How I cracked my neighbor's WiFi password without breaking a sweat • Hacker News Board

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#121

Post by X-Istence » Wed, Aug 29, 2012, 4:04 AM UTC

debacle wrote: post #94

X-Istence wrote: post #89

That is why a passphrase is so important. No longer it is a dictionary word, now it is multiple dictionary words together.

Was it correct battery horse staple or battery horse correct staple? I use passphrases almost exclusively. The key is picking words at random - phrases are easy to guess, though sometimes I pick them because, to me, they're easy to remember. "Areyouopposingshadowmoon?" is an incredibly secure password, and it's very likely that no one would ever 'guess' that phrase, but it's also highly easy to remember (because 1997…

I use things I remember from movies/books. Stuff that has always stuck in my head to the point that there is no way for me to forget it.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#122

Post by commandar » Wed, Aug 29, 2012, 4:31 AM UTC

lotharbot wrote: post #118

commandar wrote: post #111

Earlier quoted context omitted.

>It's counterproductive to start with a non-random phrase like a quote, and then try to add randomness on top of it. The primary attack vector against WPA2 keys is via precomputed tables. If your concern is about your SSID+passphrase combination appearing in one of these tables, any variation whatsoever from the "canonical" version somebody might pull from, say, a database of quotes is negated and they're forced back…

The point I'm trying to make here is that you can negate that attack vector by just using an xkcd-style passphrase , which always works, and which is typically more memorable than a mangled quote. The xkcd-style passphrase is simply better than ad-hoc solutions.

The thing is, your entire line of argument is predicated on the quote approach being vulnerable to a dictionary-style attack. In order for that to be the case, both the SSID and the exact quotation used have to match, otherwise the attacker is forced back into expensive brute force attacks. Any unique element, whether intentional or not, renders that vulnerability null.

The xkcd approach certainly works, but the arbitrary, random nature of it is going to make it difficult for some people to remember. The quotation approach is just leveraging the fact that people spend their entire lives using language as a logical framework to simplify remembering things.

Either is going to be vastly more secure than a random string of characters.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#123

Post by commandar » Wed, Aug 29, 2012, 4:36 AM UTC

nollidge wrote: post #82

EvilTerran wrote: post #75

Earlier quoted context omitted.

Someone's said in the Ars Technica comments that MAC addresses are freely available in the packets-in-flight, and MACs are spoofable, so MAC filtering will only deter the casual, passing wifi-borrower, not anyone actually determined to gain access.

> MAC filtering will only deter the casual, passing wifi-borrower, not anyone actually determined to gain access. Isn't that true of WPA and WPA2 though also?

The only in-the-wild attacks against WPA2 are variations of brute-force attacks.

There are precomputed rainbow tables of common SSID+passphrase combinations floating around, but as a general rule, WPA2 with a sufficiently complex passphrase should be secure against anyone who doesn't have a massive compute cluster at their disposal.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#124

Post by lotharbot » Wed, Aug 29, 2012, 5:19 AM UTC

commandar wrote: post #122

lotharbot wrote: post #118

Earlier quoted context omitted.

The point I'm trying to make here is that you can negate that attack vector by just using an xkcd-style passphrase , which always works, and which is typically more memorable than a mangled quote. The xkcd-style passphrase is simply better than ad-hoc solutions.

The thing is, your entire line of argument is predicated on the quote approach being vulnerable to a dictionary-style attack. In order for that to be the case, both the SSID and the exact quotation used have to match, otherwise the attacker is forced back into expensive brute force attacks. Any unique element, whether intentional or not, renders that vulnerability null. The xkcd approach certainly works, but the arbi…

My line of argument is more complex than you give it credit for. It has 3 major components:

- if you do not include "unique elements" (that is, you quote straight from wikiquote or similar), a quote is less secure than 4 random dictionary words due to being subject to wikiquote-driven dictionary-style attacks.

- if you include intentional and unique modifications, a quote from a public work like a movie or play is not particularly easier to remember than something from passphra.se or similar. Once you have to remember what you spelled/capitalized/punctuated in a nonstandard way, what have you really gained?

