Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I cracked my neighbor's WiFi password without breaking a sweat

arstechnica.com

Post reply on HN
Print view View original

111–120 of 144 posts

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#111

Post by commandar »

lotharbot wrote: post #102
commandar wrote: post #100

Earlier quoted context omitted.

>From a human-memorable standpoint, that's no better than using an actually randomly generated passphrase. Are you seriously arguing that "The quick brown fox Jumps over the lazy dog!" is less human-memorable than "dlLejs$sAgkCnzklS%9sxckAAnvk"? Any variation from what a precomputed table expects renders the table useless. >It's no better from a computer-guessable standpoint, either. Besides the increased key space t…

> "Are you seriously arguing that "The quick brown fox Jumps over the lazy dog!" is less human-memorable than "dlLejs$sAgkCnzklS%9sxckAAnvk"?" I didn't say "password", I said "passphrase". Something like "breath red long provide" or "itself even willing establish". If you're using memorable movie quotes or Shakespeare quotes or anything else that you could find on wikiquote, your keyspace is going to be smaller than…

>It's counterproductive to start with a non-random phrase like a quote, and then try to add randomness on top of it.

The primary attack vector against WPA2 keys is via precomputed tables. If your concern is about your SSID+passphrase combination appearing in one of these tables, any variation whatsoever from the "canonical" version somebody might pull from, say, a database of quotes is negated and they're forced back to square one of a pure brute force attack which the increased key space makes more expensive.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#112

Post by samstave »

InclinedPlane wrote: post #71
Xurinos wrote: post #45

Earlier quoted context omitted.

One should change passwords on an irregular basis (a regular basis is weaker protection than an irregular basis). This is just an additional layer of security, not a perfection. If the password has ever been compromised, a password change policy removes the key from bad hands. Discovered passwords are not always immediately used; in many situations, they are stored for later use, perhaps even sold/traded.

How often do you rekey your house?

Just like in work, after every major relationship status change :)

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#113

Post by eric_bullington »

lotharbot wrote: post #102
commandar wrote: post #100

Earlier quoted context omitted.

>From a human-memorable standpoint, that's no better than using an actually randomly generated passphrase. Are you seriously arguing that "The quick brown fox Jumps over the lazy dog!" is less human-memorable than "dlLejs$sAgkCnzklS%9sxckAAnvk"? Any variation from what a precomputed table expects renders the table useless. >It's no better from a computer-guessable standpoint, either. Besides the increased key space t…

> "Are you seriously arguing that "The quick brown fox Jumps over the lazy dog!" is less human-memorable than "dlLejs$sAgkCnzklS%9sxckAAnvk"?" I didn't say "password", I said "passphrase". Something like "breath red long provide" or "itself even willing establish". If you're using memorable movie quotes or Shakespeare quotes or anything else that you could find on wikiquote, your keyspace is going to be smaller than…

Or if you're on Linux:

shuf -n4 /usr/share/dict/words | tr -d '\n'; echo

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#114

Post by stonefroot »

re: MAC spoofing

I don't use WiFi as a matter of practice, but I'm curious: What if you could keep all the "whitelisted" MAC's continually logged in to your network, or, at least, you could keep track of when they log out. The idea being that MAC spoofing is not possible if the particular MAC that the attacker wants to spoof is currently logged in. This is generally true with Ethernet, correct? Is this true with WiFi as well? (Assume the traffic is encrypted.)

And in fact, it seems this guy's hack relies on someone "rejoining" the network, triggered by a deauth frame. Without that "rejoining" step, I don't think he could get very far. If his target is continually connected, and there's no way to force a "rejoin", and all the traffic is encrypted, then what can he do? The problem to me sounds like the fact that someone can send a "deauth" frame and have it be accepted, and the Apple Mac gives no warnings that the connection underwent a "rejoin".

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#115

Post by ctdonath »

Dylan16807 wrote: post #101
ctdonath wrote: post #65

When addressing various physical home security issues, I came to the realization that if a trained team of attackers equipped with body armor and night vision broke into my home, the issue escalated beyond anything I could sensibly prepare for. The article reminded me of that. If someone attacks my home wifi with network sniffing hardware, sophisticated password guessing tools, hours of planning and execution, etc th…

>network sniffing hardware a large fraction of normal wifi devices that can be set into a proper receiving mode >sophisticated password guessing tools some password cracker they downloaded in minutes >hours of planning pressing a button or typing a couple commands >and execution taking a nap It's not hard to secure a network from extremely simple attacks. At least for now. And that analogy is nonsense. Body armor, ni…

The analogy is fine.

Walk into a well stocked military surplus store and you can walk out with all the tools you need to break into a house in short order, and trust me it doesn't take long to learn how to use them well enough.

The point is that once someone is determined enough to get into either your home or network, it doesn't take much to reach a stage where the owner has to go to great lengths to resist a very unlikely occurring, but very likely successful, attack.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#116

Post by olalonde »

> To his chagrin, it took CloudCracker just 89 minutes to crack the 10-character, all-numerical password he used, although because the passcode wasn't contained in the entry-level, 604 million-word list, I relied on a premium, 1.2 billion-word dictionary that costs $34 to use.

