Wifiphisher: Fast automated phishing attacks against WPA networks • Hacker News Board

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#21

Post by pyre » Sun, Jan 04, 2015, 5:26 PM UTC

eliben wrote: post #19

Neat idea, but why can't it spoof the Wifi authentication page/popup? Can't it dress up as a new device and try to connect to the wifi network, and then see what kinds of authentication page is returned by the router? Then just copy that.

Without the password, it can't quite MitM yet. It presumably makes sure that they user connects to it because it doesn't have WEP/WPA enabled, so the client OS automatically connects to the AP with the same name, but doesn't warn the user that WPA is no longer enabled. It can't spoof the WPA connection because it doesn't have the password yet.

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#22

Post by gipsies » Sun, Jan 04, 2015, 5:29 PM UTC

This is misleading. When using WPA the client and access point perform mutual authentication. This means that if you don't know the password, you cannot set up a rogue access point that "copies the target access point's settings". Because you don't know the password! And if you'd use a random password, the client will refuse to connect to the rogue AP.

The tool is actually creating a second, unencrypted network. On Windows it will give you a warning that the configuration of the network has changed. On Android you'd have to manually reconnect to the unencrypted network. So their method doesn't automatically perform a man-in-the-middle attack. A decent setup will warn you about this. Sure, if a user ignores all OS warnings, connects to an unencrypted network anyway, and feels the need to type his password in random fields s/he never saw before, then this will work [3].

What would be more interesting is to jam the target network, using an actual jammer [1], and then perform a KARMA man-in-the-middle attack [2]. The idea is to listen for probe requests to unencrypted networks, and then clone that unencrypted network. In this case the user would automatically connect, making the attack more likely to succeed...

[1] http://people.cs.kuleuven.be/~mathy.vanhoef/papers/acsac2014...

[2] http://www.theta44.org/karma/

[3] Perhaps I'm a bit cynical, but I suppose it might actually work some of the time... :(

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#23

Post by maxerickson » Sun, Jan 04, 2015, 5:32 PM UTC

urbannomad wrote: post #20

Scarbutt wrote: post #16

A bit off-topic - I have noticed that python is used way more on the hacker/security community than other scripting langs (Perl,Ruby), anyone know why?

From what I know, python is usually the first language that newbies get pointed to when they ask where to start. It's easy to read, understand, and has a ton of libraries. Plus python is older, and I think gained more popularity than ruby (before rails came along).

They are about the same age, Python was more popular in the US/Europe prior to Rails catching on (which I guess contributes to it still being more used outside of web dev).

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#24

Post by gipsies » Sun, Jan 04, 2015, 5:35 PM UTC

drinkyouroj wrote: post #13

ikeboy wrote: post #7

This looks really cool. However, when I first read the words "social engineering", I expected it to create another access point encrypted the same way , and get the code direct from the victim. This way seems less fool-proof. Is my suggestion at all possible, or is the code transmitted while connecting useless unless you already have it? (Well it's not useless , as it can be brute-forced by aircrack-ng locally. I'm w…

Your method sounds to me like a pretty standard PSK crack: deauth client, collect auth handshake, repeat until you have enough packets to crack the passphrase. But collecting enough packets to crack the PSK becomes more difficult as the number of clients disconnecting/reconnecting goes down and the complexity of the PSK goes up. If you're trying to connect to a home AP with a halfway-decent passphrase, it can take da…

A bruteforce attack against the PSK handshake requires only a single handshake to be captured. There are no known techniques to speed up the attack if more handshakes are captured.

Man-in-the-middle attacks against WPA are not trivial at all. The client and access point perform mutual authentication. If you don't know the password, you can't put up an identical rogue access point. The passphrase is never explicitly included in the handshake, only in "protected" forms (in challenge/response messages).

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#25

Post by ikeboy » Sun, Jan 04, 2015, 5:45 PM UTC

ytjohn wrote: post #10

ikeboy wrote: post #7

This looks really cool. However, when I first read the words "social engineering", I expected it to create another access point encrypted the same way , and get the code direct from the victim. This way seems less fool-proof. Is my suggestion at all possible, or is the code transmitted while connecting useless unless you already have it? (Well it's not useless , as it can be brute-forced by aircrack-ng locally. I'm w…

The code is never trasnmitted. The data is encrypted with the code and only the code on the other side can be used to decrypt it. Most brute-force systems work by capturing packets to hard drive and then attempting to decrypt them offline. Or you can upload your captures to the cloud: https://www.cloudcracker.com/

Would this work against WEP? Or is the standard capture and crack better?

