable than "dlLejs$sAgkCnzklS%9sxckAAnvk"? Any variation from what a precomputed table expects renders the table useless. >It's no better from a computer-guessable standpoint, either. Besides the increased key space t…

> "Are you seriously arguing that "The quick brown fox Jumps over the lazy dog!" is less human-memorable than "dlLejs$sAgkCnzklS%9sxckAAnvk"?"

I didn't say "password", I said "passphrase". Something like "breath red long provide" or "itself even willing establish".

If you're using memorable movie quotes or Shakespeare quotes or anything else that you could find on wikiquote, your keyspace is going to be smaller than what you get from stringing 4 random words together. You can try to grow that keyspace by adding in variations, each of which will get you a few bits of entropy, but those variations come at the cost of memorability.

It's counterproductive to start with a non-random phrase like a quote, and then try to add randomness on top of it. If you want both entropy and memorability, use a randomly generated passphrase (via http://passphra.se or by using dice and a dictionary) instead of piecemeal randomness-on-top-of-non-random-quotes strategies.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#103

Post by DrCatbox »

SiVal wrote: post #73
brigade wrote: post #68

Earlier quoted context omitted.

A physical assault carries a high chance of being noticed, and unless carried out by law enforcement, a significant chance of being punished with jail time. So it's not something that has a high chance of happening. Additionally, it's hard to defend against, and you definitely don't want to defend against a SWAT team. Whereas a bored teenage neighbor could attack your wireless network with a very small chance of bein…

I'm no security expert, but after I saw each new wifi password standard cracked within days of its release, I stopped passwording my wifi and used a little script I put on a home linux server to watch the router and if it spotted any unrecognized MAC addresses getting an IP address from DHCP, it would throw them out within a few seconds. These days, I just turn on the MAC address filter that's built in to most wifi b…

This approach is very easy to bypass by any knowledgable hacker.

Since you said your WiFi is open, the only thing that needs to be done is fire up the aircrack-ng airdump and sniff, there I would see your MAC, in the clear. Then I could set my own to it or select any other mac I have seen connecting to for a longer while ,and use it and access your router and add my other mac on its whitelist.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#104

Post by andreasvc »

SiVal wrote: post #73
brigade wrote: post #68

Earlier quoted context omitted.

A physical assault carries a high chance of being noticed, and unless carried out by law enforcement, a significant chance of being punished with jail time. So it's not something that has a high chance of happening. Additionally, it's hard to defend against, and you definitely don't want to defend against a SWAT team. Whereas a bored teenage neighbor could attack your wireless network with a very small chance of bein…

I'm no security expert, but after I saw each new wifi password standard cracked within days of its release, I stopped passwording my wifi and used a little script I put on a home linux server to watch the router and if it spotted any unrecognized MAC addresses getting an IP address from DHCP, it would throw them out within a few seconds. These days, I just turn on the MAC address filter that's built in to most wifi b…

This provides no security at all. A good solution would be to use a VPN like OpenVPN; i.e., you treat the wifi as an insecure channel just as the internet, and only after connecting to the VPN you would be able to get to the internal network and the uplink.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#105

Post by BenOfTomorrow »

lotharbot wrote: post #97
commandar wrote: post #85

Earlier quoted context omitted.

WPA2 keys hash the passphrase and the SSID. The precomputed tables that make cracking WPA2 feasible have to not only target passwords, but password+SSID combinations as a result. I think you're grossly overstating the relative weakness of a longer passphrase. The more obscure, the better, obviously, but the chances of any given quote or phrase of any length appearing in a precomputed table are relatively minimal. Mor…

> "variations in punctuation, capitalization, spacing" ... have the same problem as a random string of characters. You have to remember which letter it was you capitalized, where you put the semicolon in place of the comma, and so on. From a human-memorable standpoint, that's no better than using an actually randomly generated passphrase. It's no better from a computer-guessable standpoint, either. So instead of tryi…

> From a human-memorable standpoint

Not to derail your point, but who needs their WiFi password to human-memorable? Tape it to the bottom of the router like the rest of us.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#106

Post by alttag »

InclinedPlane wrote: post #71
Xurinos wrote: post #45

Earlier quoted context omitted.

One should change passwords on an irregular basis (a regular basis is weaker protection than an irregular basis). This is just an additional layer of security, not a perfection. If the password has ever been compromised, a password change policy removes the key from bad hands. Discovered passwords are not always immediately used; in many situations, they are stored for later use, perhaps even sold/traded.