- if you include unintentionally unique elements (a word you always misspell), or elements that aren't really unique (you always append the same character), then your passphrase is vulnerable to a dictionary-like attack by an attacker who has some knowledge of you, particularly one who you've told your scheme to.

The key to the xkcd-style passphrase is that it remains secure even against an attacker who knows how you generated it, and who knows your personal tendencies. It's a completely universal, memorable, secure scheme.

Movie quotes are secure and memorable enough the majority of the time -- vastly more secure than using your kid's name, vastly more memorable than a string of random characters. But it seems to me like you're advocating a second-best security practice when we already have a best one.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#125

Post by delackner » Wed, Aug 29, 2012, 5:36 AM UTC

jdthomas wrote: post #80

mgualt wrote: post #44

A couple of naive questions about the design of the security system: 1. Why is it possible to do the password tests remotely? Why would the key on the router be allowed to be transmitted? Even a 6 character password should be safe if you don't allow multiple tries. 2. Why isn't the handshake protocol encrypted?

1. The attack is to brute force the shared secret (password). This can be done offline because by capturing the exchange you have the ANonce and SNonce and all other information required to generate the same key -- except the shared secret. Try lots of passwords and check if you generate the same PTK as the two stations do. 2. Encrypted with what? This is the key exchange stage that is attacked here. 802.11w adds sig…

Honest question: since all devices connecting to a WIFI network are by definition within a short distance of the router itself, is there a WIFI solution that uses pre-shared key cryptography? That seems to me to be the only truly unbreakable option.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#126

Post by Dove » Wed, Aug 29, 2012, 6:01 AM UTC

commandar wrote: post #122

lotharbot wrote: post #118

Earlier quoted context omitted.

The point I'm trying to make here is that you can negate that attack vector by just using an xkcd-style passphrase , which always works, and which is typically more memorable than a mangled quote. The xkcd-style passphrase is simply better than ad-hoc solutions.

The thing is, your entire line of argument is predicated on the quote approach being vulnerable to a dictionary-style attack. In order for that to be the case, both the SSID and the exact quotation used have to match, otherwise the attacker is forced back into expensive brute force attacks. Any unique element, whether intentional or not, renders that vulnerability null. The xkcd approach certainly works, but the arbi…

My understanding is that when people build password-cracking dictionaries, they include common permutations in the script. That is, for the dictionary word "dolphin", the script puts in "Dolphin" and "d0lph1n" and so forth. I'd be very surprised if someone building a table based on common quotations didn't do the same thing. I mean, how many memorable punctuation-mangling strategies are there on a common phrase anyway? I can only think of a few, right off; they're probably the ones most other people would think of, too.

There is a very serious tendency to overestimate how clever and creative you can be in the 90 seconds you spend thinking about a password. Odds are, the "random" thing you're doing is the same random thing that a lot of other people are doing. And it's in someone's script somewhere.

If you roll dice, instead of trusting your brain to be clever, you know what you have is random and hence secure.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#127

Post by hef19898 » Wed, Aug 29, 2012, 6:31 AM UTC

ctdonath wrote: post #115

Dylan16807 wrote: post #101

Earlier quoted context omitted.

>network sniffing hardware a large fraction of normal wifi devices that can be set into a proper receiving mode >sophisticated password guessing tools some password cracker they downloaded in minutes >hours of planning pressing a button or typing a couple commands >and execution taking a nap It's not hard to secure a network from extremely simple attacks. At least for now. And that analogy is nonsense. Body armor, ni…

The analogy is fine. Walk into a well stocked military surplus store and you can walk out with all the tools you need to break into a house in short order, and trust me it doesn't take long to learn how to use them well enough. The point is that once someone is determined enough to get into either your home or network, it doesn't take much to reach a stage where the owner has to go to great lengths to resist a very u…

Like locks at doors, only meant to desuade the random amateur. Given enough dedtermination, preparation, tools and skills one can enter anything.