There are 10 billion (10^10) possible 10-character all-numerical passwords. Can anyone explain how it was cracked using a 1.2 billion-word dictionary?

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#117

Post by githulhu »

olalonde wrote: post #116

> To his chagrin, it took CloudCracker just 89 minutes to crack the 10-character, all-numerical password he used, although because the passcode wasn't contained in the entry-level, 604 million-word list, I relied on a premium, 1.2 billion-word dictionary that costs $34 to use. There are 10 billion (10^10) possible 10-character all-numerical passwords. Can anyone explain how it was cracked using a 1.2 billion-word dic…

Maybe they assume that a 10-number password is likely to be a phone number, and so constrain the three most significant numbers to just valid US area codes. Add in other rules, like the fourth digit never being a zero, etc...and the space is pared down quite a bit.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#118

Post by lotharbot »

commandar wrote: post #111
lotharbot wrote: post #102

Earlier quoted context omitted.

> "Are you seriously arguing that "The quick brown fox Jumps over the lazy dog!" is less human-memorable than "dlLejs$sAgkCnzklS%9sxckAAnvk"?" I didn't say "password", I said "passphrase". Something like "breath red long provide" or "itself even willing establish". If you're using memorable movie quotes or Shakespeare quotes or anything else that you could find on wikiquote, your keyspace is going to be smaller than…

>It's counterproductive to start with a non-random phrase like a quote, and then try to add randomness on top of it. The primary attack vector against WPA2 keys is via precomputed tables. If your concern is about your SSID+passphrase combination appearing in one of these tables, any variation whatsoever from the "canonical" version somebody might pull from, say, a database of quotes is negated and they're forced back…

The point I'm trying to make here is that you can negate that attack vector by just using an xkcd-style passphrase, which always works, and which is typically more memorable than a mangled quote.

The xkcd-style passphrase is simply better than ad-hoc solutions.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#119

Post by nl »

electromagnetic wrote: post #107
InclinedPlane wrote: post #71

Earlier quoted context omitted.

How often do you rekey your house?

I put a keylock on my window and tripwired a claymore to my door. Problem solved. Edit: In all seriousness, wouldn't it be logical to keep records of all IP addresses that attempt/login to the system. If you frequently see attempts made from one IP address, or IP group (ISP block) then simply prevent them accessing the login. Further, for Wifi, wouldn't it be logical to record the MAC codes of computers trying to acc…

In all seriousness, wouldn't it be logical to keep records of all IP addresses that attempt/login to the system.

If you mean specific to WiFi, then no, it wouldn't be logical - often the WiFi access point acts as a DHCP server and assigns an IP. If you mean more broadly, then yes it would - see [1].

Further, for Wifi, wouldn't it be logical to record the MAC codes of computers trying to access the network and if one you don't recognize is frequently trying to access the system, simply block it

No, MAC addresses are trivially spoofable (as you note), and in some cases I believe this spoofing is automated. MAC blocking isn't a real security feature at all.

[1] http://www.fail2ban.org/wiki/index.php/Main_Page

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#120

Post by SiVal »

sciurus wrote: post #84
SiVal wrote: post #73

Earlier quoted context omitted.

I'm no security expert, but after I saw each new wifi password standard cracked within days of its release, I stopped passwording my wifi and used a little script I put on a home linux server to watch the router and if it spotted any unrecognized MAC addresses getting an IP address from DHCP, it would throw them out within a few seconds. These days, I just turn on the MAC address filter that's built in to most wifi b…

A few thoughts * WPA2 hasn't been 'cracked' * Without 'passwording', all your traffic is unencrypted and can be trivially sniffed * Spoofing one of your whitelisted MAC addresses in order to use your network is easy

First: thanks to ALL of you who answered. This was very informative. If I understand correctly:

1) I would define something as "not cracked" if it is as strong as its password--in other words, there's no way to circumvent it that isn't a general vulnerability (peek through my window, get a keylogger on my machine, etc.) I assume you're telling me that this is the case with WPA2.

2) It sounds as though you are saying that something like WPA2 doesn't just authenticate a login but remains in use as an encryption key for subsequent wireless data interchange between client and base station. If I'm understanding correctly, that's a powerful point.

3) I knew that MAC addresses could be spoofed, but I was thinking they wouldn't know WHICH MAC address to pretend to have. Of course, if I'd been a little smarter, I would have noticed that my own linux process was using the MAC address a client claimed to have to throw out unrecognized machines (before I had MAC address filtering as a built-in router feature). If they were sending their MAC address to me, then my own client machine would be sending its MAC address in clear text to them, telling them which MAC address to pretend to have. Duh.

Well, I feel a little dumber and a little smarter. Time to go change my network. Thanks again.

Post reply on HN