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#26

Post by vletmixutechre » Sun, Jan 04, 2015, 5:46 PM UTC

gipsies wrote: post #22

This is misleading. When using WPA the client and access point perform mutual authentication. This means that if you don't know the password, you cannot set up a rogue access point that "copies the target access point's settings". Because you don't know the password! And if you'd use a random password, the client will refuse to connect to the rogue AP. The tool is actually creating a second, unencrypted network. On W…

I suspect many average end-users will click 'whatever' in order to try to make things work again.

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#27

Post by thefreeman » Sun, Jan 04, 2015, 6:11 PM UTC

ikeboy wrote: post #25

ytjohn wrote: post #10

Earlier quoted context omitted.

The code is never trasnmitted. The data is encrypted with the code and only the code on the other side can be used to decrypt it. Most brute-force systems work by capturing packets to hard drive and then attempting to decrypt them offline. Or you can upload your captures to the cloud: https://www.cloudcracker.com/

Would this work against WEP? Or is the standard capture and crack better?

You can attack WEP with active attack that defeats the encryption in a matter of seconds. The only thing you need to remember about WEP is just don't use it.

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#28

Post by ssully » Sun, Jan 04, 2015, 6:31 PM UTC

dionyziz wrote: post #4

leke wrote: post #3

I don't see how this tests the security of a setup if it is relying on a user submitting the password themselves. There is no way to protect against your own or the stupidity of others.

Where does it say that this is testing the security of a setup?

When something calls itself a security tool it's usually assumed (if not explicitly stated) that it serves some purpose for assessing the security of something. Otherwise it is just a tool made for making attacks easier to perform, which is pretty frowned upon.

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#29

Post by ytjohn » Sun, Jan 04, 2015, 6:40 PM UTC

drinkyouroj wrote: post #15

ytjohn wrote: post #11

The reason I don't think this would work is because no one knows their wifi password.

This was my thought, too - and those that do would recognize the fake control panel. I think it's becoming more and more common for the PSK to come on a sticker from the all-in-one router/modem your ISP sends you. So, the user never sets a passphrase, never sees the control panel, and has the key ready to hand out by just looking at their "internet box." This attack is perfect for that.

You do have a good point there. It could work for home/apartment building attacks.

I'm not sure how many people know about the WPS button most routers have now, but I've got several people using it. It's rather slick when it works (I've only had it fail on HP printers). Windows 8 actually tells them to press the button. I think Android could make this more blatant to spread adoption.

You select the network on your device and press the WPS button and a few seconds later it's synced. Never need the password again.

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#30

Post by drinkyouroj » Sun, Jan 04, 2015, 6:45 PM UTC

gipsies wrote: post #24

drinkyouroj wrote: post #13

Earlier quoted context omitted.

Your method sounds to me like a pretty standard PSK crack: deauth client, collect auth handshake, repeat until you have enough packets to crack the passphrase. But collecting enough packets to crack the PSK becomes more difficult as the number of clients disconnecting/reconnecting goes down and the complexity of the PSK goes up. If you're trying to connect to a home AP with a halfway-decent passphrase, it can take da…

A bruteforce attack against the PSK handshake requires only a single handshake to be captured. There are no known techniques to speed up the attack if more handshakes are captured. Man-in-the-middle attacks against WPA are not trivial at all. The client and access point perform mutual authentication. If you don't know the password, you can't put up an identical rogue access point. The passphrase is never explicitly i…

Ah, you're right about only needing a single handshake. I don't make a habit of "security testing" wifi networks, but with WEP I seem to remember something about increasing the odds of your cracked key being correct based on the number of packets at your disposal. Anyway, I looked a little deeper and that's certainly not the case with WPA.

I didn't mean to imply that MitM is trivial, just that it's quicker than brute-force in many cases. And, I assumed the rogue AP was not doing true WPA encryption like the real AP, just enough to make it appear correct to get clients to connect so you can serve the fake control panel. If you need the passphrase to stand up the rogue AP, what is the point of this attack? You're not phishing for anything but the WPA key.

EDIT: just read your comment about how this actually works (that is, the "rogue" AP is just another unencrypted network.) That's actually really lame, and I withdraw my previous praise for this crack. ;)