But since I'm not the Pentagon I don't live in nuclear bunkers and don't employ regiments of cybersecurity people. I uess the risk of being cracked by pros is just part of the normal risk of live.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#128

Post by Pfiffer » Wed, Aug 29, 2012, 7:34 AM UTC

SiVal wrote: post #120

sciurus wrote: post #84

Earlier quoted context omitted.

A few thoughts * WPA2 hasn't been 'cracked' * Without 'passwording', all your traffic is unencrypted and can be trivially sniffed * Spoofing one of your whitelisted MAC addresses in order to use your network is easy

First: thanks to ALL of you who answered. This was very informative. If I understand correctly: 1) I would define something as "not cracked" if it is as strong as its password--in other words, there's no way to circumvent it that isn't a general vulnerability (peek through my window, get a keylogger on my machine, etc.) I assume you're telling me that this is the case with WPA2. 2) It sounds as though you are saying…

It is also trivial to see which MAC addresses are associated with which APs.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#129

Post by commandar » Wed, Aug 29, 2012, 7:49 AM UTC

lotharbot wrote: post #124

commandar wrote: post #122

Earlier quoted context omitted.

The thing is, your entire line of argument is predicated on the quote approach being vulnerable to a dictionary-style attack. In order for that to be the case, both the SSID and the exact quotation used have to match, otherwise the attacker is forced back into expensive brute force attacks. Any unique element, whether intentional or not, renders that vulnerability null. The xkcd approach certainly works, but the arbi…

My line of argument is more complex than you give it credit for. It has 3 major components: - if you do not include "unique elements" (that is, you quote straight from wikiquote or similar), a quote is less secure than 4 random dictionary words due to being subject to wikiquote-driven dictionary-style attacks. - if you include intentional and unique modifications, a quote from a public work like a movie or play is no…

>then your passphrase is vulnerable to a dictionary-like attack by an attacker who has some knowledge of you, particularly one who you've told your scheme to.

That's the thing right there: the difference in practical vulnerability all but requires an attacker to have a certain level of omniscience and access to a massive database of any conceivable permutation of any fragment you might choose of a huge number of works.

>But it seems to me like you're advocating a second-best security practice when we already have a best one.

I'm advocating what can be efficiently communicated to a non-technical user that gets them to use something better than the short keys they'll tend to use otherwise.

What's more likely to stick with a 40 year old office coworker that asks how to secure their wireless network? A scheme that seems nonsensical on surface that requires a comic and basic grasp of what a keyspace is to understand, or the suggestion to "use a sentence from something you like that you'll easily remember?"

Either one is going to stop all but the most determined of attackers. I don't see the point in confusing the issue for them.

Re: How I cracked my neighbor's WiFi password without breaking a sweat

#130

Post by commandar » Wed, Aug 29, 2012, 7:58 AM UTC

Dove wrote: post #126

commandar wrote: post #122

Earlier quoted context omitted.

The thing is, your entire line of argument is predicated on the quote approach being vulnerable to a dictionary-style attack. In order for that to be the case, both the SSID and the exact quotation used have to match, otherwise the attacker is forced back into expensive brute force attacks. Any unique element, whether intentional or not, renders that vulnerability null. The xkcd approach certainly works, but the arbi…

My understanding is that when people build password-cracking dictionaries, they include common permutations in the script. That is, for the dictionary word "dolphin", the script puts in "Dolphin" and "d0lph1n" and so forth. I'd be very surprised if someone building a table based on common quotations didn't do the same thing. I mean, how many memorable punctuation-mangling strategies are there on a common phrase anywa…

>I mean, how many memorable punctuation-mangling strategies are there on a common phrase anyway?

How do you define common? The person has the entirety of literature, movies, music, etc to draw from. They might select any given fragment of a work, and the attacker has no way of knowing where the fragment begins or ends.

Is a purely random key strictly more secure? Sure.

But my goal isn't to get the purest possible level of security; it's to get normal people to use something more complex than the 8-14 character passwords they generally use now. I'm certainly not claiming it's perfect, but it's a simple to understand scheme that most non-technical users will be able to understand and use that will protect them from all but the most dedicated of attackers.