How often do you rekey your house?

Every time I move.

Your point is well taken, though.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#107

Post by electromagnetic »

InclinedPlane wrote: post #71
Xurinos wrote: post #45

Earlier quoted context omitted.

One should change passwords on an irregular basis (a regular basis is weaker protection than an irregular basis). This is just an additional layer of security, not a perfection. If the password has ever been compromised, a password change policy removes the key from bad hands. Discovered passwords are not always immediately used; in many situations, they are stored for later use, perhaps even sold/traded.

How often do you rekey your house?

I put a keylock on my window and tripwired a claymore to my door. Problem solved.

Edit: In all seriousness, wouldn't it be logical to keep records of all IP addresses that attempt/login to the system. If you frequently see attempts made from one IP address, or IP group (ISP block) then simply prevent them accessing the login.

Further, for Wifi, wouldn't it be logical to record the MAC codes of computers trying to access the network and if one you don't recognize is frequently trying to access the system, simply block it.

It's not foolproof. Actually it probably is. It's not true security against a determined person (proxies and MAC spoofing), but then a good password protects you against fools and often not skilled individuals. A key logger on an insecure computer clearly trumps any password.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#108

Post by thezilch »

scott_s wrote: post #33

No doubt, this neighbor should have changed his password long ago, but there is a lot to admire about his security hygiene nonetheless. I think it's taken too much for granted that one should change passwords on a regular basis. If we assume that changing passwords more frequently means that we are more likely to use more rememberable - and, thus, more guessable - passwords, then perhaps this is not a fluke. Perhaps…

If using a significantly good password, from the beginning, it is pretty unlikely that anyone would go through the trouble or have the opportunity to watch you enter your password. To me, it only makes sense to change a WiFi password for the following reasons:

a) you care if people are using your network, or you do not simply keep track or whitelist-only of machines that have negotiated with your router

b) you use a short -- "crackable" -- password

c) someone can peer into rooms were they might spy on you entering your WiFi password

d) (c) happens enough that they can make out the whole password

For typical passwords -- desktops, laptops, email, etc -- it makes sense to change passwords (and use a password manager), but only for those things that really matter. Otherwise, there is probably not a lot of undo-able harm that can come of someone having access to your account(s) on .

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#109

Post by thezilch »

Xurinos wrote: post #45
scott_s wrote: post #33

No doubt, this neighbor should have changed his password long ago, but there is a lot to admire about his security hygiene nonetheless. I think it's taken too much for granted that one should change passwords on a regular basis. If we assume that changing passwords more frequently means that we are more likely to use more rememberable - and, thus, more guessable - passwords, then perhaps this is not a fluke. Perhaps…

One should change passwords on an irregular basis (a regular basis is weaker protection than an irregular basis). This is just an additional layer of security, not a perfection. If the password has ever been compromised, a password change policy removes the key from bad hands. Discovered passwords are not always immediately used; in many situations, they are stored for later use, perhaps even sold/traded.

If we are talking about system passwords (router or otherwise), there's a good chance you'll just be left with something malicious (ex. key logger) that is going to render null your irregular change of passwords. Regardless, irregular updates is just another form of security by obscurity. What if your password is cracked at the beginning of an irregular cycle?

The only reason one should have to change their password is if it is significantly weak -- "crackable" -- or they enter it manually -- it is visible -- in front of others a significant number of times for them to "record" the strokes. Good password managers, more or less, solve both cases.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#110

Post by Jare »

commandar wrote: post #54
ryanmolden wrote: post #6

>What's more, WPA and WPA2 passwords require a minimum of eight characters, eliminating the possibility users will pick shorter passphrases that could be brute forced in more manageable timeframes Should I point out that 'password' is 8 characters :) Have there been studies done that attempt to test the hypothesis that when forced to pick passwords that meet some arbitrary complexity threshold most common users pick…

One of the things I try very hard to drive home to people is that WPA2 uses a pass phrase and not a password. I highly encourage people to use something like a favorite movie quote or a line from a book. Something like "Alas, poor Yorick! I knew him Horatio;" is both harder to crack and easier for a human to remember than something like "v3$bk:j". You're essentially taking natural language, which is something humans…

Obligatory xkcd: http://xkcd.com/936/
Post reply on HN